config.yaml.example

# Unified configuration for Cloud SQL, GKE, and GCE drift analysis
# This config demonstrates YAML anchors & aliases to reduce duplication

# ==============================================================================
# COMMON CONFIGURATION ANCHORS
# Define reusable configuration fragments here
# ==============================================================================

# Common authorized networks for database access
common_authorized_networks: &common-authorized-networks
  - "10.0.0.0/24"     # Corporate VPN
  - "192.168.1.0/24"  # Office network

# Common database flags for all PostgreSQL instances
common_database_flags: &common-database-flags
  cloudsql.iam_authentication: "on"
  log_connections: "on"
  log_disconnections: "on"

# Common backup settings (7 days retention)
common_backup_settings: &common-backup-settings
  backup_enabled: true
  backup_retention_days: 7
  point_in_time_recovery: true
  transaction_log_retention_days: 7

# Critical backup settings (30 days retention for production)
critical_backup_settings: &critical-backup-settings
  backup_enabled: true
  backup_retention_days: 30
  point_in_time_recovery: true
  transaction_log_retention_days: 30

# Common IP configuration (private with SSL)
common_ip_config: &common-ip-config
  ipv4_enabled: false
  require_ssl: true
  authorized_networks: *common-authorized-networks

# Common IP configuration (private without SSL)
common_ip_config_no_ssl: &common-ip-config-no-ssl
  ipv4_enabled: false
  require_ssl: false
  authorized_networks: *common-authorized-networks

# Common insights configuration
common_insights_config: &common-insights-config
  query_insights_enabled: true
  query_plans_per_minute: 5
  query_string_length: 1024
  record_application_tags: false

# SSH tunnel template
ssh_tunnel_template: &ssh-tunnel-template
  enabled: true
  bastion_host: "bastion"
  use_iap: true

# SSL configuration template
ssl_config_template: &ssl-config-template
  enabled: true
  ssl_mode: "require"

# ==============================================================================
# PROJECT CONFIGURATION
# ==============================================================================

projects:
  - my-production-project
  - my-staging-project
  - my-qa-project

# ==============================================================================
# CLOUD SQL BASELINES
# Infrastructure configuration for Cloud SQL instances
# ==============================================================================

sql_baselines:
  # Application databases
  - name: "application"
    filter_labels:
      database-role: "application"
    config:
      database_version: POSTGRES_15
      tier: db-custom-4-16384
      disk_size_gb: 100
      disk_type: PD_SSD
      disk_autoresize: true
      
      required_databases:
        - app_db
        - app_db_replica
        - postgres
      
      database_flags:
        <<: *common-database-flags  # Merge common flags
        max_connections: "200"
        
      settings:
        availability_type: REGIONAL
        <<: *common-backup-settings  # Merge common backup settings
        
        ip_configuration:
          <<: *common-ip-config      # Merge common IP config
        
        insights_config:
          <<: *common-insights-config

  # Microservices databases
  - name: "microservices"
    filter_labels:
      database-role: "microservices"
    config:
      database_version: POSTGRES_15
      disk_type: PD_SSD
      
      required_databases:
        - service_a
        - service_b
        - postgres
      
      database_flags:
        <<: *common-database-flags
        cloudsql.enable_pg_cron: "on"
        
      settings:
        availability_type: ZONAL
        <<: *common-backup-settings
        
        ip_configuration:
          <<: *common-ip-config
        
        insights_config:
          <<: *common-insights-config

  # Production vault database (critical with longer retention)
  - name: "vault"
    filter_labels:
      database-role: "vault"
    config:
      database_version: POSTGRES_15
      tier: db-custom-2-7680
      disk_type: PD_SSD
      
      required_databases:
        - vault
        - postgres
      
      database_flags:
        <<: *common-database-flags
        
      settings:
        availability_type: REGIONAL
        <<: *critical-backup-settings  # 30 days retention for vault
        
        ip_configuration:
          ipv4_enabled: false
          require_ssl: true
          authorized_networks: []  # No public access for vault
        
        insights_config:
          <<: *common-insights-config

# ==============================================================================
# DATABASE CONNECTION CONFIGURATIONS
# For schema inspection - separate from infrastructure baselines
# ==============================================================================

database_connections:
  # Production database via SSH tunnel through bastion
  - name: "prod-app-db"
    instance_connection_name: "my-production-project:us-central1:app-instance"
    database: "app_db"
    username: "inspector"
    password: ""  # Leave empty for IAM auth
    use_private_ip: true
    project: "my-production-project"
    
    ssh_tunnel:
      <<: *ssh-tunnel-template
      bastion_zone: "us-central1-a"
      project: "my-production-project"
      private_ip: "10.10.0.5"
    
    ssl_config:
      <<: *ssl-config-template
      server_ca: "certs/server-ca.pem"
      client_cert: "certs/client-cert.pem"
      client_key: "certs/client-key.pem"
    
    schema_baseline:
      expected_tables: 50
      expected_views: 5
      expected_sequences: 20
      expected_functions: 10
      expected_procedures: 2
      expected_roles: 5
      expected_extensions: 2
      expected_database_owner: "cloudsqlsuperuser"
      expected_table_owner: "app_user"
      
      table_owner_exceptions:
        _prisma_migrations: "cloudsqlsuperuser"
        audit_log: "audit_user"
      
      required_extensions:
        - uuid-ossp
        - pgcrypto

  # Staging database (simpler config, no SSH tunnel)
  - name: "staging-app-db"
    instance_connection_name: "my-staging-project:us-central1:app-instance"
    database: "app_db"
    username: "postgres"
    password: "${DB_PASSWORD}"  # Use environment variable
    use_private_ip: false
    
    schema_baseline:
      expected_tables: 50
      expected_views: 5
      expected_database_owner: "cloudsqlsuperuser"
      expected_table_owner: "postgres"

# ==============================================================================
# GKE BASELINES
# Infrastructure configuration for GKE clusters
# ==============================================================================

gke_baselines:
  - name: "production"
    filter_labels:
      cluster-role: "production"
    cluster_config:
      master_version: "1.33"
      release_channel: REGULAR
      
      # Networking
      network: "projects/my-project/global/networks/prod-vpc"
      subnetwork: "projects/my-project/regions/us-central1/subnetworks/prod-subnet"
      private_cluster: true
      master_global_access: true
      datapath_provider: ADVANCED_DATAPATH
      
      master_authorized_networks:
        - "10.0.0.0/24"
      
      ip_allocation_policy:
        use_ip_aliases: true
        cluster_ipv4_cidr: "10.100.0.0/16"
        services_ipv4_cidr: "10.101.0.0/16"
        stack_type: IPV4_IPV6
      
      # Security
      shielded_nodes: true
      database_encryption: true
      security_posture: BASIC
      workload_identity: true
      network_policy: true
      binary_authorization: true
      
      # Logging and Monitoring
      logging_config:
        enable_system_logs: true
        enable_workload_logs: true
      
      monitoring_config:
        enable_system_metrics: true
        enable_apiserver_metrics: true
        enable_controller_metrics: true
        enable_scheduler_metrics: true
      
      # Addons
      addons:
        http_load_balancing: true
        horizontal_pod_autoscaling: true
        network_policy: true
      
      # Maintenance Window
      maintenance_window:
        start_time: "2024-01-01T03:00:00Z"
        duration: "4h0m0s"
      
      # Advanced Networking
      private_cluster_config:
        enable_private_endpoint: false  # Set true to disable public endpoint
        master_ipv4_cidr_block: "172.16.0.0/28"
      
      default_max_pods_per_node: 110  # Default pod density per node
      
      # dns_config:  # Uncomment to enforce DNS provider
      #   provider: CLOUD_DNS  # or KUBE_DNS
      
      # gateway_api_config:  # Uncomment to enforce Gateway API
      #   enabled: true
      
      # Cost & Resource Management
      autopilot: false  # Set true for Autopilot mode
      vertical_pod_autoscaling: true
      
      # resource_usage_export_config:  # Uncomment for cost metering
      #   enabled: true
      #   bigquery_dataset: "project.usage_metering"
      
      # Advanced Security
      # pod_security_policy: true  # Deprecated in K8s 1.25+
      
      # authenticator_groups_config:  # Uncomment for RBAC groups
      #   enabled: true
      #   security_group: "gke-security-groups@example.com"
      
      # Observability
      # notification_config:  # Uncomment for cluster event notifications
      #   enabled: true
      #   pubsub_topic: "projects/my-project/topics/gke-notifications"
      
      managed_prometheus: true
      
      # Cluster Lifecycle
      # enable_kubernetes_alpha: false  # Alpha features (not recommended for production)
      # enable_tpu: false  # TPU support
      
    nodepool_config:
      version: "1.33"
      machine_type: n2-standard-4
      disk_size_gb: 100
      disk_type: pd-ssd
      image_type: COS_CONTAINERD
      service_account: "gke-nodes@my-project.iam.gserviceaccount.com"
      initial_node_count: 3
      
      # Cost Optimization
      preemptible: false  # Set true for preemptible nodes (not recommended for production)
      spot: false         # Set true for spot instances (similar to preemptible)
      
      autoscaling:
        enabled: true
        min_node_count: 3
        max_node_count: 10
      
      auto_upgrade: true
      auto_repair: true
      
      # Advanced Node Pool Configuration
      # management:
      #   upgrade_settings:
      #     max_surge: 1        # Max nodes added during upgrade
      #     max_unavailable: 0  # Max nodes unavailable during upgrade
      
      # network_config:  # Uncomment for custom pod IP range
      #   pod_range: "gke-pods-1"
      
      # boot_disk_kms_key: "projects/my-project/locations/us-central1/keyRings/gke/cryptoKeys/boot-disk"
      
      # shielded_instance_config:
      #   enable_secure_boot: true
      #   enable_integrity_monitoring: true
      
      # linux_node_config:  # Uncomment for custom sysctls
      #   sysctls:
      #     net.core.somaxconn: "1024"
      
      # sandbox_config:  # Uncomment for gVisor sandbox
      #   type: "gvisor"

# ==============================================================================
# GCE BASELINES
# Infrastructure configuration for GCE instances
# ==============================================================================

gce_baselines:
  - name: "production-vms"
    filter_labels:
      env: "production"
      instance-role: "app-server"
    vm_config:
      machine_type: n2-standard-4
      disk_size_gb: 100
      disk_type: pd-ssd
      image_family: ubuntu-2204-jammy
      image_project: ubuntu-os-cloud
      
      network_config:
        network: default
        subnetwork: default
        external_ip: false
        network_tier: PREMIUM
      
      service_account:
        email: "app-sa@project.iam.gserviceaccount.com"
        scopes:
          - "https://www.googleapis.com/auth/logging.write"
          - "https://www.googleapis.com/auth/monitoring.write"
      
      metadata:
        enable-oslogin: "TRUE"
      
      tags:
        - "http-server"
        - "https-server"
      
      preemptible: false
      automatic_restart: true
      on_host_maintenance: "MIGRATE"
      deletion_protection: true
      
      shielded_vm:
        enable_secure_boot: true
        enable_vtpm: true
        enable_integrity_monitoring: true