# Beispiel: DSGVO-konforme Pod-Konfiguration
apiVersion: v1
kind: Pod
metadata:
  name: gdpr-compliant-app
  namespace: data-processing
  labels:
    data-classification: 'personal'
    compliance: 'gdpr'
  annotations:
    gdpr.company.com/data-categories: 'customer-data,contact-info'
    gdpr.company.com/processing-purpose: 'service-delivery'
    gdpr.company.com/retention-period: '2y'
    gdpr.company.com/lawful-basis: 'contract'
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
  containers:
    - name: app
      image: gdpr-app:v1.0
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      env:
        - name: ENCRYPTION_KEY
          valueFrom:
            secretKeyRef:
              name: encryption-keys
              key: data-encryption-key
        - name: GDPR_MODE
          value: 'strict'
      volumeMounts:
        - name: encrypted-data
          mountPath: /data
          readOnly: false
  volumes:
    - name: encrypted-data
      persistentVolumeClaim:
        claimName: encrypted-pvc

graph TB
    subgraph "EU Cloud Region (Frankfurt)"
        subgraph "Kubernetes Cluster"
            subgraph "Data Processing Namespace"
                A[Personal Data Apps]
                B[Pseudonymization Service]
                C[Encryption Service]
            end

            subgraph "Compliance Namespace"
                D[Audit Logger]
                E[Access Monitor]
                F[Data Subject Rights API]
            end

            subgraph "Security Namespace"
                G[Certificate Manager]
                H[Vault Secrets]
                I[Network Policies]
            end
        end

        subgraph "Storage Layer"
            J[Encrypted PVs]
            K[Backup Encryption]
            L[Audit Logs]
        end
    end

    subgraph "External Systems"
        M[EU-Based Identity Provider]
        N[German Data Centers]
        O[GDPR Compliance Tools]
    end

    A --> J
    B --> C
    D --> L
    E --> O
    F --> M
    G --> H
    I --> N

# GDPR Data Classification System
apiVersion: v1
kind: ConfigMap
metadata:
  name: gdpr-data-classification
  namespace: compliance
data:
  classification-rules.yaml: |
    data_categories:
      personal_identifiable:
        - name
        - email
        - phone
        - address
        retention: "2y"
        encryption_required: true
        pseudonymization: true
      
      special_categories:
        - health_data
        - biometric_data
        - political_opinions
        retention: "1y"
        encryption_required: true
        explicit_consent: true
      
      technical_data:
        - ip_address
        - cookies
        - device_fingerprint
        retention: "13m"
        encryption_required: false
        legitimate_interest: true

    processing_purposes:
      service_delivery:
        lawful_basis: "contract"
        data_minimization: true
      
      marketing:
        lawful_basis: "consent"
        opt_out_required: true
      
      legal_compliance:
        lawful_basis: "legal_obligation"
        extended_retention: true

# Comprehensive Encryption Setup
apiVersion: v1
kind: Secret
metadata:
  name: encryption-keys
  namespace: data-processing
type: Opaque
stringData:
  # AES-256 Key für Datenbank-Verschlüsselung
  db-encryption-key: 'encryption-key-from-vault'
  # TLS Certificates für Service-to-Service Communication
  tls-cert: |
    -----BEGIN CERTIFICATE-----
    [Certificate Content]
    -----END CERTIFICATE-----
  tls-key: |
    -----BEGIN PRIVATE KEY-----
    [Private Key Content]
    -----END PRIVATE KEY-----
---
# Encrypted Storage Class
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: encrypted-storage
provisioner: kubernetes.io/aws-ebs
parameters:
  type: gp3
  encrypted: 'true'
  kmsKeyId: 'arn:aws:kms:eu-central-1:account:key/key-id'
allowVolumeExpansion: true
volumeBindingMode: WaitForFirstConsumer
---
# Service Mesh TLS Configuration
apiVersion: security.istio.io/v1beta1
kind: PeerAuthentication
metadata:
  name: default
  namespace: data-processing
spec:
  mtls:
    mode: STRICT

# GDPR-konforme Network Policies
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: gdpr-data-isolation
  namespace: data-processing
spec:
  podSelector:
    matchLabels:
      data-classification: 'personal'
  policyTypes:
    - Ingress
    - Egress
  ingress:
    - from:
        - namespaceSelector:
            matchLabels:
              name: data-processing
        - podSelector:
            matchLabels:
              role: 'data-processor'
      ports:
        - protocol: TCP
          port: 8080
  egress:
    - to:
        - namespaceSelector:
            matchLabels:
              name: database
      ports:
        - protocol: TCP
          port: 5432
    - to:
        - namespaceSelector:
            matchLabels:
              name: audit
      ports:
        - protocol: TCP
          port: 9200
---
# RBAC für GDPR-Compliance
apiVersion: rbac.authorization.k8s.io/v1
kind: Role
metadata:
  namespace: data-processing
  name: gdpr-data-processor
rules:
  - apiGroups: ['']
    resources: ['pods', 'configmaps']
    verbs: ['get', 'list', 'watch']
  - apiGroups: ['']
    resources: ['secrets']
    resourceNames: ['encryption-keys', 'db-credentials']
    verbs: ['get']
  - apiGroups: ['apps']
    resources: ['deployments']
    verbs: ['get', 'list', 'patch']
---
apiVersion: rbac.authorization.k8s.io/v1
kind: RoleBinding
metadata:
  name: gdpr-data-processor-binding
  namespace: data-processing
subjects:
  - kind: ServiceAccount
    name: data-processor-sa
    namespace: data-processing
roleRef:
  kind: Role
  name: gdpr-data-processor
  apiGroup: rbac.authorization.k8s.io

# Automated Data Flow Mapping
apiVersion: batch/v1
kind: Job
metadata:
  name: gdpr-data-discovery
  namespace: compliance
spec:
  template:
    spec:
      containers:
        - name: data-mapper
          image: data-discovery:v1.0
          command:
            - python
            - -c
            - |
              import json
              import kubernetes
              import re

              # GDPR-relevante Datentypen identifizieren
              gdpr_patterns = {
                  'email': r'\b[A-Za-z0-9._%+-]+@[A-Za-z0-9.-]+\.[A-Z|a-z]{2,}\b',
                  'phone': r'\b\d{3}-?\d{3}-?\d{4}\b',
                  'iban': r'\b[A-Z]{2}\d{2}[A-Z0-9]{4}\d{7}[A-Z0-9]{1,31}\b',
                  'credit_card': r'\b\d{4}[-\s]?\d{4}[-\s]?\d{4}[-\s]?\d{4}\b'
              }

              # Kubernetes Resources scannen
              def scan_configmaps_and_secrets():
                  v1 = kubernetes.client.CoreV1Api()
                  findings = []
                  
                  # ConfigMaps scannen
                  configmaps = v1.list_config_map_for_all_namespaces()
                  for cm in configmaps.items:
                      if cm.data:
                          for key, value in cm.data.items():
                              for pattern_name, pattern in gdpr_patterns.items():
                                  if re.search(pattern, value):
                                      findings.append({
                                          'type': 'configmap',
                                          'namespace': cm.metadata.namespace,
                                          'name': cm.metadata.name,
                                          'key': key,
                                          'data_type': pattern_name,
                                          'risk_level': 'high'
                                      })
                  
                  # Secrets scannen (Base64-decodiert)
                  secrets = v1.list_secret_for_all_namespaces()
                  for secret in secrets.items:
                      if secret.data:
                          for key, value in secret.data.items():
                              try:
                                  decoded = base64.b64decode(value).decode('utf-8')
                                  for pattern_name, pattern in gdpr_patterns.items():
                                      if re.search(pattern, decoded):
                                          findings.append({
                                              'type': 'secret',
                                              'namespace': secret.metadata.namespace,
                                              'name': secret.metadata.name,
                                              'key': key,
                                              'data_type': pattern_name,
                                              'risk_level': 'critical'
                                          })
                              except:
                                  pass
                  
                  return findings

              # Data Flow zwischen Services analysieren
              def analyze_service_communications():
                  communications = []
                  # Istio Service Mesh Metrics analysieren
                  # Network Policies auswerten
                  # Database-Verbindungen tracken
                  return communications

              # GDPR Impact Assessment
              findings = scan_configmaps_and_secrets()
              communications = analyze_service_communications()

              gdpr_report = {
                  'scan_timestamp': datetime.now().isoformat(),
                  'personal_data_findings': findings,
                  'service_communications': communications,
                  'compliance_score': calculate_compliance_score(findings),
                  'recommendations': generate_recommendations(findings)
              }

              print(json.dumps(gdpr_report, indent=2))
          volumeMounts:
            - name: kubeconfig
              mountPath: /root/.kube
      volumes:
        - name: kubeconfig
          secret:
            secretName: kubeconfig
      restartPolicy: Never

# Automated PIA Template
apiVersion: v1
kind: ConfigMap
metadata:
  name: pia-template
  namespace: compliance
data:
  pia-kubernetes.yaml: |
    privacy_impact_assessment:
      project_name: "Kubernetes Cloud Migration"
      assessment_date: "2025-09-11"
      
      data_processing_activities:
        - activity: "Container Orchestration"
          personal_data_types: ["system_logs", "user_sessions", "api_requests"]
          lawful_basis: "legitimate_interest"
          purpose: "service_operation"
          retention_period: "90d"
          
        - activity: "Application Monitoring"
          personal_data_types: ["ip_addresses", "user_agents", "request_paths"]
          lawful_basis: "legitimate_interest"
          purpose: "security_monitoring"
          retention_period: "1y"
          
        - activity: "Backup and Recovery"
          personal_data_types: ["application_data", "database_dumps"]
          lawful_basis: "contract"
          purpose: "business_continuity"
          retention_period: "7y"
      
      risk_assessment:
        high_risks:
          - "Cross-border data transfer to US cloud providers"
          - "Container logs containing personal data"
          - "Inadequate encryption of backup data"
        
        medium_risks:
          - "Service mesh metadata exposure"
          - "Third-party monitoring tools"
          - "Development environment data leakage"
        
        low_risks:
          - "Performance metrics collection"
          - "Anonymous usage analytics"
      
      mitigation_measures:
        technical:
          - "End-to-end encryption (TLS 1.3)"
          - "Data pseudonymization in logs"
          - "EU-only data residency"
          - "Regular security updates"
        
        organizational:
          - "Staff training on GDPR"
          - "Data processing agreements"
          - "Regular compliance audits"
          - "Incident response procedures"

# GDPR Data Subject Rights Implementation
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gdpr-rights-api
  namespace: compliance
spec:
  replicas: 3
  selector:
    matchLabels:
      app: gdpr-rights-api
  template:
    metadata:
      labels:
        app: gdpr-rights-api
    spec:
      containers:
        - name: api
          image: gdpr-rights-api:v1.0
          ports:
            - containerPort: 8080
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: gdpr-db-credentials
                  key: connection-string
            - name: ENCRYPTION_KEY
              valueFrom:
                secretKeyRef:
                  name: encryption-keys
                  key: gdpr-encryption-key
          command:
            - python
            - -c
            - |
              from flask import Flask, request, jsonify
              from cryptography.fernet import Fernet
              import psycopg2
              import json

              app = Flask(__name__)

              # GDPR Article 15: Right of Access
              @app.route('/gdpr/access', methods=['POST'])
              def data_access():
                  user_id = request.json.get('user_id')
                  verification_token = request.json.get('verification_token')
                  
                  # Benutzerverifikation
                  if not verify_user_identity(user_id, verification_token):
                      return jsonify({'error': 'Invalid verification'}), 401
                  
                  # Persönliche Daten aus allen Services sammeln
                  personal_data = {}
                  
                  # User Service
                  personal_data['profile'] = get_user_profile(user_id)
                  # Order Service
                  personal_data['orders'] = get_user_orders(user_id)
                  # Analytics Service
                  personal_data['analytics'] = get_user_analytics(user_id)
                  # Audit Logs
                  personal_data['activities'] = get_user_activities(user_id)
                  
                  # Daten pseudonymisieren für Export
                  export_data = pseudonymize_for_export(personal_data)
                  
                  return jsonify({
                      'user_id': user_id,
                      'data_export': export_data,
                      'export_timestamp': datetime.now().isoformat(),
                      'retention_info': get_retention_info(user_id)
                  })

              # GDPR Article 17: Right to Erasure
              @app.route('/gdpr/erasure', methods=['POST'])
              def data_erasure():
                  user_id = request.json.get('user_id')
                  verification_token = request.json.get('verification_token')
                  
                  if not verify_user_identity(user_id, verification_token):
                      return jsonify({'error': 'Invalid verification'}), 401
                  
                  # Legal basis prüfen
                  if not can_erase_data(user_id):
                      return jsonify({
                          'error': 'Erasure not possible',
                          'reason': 'Legal retention requirements'
                      }), 400
                  
                  # Löschung in allen Services
                  erasure_results = {}
                  services = ['user-service', 'order-service', 'analytics-service']
                  
                  for service in services:
                      try:
                          result = call_service_erasure_api(service, user_id)
                          erasure_results[service] = result
                      except Exception as e:
                          erasure_results[service] = {'error': str(e)}
                  
                  # Backup-Löschung einleiten
                  schedule_backup_erasure(user_id)
                  
                  return jsonify({
                      'user_id': user_id,
                      'erasure_timestamp': datetime.now().isoformat(),
                      'services_processed': erasure_results,
                      'backup_scheduled': True
                  })

              # GDPR Article 20: Right to Data Portability
              @app.route('/gdpr/portability', methods=['POST'])
              def data_portability():
                  user_id = request.json.get('user_id')
                  format_type = request.json.get('format', 'json')
                  
                  # Strukturierte Daten für Portabilität
                  portable_data = collect_portable_data(user_id)
                  
                  if format_type == 'csv':
                      return export_as_csv(portable_data)
                  elif format_type == 'xml':
                      return export_as_xml(portable_data)
                  else:
                      return jsonify(portable_data)

              if __name__ == '__main__':
                  app.run(host='0.0.0.0', port=8080)
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5

# GDPR-konformes Audit Logging
apiVersion: apps/v1
kind: DaemonSet
metadata:
  name: gdpr-audit-logger
  namespace: compliance
spec:
  selector:
    matchLabels:
      name: gdpr-audit-logger
  template:
    metadata:
      labels:
        name: gdpr-audit-logger
    spec:
      containers:
        - name: audit-logger
          image: fluent/fluentd:v1.16-1
          env:
            - name: FLUENTD_CONF
              value: 'fluent.conf'
          volumeMounts:
            - name: config
              mountPath: /fluentd/etc
            - name: varlog
              mountPath: /var/log
            - name: containers
              mountPath: /var/lib/docker/containers
              readOnly: true
      volumes:
        - name: config
          configMap:
            name: gdpr-audit-config
        - name: varlog
          hostPath:
            path: /var/log
        - name: containers
          hostPath:
            path: /var/lib/docker/containers
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gdpr-audit-config
  namespace: compliance
data:
  fluent.conf: |
    <source>
      @type tail
      path /var/log/containers/*gdpr*.log
      pos_file /var/log/fluentd-gdpr.log.pos
      tag kubernetes.gdpr.*
      format json
      time_key time
      time_format %Y-%m-%dT%H:%M:%S.%NZ
    </source>

    <filter kubernetes.gdpr.**>
      @type record_transformer
      <record>
        # GDPR-spezifische Felder hinzufügen
        compliance_event true
        data_controller "Company GmbH"
        processing_purpose "${record['purpose'] || 'system_operation'}"
        lawful_basis "${record['lawful_basis'] || 'legitimate_interest'}"
        audit_timestamp ${time}
        retention_period "${record['retention'] || '1y'}"
      </record>
    </filter>

    # PII-Daten pseudonymisieren
    <filter kubernetes.gdpr.**>
      @type anonymizer
      <anonymize>
        sha256_keys email,phone,user_id
        ipv4_mask_bits 24
        remove_keys password,token,secret
      </anonymize>
    </filter>

    <match kubernetes.gdpr.**>
      @type elasticsearch
      host elasticsearch.compliance.svc.cluster.local
      port 9200
      index_name gdpr-audit-${Time.at(time).strftime('%Y-%m')}
      type_name audit_log
      include_timestamp true
      reconnect_on_error true
      reload_on_failure true
      ssl_verify false
      
      <buffer>
        @type file
        path /var/log/fluentd-buffers/gdpr-audit
        flush_interval 10s
        chunk_limit_size 10MB
        queue_limit_length 32
        retry_max_interval 30
        retry_forever true
      </buffer>
    </match>

# GDPR Compliance Monitoring CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: gdpr-compliance-check
  namespace: compliance
spec:
  schedule: '0 2 * * *' # Täglich um 02:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: compliance-checker
              image: compliance-checker:v1.0
              command:
                - python
                - -c
                - |
                  import kubernetes
                  import json
                  import requests
                  from datetime import datetime, timedelta

                  def check_encryption_compliance():
                      """Prüfe ob alle PVCs verschlüsselt sind"""
                      v1 = kubernetes.client.CoreV1Api()
                      storage_v1 = kubernetes.client.StorageV1Api()
                      
                      violations = []
                      pvcs = v1.list_persistent_volume_claim_for_all_namespaces()
                      
                      for pvc in pvcs.items:
                          # StorageClass prüfen
                          sc_name = pvc.spec.storage_class_name
                          if sc_name:
                              sc = storage_v1.read_storage_class(sc_name)
                              if not sc.parameters.get('encrypted', '').lower() == 'true':
                                  violations.append({
                                      'type': 'unencrypted_storage',
                                      'resource': f"{pvc.metadata.namespace}/{pvc.metadata.name}",
                                      'storage_class': sc_name,
                                      'severity': 'high'
                                  })
                      
                      return violations

                  def check_data_retention():
                      """Prüfe Datenaufbewahrungsrichtlinien"""
                      violations = []
                      
                      # Elasticsearch Audit Logs prüfen
                      es_url = "http://elasticsearch.compliance:9200"
                      
                      # Alte Audit Logs finden (> Retention Period)
                      cutoff_date = datetime.now() - timedelta(days=365)  # 1 Jahr Standard
                      
                      query = {
                          "query": {
                              "range": {
                                  "@timestamp": {
                                      "lt": cutoff_date.isoformat()
                                  }
                              }
                          }
                      }
                      
                      response = requests.post(f"{es_url}/gdpr-audit-*/_search", 
                                             json=query)
                      
                      if response.status_code == 200:
                          hits = response.json().get('hits', {}).get('total', {}).get('value', 0)
                          if hits > 0:
                              violations.append({
                                  'type': 'retention_violation',
                                  'resource': 'elasticsearch_audit_logs',
                                  'old_records_count': hits,
                                  'severity': 'medium'
                              })
                      
                      return violations

                  def check_cross_border_transfers():
                      """Prüfe grenzüberschreitende Datenübertragungen"""
                      violations = []
                      
                      # Service Mesh Traffic analysieren
                      apps_v1 = kubernetes.client.AppsV1Api()
                      deployments = apps_v1.list_deployment_for_all_namespaces()
                      
                      for deployment in deployments.items:
                          containers = deployment.spec.template.spec.containers
                          for container in containers:
                              # Environment Variables auf non-EU URLs prüfen
                              if container.env:
                                  for env_var in container.env:
                                      if env_var.value and any(region in env_var.value.lower() 
                                                             for region in ['us-', 'ap-', 'ca-']):
                                          violations.append({
                                              'type': 'cross_border_risk',
                                              'resource': f"{deployment.metadata.namespace}/{deployment.metadata.name}",
                                              'env_var': env_var.name,
                                              'value': env_var.value[:50] + "...",
                                              'severity': 'high'
                                          })
                      
                      return violations

                  def check_consent_management():
                      """Prüfe Consent Management Implementierung"""
                      violations = []
                      
                      # ConfigMaps nach Consent-Konfiguration durchsuchen
                      v1 = kubernetes.client.CoreV1Api()
                      configmaps = v1.list_config_map_for_all_namespaces()
                      
                      consent_found = False
                      for cm in configmaps.items:
                          if cm.data and any('consent' in key.lower() 
                                           for key in cm.data.keys()):
                              consent_found = True
                              break
                      
                      if not consent_found:
                          violations.append({
                              'type': 'missing_consent_management',
                              'resource': 'cluster_wide',
                              'severity': 'high',
                              'description': 'No consent management configuration found'
                          })
                      
                      return violations

                  # Alle Compliance-Checks ausführen
                  all_violations = []
                  all_violations.extend(check_encryption_compliance())
                  all_violations.extend(check_data_retention())
                  all_violations.extend(check_cross_border_transfers())
                  all_violations.extend(check_consent_management())

                  # Compliance Score berechnen
                  total_checks = 10  # Anzahl durchgeführter Checks
                  violations_count = len(all_violations)
                  compliance_score = max(0, (total_checks - violations_count) / total_checks * 100)

                  # Report generieren
                  compliance_report = {
                      'timestamp': datetime.now().isoformat(),
                      'compliance_score': compliance_score,
                      'total_violations': violations_count,
                      'violations': all_violations,
                      'recommendations': generate_recommendations(all_violations),
                      'next_check': (datetime.now() + timedelta(days=1)).isoformat()
                  }

                  # Kritische Violations als Alerts senden
                  critical_violations = [v for v in all_violations if v['severity'] == 'high']
                  if critical_violations:
                      send_compliance_alert(critical_violations)

                  print(json.dumps(compliance_report, indent=2))

                  # Report in ConfigMap speichern
                  v1 = kubernetes.client.CoreV1Api()
                  cm_body = kubernetes.client.V1ConfigMap(
                      metadata=kubernetes.client.V1ObjectMeta(
                          name=f"compliance-report-{datetime.now().strftime('%Y%m%d')}",
                          namespace="compliance"
                      ),
                      data={'report.json': json.dumps(compliance_report, indent=2)}
                  )

                  try:
                      v1.create_namespaced_config_map(
                          namespace="compliance", 
                          body=cm_body
                      )
                  except kubernetes.client.rest.ApiException as e:
                      if e.status == 409:  # Already exists
                          v1.patch_namespaced_config_map(
                              name=cm_body.metadata.name,
                              namespace="compliance",
                              body=cm_body
                          )
              volumeMounts:
                - name: kubeconfig
                  mountPath: /root/.kube
          volumes:
            - name: kubeconfig
              secret:
                secretName: compliance-kubeconfig
          restartPolicy: OnFailure

# Node Affinity für EU-Datenresidenz
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gdpr-sensitive-app
  namespace: data-processing
spec:
  replicas: 3
  template:
    spec:
      affinity:
        nodeAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            nodeSelectorTerms:
              - matchExpressions:
                  - key: topology.kubernetes.io/region
                    operator: In
                    values:
                      - eu-central-1
                      - eu-west-1
                      - eu-north-1
                  - key: node.kubernetes.io/instance-type
                    operator: NotIn
                    values:
                      - us-based-instance-types
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - gdpr-sensitive-app
                topologyKey: topology.kubernetes.io/zone
      containers:
        - name: app
          image: gdpr-app:eu-only
          env:
            - name: DATA_RESIDENCY
              value: 'EU_ONLY'
            - name: GDPR_COMPLIANCE_MODE
              value: 'STRICT'

# GDPR Breach Detection System
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: gdpr-breach-detection
  namespace: compliance
spec:
  groups:
    - name: gdpr.breach
      rules:
        - alert: UnauthorizedDataAccess
          expr: |
            increase(http_requests_total{
              endpoint=~"/api/users.*",
              status_code!~"2..|3.."
            }[5m]) > 10
          for: 2m
          labels:
            severity: critical
            gdpr_relevant: 'true'
          annotations:
            summary: 'Potential unauthorized access to personal data'
            description: '{{ $value }} failed attempts to access user data in 5 minutes'
            breach_category: 'unauthorized_access'
            notification_required: '72h'

        - alert: DataExfiltrationSuspected
          expr: |
            increase(http_response_size_bytes{
              endpoint=~"/api/export.*"
            }[10m]) > 100000000  # 100MB
          for: 1m
          labels:
            severity: critical
            gdpr_relevant: 'true'
          annotations:
            summary: 'Suspicious large data export detected'
            description: 'Large data export of {{ $value }} bytes detected'
            breach_category: 'data_exfiltration'
            notification_required: 'immediately'

        - alert: EncryptionFailure
          expr: |
            increase(encryption_failures_total[5m]) > 0
          for: 0m
          labels:
            severity: critical
            gdpr_relevant: 'true'
          annotations:
            summary: 'Encryption failure detected'
            description: 'Personal data may be stored unencrypted'
            breach_category: 'encryption_failure'
            notification_required: 'immediately'
---
# Automated Breach Response
apiVersion: apps/v1
kind: Deployment
metadata:
  name: breach-response-handler
  namespace: compliance
spec:
  replicas: 1
  template:
    spec:
      containers:
        - name: handler
          image: breach-response:v1.0
          env:
            - name: ALERT_WEBHOOK_URL
              valueFrom:
                secretKeyRef:
                  name: alerting-secrets
                  key: webhook-url
            - name: DPA_NOTIFICATION_EMAIL
              value: 'privacy@company.com'
          command:
            - python
            - -c
            - |
              from flask import Flask, request
              import json
              import smtplib
              from email.mime.text import MIMEText
              from datetime import datetime, timedelta

              app = Flask(__name__)

              @app.route('/breach-alert', methods=['POST'])
              def handle_breach_alert():
                  alert_data = request.json
                  
                  # GDPR-relevante Alerts filtern
                  if not alert_data.get('labels', {}).get('gdpr_relevant'):
                      return "Not GDPR relevant", 200
                  
                  breach_category = alert_data.get('annotations', {}).get('breach_category')
                  severity = alert_data.get('labels', {}).get('severity')
                  
                  # Sofortige Maßnahmen einleiten
                  if severity == 'critical':
                      # 1. Incident-Team benachrichtigen
                      notify_incident_team(alert_data)
                      
                      # 2. Betroffene Services isolieren
                      if breach_category == 'unauthorized_access':
                          isolate_affected_services(alert_data)
                      
                      # 3. Forensik-Daten sammeln
                      collect_forensic_data(alert_data)
                  
                  # GDPR-konforme Dokumentation
                  breach_record = {
                      'incident_id': generate_incident_id(),
                      'detection_time': datetime.now().isoformat(),
                      'breach_category': breach_category,
                      'affected_data_subjects': estimate_affected_subjects(alert_data),
                      'risk_assessment': assess_breach_risk(alert_data),
                      'notification_deadline': calculate_notification_deadline(),
                      'containment_measures': [],
                      'investigation_status': 'ongoing'
                  }
                  
                  # Breach Record speichern
                  store_breach_record(breach_record)
                  
                  # Bei hohem Risiko: DPA-Notification vorbereiten
                  if breach_record['risk_assessment']['level'] == 'high':
                      prepare_dpa_notification(breach_record)
                  
                  return jsonify({'status': 'handled', 'incident_id': breach_record['incident_id']})

              def calculate_notification_deadline():
                  """GDPR Art. 33: 72 Stunden für Aufsichtsbehörde"""
                  return (datetime.now() + timedelta(hours=72)).isoformat()

              def assess_breach_risk(alert_data):
                  """Risikobewertung nach GDPR Art. 34"""
                  risk_factors = {
                      'data_volume': 'unknown',
                      'data_sensitivity': 'personal',
                      'encryption_status': 'encrypted',
                      'public_exposure': False,
                      'identity_theft_risk': 'low'
                  }
                  
                  # Risiko-Level bestimmen
                  if alert_data.get('annotations', {}).get('breach_category') == 'data_exfiltration':
                      risk_factors['public_exposure'] = True
                      risk_level = 'high'
                  elif alert_data.get('annotations', {}).get('breach_category') == 'encryption_failure':
                      risk_factors['encryption_status'] = 'failed'
                      risk_level = 'medium'
                  else:
                      risk_level = 'low'
                  
                  return {
                      'level': risk_level,
                      'factors': risk_factors,
                      'data_subject_notification_required': risk_level == 'high'
                  }

              if __name__ == '__main__':
                  app.run(host='0.0.0.0', port=8080)

# GDPR Compliance Dashboard
apiVersion: v1
kind: ConfigMap
metadata:
  name: gdpr-compliance-dashboard
  namespace: compliance
data:
  dashboard.json: |
    {
      "dashboard": {
        "title": "GDPR Compliance Dashboard",
        "panels": [
          {
            "title": "Compliance Score",
            "type": "singlestat",
            "targets": [
              {
                "expr": "gdpr_compliance_score",
                "legendFormat": "Overall Score"
              }
            ],
            "thresholds": [
              {"color": "red", "value": 0},
              {"color": "yellow", "value": 70},
              {"color": "green", "value": 90}
            ]
          },
          {
            "title": "Data Subject Requests",
            "type": "graph",
            "targets": [
              {
                "expr": "increase(gdpr_data_subject_requests_total[24h])",
                "legendFormat": "{{request_type}}"
              }
            ]
          },
          {
            "title": "Breach Detection",
            "type": "table",
            "targets": [
              {
                "expr": "gdpr_breach_alerts_total",
                "legendFormat": "{{severity}} - {{category}}"
              }
            ]
          },
          {
            "title": "Data Retention Compliance",
            "type": "graph",
            "targets": [
              {
                "expr": "gdpr_retention_violations_total",
                "legendFormat": "Retention Violations"
              }
            ]
          },
          {
            "title": "Encryption Coverage",
            "type": "piechart",
            "targets": [
              {
                "expr": "gdpr_encrypted_volumes / gdpr_total_volumes * 100",
                "legendFormat": "Encrypted Storage %"
              }
            ]
          }
        ]
      }
    }

# Encryption Verification
kubectl get pvc -A -o custom-columns="NAMESPACE:.metadata.namespace,NAME:.metadata.name,STORAGECLASS:.spec.storageClassName"
kubectl get storageclass -o yaml | grep -A 5 -B 5 encrypted

# RBAC Audit
kubectl auth can-i --list --as=system:serviceaccount:default:default
kubectl get rolebindings,clusterrolebindings -A | grep -v system:

# Network Policy Validation
kubectl get networkpolicies -A
kubectl describe networkpolicy gdpr-data-isolation -n data-processing

#!/bin/bash
# GDPR Compliance Verification Script

echo "=== GDPR Compliance Check ==="

# 1. Encryption Compliance
echo "1. Checking Encryption Compliance..."
UNENCRYPTED_PVCs=$(kubectl get pvc -A -o json | jq -r '.items[] | select(.spec.storageClassName) | select(.spec.storageClassName as $sc | (kubectl get storageclass $sc -o json | jq -r ".parameters.encrypted // empty") != "true") | "\(.metadata.namespace)/\(.metadata.name)"')

if [ -z "$UNENCRYPTED_PVCs" ]; then
    echo "✅ All PVCs are encrypted"
else
    echo "❌ Unencrypted PVCs found: $UNENCRYPTED_PVCs"
fi

# 2. Data Subject Rights API
echo "2. Checking Data Subject Rights API..."
DSR_STATUS=$(kubectl get deployment gdpr-rights-api -n compliance -o jsonpath='{.status.readyReplicas}' 2>/dev/null || echo "0")
if [ "$DSR_STATUS" -gt 0 ]; then
    echo "✅ Data Subject Rights API is running"
else
    echo "❌ Data Subject Rights API not found or not ready"
fi

# 3. Audit Logging
echo "3. Checking Audit Logging..."
AUDIT_PODS=$(kubectl get pods -n compliance -l name=gdpr-audit-logger --field-selector=status.phase=Running | wc -l)
if [ "$AUDIT_PODS" -gt 1 ]; then
    echo "✅ Audit logging is active on $((AUDIT_PODS-1)) nodes"
else
    echo "❌ Audit logging not properly deployed"
fi

# 4. Network Isolation
echo "4. Checking Network Isolation..."
NP_COUNT=$(kubectl get networkpolicy gdpr-data-isolation -n data-processing 2>/dev/null | wc -l)
if [ "$NP_COUNT" -gt 1 ]; then
    echo "✅ GDPR Network Policies are active"
else
    echo "❌ GDPR Network Policies missing"
fi

# 5. Compliance Monitoring
echo "5. Checking Compliance Monitoring..."
COMPLIANCE_JOB=$(kubectl get cronjob gdpr-compliance-check -n compliance 2>/dev/null | wc -l)
if [ "$COMPLIANCE_JOB" -gt 1 ]; then
    echo "✅ Automated compliance monitoring is scheduled"
    # Letzter Report prüfen
    LAST_REPORT=$(kubectl get configmap -n compliance | grep compliance-report | head -1 | awk '{print $1}')
    if [ ! -z "$LAST_REPORT" ]; then
        COMPLIANCE_SCORE=$(kubectl get configmap $LAST_REPORT -n compliance -o jsonpath='{.data.report\.json}' | jq -r '.compliance_score')
        echo "   Latest compliance score: $COMPLIANCE_SCORE%"
    fi
else
    echo "❌ Compliance monitoring not configured"
fi

echo "=== GDPR Compliance Check Complete ==="

# Data Erasure Job mit Volume-based Approach
apiVersion: batch/v1
kind: Job
metadata:
  name: gdpr-erasure-job
spec:
  template:
    spec:
      containers:
        - name: data-eraser
          image: alpine:3.18
          command:
            - /bin/sh
            - -c
            - |
              # 1. Database Erasure
              apk add --no-cache postgresql-client
              psql $DATABASE_URL -c "
                DELETE FROM user_profiles WHERE user_id = '$USER_ID';
                DELETE FROM user_activities WHERE user_id = '$USER_ID';
                DELETE FROM user_preferences WHERE user_id = '$USER_ID';
              "

              # 2. File System Erasure
              find /data -name "*$USER_ID*" -delete
              find /logs -name "*$USER_ID*" -exec shred -vfz -n 3 {} \;

              # 3. Cache Invalidation
              redis-cli DEL "user:$USER_ID:*"

              # 4. Backup Scheduling für Erasure
              kubectl create job backup-erasure-$USER_ID --from=cronjob/backup-erasure-template
          env:
            - name: USER_ID
              value: '{{USER_ID}}'
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: db-credentials
                  key: connection-string
          volumeMounts:
            - name: data-volume
              mountPath: /data
            - name: log-volume
              mountPath: /logs
      volumes:
        - name: data-volume
          persistentVolumeClaim:
            claimName: user-data-pvc
        - name: log-volume
          persistentVolumeClaim:
            claimName: audit-logs-pvc
      restartPolicy: Never

# Istio EnvoyFilter für Data Minimization
apiVersion: networking.istio.io/v1alpha3
kind: EnvoyFilter
metadata:
  name: gdpr-data-minimization
  namespace: data-processing
spec:
  configPatches:
    - applyTo: HTTP_FILTER
      match:
        context: SIDECAR_INBOUND
        listener:
          filterChain:
            filter:
              name: 'envoy.filters.network.http_connection_manager'
      patch:
        operation: INSERT_BEFORE
        value:
          name: envoy.filters.http.lua
          typed_config:
            '@type': type.googleapis.com/envoy.extensions.filters.http.lua.v3.Lua
            inline_code: |
              function envoy_on_request(request_handle)
                -- GDPR Data Classification Headers prüfen
                local data_purpose = request_handle:headers():get("x-data-purpose")
                local data_minimization = request_handle:headers():get("x-data-minimization")
                
                if data_minimization == "strict" then
                  -- Request Body auf notwendige Felder reduzieren
                  local body = request_handle:body()
                  if body then
                    local json = require("json")
                    local data = json.decode(body:getBytes(0, body:length()))
                    
                    -- Nur notwendige Felder basierend auf Purpose
                    local minimized_data = {}
                    if data_purpose == "authentication" then
                      minimized_data.user_id = data.user_id
                      minimized_data.timestamp = data.timestamp
                    elseif data_purpose == "billing" then
                      minimized_data.user_id = data.user_id
                      minimized_data.amount = data.amount
                      minimized_data.currency = data.currency
                    end
                    
                    -- Minimized Body setzen
                    request_handle:body():setBytes(json.encode(minimized_data))
                  end
                end
              end

              function envoy_on_response(response_handle)
                -- Response Data Minimization
                local data_classification = response_handle:headers():get("x-data-classification")
                
                if data_classification == "personal" then
                  local body = response_handle:body()
                  if body then
                    local json = require("json")
                    local data = json.decode(body:getBytes(0, body:length()))
                    
                    -- PII-Felder pseudonymisieren
                    if data.email then
                      data.email = hash_email(data.email)
                    end
                    if data.phone then
                      data.phone = "***-***-" .. string.sub(data.phone, -4)
                    end
                    
                    response_handle:body():setBytes(json.encode(data))
                  end
                end
              end

# GDPR-konformer Logging Stack
apiVersion: apps/v1
kind: Deployment
metadata:
  name: gdpr-log-processor
  namespace: logging
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: log-processor
          image: fluent/fluent-bit:2.1
          volumeMounts:
            - name: config
              mountPath: /fluent-bit/etc
      volumes:
        - name: config
          configMap:
            name: gdpr-log-config
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: gdpr-log-config
  namespace: logging
data:
  fluent-bit.conf: |
    [SERVICE]
        Flush        1
        Log_Level    info
        Daemon       off
        Parsers_File parsers.conf

    [INPUT]
        Name              tail
        Path              /var/log/containers/*.log
        Parser            docker
        Tag               kube.*
        Refresh_Interval  5
        Mem_Buf_Limit     50MB
        Skip_Long_Lines   On

    [FILTER]
        Name    kubernetes
        Match   kube.*
        Kube_URL https://kubernetes.default.svc:443
        Kube_CA_File /var/run/secrets/kubernetes.io/serviceaccount/ca.crt
        Kube_Token_File /var/run/secrets/kubernetes.io/serviceaccount/token

    # GDPR PII Anonymization Filter
    [FILTER]
        Name    lua
        Match   kube.*
        Script  gdpr_anonymize.lua
        Call    anonymize_pii

    # GDPR Retention Filter
    [FILTER]
        Name    modify
        Match   kube.*
        Add     retention_class standard
        Add     retention_period 1y
        Add     gdpr_compliant true

    [OUTPUT]
        Name  es
        Match *
        Host  elasticsearch.logging.svc.cluster.local
        Port  9200
        Index gdpr-logs-${HOSTNAME}-%Y.%m
        Type  _doc
        HTTP_User elastic
        HTTP_Passwd ${ELASTICSEARCH_PASSWORD}
        tls   On
        tls.verify Off
        Suppress_Type_Name On

  gdpr_anonymize.lua: |
    function anonymize_pii(tag, timestamp, record)
        -- Email Anonymization
        if record["log"] then
            -- Email-Pattern erkennen und hash-anonymisieren
            record["log"] = string.gsub(record["log"], 
                "([%w%._%-%+]+@[%w%._%-%+]+%.%w+)", 
                function(email)
                    return "email_" .. string.sub(sha256(email), 1, 8)
                end)
            
            -- IP-Adressen anonymisieren (letztes Oktett)
            record["log"] = string.gsub(record["log"], 
                "(%d+%.%d+%.%d+%.)%d+", 
                "%1xxx")
            
            -- Telefonnummern anonymisieren
            record["log"] = string.gsub(record["log"], 
                "%+?%d%d%d?[%-%s]?%d%d%d[%-%s]?%d%d%d%d", 
                "***-***-****")
            
            -- Credit Card Numbers
            record["log"] = string.gsub(record["log"], 
                "%d%d%d%d[%-%s]?%d%d%d%d[%-%s]?%d%d%d%d[%-%s]?%d%d%d%d", 
                "****-****-****-****")
        end
        
        -- GDPR Metadata hinzufügen
        record["gdpr_processed"] = true
        record["anonymization_timestamp"] = os.date("!%Y-%m-%dT%H:%M:%SZ")
        
        return 1, timestamp, record
    end

    function sha256(str)
        -- Simplified hash function für Demo
        return tostring(string.len(str) * 12345 + 67890)
    end

  parsers.conf: |
    [PARSER]
        Name        docker
        Format      json
        Time_Key    time
        Time_Format %Y-%m-%dT%H:%M:%S.%L
        Time_Keep   On