# Deployment na OCI (OKE)

Guia para deploy do Monetarie PIX na Oracle Cloud Infrastructure usando OKE (Oracle Container Engine for Kubernetes), OCI Database Service for PostgreSQL, OCI Cache with Redis e NATS em instancias Compute.

## Pre-requisitos

- Conta OCI com compartimento (compartment) configurado
- OCI CLI instalado e configurado (`oci setup config`)
- kubectl 1.28+ instalado
- Helm 3.14+ instalado

Verifique os pre-requisitos:

```bash
oci --version
# Esperado: x.x.x

oci iam region list --query 'data[?name==`sa-saopaulo-1`].name' --output table
# Esperado: sa-saopaulo-1
```

## Arquitetura OCI

```mermaid
graph TB
    subgraph VCN["VCN (10.0.0.0/16)"]
        subgraph PublicSubnet["Subnet Publica"]
            LB[OCI Load Balancer<br/>Flexible Shape]
        end

        subgraph PrivateSubnet["Subnet Privada"]
            subgraph OKE["OKE Cluster"]
                BACKEND[Backend Pods x2-10<br/>:4003]
                ADMIN[Admin Pods x2-5<br/>:80]
            end

            subgraph DataSubnet["Subnet Dados"]
                PGDB[(OCI Database<br/>PostgreSQL 16)]
                CACHE[(OCI Cache<br/>Redis 7)]
            end

            subgraph NATSSubnet["Subnet NATS"]
                NATS1[Compute NATS 1]
                NATS2[Compute NATS 2]
                NATS3[Compute NATS 3]
            end
        end
    end

    subgraph External["Servicos OCI"]
        OCIR[OCIR<br/>Container Registry]
        MONITOR[OCI Monitoring]
        VAULT[OCI Vault]
    end

    LB --> BACKEND
    LB --> ADMIN
    BACKEND --> PGDB
    BACKEND --> CACHE
    BACKEND --> NATS1
    OKE -.-> OCIR
    BACKEND -.-> MONITOR
```

## Passo 1: Criar Compartimento

```bash
oci iam compartment create \
  --compartment-id <TENANCY_OCID> \
  --name monetarie-pix \
  --description "Monetarie PIX Payment Platform"
```

## Passo 2: Criar Cluster OKE

```bash
# Criar VCN com Quick Create
oci ce cluster create \
  --compartment-id <COMPARTMENT_OCID> \
  --name monetarie-pix-oke \
  --kubernetes-version v1.29.1 \
  --vcn-id <VCN_OCID> \
  --service-lb-subnet-ids '["<PUBLIC_SUBNET_OCID>"]'

# Criar Node Pool
oci ce node-pool create \
  --cluster-id <CLUSTER_OCID> \
  --compartment-id <COMPARTMENT_OCID> \
  --name pix-nodes \
  --kubernetes-version v1.29.1 \
  --node-shape VM.Standard.E4.Flex \
  --node-shape-config '{"memoryInGBs": 32, "ocpus": 4}' \
  --size 3 \
  --placement-configs '[{"availabilityDomain": "SA-SAOPAULO-1-AD-1", "subnetId": "<PRIVATE_SUBNET_OCID>"}]'
```

Configurar kubectl:

```bash
oci ce cluster create-kubeconfig \
  --cluster-id <CLUSTER_OCID> \
  --file $HOME/.kube/config \
  --region sa-saopaulo-1

kubectl get nodes
# Esperado: 3 nodes Ready
```

## Passo 3: Criar OCI Database for PostgreSQL

```bash
oci psql db-system create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name monetarie-pix-db \
  --db-version "16" \
  --shape-id "PostgreSQL.VM.Standard.E4.Flex.4.64GB" \
  --instance-count 2 \
  --storage-details '{"systemType": "OCI_OPTIMIZED_STORAGE", "iops": 75000, "isRegionallyDurable": true, "availabilityDomain": "SA-SAOPAULO-1-AD-1"}' \
  --network-details '{"subnetId": "<DATA_SUBNET_OCID>"}' \
  --credentials '{"username": "postgres", "passwordDetails": {"passwordType": "PLAIN_TEXT", "password": "<SENHA_SEGURA>"}}' \
  --config-id <CONFIG_OCID>
```

Obter endpoint:

```bash
oci psql db-system get --db-system-id <DB_SYSTEM_OCID> \
  --query 'data."network-details"."primary-db-endpoint-private-ip"' \
  --output table
```

## Passo 4: Criar OCI Cache with Redis

```bash
oci redis cluster create \
  --compartment-id <COMPARTMENT_OCID> \
  --display-name monetarie-pix-redis \
  --node-count 3 \
  --node-memory-in-gbs 8 \
  --software-version "V7_0_5" \
  --subnet-id <DATA_SUBNET_OCID>
```

Obter endpoint:

```bash
oci redis cluster get --redis-cluster-id <REDIS_CLUSTER_OCID> \
  --query 'data."primary-endpoint-ip-address"' \
  --output table
```

## Passo 5: Configurar NATS em Compute Instances

```bash
for i in 1 2 3; do
  oci compute instance launch \
    --compartment-id <COMPARTMENT_OCID> \
    --availability-domain SA-SAOPAULO-1-AD-1 \
    --shape VM.Standard.E4.Flex \
    --shape-config '{"memoryInGBs": 8, "ocpus": 2}' \
    --display-name "nats-$i" \
    --subnet-id <NATS_SUBNET_OCID> \
    --image-id <ORACLE_LINUX_IMAGE_OCID> \
    --user-data-file nats-cloud-init.sh
done
```

Criar Security List para NATS:

```bash
oci network security-list update \
  --security-list-id <NATS_SL_OCID> \
  --ingress-security-rules '[
    {"source": "10.0.0.0/16", "protocol": "6", "tcpOptions": {"destinationPortRange": {"min": 4222, "max": 4222}}},
    {"source": "10.0.0.0/16", "protocol": "6", "tcpOptions": {"destinationPortRange": {"min": 6222, "max": 6222}}},
    {"source": "10.0.0.0/16", "protocol": "6", "tcpOptions": {"destinationPortRange": {"min": 8222, "max": 8222}}}
  ]'
```

## Passo 6: Configurar OCIR (Container Registry)

```bash
# Login no OCIR
docker login gru.ocir.io \
  --username '<TENANCY_NAMESPACE>/oracleidentitycloudservice/<EMAIL>' \
  --password '<AUTH_TOKEN>'

# Build e push do backend
docker build -t gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-backend:latest \
  backend/
docker push gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-backend:latest

# Build e push do admin
docker build -t gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-admin:latest \
  frontend/admin/
docker push gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-admin:latest
```

Criar secret para pull do OCIR:

```bash
kubectl create namespace pix

kubectl create secret docker-registry ocir-secret \
  --namespace pix \
  --docker-server=gru.ocir.io \
  --docker-username='<TENANCY_NAMESPACE>/oracleidentitycloudservice/<EMAIL>' \
  --docker-password='<AUTH_TOKEN>'
```

## Passo 7: Criar Secrets no OKE

```bash
# Secret do banco de dados
kubectl create secret generic db-credentials \
  --namespace pix \
  --from-literal=database-url="ecto://postgres:<SENHA>@<PG_IP>:5432/monetarie?sslmode=require"

# Secret do PIX
kubectl create secret generic pix-secrets \
  --namespace pix \
  --from-literal=secret-key-base="$(openssl rand -base64 64 | tr -d '\n')"

# Secret JWT compartilhado
kubectl create secret generic monetarie-shared-jwt-secret \
  --namespace pix \
  --from-literal=secret="<GUARDIAN_SECRET_KEY>"
```

## Passo 8: Deploy com Helm

```bash
helm install monetarie-pix deploy/kubernetes/helm/pix \
  --namespace pix \
  -f deploy/kubernetes/helm/pix/values-oci.yaml \
  --set backend.image.repository=gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-backend \
  --set admin.image.repository=gru.ocir.io/<TENANCY_NAMESPACE>/monetarie/pix-admin \
  --set backend.imagePullSecrets[0].name=ocir-secret \
  --set admin.imagePullSecrets[0].name=ocir-secret \
  --set redis.host="<REDIS_IP>" \
  --set nats.host="<NATS_IP_1>" \
  --set "nats.cluster[0]=<NATS_IP_1>:4222" \
  --set "nats.cluster[1]=<NATS_IP_2>:4222" \
  --set "nats.cluster[2]=<NATS_IP_3>:4222"
```

## Passo 9: Migrations e Seeds

```bash
kubectl exec -n pix deployment/monetarie-pix-backend -- \
  bin/monetarie_pix eval "Shared.Release.migrate()"

kubectl exec -n pix deployment/monetarie-pix-backend -- \
  bin/monetarie_pix eval "Shared.Release.seed()"
```

## Passo 10: Verificar

```bash
# Pods
kubectl get pods -n pix

# Load Balancer
kubectl get svc -n pix

# Health check
curl -s https://pixapi.seudominio.com/health
# Esperado: {"status":"ok"}
```

## OCI Load Balancer

O values-oci.yaml configura o ingress com OCI Load Balancer flexible shape:

```yaml
ingress:
  annotations:
    oci.oraclecloud.com/load-balancer-type: "lb"
    service.beta.kubernetes.io/oci-load-balancer-shape: "flexible"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-min: "10"
    service.beta.kubernetes.io/oci-load-balancer-shape-flex-max: "100"
```

Para certificados TLS, use o OCI Certificate Service ou cert-manager com Let's Encrypt.

## OCI Monitoring

### Metricas Nativas

O OKE emite metricas automaticamente para o OCI Monitoring. Crie alarmes no console OCI:

| Alarme | Metrica | Threshold |
|--------|---------|-----------|
| DB CPU | CpuUtilization (DB System) | > 80% |
| DB Storage | StorageUtilization | > 85% |
| Redis Memory | MemoryUsage | > 80% |
| OKE Node CPU | CpuUtilization (Instance) | > 80% |

### Prometheus

Para metricas customizadas do Monetarie PIX, configure o Prometheus Stack no OKE:

```bash
helm repo add prometheus-community https://prometheus-community.github.io/helm-charts
helm install prometheus prometheus-community/kube-prometheus-stack \
  --namespace monitoring --create-namespace \
  --set prometheus.prometheusSpec.serviceMonitorSelectorNilUsesHelmValues=false
```

## Resultado Esperado

Ao final deste guia, voce tera:

- Cluster OKE com 3 nodes em `sa-saopaulo-1` (Sao Paulo)
- OCI Database for PostgreSQL 16 com alta disponibilidade
- OCI Cache with Redis 7 com cluster de 3 nos
- Cluster NATS de 3 instancias Compute
- OCIR com imagens Monetarie PIX
- OCI Load Balancer flexible com TLS
- Monetarie PIX rodando com 2+ backend pods e 2+ admin pods
- OCI Monitoring com alertas configurados