# Deployment no GCP (GKE)

Guia para deploy do Monetarie PIX no Google Cloud Platform usando GKE (Google Kubernetes Engine), Cloud SQL PostgreSQL, Memorystore Redis e NATS em Compute Engine. Este e o setup de referencia utilizado pelo Monetarie em producao.

## Pre-requisitos

- Conta GCP com projeto criado e billing habilitado
- Google Cloud CLI (`gcloud`) instalado e configurado
- kubectl 1.28+ instalado
- Helm 3.14+ instalado
- APIs habilitadas: Container, Cloud SQL Admin, Memorystore, Compute Engine, Artifact Registry

Verifique os pre-requisitos:

```bash
gcloud --version
# Esperado: Google Cloud SDK x.x.x

gcloud config get-value project
# Esperado: ID do seu projeto

# Habilitar APIs necessarias
gcloud services enable container.googleapis.com \
  sqladmin.googleapis.com \
  redis.googleapis.com \
  compute.googleapis.com \
  artifactregistry.googleapis.com
```

## Arquitetura GCP (Referencia de Producao)

```mermaid
graph TB
    subgraph VPC["VPC (10.10.0.0/16)"]
        subgraph GKE["GKE Cluster (fluxiq-dev)"]
            subgraph PixNamespace["Namespace: pix"]
                TRAEFIK[Traefik Ingress<br/>35.199.88.206]
                BACKEND[Backend Pods x2<br/>:4003]
                ADMIN[Admin Pods x2<br/>:80]
            end
        end

        subgraph DataLayer["Camada de Dados"]
            CSQL[(Cloud SQL PostgreSQL 16<br/>10.140.241.2<br/>max_connections: 6000)]
            MEMSTORE[(Memorystore Redis 7<br/>10.140.240.4:6379)]
        end

        subgraph NATS_VMS["Compute Engine VMs"]
            NATS1[nats-dev-1<br/>10.10.40.5:4222]
            NATS2[nats-dev-2<br/>10.10.40.7:4222]
            NATS3[nats-dev-3<br/>10.10.40.4:4222]
        end
    end

    subgraph External["Servicos GCP"]
        AR[Artifact Registry<br/>southamerica-east1]
        CB[Cloud Build<br/>CI/CD]
        CM[Cloud Monitoring]
        DNS[Cloud DNS<br/>*.fluxiq.com.br]
    end

    TRAEFIK --> BACKEND
    TRAEFIK --> ADMIN
    BACKEND --> CSQL
    BACKEND --> MEMSTORE
    BACKEND --> NATS1
    CB -.-> AR -.-> GKE
    BACKEND -.-> CM
```

::: info REFERENCIA DE PRODUCAO
Os IPs e nomes acima sao do ambiente `fluxiq-dev` em producao. Ajuste conforme seu ambiente.
:::

## Passo 1: Criar Cluster GKE

```bash
gcloud container clusters create monetarie-pix \
  --project=<PROJECT_ID> \
  --region=southamerica-east1 \
  --machine-type=e2-standard-8 \
  --num-nodes=3 \
  --enable-ip-alias \
  --enable-autoscaling --min-nodes=2 --max-nodes=6 \
  --workload-pool=<PROJECT_ID>.svc.id.goog
```

Saida esperada (~10 minutos):
```
Creating cluster monetarie-pix in southamerica-east1...
...done.
kubeconfig entry generated for monetarie-pix.
```

Configurar kubectl:

```bash
gcloud container clusters get-credentials monetarie-pix \
  --region=southamerica-east1

kubectl get nodes
# Esperado: 3 nodes Ready
```

## Passo 2: Criar Cloud SQL PostgreSQL 16

```bash
gcloud sql instances create monetarie-pix-db \
  --database-version=POSTGRES_16 \
  --tier=db-custom-4-16384 \
  --region=southamerica-east1 \
  --network=default \
  --no-assign-ip \
  --storage-type=SSD \
  --storage-size=100GB \
  --storage-auto-increase \
  --availability-type=REGIONAL \
  --backup-start-time=03:00 \
  --retained-backups-count=30 \
  --database-flags=max_connections=6000
```

::: warning CLOUD SQL PROXY
NAO use Cloud SQL Proxy com pools de conexao grandes. O proxy tem rate limit de 1.000 conexoes/minuto e causa erro 429. Use conexao direta via IP privado.
:::

Criar banco de dados e usuario:

```bash
# Criar banco
gcloud sql databases create monetarie --instance=monetarie-pix-db

# Definir senha do usuario postgres
gcloud sql users set-password postgres \
  --instance=monetarie-pix-db \
  --password="<SENHA_SEGURA>"

# Obter IP privado
gcloud sql instances describe monetarie-pix-db \
  --format='value(ipAddresses[0].ipAddress)'
# Esperado: 10.x.x.x (IP privado)
```

## Passo 3: Criar Memorystore Redis

```bash
gcloud redis instances create monetarie-pix-redis \
  --size=4 \
  --region=southamerica-east1 \
  --redis-version=redis_7_2 \
  --tier=STANDARD_HA \
  --network=default
```

Obter IP:

```bash
gcloud redis instances describe monetarie-pix-redis \
  --region=southamerica-east1 \
  --format='value(host)'
# Esperado: 10.x.x.x
```

## Passo 4: Configurar NATS em Compute Engine

Crie 3 VMs para o cluster NATS:

```bash
for i in 1 2 3; do
  gcloud compute instances create nats-$i \
    --project=<PROJECT_ID> \
    --zone=southamerica-east1-a \
    --machine-type=e2-standard-4 \
    --network=default \
    --metadata-from-file=startup-script=nats-install.sh \
    --tags=nats-server
done
```

Criar regra de firewall para NATS:

```bash
gcloud compute firewall-rules create allow-nats \
  --allow=tcp:4222,tcp:6222,tcp:8222 \
  --target-tags=nats-server \
  --source-ranges=10.0.0.0/8
```

## Passo 5: Configurar Artifact Registry

```bash
# Criar repositorio
gcloud artifacts repositories create monetarie \
  --repository-format=docker \
  --location=southamerica-east1 \
  --description="Monetarie container images"

# Autenticar Docker
gcloud auth configure-docker southamerica-east1-docker.pkg.dev

# Build e push do backend
docker build -t southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-backend:latest \
  backend/
docker push southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-backend:latest

# Build e push do admin
docker build -t southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-admin:latest \
  frontend/admin/
docker push southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-admin:latest
```

### Cloud Build (CI/CD)

Para builds automatizados, use Cloud Build:

```bash
# Backend
SHORT_SHA=$(git rev-parse --short HEAD)
gcloud builds submit --config=backend/cloudbuild.yaml \
  --substitutions=SHORT_SHA=$SHORT_SHA \
  --machine-type=E2_HIGHCPU_8 \
  --region=southamerica-east1 \
  backend/

# Admin Frontend
gcloud builds submit --config=frontend/admin/cloudbuild.yaml \
  --substitutions=SHORT_SHA=$SHORT_SHA \
  --machine-type=E2_HIGHCPU_8 \
  --region=southamerica-east1 \
  frontend/admin/
```

::: warning SHORT_SHA
Sempre passe `--substitutions=SHORT_SHA=<hash>` ao executar `gcloud builds submit` manualmente. A variavel fica vazia quando nao executada por trigger.
:::

## Passo 6: Criar Secrets no GKE

```bash
kubectl create namespace pix

# Secret do banco de dados (IP privado, SEM Cloud SQL Proxy)
kubectl create secret generic db-credentials \
  --namespace pix \
  --from-literal=database-url="ecto://postgres:<SENHA>@<CLOUD_SQL_IP>:5432/monetarie"

# Secret do PIX
kubectl create secret generic pix-secrets \
  --namespace pix \
  --from-literal=secret-key-base="$(openssl rand -base64 64 | tr -d '\n')"

# Secret JWT compartilhado com Core Banking
kubectl create secret generic monetarie-shared-jwt-secret \
  --namespace pix \
  --from-literal=secret="<GUARDIAN_SECRET_KEY>"
```

::: tip CHAVES DE SECRET
Os nomes das chaves sao kebab-case: `database-url`, `secret-key-base`, `secret`. NAO use `DATABASE_URL` ou `SECRET_KEY_BASE`.
:::

## Passo 7: Deploy com Helm

```bash
helm install monetarie-pix deploy/kubernetes/helm/pix \
  --namespace pix \
  -f deploy/kubernetes/helm/pix/values-gcp.yaml \
  --set backend.image.repository=southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-backend \
  --set admin.image.repository=southamerica-east1-docker.pkg.dev/<PROJECT_ID>/monetarie/pix-admin \
  --set redis.host="<MEMORYSTORE_IP>" \
  --set nats.host="<NATS_IP_1>" \
  --set "nats.cluster[0]=<NATS_IP_1>:4222" \
  --set "nats.cluster[1]=<NATS_IP_2>:4222" \
  --set "nats.cluster[2]=<NATS_IP_3>:4222"
```

## Passo 8: Configurar Ingress (Traefik)

Se estiver usando Traefik como ingress controller (como no ambiente de referencia):

```bash
# Instalar Traefik (se ainda nao instalado)
helm repo add traefik https://traefik.github.io/charts
helm repo update
helm install traefik traefik/traefik --namespace kube-system
```

Criar certificado TLS:

```bash
# Se usando cert-manager com Let's Encrypt
kubectl create secret tls monetarie-dev-tls \
  --namespace pix \
  --cert=path/to/tls.crt \
  --key=path/to/tls.key
```

## Passo 9: Migrations e Seeds

```bash
kubectl exec -n pix deployment/monetarie-pix-backend -- \
  bin/monetarie_pix eval "Shared.Release.migrate()"

kubectl exec -n pix deployment/monetarie-pix-backend -- \
  bin/monetarie_pix eval "Shared.Release.seed()"
```

## Passo 10: Verificar

```bash
# Pods
kubectl get pods -n pix
# Esperado: 2 backend + 2 admin Running

# Ingress
kubectl get ingress -n pix

# Health check
curl -s https://pixapi.seudominio.com.br/health
# Esperado: {"status":"ok"}
```

## Cloud Monitoring

### Habilitar Container Monitoring

O GKE Operations Suite coleta metricas automaticamente. Para dashboards customizados:

```bash
# Verificar se o monitoring esta habilitado
gcloud container clusters describe monetarie-pix \
  --region=southamerica-east1 \
  --format='value(monitoringConfig.componentConfig.enableComponents)'
```

### Alertas Recomendados

| Alerta | Metrica | Threshold |
|--------|---------|-----------|
| Cloud SQL CPU | `cloudsql.googleapis.com/database/cpu/utilization` | > 80% |
| Cloud SQL Connections | `cloudsql.googleapis.com/database/postgresql/num_backends` | > 3000 |
| Memorystore Memory | `redis.googleapis.com/stats/memory/usage_ratio` | > 80% |
| Pod Restart | `kubernetes.io/container/restart_count` | > 5 em 5min |
| Latencia API | `custom.googleapis.com/pix/http_request_duration` | p99 > 2s |

### Metricas Prometheus

O Monetarie PIX expoe metricas Prometheus na porta 9568. Para coletar com Google Managed Prometheus (GMP):

```yaml
# PodMonitoring para GMP
apiVersion: monitoring.googleapis.com/v1
kind: PodMonitoring
metadata:
  name: monetarie-pix-metrics
  namespace: pix
spec:
  selector:
    matchLabels:
      app.kubernetes.io/component: backend
  endpoints:
    - port: metrics
      interval: 15s
      path: /metrics
```

## Atualizacao via Cloud Build

Para updates automaticos apos o build:

```bash
# O cloudbuild.yaml Step #3 faz deploy automatico:
# 1. Build da imagem
# 2. Push para Artifact Registry
# 3. kubectl set image + rollout status
# 4. Verifica deploy bem-sucedido

SHORT_SHA=$(git rev-parse --short HEAD)
gcloud builds submit --config=backend/cloudbuild.yaml \
  --substitutions=SHORT_SHA=$SHORT_SHA \
  --machine-type=E2_HIGHCPU_8 \
  --region=southamerica-east1 \
  backend/
```

::: tip ROLLOUT
Lembre-se que a mesma tag de imagem NAO dispara restart dos pods. Use tags unicas (SHORT_SHA) ou execute `kubectl rollout restart deployment/monetarie-pix-backend -n pix` apos o push.
:::

## Resultado Esperado

Ao final deste guia, voce tera:

- Cluster GKE com 3 nodes em `southamerica-east1` (Sao Paulo)
- Cloud SQL PostgreSQL 16 com alta disponibilidade regional e max_connections=6000
- Memorystore Redis 7 com HA automatico
- Cluster NATS de 3 VMs em Compute Engine
- Artifact Registry para armazenamento de imagens
- Cloud Build configurado para CI/CD
- Monetarie PIX rodando com 2 backend pods e 2 admin pods
- Cloud Monitoring e alertas configurados