# Minimale Service Configuration
apiVersion: v1
kind: Pod
metadata:
  name: privacy-by-design-app
  labels:
    data-classification: personal
    retention-policy: '7-years'
spec:
  securityContext:
    runAsNonRoot: true
    runAsUser: 1000
    fsGroup: 2000
  containers:
    - name: app
      image: company/gdpr-app:latest
      env:
        - name: DATA_RETENTION_DAYS
          value: '2555' # 7 Jahre gesetzliche Aufbewahrung
        - name: PSEUDONYMIZATION_KEY
          valueFrom:
            secretKeyRef:
              name: crypto-keys
              key: pseudonymization
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
      resources:
        limits:
          memory: '512Mi'
          cpu: '500m'
      volumeMounts:
        - name: temp-data
          mountPath: /tmp
        - name: app-config
          mountPath: /app/config
          readOnly: true
  volumes:
    - name: temp-data
      emptyDir:
        sizeLimit: 1Gi
    - name: app-config
      configMap:
        name: gdpr-config

# Encryption at Rest - Storage Class
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: encrypted-personal-data
provisioner: kubernetes.io/azure-disk
parameters:
  encryption: 'true'
  storageaccounttype: Premium_LRS
  cachingmode: ReadOnly
reclaimPolicy: Delete
volumeBindingMode: WaitForFirstConsumer

---
# TLS-verschlüsselte Kommunikation
apiVersion: v1
kind: Service
metadata:
  name: gdpr-compliant-service
  annotations:
    service.beta.kubernetes.io/azure-load-balancer-internal: 'true'
spec:
  type: LoadBalancer
  ports:
    - port: 443
      targetPort: 8443
      protocol: TCP
      name: https
  selector:
    app: gdpr-app

---
# Certificate Management
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
  name: gdpr-app-tls
spec:
  secretName: gdpr-app-tls-secret
  issuer:
    name: letsencrypt-prod
    kind: ClusterIssuer
  commonName: gdpr-app.company.de
  dnsNames:
    - gdpr-app.company.de

# Audit Policy für personenbezogene Daten
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  # Protokolliere alle Zugriffe auf Secrets mit personenbezogenen Daten
  - level: RequestResponse
    resources:
      - group: ''
        resources: ['secrets']
    namespaces: ['production', 'staging']
    omitStages:
      - RequestReceived

  # Protokolliere ConfigMap-Änderungen (Datenschutz-Konfiguration)
  - level: RequestResponse
    resources:
      - group: ''
        resources: ['configmaps']
    verbs: ['create', 'update', 'patch', 'delete']
    namespaces: ['production']

  # Protokolliere alle Pod-Erstellungen mit Personal Data Label
  - level: Request
    resources:
      - group: ''
        resources: ['pods']
    verbs: ['create']
    namespaces: ['production']
    labelSelector: 'data-classification=personal'

# Automated Data Deletion CronJob
apiVersion: batch/v1
kind: CronJob
metadata:
  name: gdpr-data-deletion
spec:
  schedule: '0 2 * * *' # Täglich um 2:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: data-eraser
              image: company/gdpr-eraser:latest
              env:
                - name: DB_CONNECTION
                  valueFrom:
                    secretKeyRef:
                      name: database-credentials
                      key: connection-string
                - name: RETENTION_POLICIES
                  valueFrom:
                    configMapKeyRef:
                      name: gdpr-policies
                      key: retention-config
              command:
                - /bin/bash
                - -c
                - |
                  echo "Starting GDPR-compliant data deletion..."

                  # Lösche abgelaufene Benutzerdaten
                  python3 /app/scripts/delete_expired_data.py \
                    --policy-file /config/retention-policies.yaml \
                    --dry-run false \
                    --log-level INFO

                  # Audit Log erstellen
                  echo "Data deletion completed at $(date)" >> /logs/deletion-audit.log

              volumeMounts:
                - name: config-volume
                  mountPath: /config
                - name: log-volume
                  mountPath: /logs
          volumes:
            - name: config-volume
              configMap:
                name: gdpr-policies
            - name: log-volume
              persistentVolumeClaim:
                claimName: audit-logs-pvc
          restartPolicy: OnFailure

# BSI-konforme Netzwerksegmentierung
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: bsi-compliant-segmentation
  namespace: production
spec:
  podSelector: {}
  policyTypes:
    - Ingress
    - Egress

  # Default Deny All
  ingress: []
  egress: []

---
# Explizite Erlaubnis für notwendige Kommunikation
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: frontend-to-backend-allowed
  namespace: production
spec:
  podSelector:
    matchLabels:
      tier: backend
  policyTypes:
    - Ingress
  ingress:
    - from:
        - podSelector:
            matchLabels:
              tier: frontend
      ports:
        - protocol: TCP
          port: 8080
        - protocol: TCP
          port: 8443

---
# Internet-Zugang nur für spezifische Services
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: internet-access-restricted
  namespace: production
spec:
  podSelector:
    matchLabels:
      internet-access: 'required'
  policyTypes:
    - Egress
  egress:
    - to: []
      ports:
        - protocol: TCP
          port: 443
        - protocol: TCP
          port: 80
    - to:
        - namespaceSelector:
            matchLabels:
              name: kube-system

# Vulnerability Scanning Pipeline
apiVersion: batch/v1
kind: CronJob
metadata:
  name: bsi-vulnerability-scan
spec:
  schedule: '0 1 * * *' # Tägliche Überprüfung
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: trivy-scanner
              image: aquasec/trivy:latest
              command:
                - /bin/sh
                - -c
                - |
                  echo "BSI IT-Grundschutz Vulnerability Scan gestartet..."

                  # Scanne alle Container Images im Cluster
                  kubectl get pods --all-namespaces -o jsonpath='{.items[*].spec.containers[*].image}' | \
                  tr ' ' '\n' | sort -u | while read image; do
                    echo "Scanning $image..."
                    trivy image --severity HIGH,CRITICAL --exit-code 1 --format json $image > /reports/$(echo $image | tr '/' '_' | tr ':' '_').json
                  done

                  # BSI-konformer Report erstellen
                  python3 /scripts/generate_bsi_report.py /reports/ > /reports/bsi-compliance-report.html

              volumeMounts:
                - name: reports
                  mountPath: /reports
                - name: scripts
                  mountPath: /scripts
          volumes:
            - name: reports
              persistentVolumeClaim:
                claimName: vulnerability-reports
            - name: scripts
              configMap:
                name: bsi-scripts
          restartPolicy: OnFailure

# BSI-konforme Pod Security Standards
apiVersion: v1
kind: Pod
metadata:
  name: bsi-compliant-pod
  labels:
    security-level: 'restricted'
spec:
  securityContext:
    # Erhöhte Sicherheitsanforderungen
    runAsNonRoot: true
    runAsUser: 1000
    runAsGroup: 3000
    fsGroup: 2000
    seccompProfile:
      type: RuntimeDefault
    sysctls:
      - name: net.core.somaxconn
        value: '1024'

  containers:
    - name: secure-app
      image: company/bsi-app:latest
      securityContext:
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
          add:
            - NET_BIND_SERVICE # Nur notwendige Capabilities
        runAsNonRoot: true
        runAsUser: 1000

      # Resource Limits nach BSI-Empfehlungen
      resources:
        requests:
          memory: '256Mi'
          cpu: '250m'
          ephemeral-storage: '1Gi'
        limits:
          memory: '512Mi'
          cpu: '500m'
          ephemeral-storage: '2Gi'

      # Minimale Umgebungsvariablen
      env:
        - name: APP_ENV
          value: 'production'
        - name: LOG_LEVEL
          value: 'INFO'

      # Sichere Volume-Mounts
      volumeMounts:
        - name: tmp
          mountPath: /tmp
        - name: app-data
          mountPath: /app/data
          readOnly: true

      # Health Checks
      livenessProbe:
        httpGet:
          path: /health
          port: 8080
        initialDelaySeconds: 30
        periodSeconds: 10

      readinessProbe:
        httpGet:
          path: /ready
          port: 8080
        initialDelaySeconds: 5
        periodSeconds: 5

  volumes:
    - name: tmp
      emptyDir:
        sizeLimit: 100Mi
    - name: app-data
      configMap:
        name: app-config
        defaultMode: 0440

# Financial Services Compliant Configuration
apiVersion: v1
kind: Namespace
metadata:
  name: banking-production
  labels:
    compliance: 'bait-marisk'
    data-classification: 'financial'
    environment: 'production'
  annotations:
    bafin.de/audit-frequency: 'quarterly'
    bafin.de/data-retention: '10-years'

---
# High-Availability für kritische Banking Services
apiVersion: apps/v1
kind: Deployment
metadata:
  name: banking-core-system
  namespace: banking-production
spec:
  replicas: 5 # Mindestens 3 für HA
  strategy:
    type: RollingUpdate
    rollingUpdate:
      maxUnavailable: 1
      maxSurge: 2
  selector:
    matchLabels:
      app: banking-core
  template:
    spec:
      affinity:
        # Anti-Affinity für Ausfallsicherheit
        podAntiAffinity:
          requiredDuringSchedulingIgnoredDuringExecution:
            - labelSelector:
                matchExpressions:
                  - key: app
                    operator: In
                    values:
                      - banking-core
              topologyKey: kubernetes.io/hostname

      containers:
        - name: banking-app
          image: bank/core-system:v2.1-bait-compliant
          env:
            - name: COMPLIANCE_MODE
              value: 'BAIT_MARISK'
            - name: AUDIT_LEVEL
              value: 'FULL'
            - name: ENCRYPTION_STANDARD
              value: 'AES-256-GCM'

          # Erweiterte Ressourcen für kritische Workloads
          resources:
            requests:
              memory: '2Gi'
              cpu: '1000m'
            limits:
              memory: '4Gi'
              cpu: '2000m'

          # Umfassende Health Checks
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 60
            periodSeconds: 30
            timeoutSeconds: 10
            failureThreshold: 3

          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
            timeoutSeconds: 5
            failureThreshold: 3

# Healthcare Data Protection Setup
apiVersion: v1
kind: Secret
metadata:
  name: patient-data-encryption
  namespace: healthcare
  labels:
    data-type: 'patient-data'
    compliance: 'sgb-v'
type: Opaque
data:
  encryption-key: <base64-encoded-key>
  signing-key: <base64-encoded-key>

---
apiVersion: apps/v1
kind: Deployment
metadata:
  name: patient-management-system
  namespace: healthcare
spec:
  replicas: 3
  selector:
    matchLabels:
      app: patient-system
  template:
    spec:
      containers:
        - name: patient-app
          image: clinic/patient-system:latest
          env:
            - name: PATIENT_DATA_ENCRYPTION
              value: 'AES-256'
            - name: SCHWEIGEPFLICHT_MODE
              value: 'ENABLED'
            - name: AUDIT_PATIENT_ACCESS
              value: 'TRUE'

          # Spezielle Security Context für Patientendaten
          securityContext:
            allowPrivilegeEscalation: false
            readOnlyRootFilesystem: true
            capabilities:
              drop:
                - ALL

          volumeMounts:
            - name: patient-data
              mountPath: /app/data
            - name: encryption-keys
              mountPath: /app/keys
              readOnly: true

      volumes:
        - name: patient-data
          persistentVolumeClaim:
            claimName: encrypted-patient-storage
        - name: encryption-keys
          secret:
            secretName: patient-data-encryption
            defaultMode: 0400

---
# Spezielle StorageClass für Patientendaten
apiVersion: storage.k8s.io/v1
kind: StorageClass
metadata:
  name: patient-data-encrypted
provisioner: kubernetes.io/azure-disk
parameters:
  encryption: 'true'
  storageaccounttype: Premium_LRS
  cachingmode: None # Keine Caching für sensitive Daten
reclaimPolicy: Retain # Niemals automatisch löschen
volumeBindingMode: WaitForFirstConsumer

# Open Policy Agent für Policy Enforcement
apiVersion: apps/v1
kind: Deployment
metadata:
  name: opa-gatekeeper
  namespace: gatekeeper-system
spec:
  replicas: 3
  selector:
    matchLabels:
      app: gatekeeper
  template:
    spec:
      containers:
        - name: opa
          image: openpolicyagent/opa:latest-envoy
          args:
            - 'run'
            - '--server'
            - '--config-file=/config/config.yaml'
            - '/policies'
          volumeMounts:
            - name: opa-policies
              mountPath: /policies
            - name: opa-config
              mountPath: /config
      volumes:
        - name: opa-policies
          configMap:
            name: compliance-policies
        - name: opa-config
          configMap:
            name: opa-config

---
# Compliance Policy Beispiel
apiVersion: v1
kind: ConfigMap
metadata:
  name: compliance-policies
data:
  gdpr.rego: |
    package kubernetes.gdpr

    # DSGVO: Alle Pods mit personenbezogenen Daten müssen verschlüsselt sein
    deny[msg] {
      input.request.kind.kind == "Pod"
      input.request.object.metadata.labels["data-classification"] == "personal"
      not has_encryption_annotation
      msg := "DSGVO Violation: Personal data pods must have encryption annotation"
    }

    has_encryption_annotation {
      input.request.object.metadata.annotations["encryption.company.de/enabled"] == "true"
    }

  bsi.rego: |
    package kubernetes.bsi

    # BSI: Alle Production Pods müssen Security Context haben
    deny[msg] {
      input.request.kind.kind == "Pod"
      input.request.object.metadata.namespace == "production"
      not has_security_context
      msg := "BSI Violation: Production pods must have security context"
    }

    has_security_context {
      input.request.object.spec.securityContext.runAsNonRoot == true
    }

# Compliance Report Generator
apiVersion: batch/v1
kind: CronJob
metadata:
  name: compliance-report-generator
spec:
  schedule: '0 6 * * 1' # Jeden Montag um 6:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: report-generator
              image: company/compliance-reporter:latest
              command:
                - /bin/bash
                - -c
                - |
                  echo "Generating weekly compliance report..."

                  # DSGVO Compliance Check
                  echo "=== DSGVO Compliance Report ===" > /reports/weekly-compliance.txt
                  kubectl get pods --all-namespaces -l data-classification=personal \
                    -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}: {.metadata.annotations.encryption\.company\.de/enabled}{"\n"}{end}' \
                    >> /reports/weekly-compliance.txt

                  # BSI Grundschutz Check
                  echo "=== BSI IT-Grundschutz Report ===" >> /reports/weekly-compliance.txt
                  kubectl get networkpolicies --all-namespaces \
                    -o jsonpath='{range .items[*]}{.metadata.namespace}/{.metadata.name}{"\n"}{end}' \
                    >> /reports/weekly-compliance.txt

                  # Vulnerability Report
                  echo "=== Vulnerability Summary ===" >> /reports/weekly-compliance.txt
                  cat /vulnerability-reports/latest-scan.json | jq '.vulnerabilities | length' \
                    >> /reports/weekly-compliance.txt

                  # Send Report (via email, Slack, etc.)
                  python3 /scripts/send_compliance_report.py /reports/weekly-compliance.txt

              volumeMounts:
                - name: reports
                  mountPath: /reports
                - name: vulnerability-reports
                  mountPath: /vulnerability-reports
                - name: scripts
                  mountPath: /scripts
          volumes:
            - name: reports
              persistentVolumeClaim:
                claimName: compliance-reports
            - name: vulnerability-reports
              persistentVolumeClaim:
                claimName: vulnerability-reports
            - name: scripts
              configMap:
                name: reporting-scripts
          restartPolicy: OnFailure

# Velero Backup mit Verschlüsselung
apiVersion: velero.io/v1
kind: Schedule
metadata:
  name: gdpr-compliant-backup
spec:
  schedule: '0 3 * * *' # Täglich um 3:00 Uhr
  template:
    metadata:
      labels:
        compliance: gdpr
        retention: '7-years'
    spec:
      # Backup nur spezifischer Namespaces
      includedNamespaces:
        - production
        - staging

      # Excludiere Secrets mit temporären Daten
      excludedResources:
        - secrets.v1
        - events.v1

      # Verschlüsselung aktivieren
      storageLocation: primary-encrypted

      # Retention gemäß DSGVO
      ttl: 61320h # 7 Jahre

      # Zusätzliche Labels für Audit
      labelSelector:
        matchLabels:
          data-classification: personal

---
# Backup Storage Location mit Verschlüsselung
apiVersion: velero.io/v1
kind: BackupStorageLocation
metadata:
  name: primary-encrypted
spec:
  provider: azure
  objectStorage:
    bucket: gdpr-backups-encrypted
    prefix: kubernetes-backups
  config:
    resourceGroup: backup-rg
    storageAccount: gdprbackupstorage
    subscriptionId: <subscription-id>
    # Server-side Verschlüsselung
    encryptionScope: gdpr-encryption-scope

# Multi-Region Setup für kritische Services
apiVersion: apps/v1
kind: Deployment
metadata:
  name: critical-service-dr
  namespace: production
spec:
  replicas: 6
  selector:
    matchLabels:
      app: critical-service
  template:
    spec:
      affinity:
        # Verteilung auf verschiedene Availability Zones
        podAntiAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
            - weight: 100
              podAffinityTerm:
                labelSelector:
                  matchExpressions:
                    - key: app
                      operator: In
                      values:
                        - critical-service
                topologyKey: topology.kubernetes.io/zone

      containers:
        - name: app
          image: company/critical-service:latest
          env:
            - name: REGION
              valueFrom:
                fieldRef:
                  fieldPath: metadata.annotations['topology.kubernetes.io/region']
            - name: ZONE
              valueFrom:
                fieldRef:
                  fieldPath: metadata.annotations['topology.kubernetes.io/zone']

          # Readiness Gate für Cross-Region Health Check
          readinessGates:
            - conditionType: 'company.de/cross-region-ready'

# GitLab CI/CD Pipeline mit Compliance Checks
apiVersion: v1
kind: ConfigMap
metadata:
  name: compliance-pipeline
data:
  .gitlab-ci.yml: |
    stages:
      - security-scan
      - compliance-check
      - deploy

    variables:
      DOCKER_TLS_CERTDIR: "/certs"

    security-scan:
      stage: security-scan
      image: aquasec/trivy:latest
      script:
        - trivy image --exit-code 1 --severity HIGH,CRITICAL $CI_REGISTRY_IMAGE:$CI_COMMIT_SHA
        - trivy fs --exit-code 1 --severity HIGH,CRITICAL .
      
    gdpr-compliance-check:
      stage: compliance-check
      image: openpolicyagent/opa:latest
      script:
        - opa test policies/
        - opa fmt --diff policies/
        - |
          for file in k8s-manifests/*.yaml; do
            opa eval -d policies/ -i $file "data.kubernetes.gdpr.deny[x]"
          done
      
    bsi-compliance-check:
      stage: compliance-check
      image: company/bsi-checker:latest
      script:
        - bsi-check --manifests k8s-manifests/ --report compliance-report.json
        - cat compliance-report.json
      artifacts:
        reports:
          junit: compliance-report.json

    deploy:
      stage: deploy
      image: bitnami/kubectl:latest
      script:
        - kubectl apply -f k8s-manifests/
      only:
        - main
      when: manual

# Policy Update Automation
apiVersion: batch/v1
kind: CronJob
metadata:
  name: policy-update-automation
spec:
  schedule: '0 4 * * 1' # Jeden Montag um 4:00 Uhr
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: policy-updater
              image: company/policy-updater:latest
              command:
                - /bin/bash
                - -c
                - |
                  echo "Checking for policy updates..."

                  # BSI IT-Grundschutz Updates
                  curl -s https://www.bsi.bund.de/api/grundschutz/updates | \
                    jq '.containers' > /tmp/bsi-updates.json

                  # DSGVO Guidance Updates
                  curl -s https://edpb.europa.eu/api/guidelines | \
                    jq '.technical' > /tmp/gdpr-updates.json

                  # Policy Updates anwenden
                  python3 /scripts/update_policies.py \
                    --bsi-updates /tmp/bsi-updates.json \
                    --gdpr-updates /tmp/gdpr-updates.json \
                    --policy-dir /policies

                  # Neue Policies in Cluster anwenden
                  kubectl apply -f /policies/updated/

              volumeMounts:
                - name: policies
                  mountPath: /policies
                - name: scripts
                  mountPath: /scripts
          volumes:
            - name: policies
              configMap:
                name: compliance-policies
            - name: scripts
              configMap:
                name: policy-scripts
          restartPolicy: OnFailure

# SIEM Integration für Compliance Violations
apiVersion: apps/v1
kind: Deployment
metadata:
  name: compliance-monitor
spec:
  replicas: 2
  selector:
    matchLabels:
      app: compliance-monitor
  template:
    spec:
      containers:
        - name: monitor
          image: company/compliance-monitor:latest
          env:
            - name: ALERT_WEBHOOK
              valueFrom:
                secretKeyRef:
                  name: alert-config
                  key: webhook-url
            - name: GDPR_BREACH_THRESHOLD
              value: '72h' # 72 Stunden Meldepflicht

          command:
            - /bin/bash
            - -c
            - |
              # Kontinuierliches Monitoring
              while true; do
                # Check für DSGVO Violations
                gdpr_violations=$(kubectl logs --selector=compliance=gdpr --since=1h | grep "VIOLATION" | wc -l)
                
                if [ $gdpr_violations -gt 0 ]; then
                  echo "GDPR violation detected: $gdpr_violations incidents"
                  
                  # Sofortige Benachrichtigung
                  curl -X POST $ALERT_WEBHOOK \
                    -H "Content-Type: application/json" \
                    -d "{\"text\":\"🚨 GDPR Compliance Violation detected: $gdpr_violations incidents\", \"severity\":\"critical\"}"
                  
                  # Incident Report generieren
                  python3 /scripts/generate_incident_report.py --violations $gdpr_violations
                fi
                
                # Check für BSI Grundschutz Abweichungen
                bsi_violations=$(kubectl get events --field-selector reason=FailedMount | grep -c "security")
                
                if [ $bsi_violations -gt 0 ]; then
                  echo "BSI IT-Grundschutz violation detected"
                  python3 /scripts/bsi_incident_handler.py --violations $bsi_violations
                fi
                
                sleep 300  # Check alle 5 Minuten
              done

# DSGVO-konforme Breach Notification
apiVersion: v1
kind: ConfigMap
metadata:
  name: breach-notification-template
data:
  notification-template.json: |
    {
      "incident_id": "{{.IncidentID}}",
      "timestamp": "{{.Timestamp}}",
      "severity": "{{.Severity}}",
      "affected_data_subjects": {{.AffectedCount}},
      "data_categories": {{.DataCategories}},
      "breach_description": "{{.Description}}",
      "containment_measures": "{{.ContainmentMeasures}}",
      "notification_deadline": "{{.NotificationDeadline}}",
      "dpo_contact": "dpo@company.de",
      "authority_contact": "poststelle@bfdi.bund.de"
    }

---
apiVersion: batch/v1
kind: Job
metadata:
  name: breach-notification-handler
spec:
  template:
    spec:
      containers:
        - name: notification-handler
          image: company/breach-handler:latest
          env:
            - name: INCIDENT_ID
              value: '{{INCIDENT_ID}}'
            - name: BREACH_SEVERITY
              value: '{{SEVERITY}}'
          command:
            - /bin/bash
            - -c
            - |
              echo "Processing GDPR breach notification..."

              # Datensammlung für Meldung
              affected_pods=$(kubectl get pods -l data-classification=personal --no-headers | wc -l)
              incident_time=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
              notification_deadline=$(date -u -d "+72 hours" +"%Y-%m-%dT%H:%M:%SZ")

              # Incident Report erstellen
              python3 /scripts/create_breach_report.py \
                --incident-id $INCIDENT_ID \
                --affected-pods $affected_pods \
                --incident-time $incident_time \
                --deadline $notification_deadline

              # Automatische Benachrichtigung an Aufsichtsbehörde (wenn konfiguriert)
              if [ "$AUTO_NOTIFY" = "true" ]; then
                python3 /scripts/notify_authority.py --report /tmp/breach-report.json
              fi

          volumeMounts:
            - name: templates
              mountPath: /templates
            - name: scripts
              mountPath: /scripts
      volumes:
        - name: templates
          configMap:
            name: breach-notification-template
        - name: scripts
          configMap:
            name: breach-scripts
      restartPolicy: Never

# Automated Compliance Training Tracking
apiVersion: apps/v1
kind: Deployment
metadata:
  name: compliance-training-tracker
spec:
  replicas: 1
  selector:
    matchLabels:
      app: training-tracker
  template:
    spec:
      containers:
        - name: tracker
          image: company/training-tracker:latest
          env:
            - name: TRAINING_REQUIREMENTS
              value: 'GDPR_ANNUAL,BSI_QUARTERLY,SECURITY_MONTHLY'
            - name: NOTIFICATION_SLACK_WEBHOOK
              valueFrom:
                secretKeyRef:
                  name: notification-config
                  key: slack-webhook

          command:
            - /bin/bash
            - -c
            - |
              # Daily check für Training Compliance
              while true; do
                echo "Checking training compliance status..."
                
                # Check User Training Status
                python3 /scripts/check_training_status.py \
                  --requirements $TRAINING_REQUIREMENTS \
                  --notification-webhook $NOTIFICATION_SLACK_WEBHOOK
                
                # Generate Training Reports
                python3 /scripts/generate_training_report.py \
                  --output /reports/training-status-$(date +%Y-%m-%d).json
                
                sleep 86400  # Daily check
              done