NexusFlow — Linkerd Service Mesh

#!/bin/bash
# NexusFlow — Instalación Linkerd en GKE eu-west · nexusflow-prod
# Requisitos: kubectl configurado, cluster GKE 1.28+

# 1. Instalar CLI de Linkerd
curl --proto '=https' --tlsv1.2 -sSfL https://run.linkerd.io/install | sh
export PATH=$PATH:$HOME/.linkerd2/bin

# 2. Verificar compatibilidad del cluster GKE
linkerd check --pre

# 3. Instalar CRDs
linkerd install --crds | kubectl apply -f -

# 4. Instalar control plane (con HA para producción)
linkerd install \
  --ha \
  --cluster-domain cluster.local \
  --identity-issuance-lifetime 24h | kubectl apply -f -

# 5. Verificar instalación
linkerd check

# 6. Instalar extensión viz (dashboard)
linkerd viz install | kubectl apply -f -

# 7. Habilitar inyección automática en nexusflow-prod
kubectl annotate namespace nexusflow-prod \
  linkerd.io/inject=enabled

# 8. Rolling restart para inyectar proxies en pods existentes
kubectl rollout restart deployment -n nexusflow-prod

# 9. Verificar que todos los pods tienen proxy inyectado
linkerd check --proxy -n nexusflow-prod

# Namespace nexusflow-prod con inyección automática de proxies Linkerd
apiVersion: v1
kind: Namespace
metadata:
  name: nexusflow-prod
  annotations:
    linkerd.io/inject: "enabled"
  labels:
    environment: production
    app.kubernetes.io/managed-by: linkerd
    compliance: soc2-type-ii  # Tag para auditoría

apiVersion: linkerd.io/v1alpha2
kind: ServiceProfile
metadata:
  name: approval-engine.nexusflow-prod.svc.cluster.local
  namespace: nexusflow-prod
spec:
  routes:
    # Ruta crítica: aprobar solicitud (SLA 200ms p99)
    - name: POST /api/v1/approvals
      condition:
        method: POST
        pathRegex: /api/v1/approvals
      responseClasses:
        - condition:
            status:
              min: 500
              max: 599
          isFailure: true
      isRetryable: false  # POST idempotente no aplica
      timeout: 200ms        # SLA contractual

    # Ruta: consultar estado de aprobación
    - name: GET /api/v1/approvals/{id}
      condition:
        method: GET
        pathRegex: /api/v1/approvals/[^/]+
      isRetryable: true
      timeout: 150ms

    # Ruta: listar aprobaciones (permite retry)
    - name: GET /api/v1/approvals
      condition:
        method: GET
        pathRegex: /api/v1/approvals
      isRetryable: true
      timeout: 500ms

    # Ruta: actualizar política de aprobación
    - name: PUT /api/v1/policies/{id}
      condition:
        method: PUT
        pathRegex: /api/v1/policies/[^/]+
      isRetryable: false
      timeout: 300ms

    # Health check — timeout agresivo
    - name: GET /health
      condition:
        method: GET
        pathRegex: /health
      isRetryable: true
      timeout: 50ms

  # Retry budget: máx 20% del tráfico total como reintentos
  retryBudget:
    retryRatio: 0.2
    minRetriesPerSecond: 10
    ttl: 10s

# billing-service: SOLO accesible desde api-gateway y approval-engine
# Bloquea el acceso directo desde billing-service → document-store

---
# Definir el servidor de billing-service
apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  name: billing-service-http
  namespace: nexusflow-prod
spec:
  podSelector:
    matchLabels:
      app: billing-service
  port: 8080
  proxyProtocol: HTTP/2

---
# Autorizar: api-gateway → billing-service
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: billing-allow-api-gateway
  namespace: nexusflow-prod
spec:
  server:
    name: billing-service-http
  client:
    meshTLS:
      serviceAccounts:
        - name: api-gateway
          namespace: nexusflow-prod

---
# Autorizar: approval-engine → billing-service
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: billing-allow-approval-engine
  namespace: nexusflow-prod
spec:
  server:
    name: billing-service-http
  client:
    meshTLS:
      serviceAccounts:
        - name: approval-engine
          namespace: nexusflow-prod

---
# document-store: SOLO approval-engine + document-store propios
apiVersion: policy.linkerd.io/v1beta1
kind: Server
metadata:
  name: document-store-http
  namespace: nexusflow-prod
spec:
  podSelector:
    matchLabels:
      app: document-store
  port: 9000
  proxyProtocol: HTTP/1
---
apiVersion: policy.linkerd.io/v1beta1
kind: ServerAuthorization
metadata:
  name: docstore-allow-approval-only
  namespace: nexusflow-prod
spec:
  server:
    name: document-store-http
  client:
    meshTLS:
      serviceAccounts:
        - name: approval-engine
          namespace: nexusflow-prod
        - name: api-gateway
          namespace: nexusflow-prod
  # NOTA: billing-service NO aparece aquí → bloqueado por mTLS policy

# TrafficSplit: 90% → approval-engine-stable, 10% → approval-engine-v2
apiVersion: split.smi-spec.io/v1alpha1
kind: TrafficSplit
metadata:
  name: approval-engine-canary
  namespace: nexusflow-prod
spec:
  service: approval-engine       # Servicio principal (VIP)
  backends:
    - service: approval-engine-stable
      weight: 900m               # 90% del tráfico
    - service: approval-engine-v2
      weight: 100m               # 10% canary — incrementar gradualmente

---
# HTTPRoute avanzado: enrutar tráfico de beta-testers al 100% a v2
apiVersion: policy.linkerd.io/v1beta2
kind: HTTPRoute
metadata:
  name: approval-engine-beta-route
  namespace: nexusflow-prod
spec:
  parentRefs:
    - name: approval-engine
      kind: Service
      group: core
      port: 8080
  rules:
    # Clientes beta (header X-NexusFlow-Beta: true) → siempre v2
    - matches:
        - headers:
            - name: x-nexusflow-beta
              value: "true"
      backendRefs:
        - name: approval-engine-v2
          port: 8080
    # API v2 endpoints → siempre v2
    - matches:
        - path:
            type: PathPrefix
            value: /api/v2
      backendRefs:
        - name: approval-engine-v2
          port: 8080
    # Resto → stable (v1)
    - matches:
        - path:
            type: PathPrefix
            value: /
      backendRefs:
        - name: approval-engine-stable
          port: 8080