Merge remote master with local project

.gitignore

@@ -0,0 +1,5 @@
+# .gitignore
+node_modules/
+dist/
+.env
+*.env

backend/deployment.yaml

@@ -0,0 +1,77 @@
+# kubernetes/backend/backend.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: backend
+  namespace: todo-app
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: backend
+  template:
+    metadata:
+      labels:
+        app: backend
+        tier: api             # ← label for NetworkPolicy
+    spec:
+      containers:
+        - name: backend
+          image: silvarno/todo-backend:latest
+          ports:
+            - containerPort: 5000
+          env:
+            - name: PORT
+              value: "5000"
+            - name: NODE_ENV
+              value: "production"
+            - name: MONGO_URI
+              valueFrom:
+                secretKeyRef:
+                  name: todo-secrets
+                  key: MONGO_URI
+            - name: JWT_SECRET
+              valueFrom:
+                secretKeyRef:
+                  name: todo-secrets
+                  key: JWT_SECRET
+          # Security context
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 1000
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+          # Health checks
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 15
+            periodSeconds: 20
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 5000
+            initialDelaySeconds: 5
+            periodSeconds: 10
+          # Resource limits
+          resources:
+            requests:
+              memory: "128Mi"
+              cpu: "100m"
+            limits:
+              memory: "256Mi"
+              cpu: "500m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: backend-service
+  namespace: todo-app
+spec:
+  selector:
+    app: backend
+  ports:
+    - port: 5000
+      targetPort: 5000
+  type: ClusterIP    # ← internal only

frontend/deployment.yaml

@@ -0,0 +1,46 @@
+# kubernetes/frontend/deployment.yaml
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: frontend
+  namespace: todo-app
+spec:
+  replicas: 2
+  selector:
+    matchLabels:
+      app: frontend
+  template:
+    metadata:
+      labels:
+        app: frontend
+        tier: web
+    spec:
+      containers:
+        - name: frontend
+          image: silvarno/todo-frontend:latest
+          ports:
+            - containerPort: 80
+          securityContext:
+            runAsNonRoot: false  # nginx needs root to bind port 80
+            allowPrivilegeEscalation: false
+          resources:
+            requests:
+              memory: "64Mi"
+              cpu: "50m"
+            limits:
+              memory: "128Mi"
+              cpu: "200m"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: frontend-service
+  namespace: todo-app
+spec:
+  selector:
+    app: frontend
+  type: NodePort
+  ports:
+    - port: 80
+      targetPort: 80
+      nodePort: 31081

gateway/gateway.yaml

@@ -0,0 +1,22 @@
+# kubernetes/gateway/gateway.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: GatewayClass
+metadata:
+  name: nginx
+spec:
+  controllerName: gateway.nginx.org/nginx-gateway-controller
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: Gateway
+metadata:
+  name: todo-gateway
+  namespace: todo-app
+spec:
+  gatewayClassName: nginx
+  listeners:
+    - name: http
+      port: 80
+      protocol: HTTP
+      allowedRoutes:
+        namespaces:
+          from: Same    # only routes from todo-app namespace

gateway/httproute.yaml

@@ -0,0 +1,27 @@
+# kubernetes/gateway/httproute.yaml
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: todo-routes
+  namespace: todo-app
+spec:
+  parentRefs:
+    - name: todo-gateway
+  rules:
+    # API traffic → backend
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /api
+      backendRefs:
+        - name: backend-service
+          port: 5000
+
+    # All other traffic → frontend
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /
+      backendRefs:
+        - name: frontend-service
+          port: 30081

ingress/ingress.yaml

@@ -0,0 +1,27 @@
+# kubernetes/ingress/ingress.yaml
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: todo-ingress
+  namespace: todo-app
+  annotations:
+    nginx.ingress.kubernetes.io/rewrite-target: /
+spec:
+  ingressClassName: nginx
+  rules:
+    - http:
+        paths:
+          - path: /api
+            pathType: Prefix
+            backend:
+              service:
+                name: backend-service
+                port:
+                  number: 5000
+          - path: /
+            pathType: Prefix
+            backend:
+              service:
+                name: frontend-service
+                port:
+                  number: 30081

mongodb/data/WiredTiger

@@ -0,0 +1,2 @@
+WiredTiger
+WiredTiger 12.0.0: (November 15, 2024)

mongodb/data/WiredTiger.lock

@@ -0,0 +1 @@
+WiredTiger lock file

mongodb/data/WiredTiger.turtle

@@ -0,0 +1,6 @@
+WiredTiger version string
+WiredTiger 12.0.0: (November 15, 2024)
+WiredTiger version
+major=12,minor=0,patch=0
+file:WiredTiger.wt
+access_pattern_hint=none,allocation_size=4KB,app_metadata=,assert=(commit_timestamp=none,durable_timestamp=none,read_timestamp=none,write_timestamp=off),block_allocation=best,block_compressor=,cache_resident=false,checksum=on,collator=,columns=,dictionary=0,encryption=(keyid=,name=),format=btree,huffman_key=,huffman_value=,id=0,ignore_in_memory_cache_size=false,internal_item_max=0,internal_key_max=0,internal_key_truncate=true,internal_page_max=4KB,key_format=S,key_gap=10,leaf_item_max=0,leaf_key_max=0,leaf_page_max=32KB,leaf_value_max=0,log=(enabled=true),memory_page_image_max=0,memory_page_max=5MB,os_cache_dirty_max=0,os_cache_max=0,prefix_compression=false,prefix_compression_min=4,readonly=false,split_deepen_min_child=0,split_deepen_per_child=0,split_pct=90,tiered_object=false,tiered_storage=(auth_token=,bucket=,bucket_prefix=,cache_directory=,local_retention=300,name=,object_target_size=0),value_format=S,verbose=[],version=(major=1,minor=1),write_timestamp_usage=none,checkpoint=(WiredTigerCheckpoint.6962=(addr="019081e46d2258f99181e48f5326a39581e4a8cad1a2808080e3014fc0e25fc0",order=6962,time=1777795082,size=36864,newest_start_durable_ts=0,oldest_start_ts=0,newest_txn=7123,newest_stop_durable_ts=0,newest_stop_ts=-1,newest_stop_txn=-11,prepare=0,write_gen=20886,run_write_gen=1)),checkpoint_backup_info=,checkpoint_lsn=(1,6911616)

mongodb/data/_tmp/spilldb/WiredTiger

@@ -0,0 +1,2 @@
+WiredTiger
+WiredTiger 12.0.0: (November 15, 2024)

mongodb/data/_tmp/spilldb/WiredTiger.lock

@@ -0,0 +1 @@
+WiredTiger lock file

mongodb/data/_tmp/spilldb/WiredTiger.turtle

@@ -0,0 +1,6 @@
+WiredTiger version string
+WiredTiger 12.0.0: (November 15, 2024)
+WiredTiger version
+major=12,minor=0,patch=0
+file:WiredTiger.wt
+access_pattern_hint=none,allocation_size=4KB,app_metadata=,assert=(commit_timestamp=none,durable_timestamp=none,read_timestamp=none,write_timestamp=off),block_allocation=best,block_compressor=,cache_resident=false,checksum=on,collator=,columns=,dictionary=0,encryption=(keyid=,name=),format=btree,huffman_key=,huffman_value=,id=0,ignore_in_memory_cache_size=false,internal_item_max=0,internal_key_max=0,internal_key_truncate=true,internal_page_max=4KB,key_format=S,key_gap=10,leaf_item_max=0,leaf_key_max=0,leaf_page_max=32KB,leaf_value_max=0,log=(enabled=true),memory_page_image_max=0,memory_page_max=5MB,os_cache_dirty_max=0,os_cache_max=0,prefix_compression=false,prefix_compression_min=4,readonly=false,split_deepen_min_child=0,split_deepen_per_child=0,split_pct=90,tiered_object=false,tiered_storage=(auth_token=,bucket=,bucket_prefix=,cache_directory=,local_retention=300,name=,object_target_size=0),value_format=S,verbose=[],version=(major=1,minor=1),write_timestamp_usage=none,checkpoint=(WiredTigerCheckpoint.2=(addr="018181e407ed97398281e41546bd168381e44d7dd725808080e22fc0cfc0",order=2,time=1777371693,size=8192,newest_start_durable_ts=0,oldest_start_ts=0,newest_txn=1,newest_stop_durable_ts=0,newest_stop_ts=-1,newest_stop_txn=-11,prepare=0,write_gen=3,run_write_gen=1)),checkpoint_backup_info=,checkpoint_lsn=(4294967295,2147483647)

mongodb/data/mongod.lock

@@ -0,0 +1 @@
+1

mongodb/development.yaml

@@ -0,0 +1,85 @@
+# kubernetes/mongodb/mongodb.yaml
+apiVersion: v1
+kind: PersistentVolume
+metadata:
+  name: mongo-pv
+spec:
+  capacity:
+    storage: 2Gi
+  volumeMode: Filesystem
+  accessModes:
+  - ReadWriteOnce
+  persistentVolumeReclaimPolicy: Retain
+  storageClassName: local-storage
+  local:
+    path: /root/todoApp/kubernetes/mongodb/data
+
+  nodeAffinity:
+    required:
+      nodeSelectorTerms:
+      - matchExpressions:
+        - key: kubernetes.io/hostname
+          operator: In
+          values:
+          - master-controller
+
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: mongo
+  namespace: todo-app
+spec:
+  serviceName: mongo-service   # ✅ REQUIRED
+  replicas: 1
+  selector:
+    matchLabels:
+      app: mongo
+
+  volumeClaimTemplates:
+  - metadata:
+      name: mongo-pvc
+    spec:
+      accessModes: [ "ReadWriteOnce" ]
+      storageClassName: local-storage
+      resources:
+        requests:
+          storage: 2Gi
+  template:
+    metadata:
+      labels:
+        app: mongo
+        tier: database        # ← label for NetworkPolicy
+    spec:
+      tolerations:
+      - key: "node-role.kubernetes.io/control-plane"
+        operator: "Exists"
+        effect: "NoSchedule"
+      containers:
+        - name: mongo
+          image: mongo
+          ports:
+            - containerPort: 27017
+          volumeMounts:
+            - name: mongo-pvc
+              mountPath: /data/db
+          # Security — run as non-root
+          securityContext:
+            runAsNonRoot: true
+            runAsUser: 999
+            allowPrivilegeEscalation: false
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: mongo-service
+  namespace: todo-app
+spec:
+  clusterIP: None
+  selector:
+    app: mongo
+  ports:
+    - port: 27017
+      targetPort: 27017
+  # ClusterIP — internal only, never exposed outside
+  type: ClusterIP

mongodb/pvc.yaml

@@ -0,0 +1,12 @@
+# kubernetes/mongodb/pvc.yaml
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: mongo-pvc
+  namespace: todo-app
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 2Gi

networkpolicy/networkpolicy.yaml

@@ -0,0 +1,98 @@
+# kubernetes/networkpolicy/networkpolicy.yaml
+
+# Rule 1 — Default deny ALL ingress + egress in namespace
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: default-deny-all
+  namespace: todo-app
+spec:
+  podSelector: {}    # applies to ALL pods
+  policyTypes:
+    - Ingress
+    - Egress
+---
+# Rule 2 — Frontend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-frontend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: web
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 3 — Backend can receive from Gateway only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-gateway-to-backend
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: nginx-gateway
+---
+# Rule 4 — MongoDB accepts connections from backend ONLY
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: allow-backend-to-mongo
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: database
+  policyTypes:
+    - Ingress
+  ingress:
+    - from:
+        - podSelector:
+            matchLabels:
+              tier: api    # only backend pods
+      ports:
+        - port: 27017
+---
+# Rule 5 — Backend can talk to MongoDB + DNS only
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: backend-egress
+  namespace: todo-app
+spec:
+  podSelector:
+    matchLabels:
+      tier: api
+  policyTypes:
+    - Egress
+  egress:
+    # Allow MongoDB
+    - to:
+        - podSelector:
+            matchLabels:
+              tier: database
+      ports:
+        - port: 27017
+    # Allow DNS resolution
+    - to:
+        - namespaceSelector: {}
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP

secret.yaml

@@ -0,0 +1,10 @@
+# kubernetes/secrets.yaml
+apiVersion: v1
+kind: Secret
+metadata:
+  name: todo-secrets
+  namespace: todo-app
+type: Opaque
+data:
+  JWT_SECRET: MTIzUmFTaElrXjBOeSY4KG1FYVBwX1MzYw==
+  MONGO_URI: bW9uZ29kYjovL21vbmdvLXNlcnZpY2U6MjcwMTcvdG9kb2FwcA==