# Minimale Service Configuration
apiVersion: v1
kind: Pod
metadata:
  name: privacy-by-design-app
  labels:
    data-classification: personal
    retention-policy: "7-years"
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
  - name: app
    image: company/gdpr-app:latest
    env:
    - name: DATA_RETENTION_DAYS
      value: "2555"  # 7 Jahre gesetzliche Aufbewahrung
    - name: PSEUDONYMIZATION_KEY
      valueFrom:
        secretKeyRef:
          name: crypto-keys
          key: pseudonymization
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
    resources:
      limits:
        memory: "512Mi"
        cpu: "500m"
    volumeMounts:
    - name: temp-data
      mountPath: /tmp
    - name: app-config
      mountPath: /app/config
      readOnly: true
  volumes:
  - name: temp-data
    emptyDir:
      sizeLimit: 1Gi
  - name: app-config
    configMap:
      name: gdpr-config

# Encryption at Rest - Storage Class
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: encrypted-personal-data
provisioner: kubernetes.io/azure-disk
parameters:
  encryption: "true"
  storageaccounttype: Premium_LRS
  cachingmode: ReadOnly
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

---
# TLS-verschlüsselte Kommunikation
apiVersion: v1
kind: Service
metadata:
  name: gdpr-compliant-service
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: "true"
spec:
  type: LoadBalancer
  ports:
  - port: 443
    targetPort: 8443
    protocol: TCP
    name: https
  selector:
    app: gdpr-app

---
# Certificate Management
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gdpr-app-tls
spec:
  secretName: gdpr-app-tls-secret
  issuer:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: gdpr-app.company.de
  dnsNames:
  - gdpr-app.company.de

# Audit Policy für personenbezogene Daten
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# Protokolliere alle Zugriffe auf Secrets mit personenbezogenen Daten
- level: RequestResponse
  resources:
  - group: ""
    resources: ["secrets"]
  namespaces: ["production", "staging"]
  omitStages:
  - RequestReceived

# Protokolliere ConfigMap-Änderungen (Datenschutz-Konfiguration)
- level: RequestResponse
  resources:
  - group: ""
    resources: ["configmaps"]
  verbs: ["create", "update", "patch", "delete"]
  namespaces: ["production"]

# Protokolliere alle Pod-Erstellungen mit Personal Data Label
- level: Request
  resources:
  - group: ""
    resources: ["pods"]
  verbs: ["create"]
  namespaces: ["production"]
  labelSelector: "data-classification=personal"

# Automated Data Deletion CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: gdpr-data-deletion
spec:
  schedule: "0 2 * * *"  # Täglich um 2:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: data-eraser
            image: company/gdpr-eraser:latest
            env:
            - name: DB_CONNECTION
              valueFrom:
                secretKeyRef:
                  name: database-credentials
                  key: connection-string
            - name: RETENTION_POLICIES
              valueFrom:
                configMapKeyRef:
                  name: gdpr-policies
                  key: retention-config
            command:
            - /bin/bash
            - -c
            - |
              echo "Starting GDPR-compliant data deletion..."
              
              # Lösche abgelaufene Benutzerdaten
              python3 /app/scripts/delete_expired_data.py \
                --policy-file /config/retention-policies.yaml \
                --dry-run false \
                --log-level INFO
              
              # Audit Log erstellen
              echo "Data deletion completed at $(date)" >> /logs/deletion-audit.log
              
            volumeMounts:
            - name: config-volume
              mountPath: /config
            - name: log-volume
              mountPath: /logs
          volumes:
          - name: config-volume
            configMap:
              name: gdpr-policies
          - name: log-volume
            persistentVolumeClaim:
              claimName: audit-logs-pvc
          restartPolicy: OnFailure

# BSI-konforme Netzwerksegmentierung
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bsi-compliant-segmentation
  namespace: production
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  
  # Default Deny All
  ingress: []
  egress: []

---
# Explizite Erlaubnis für notwendige Kommunikation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-to-backend-allowed
  namespace: production
spec:
  podSelector:
    matchLabels:
      tier: backend
  policyTypes:
  - Ingress
  ingress:
  - from:
    - podSelector:
        matchLabels:
          tier: frontend
    ports:
    - protocol: TCP
      port: 8080
    - protocol: TCP
      port: 8443

---
# Internet-Zugang nur für spezifische Services
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internet-access-restricted
  namespace: production
spec:
  podSelector:
    matchLabels:
      internet-access: "required"
  policyTypes:
  - Egress
  egress:
  - to: []
    ports:
    - protocol: TCP
      port: 443
    - protocol: TCP
      port: 80
  - to:
    - namespaceSelector:
        matchLabels:
          name: kube-system

# Vulnerability Scanning Pipeline
apiVersion: batch/v1
kind: CronJob
metadata:
  name: bsi-vulnerability-scan
spec:
  schedule: "0 1 * * *"  # Tägliche Überprüfung
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: trivy-scanner
            image: aquasec/trivy:latest
            command:
            - /bin/sh
            - -c
            - |
              echo "BSI IT-Grundschutz Vulnerability Scan gestartet..."
              
              # Scanne alle Container Images im Cluster
              kubectl get pods --all-namespaces -o jsonpath='{.items[*].spec.containers[*].image}' | \
              tr ' ' '\n' | sort -u | while read image; do
                echo "Scanning $image..."
                trivy image --severity HIGH,CRITICAL --exit-code 1 --format json $image > /reports/$(echo $image | tr '/' '_' | tr ':' '_').json
              done
              
              # BSI-konformer Report erstellen
              python3 /scripts/generate_bsi_report.py /reports/ > /reports/bsi-compliance-report.html
              
            volumeMounts:
            - name: reports
              mountPath: /reports
            - name: scripts
              mountPath: /scripts
          volumes:
          - name: reports
            persistentVolumeClaim:
              claimName: vulnerability-reports
          - name: scripts
            configMap:
              name: bsi-scripts
          restartPolicy: OnFailure

# BSI-konforme Pod Security Standards
apiVersion: v1
kind: Pod
metadata:
  name: bsi-compliant-pod
  labels:
    security-level: "restricted"
spec:
  securityContext:
    # Erhöhte Sicherheitsanforderungen
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
    sysctls:
    - name: net.core.somaxconn
      value: "1024"
  
  containers:
  - name: secure-app
    image: company/bsi-app:latest
    securityContext:
      allowPrivilegeEscalation: false
      readOnlyRootFilesystem: true
      capabilities:
        drop:
        - ALL
        add:
        - NET_BIND_SERVICE  # Nur notwendige Capabilities
      runAsNonRoot: true
      runAsUser: 1000
      
    # Resource Limits nach BSI-Empfehlungen
    resources:
      requests:
        memory: "256Mi"
        cpu: "250m"
        ephemeral-storage: "1Gi"
      limits:
        memory: "512Mi"
        cpu: "500m"
        ephemeral-storage: "2Gi"
    
    # Minimale Umgebungsvariablen
    env:
    - name: APP_ENV
      value: "production"
    - name: LOG_LEVEL
      value: "INFO"
    
    # Sichere Volume-Mounts
    volumeMounts:
    - name: tmp
      mountPath: /tmp
    - name: app-data
      mountPath: /app/data
      readOnly: true
    
    # Health Checks
    livenessProbe:
      httpGet:
        path: /health
        port: 8080
      initialDelaySeconds: 30
      periodSeconds: 10
    
    readinessProbe:
      httpGet:
        path: /ready
        port: 8080
      initialDelaySeconds: 5
      periodSeconds: 5
  
  volumes:
  - name: tmp
    emptyDir:
      sizeLimit: 100Mi
  - name: app-data
    configMap:
      name: app-config
      defaultMode: 0440

# Financial Services Compliant Configuration
apiVersion: v1
kind: Namespace
metadata:
  name: banking-production
  labels:
    compliance: "bait-marisk"
    data-classification: "financial"
    environment: "production"
  annotations:
    bafin.de/audit-frequency: "quarterly"
    bafin.de/data-retention: "10-years"

---
# High-Availability für kritische Banking Services
apiVersion: apps/v1
kind: Deployment
metadata:
  name: banking-core-system
  namespace: banking-production
spec:
  replicas: 5  # Mindestens 3 für HA
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 2
  selector:
    matchLabels:
      app: banking-core
  template:
    spec:
      affinity:
        # Anti-Affinity für Ausfallsicherheit
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
          - labelSelector:
              matchExpressions:
              - key: app
                operator: In
                values:
                - banking-core
            topologyKey: kubernetes.io/hostname
      
      containers:
      - name: banking-app
        image: bank/core-system:v2.1-bait-compliant
        env:
        - name: COMPLIANCE_MODE
          value: "BAIT_MARISK"
        - name: AUDIT_LEVEL
          value: "FULL"
        - name: ENCRYPTION_STANDARD
          value: "AES-256-GCM"
        
        # Erweiterte Ressourcen für kritische Workloads
        resources:
          requests:
            memory: "2Gi"
            cpu: "1000m"
          limits:
            memory: "4Gi"
            cpu: "2000m"
        
        # Umfassende Health Checks
        livenessProbe:
          httpGet:
            path: /actuator/health/liveness
            port: 8080
          initialDelaySeconds: 60
          periodSeconds: 30
          timeoutSeconds: 10
          failureThreshold: 3
        
        readinessProbe:
          httpGet:
            path: /actuator/health/readiness
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3

# Healthcare Data Protection Setup
apiVersion: v1
kind: Secret
metadata:
  name: patient-data-encryption
  namespace: healthcare
  labels:
    data-type: "patient-data"
    compliance: "sgb-v"
type: Opaque
data:
  encryption-key: <base64-encoded-key>
  signing-key: <base64-encoded-key>

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: patient-management-system
  namespace: healthcare
spec:
  replicas: 3
  selector:
    matchLabels:
      app: patient-system
  template:
    spec:
      containers:
      - name: patient-app
        image: clinic/patient-system:latest
        env:
        - name: PATIENT_DATA_ENCRYPTION
          value: "AES-256"
        - name: SCHWEIGEPFLICHT_MODE
          value: "ENABLED"
        - name: AUDIT_PATIENT_ACCESS
          value: "TRUE"
        
        # Spezielle Security Context für Patientendaten
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: true
          capabilities:
            drop:
            - ALL
        
        volumeMounts:
        - name: patient-data
          mountPath: /app/data
        - name: encryption-keys
          mountPath: /app/keys
          readOnly: true
      
      volumes:
      - name: patient-data
        persistentVolumeClaim:
          claimName: encrypted-patient-storage
      - name: encryption-keys
        secret:
          secretName: patient-data-encryption
          defaultMode: 0400

---
# Spezielle StorageClass für Patientendaten
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: patient-data-encrypted
provisioner: kubernetes.io/azure-disk
parameters:
  encryption: "true"
  storageaccounttype: Premium_LRS
  cachingmode: None  # Keine Caching für sensitive Daten
reclaimPolicy: Retain  # Niemals automatisch löschen
volumeBindingMode: WaitForFirstConsumer

# Open Policy Agent für Policy Enforcement
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa-gatekeeper
  namespace: gatekeeper-system
spec:
  replicas: 3
  selector:
    matchLabels:
      app: gatekeeper
  template:
    spec:
      containers:
      - name: opa
        image: openpolicyagent/opa:latest-envoy
        args:
        - "run"
        - "--server"
        - "--config-file=/config/config.yaml"
        - "/policies"
        volumeMounts:
        - name: opa-policies
          mountPath: /policies
        - name: opa-config
          mountPath: /config
      volumes:
      - name: opa-policies
        configMap:
          name: compliance-policies
      - name: opa-config
        configMap:
          name: opa-config

---
# Compliance Policy Beispiel
apiVersion: v1
kind: ConfigMap
metadata:
  name: compliance-policies
data:
  gdpr.rego: |
    package kubernetes.gdpr
    
    # DSGVO: Alle Pods mit personenbezogenen Daten müssen verschlüsselt sein
    deny[msg] {
      input.request.kind.kind == "Pod"
      input.request.object.metadata.labels["data-classification"] == "personal"
      not has_encryption_annotation
      msg := "DSGVO Violation: Personal data pods must have encryption annotation"
    }
    
    has_encryption_annotation {
      input.request.object.metadata.annotations["encryption.company.de/enabled"] == "true"
    }
  
  bsi.rego: |
    package kubernetes.bsi
    
    # BSI: Alle Production Pods müssen Security Context haben
    deny[msg] {
      input.request.kind.kind == "Pod"
      input.request.object.metadata.namespace == "production"
      not has_security_context
      msg := "BSI Violation: Production pods must have security context"
    }
    
    has_security_context {
      input.request.object.spec.securityContext.runAsNonRoot == true
    }

# Compliance Report Generator
apiVersion: batch/v1
kind: CronJob
metadata:
  name: compliance-report-generator
spec:
  schedule: "0 6 * * 1"  # Jeden Montag um 6:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: report-generator
            image: company/compliance-reporter:latest
            command:
            - /bin/bash
            - -c
            - |
              echo "Generating weekly compliance report..."
              
              # DSGVO Compliance Check
              echo "=== DSGVO Compliance Report ===" > /reports/weekly-compliance.txt
              kubectl get pods --all-namespaces -l data-classification=personal \
                -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.metadata.annotations.encryption\.company\.de/enabled}{"\n"}{end}' \
                >> /reports/weekly-compliance.txt
              
              # BSI Grundschutz Check
              echo "=== BSI IT-Grundschutz Report ===" >> /reports/weekly-compliance.txt
              kubectl get networkpolicies --all-namespaces \
                -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' \
                >> /reports/weekly-compliance.txt
              
              # Vulnerability Report
              echo "=== Vulnerability Summary ===" >> /reports/weekly-compliance.txt
              cat /vulnerability-reports/latest-scan.json | jq '.vulnerabilities | length' \
                >> /reports/weekly-compliance.txt
              
              # Send Report (via email, Slack, etc.)
              python3 /scripts/send_compliance_report.py /reports/weekly-compliance.txt
              
            volumeMounts:
            - name: reports
              mountPath: /reports
            - name: vulnerability-reports
              mountPath: /vulnerability-reports
            - name: scripts
              mountPath: /scripts
          volumes:
          - name: reports
            persistentVolumeClaim:
              claimName: compliance-reports
          - name: vulnerability-reports
            persistentVolumeClaim:
              claimName: vulnerability-reports
          - name: scripts
            configMap:
              name: reporting-scripts
          restartPolicy: OnFailure

# Velero Backup mit Verschlüsselung
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: gdpr-compliant-backup
spec:
  schedule: "0 3 * * *"  # Täglich um 3:00 Uhr
  template:
    metadata:
      labels:
        compliance: gdpr
        retention: "7-years"
    spec:
      # Backup nur spezifischer Namespaces
      includedNamespaces:
      - production
      - staging
      
      # Excludiere Secrets mit temporären Daten
      excludedResources:
      - secrets.v1
      - events.v1
      
      # Verschlüsselung aktivieren
      storageLocation: primary-encrypted
      
      # Retention gemäß DSGVO
      ttl: 61320h  # 7 Jahre
      
      # Zusätzliche Labels für Audit
      labelSelector:
        matchLabels:
          data-classification: personal

---
# Backup Storage Location mit Verschlüsselung
apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: primary-encrypted
spec:
  provider: azure
  objectStorage:
    bucket: gdpr-backups-encrypted
    prefix: kubernetes-backups
  config:
    resourceGroup: backup-rg
    storageAccount: gdprbackupstorage
    subscriptionId: <subscription-id>
    # Server-side Verschlüsselung
    encryptionScope: gdpr-encryption-scope

# Multi-Region Setup für kritische Services
apiVersion: apps/v1
kind: Deployment
metadata:
  name: critical-service-dr
  namespace: production
spec:
  replicas: 6
  selector:
    matchLabels:
      app: critical-service
  template:
    spec:
      affinity:
        # Verteilung auf verschiedene Availability Zones
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            podAffinityTerm:
              labelSelector:
                matchExpressions:
                - key: app
                  operator: In
                  values:
                  - critical-service
              topologyKey: topology.kubernetes.io/zone
      
      containers:
      - name: app
        image: company/critical-service:latest
        env:
        - name: REGION
          valueFrom:
            fieldRef:
              fieldPath: metadata.annotations['topology.kubernetes.io/region']
        - name: ZONE
          valueFrom:
            fieldRef:
              fieldPath: metadata.annotations['topology.kubernetes.io/zone']
        
        # Readiness Gate für Cross-Region Health Check
        readinessGates:
        - conditionType: "company.de/cross-region-ready"

# GitLab CI/CD Pipeline mit Compliance Checks
apiVersion: v1
kind: ConfigMap
metadata:
  name: compliance-pipeline
data:
  .gitlab-ci.yml: |
    stages:
      - security-scan
      - compliance-check
      - deploy
    
    variables:
      DOCKER_TLS_CERTDIR: "/certs"
    
    security-scan:
      stage: security-scan
      image: aquasec/trivy:latest
      script:
        - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
        - trivy fs --exit-code 1 --severity HIGH,CRITICAL .
      
    gdpr-compliance-check:
      stage: compliance-check
      image: openpolicyagent/opa:latest
      script:
        - opa test policies/
        - opa fmt --diff policies/
        - |
          for file in k8s-manifests/*.yaml; do
            opa eval -d policies/ -i $file "data.kubernetes.gdpr.deny[x]"
          done
      
    bsi-compliance-check:
      stage: compliance-check
      image: company/bsi-checker:latest
      script:
        - bsi-check --manifests k8s-manifests/ --report compliance-report.json
        - cat compliance-report.json
      artifacts:
        reports:
          junit: compliance-report.json
    
    deploy:
      stage: deploy
      image: bitnami/kubectl:latest
      script:
        - kubectl apply -f k8s-manifests/
      only:
        - main
      when: manual

# Policy Update Automation
apiVersion: batch/v1
kind: CronJob
metadata:
  name: policy-update-automation
spec:
  schedule: "0 4 * * 1"  # Jeden Montag um 4:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: policy-updater
            image: company/policy-updater:latest
            command:
            - /bin/bash
            - -c
            - |
              echo "Checking for policy updates..."
              
              # BSI IT-Grundschutz Updates
              curl -s https://www.bsi.bund.de/api/grundschutz/updates | \
                jq '.containers' > /tmp/bsi-updates.json
              
              # DSGVO Guidance Updates
              curl -s https://edpb.europa.eu/api/guidelines | \
                jq '.technical' > /tmp/gdpr-updates.json
              
              # Policy Updates anwenden
              python3 /scripts/update_policies.py \
                --bsi-updates /tmp/bsi-updates.json \
                --gdpr-updates /tmp/gdpr-updates.json \
                --policy-dir /policies
              
              # Neue Policies in Cluster anwenden
              kubectl apply -f /policies/updated/
              
            volumeMounts:
            - name: policies
              mountPath: /policies
            - name: scripts
              mountPath: /scripts
          volumes:
          - name: policies
            configMap:
              name: compliance-policies
          - name: scripts
            configMap:
              name: policy-scripts
          restartPolicy: OnFailure

# SIEM Integration für Compliance Violations
apiVersion: apps/v1
kind: Deployment
metadata:
  name: compliance-monitor
spec:
  replicas: 2
  selector:
    matchLabels:
      app: compliance-monitor
  template:
    spec:
      containers:
      - name: monitor
        image: company/compliance-monitor:latest
        env:
        - name: ALERT_WEBHOOK
          valueFrom:
            secretKeyRef:
              name: alert-config
              key: webhook-url
        - name: GDPR_BREACH_THRESHOLD
          value: "72h"  # 72 Stunden Meldepflicht
        
        command:
        - /bin/bash
        - -c
        - |
          # Kontinuierliches Monitoring
          while true; do
            # Check für DSGVO Violations
            gdpr_violations=$(kubectl logs --selector=compliance=gdpr --since=1h | grep "VIOLATION" | wc -l)
            
            if [ $gdpr_violations -gt 0 ]; then
              echo "GDPR violation detected: $gdpr_violations incidents"
              
              # Sofortige Benachrichtigung
              curl -X POST $ALERT_WEBHOOK \
                -H "Content-Type: application/json" \
                -d "{\"text\":\"🚨 GDPR Compliance Violation detected: $gdpr_violations incidents\", \"severity\":\"critical\"}"
              
              # Incident Report generieren
              python3 /scripts/generate_incident_report.py --violations $gdpr_violations
            fi
            
            # Check für BSI Grundschutz Abweichungen
            bsi_violations=$(kubectl get events --field-selector reason=FailedMount | grep -c "security")
            
            if [ $bsi_violations -gt 0 ]; then
              echo "BSI IT-Grundschutz violation detected"
              python3 /scripts/bsi_incident_handler.py --violations $bsi_violations
            fi
            
            sleep 300  # Check alle 5 Minuten
          done

# DSGVO-konforme Breach Notification
apiVersion: v1
kind: ConfigMap
metadata:
  name: breach-notification-template
data:
  notification-template.json: |
    {
      "incident_id": "{{.IncidentID}}",
      "timestamp": "{{.Timestamp}}",
      "severity": "{{.Severity}}",
      "affected_data_subjects": {{.AffectedCount}},
      "data_categories": {{.DataCategories}},
      "breach_description": "{{.Description}}",
      "containment_measures": "{{.ContainmentMeasures}}",
      "notification_deadline": "{{.NotificationDeadline}}",
      "dpo_contact": "dpo@company.de",
      "authority_contact": "poststelle@bfdi.bund.de"
    }

---
apiVersion: batch/v1
kind: Job
metadata:
  name: breach-notification-handler
spec:
  template:
    spec:
      containers:
      - name: notification-handler
        image: company/breach-handler:latest
        env:
        - name: INCIDENT_ID
          value: "{{INCIDENT_ID}}"
        - name: BREACH_SEVERITY
          value: "{{SEVERITY}}"
        command:
        - /bin/bash
        - -c
        - |
          echo "Processing GDPR breach notification..."
          
          # Datensammlung für Meldung
          affected_pods=$(kubectl get pods -l data-classification=personal --no-headers | wc -l)
          incident_time=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
          notification_deadline=$(date -u -d "+72 hours" +"%Y-%m-%dT%H:%M:%SZ")
          
          # Incident Report erstellen
          python3 /scripts/create_breach_report.py \
            --incident-id $INCIDENT_ID \
            --affected-pods $affected_pods \
            --incident-time $incident_time \
            --deadline $notification_deadline
          
          # Automatische Benachrichtigung an Aufsichtsbehörde (wenn konfiguriert)
          if [ "$AUTO_NOTIFY" = "true" ]; then
            python3 /scripts/notify_authority.py --report /tmp/breach-report.json
          fi
          
        volumeMounts:
        - name: templates
          mountPath: /templates
        - name: scripts
          mountPath: /scripts
      volumes:
      - name: templates
        configMap:
          name: breach-notification-template
      - name: scripts
        configMap:
          name: breach-scripts
      restartPolicy: Never

# Automated Compliance Training Tracking
apiVersion: apps/v1
kind: Deployment
metadata:
  name: compliance-training-tracker
spec:
  replicas: 1
  selector:
    matchLabels:
      app: training-tracker
  template:
    spec:
      containers:
      - name: tracker
        image: company/training-tracker:latest
        env:
        - name: TRAINING_REQUIREMENTS
          value: "GDPR_ANNUAL,BSI_QUARTERLY,SECURITY_MONTHLY"
        - name: NOTIFICATION_SLACK_WEBHOOK
          valueFrom:
            secretKeyRef:
              name: notification-config
              key: slack-webhook
        
        command:
        - /bin/bash
        - -c
        - |
          # Daily check für Training Compliance
          while true; do
            echo "Checking training compliance status..."
            
            # Check User Training Status
            python3 /scripts/check_training_status.py \
              --requirements $TRAINING_REQUIREMENTS \
              --notification-webhook $NOTIFICATION_SLACK_WEBHOOK
            
            # Generate Training Reports
            python3 /scripts/generate_training_report.py \
              --output /reports/training-status-$(date +%Y-%m-%d).json
            
            sleep 86400  # Daily check
          done