// TypeScript: Typ-Sicherheit und IDE-Support
import * as k8s from "@pulumi/kubernetes";

// Fehler werden VOR dem Deployment erkannt
const deploy = new k8s.apps.v1.Deployment("app", {
  spec: {
    replicas: 3, // IDE zeigt dir: number erwartet
    selector: { matchLabels: { app: "web" } },
    template: {
      metadata: { labels: { app: "web" } },
      spec: {
        containers: [{
          name: "web",
          image: "nginx:1.27",
          ports: [{ containerPort: 80 }],
        }],
      },
    },
  },
});

# Pulumi CLI installieren
# macOS
brew install pulumi

# Linux
curl -fsSL https://get.pulumi.com | sh

# Neues Projekt erstellen
mkdir k8s-infra && cd k8s-infra
pulumi new aws-typescript

# Abhängigkeiten für EKS
npm install @pulumi/eks @pulumi/kubernetes

import * as pulumi from "@pulumi/pulumi";
import * as eks from "@pulumi/eks";
import * as k8s from "@pulumi/kubernetes";

// EKS-Cluster mit Managed Node Group
const cluster = new eks.Cluster("production", {
  instanceType: "t3.medium",
  desiredCapacity: 3,
  minSize: 2,
  maxSize: 5,
  version: "1.31",
  nodeRootVolumeSize: 50,
  enabledClusterLogTypes: [
    "api", "audit", "authenticator",
  ],
});

// Kubeconfig als Output exportieren
export const kubeconfig = cluster.kubeconfig;
export const clusterName = cluster.eksCluster.name;

// Kubernetes-Provider mit dem erstellten Cluster
const provider = new k8s.Provider("k8s", {
  kubeconfig: cluster.kubeconfig,
});

// Namespace
const ns = new k8s.core.v1.Namespace("app", {
  metadata: { name: "production" },
}, { provider });

// Deployment
const appDeployment = new k8s.apps.v1.Deployment("web-app", {
  metadata: { namespace: ns.metadata.name },
  spec: {
    replicas: 3,
    selector: { matchLabels: { app: "web" } },
    template: {
      metadata: { labels: { app: "web" } },
      spec: {
        containers: [{
          name: "app",
          image: "my-registry/web-app:v1.2.0",
          ports: [{ containerPort: 8080 }],
          resources: {
            requests: { cpu: "100m", memory: "128Mi" },
            limits: { cpu: "500m", memory: "512Mi" },
          },
          livenessProbe: {
            httpGet: { path: "/healthz", port: 8080 },
            initialDelaySeconds: 10,
          },
        }],
      },
    },
  },
}, { provider });

// Service
const service = new k8s.core.v1.Service("web-service", {
  metadata: { namespace: ns.metadata.name },
  spec: {
    type: "LoadBalancer",
    selector: { app: "web" },
    ports: [{ port: 80, targetPort: 8080 }],
  },
}, { provider });

export const serviceUrl = service.status.loadBalancer.ingress[0].hostname;

// Wiederverwendbare Microservice-Komponente
interface MicroserviceArgs {
  image: string;
  port: number;
  replicas?: number;
  namespace: pulumi.Input<string>;
}

function createMicroservice(
  name: string,
  args: MicroserviceArgs,
  provider: k8s.Provider
) {
  const labels = { app: name };

  const deployment = new k8s.apps.v1.Deployment(name, {
    metadata: { namespace: args.namespace },
    spec: {
      replicas: args.replicas ?? 2,
      selector: { matchLabels: labels },
      template: {
        metadata: { labels },
        spec: {
          containers: [{
            name,
            image: args.image,
            ports: [{ containerPort: args.port }],
          }],
        },
      },
    },
  }, { provider });

  const service = new k8s.core.v1.Service(`${name}-svc`, {
    metadata: { namespace: args.namespace },
    spec: {
      selector: labels,
      ports: [{ port: args.port }],
    },
  }, { provider });

  return { deployment, service };
}

// Nutzung: 3 Microservices mit einer Funktion
createMicroservice("api", {
  image: "my-app/api:latest",
  port: 3000,
  replicas: 3,
  namespace: "production",
}, provider);

createMicroservice("worker", {
  image: "my-app/worker:latest",
  port: 9090,
  namespace: "production",
}, provider);

# Secret in der Konfiguration setzen
pulumi config set --secret dbPassword "s3cure-p4ss!"

# State-Backend wählen
# Pulumi Cloud (default)
pulumi login

# Self-hosted S3
pulumi login s3://my-pulumi-state

# Lokaler State
pulumi login --local

# .github/workflows/infra.yml
name: Infrastructure
on:
  push:
    branches: [main]
    paths: ['infra/**']

jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with:
          node-version: '22'
      - run: npm ci
        working-directory: infra
      - uses: pulumi/actions@v6
        with:
          command: up
          stack-name: production
          work-dir: infra
        env:
          PULUMI_ACCESS_TOKEN: ${{ secrets.PULUMI_ACCESS_TOKEN }}
          AWS_ACCESS_KEY_ID: ${{ secrets.AWS_ACCESS_KEY_ID }}
          AWS_SECRET_ACCESS_KEY: ${{ secrets.AWS_SECRET_ACCESS_KEY }}