# Beispiel: Hybrid-Deployment während Migration
apiVersion: apps/v1
kind: Deployment
metadata:
  name: legacy-app-bridge
  namespace: migration
spec:
  replicas: 2
  selector:
    matchLabels:
      app: legacy-bridge
  template:
    metadata:
      labels:
        app: legacy-bridge
    spec:
      containers:
        - name: app-proxy
          image: nginx:1.21
          ports:
            - containerPort: 80
          volumeMounts:
            - name: config
              mountPath: /etc/nginx/conf.d
        - name: legacy-connector
          image: legacy-app:v1.0
          env:
            - name: DATABASE_URL
              valueFrom:
                secretKeyRef:
                  name: legacy-db-credentials
                  key: connection-string
            - name: MIGRATION_MODE
              value: 'hybrid'
      volumes:
        - name: config
          configMap:
            name: nginx-migration-config

graph TB
    subgraph "Migration Approaches"
        A[Lift & Shift]
        B[Re-Platform]
        C[Re-Factor]
        D[Re-Architect]
    end

    subgraph "Kubernetes Patterns"
        E[Strangler Fig]
        F[Ambassador]
        G[Sidecar]
        H[Blue-Green]
    end

    subgraph "Target Architecture"
        I[Multi-Cloud K8s]
        J[Hybrid Cloud]
        K[Edge Computing]
        L[Microservices]
    end

    A --> E
    B --> F
    C --> G
    D --> H
    E --> I
    F --> J
    G --> K
    H --> L

# Schrittweise Migration mit Istio Service Mesh
apiVersion: networking.istio.io/v1beta1
kind: VirtualService
metadata:
  name: legacy-migration-routing
  namespace: production
spec:
  http:
    - match:
        - uri:
            prefix: '/api/v2/'
      route:
        - destination:
            host: new-microservice
            port:
              number: 8080
          weight: 100
    - match:
        - uri:
            prefix: '/api/v1/'
      route:
        - destination:
            host: legacy-service
            port:
              number: 8080
          weight: 80
        - destination:
            host: new-microservice
            port:
              number: 8080
          weight: 20
    - route:
        - destination:
            host: legacy-service
            port:
              number: 8080

# Multi-Stage Database Migration
apiVersion: batch/v1
kind: Job
metadata:
  name: database-migration-stage1
  namespace: migration
spec:
  template:
    spec:
      containers:
        - name: db-migrator
          image: migrate/migrate:v4.15.2
          command:
            - migrate
            - -path
            - /migrations
            - -database
            - postgres://user:pass@legacy-db:5432/app?sslmode=disable
            - up
          volumeMounts:
            - name: migration-scripts
              mountPath: /migrations
      volumes:
        - name: migration-scripts
          configMap:
            name: db-migration-scripts
      restartPolicy: Never
  backoffLimit: 3
---
# Parallel Read/Write Setup für Zero-Downtime
apiVersion: apps/v1
kind: Deployment
metadata:
  name: dual-write-service
spec:
  replicas: 3
  template:
    spec:
      containers:
        - name: app
          image: dual-write-app:v1.0
          env:
            - name: PRIMARY_DB
              value: 'legacy-postgres'
            - name: SECONDARY_DB
              value: 'cloud-postgres'
            - name: WRITE_MODE
              value: 'dual'
            - name: READ_PREFERENCE
              value: 'primary'

# Feature-Flag-basierte Migration
apiVersion: v1
kind: ConfigMap
metadata:
  name: migration-feature-flags
data:
  features.yaml: |
    migration:
      user_service:
        enabled: true
        percentage: 25
        regions: ["eu-central-1"]
      payment_service:
        enabled: false
        percentage: 0
        regions: []
      notification_service:
        enabled: true
        percentage: 100
        regions: ["eu-central-1", "eu-west-1"]

# Automatisierte Dependency-Analyse
kubectl create job app-discovery --image=application-mapper:v1.0 -- \
  --scan-network 10.0.0.0/16 \
  --output-format json \
  --include-databases \
  --trace-connections

# Resultate analysieren
kubectl logs job/app-discovery | jq '.dependencies[] | select(.criticality == "high")'

# Assessment Job für Kubernetes-Readiness
apiVersion: batch/v1
kind: Job
metadata:
  name: migration-assessment
spec:
  template:
    spec:
      containers:
        - name: assessor
          image: migration-tools:latest
          command:
            - python
            - -c
            - |
              import json
              import subprocess

              # Container-Readiness Score
              def assess_containerization(app_path):
                  score = 0
                  if os.path.exists(f"{app_path}/Dockerfile"):
                      score += 30
                  if os.path.exists(f"{app_path}/docker-compose.yml"):
                      score += 20
                  if "stateless" in check_app_architecture(app_path):
                      score += 30
                  if check_external_dependencies(app_path) < 5:
                      score += 20
                  return score

              # Cloud-Readiness Score
              def assess_cloud_readiness(app_config):
                  score = 0
                  if app_config.get("12factor_compliance", 0) > 8:
                      score += 40
                  if app_config.get("horizontal_scalable", False):
                      score += 30
                  if app_config.get("config_externalized", False):
                      score += 30
                  return score

              # Migration Complexity Score
              apps = scan_applications()
              for app in apps:
                  container_score = assess_containerization(app['path'])
                  cloud_score = assess_cloud_readiness(app['config'])
                  
                  if container_score > 70 and cloud_score > 70:
                      migration_strategy = "lift-and-shift"
                      complexity = "low"
                  elif container_score > 40:
                      migration_strategy = "re-platform"
                      complexity = "medium"
                  else:
                      migration_strategy = "re-architect"
                      complexity = "high"
                  
                  print(json.dumps({
                      "app": app['name'],
                      "container_readiness": container_score,
                      "cloud_readiness": cloud_score,
                      "migration_strategy": migration_strategy,
                      "complexity": complexity,
                      "estimated_effort_weeks": calculate_effort(complexity)
                  }))
          volumeMounts:
            - name: app-source
              mountPath: /source
      volumes:
        - name: app-source
          hostPath:
            path: /opt/applications
      restartPolicy: Never

# Pilot Migration mit Blue-Green Deployment
apiVersion: argoproj.io/v1alpha1
kind: Rollout
metadata:
  name: pilot-app-migration
  namespace: pilot
spec:
  replicas: 3
  strategy:
    blueGreen:
      activeService: pilot-app-active
      previewService: pilot-app-preview
      autoPromotionEnabled: false
      scaleDownDelaySeconds: 30
      prePromotionAnalysis:
        templates:
          - templateName: success-rate
        args:
          - name: service-name
            value: pilot-app-preview
      postPromotionAnalysis:
        templates:
          - templateName: success-rate
        args:
          - name: service-name
            value: pilot-app-active
  selector:
    matchLabels:
      app: pilot-app
  template:
    metadata:
      labels:
        app: pilot-app
    spec:
      containers:
        - name: app
          image: pilot-app:cloud-v1.0
          ports:
            - containerPort: 8080
          env:
            - name: MIGRATION_PHASE
              value: 'pilot'
            - name: FEATURE_FLAGS_URL
              value: 'http://feature-flags:8080'
          livenessProbe:
            httpGet:
              path: /health
              port: 8080
            initialDelaySeconds: 30
          readinessProbe:
            httpGet:
              path: /ready
              port: 8080
            initialDelaySeconds: 5

# Custom Metrics für Migration-Tracking
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: migration-metrics
spec:
  groups:
    - name: migration.performance
      rules:
        - alert: MigrationPerformanceDegradation
          expr: |
            (
              avg_over_time(http_request_duration_seconds{service="legacy"}[5m]) /
              avg_over_time(http_request_duration_seconds{service="migrated"}[5m])
            ) > 1.5
          for: 10m
          labels:
            severity: warning
          annotations:
            summary: 'Migration showing performance degradation'
            description: 'Migrated service is {{ $value }}x slower than legacy'

        - alert: MigrationErrorRateHigh
          expr: |
            rate(http_requests_total{service="migrated",status=~"5.."}[5m]) /
            rate(http_requests_total{service="migrated"}[5m]) > 0.05
          for: 5m
          labels:
            severity: critical
          annotations:
            summary: 'High error rate in migrated service'
            description: 'Error rate is {{ $value | humanizePercentage }}'

# GitOps-based Migration Pipeline
apiVersion: argoproj.io/v1alpha1
kind: Workflow
metadata:
  name: production-migration-pipeline
spec:
  entrypoint: migrate-production
  templates:
    - name: migrate-production
      dag:
        tasks:
          - name: pre-migration-backup
            template: backup-databases
          - name: deploy-bridge-services
            template: deploy-bridges
            dependencies: [pre-migration-backup]
          - name: start-dual-write
            template: enable-dual-write
            dependencies: [deploy-bridge-services]
          - name: migrate-traffic-5percent
            template: traffic-shift
            arguments:
              parameters:
                - name: percentage
                  value: '5'
            dependencies: [start-dual-write]
          - name: validate-migration-5percent
            template: validate-migration
            dependencies: [migrate-traffic-5percent]
          - name: migrate-traffic-25percent
            template: traffic-shift
            arguments:
              parameters:
                - name: percentage
                  value: '25'
            dependencies: [validate-migration-5percent]
          - name: validate-migration-25percent
            template: validate-migration
            dependencies: [migrate-traffic-25percent]
          - name: migrate-traffic-100percent
            template: traffic-shift
            arguments:
              parameters:
                - name: percentage
                  value: '100'
            dependencies: [validate-migration-25percent]
          - name: cleanup-legacy
            template: cleanup-legacy-systems
            dependencies: [migrate-traffic-100percent]

    - name: traffic-shift
      inputs:
        parameters:
          - name: percentage
      script:
        image: istioctl:1.19
        command: [bash]
        source: |
          istioctl proxy-config cluster $(kubectl get pod -l app=istio-proxy -o jsonpath='{.items[0].metadata.name}') --fqdn production-service.default.svc.cluster.local

          kubectl patch virtualservice production-service --type='merge' -p='
          {
            "spec": {
              "http": [{
                "route": [{
                  "destination": {
                    "host": "legacy-service"
                  },
                  "weight": '$(( 100 - {{inputs.parameters.percentage}} ))'
                }, {
                  "destination": {
                    "host": "migrated-service"
                  },
                  "weight": {{inputs.parameters.percentage}}
                }]
              }]
            }
          }'

# Resilience für Migration mit Circuit Breaker
apiVersion: networking.istio.io/v1beta1
kind: DestinationRule
metadata:
  name: migration-circuit-breaker
spec:
  host: migrated-service
  trafficPolicy:
    outlierDetection:
      consecutiveErrors: 3
      interval: 30s
      baseEjectionTime: 30s
      maxEjectionPercent: 50
    circuitBreaker:
      connectionPool:
        tcp:
          maxConnections: 100
        http:
          http1MaxPendingRequests: 10
          maxRequestsPerConnection: 2
      interval: 5s
      baseEjectionTime: 30s
      maxEjectionPercent: 50

# Automated Rollback bei kritischen Fehlern
apiVersion: argoproj.io/v1alpha1
kind: AnalysisTemplate
metadata:
  name: migration-success-analysis
spec:
  metrics:
    - name: error-rate
      interval: 1m
      successCondition: result[0] < 0.02
      failureLimit: 3
      provider:
        prometheus:
          address: http://prometheus:9090
          query: |
            rate(http_requests_total{service="migrated-service",status=~"5.."}[2m]) /
            rate(http_requests_total{service="migrated-service"}[2m])
    - name: response-time
      interval: 1m
      successCondition: result[0] < 500
      failureLimit: 3
      provider:
        prometheus:
          address: http://prometheus:9090
          query: |
            histogram_quantile(0.95, 
              rate(http_request_duration_seconds_bucket{service="migrated-service"}[2m])
            ) * 1000

# Multi-Cloud Istio Setup
apiVersion: networking.istio.io/v1beta1
kind: Gateway
metadata:
  name: cross-cloud-gateway
spec:
  selector:
    istio: eastwestgateway
  servers:
    - port:
        number: 15443
        name: tls
        protocol: TLS
      tls:
        mode: ISTIO_MUTUAL
      hosts:
        - '*.local'
        - 'aws-cluster.mesh'
        - 'azure-cluster.mesh'
---
apiVersion: networking.istio.io/v1beta1
kind: ServiceEntry
metadata:
  name: aws-services
spec:
  hosts:
    - aws-service.production.svc.cluster.local
  location: MESH_EXTERNAL
  ports:
    - number: 443
      name: https
      protocol: HTTPS
  resolution: DNS
  addresses:
    - 192.168.1.100
  endpoints:
    - address: aws-cluster-endpoint.amazonaws.com
      ports:
        https: 443

# Migration Dashboard Metriken
apiVersion: v1
kind: ConfigMap
metadata:
  name: migration-dashboard
data:
  queries.yaml: |
    # Application Performance
    migration_response_time_improvement:
      query: |
        (
          avg_over_time(http_request_duration_seconds{service="legacy"}[24h]) -
          avg_over_time(http_request_duration_seconds{service="migrated"}[24h])
        ) / avg_over_time(http_request_duration_seconds{service="legacy"}[24h]) * 100
      
    # Resource Utilization
    migration_resource_efficiency:
      query: |
        (
          avg_over_time(container_memory_usage_bytes{pod=~"legacy-.*"}[24h]) -
          avg_over_time(container_memory_usage_bytes{pod=~"migrated-.*"}[24h])
        ) / avg_over_time(container_memory_usage_bytes{pod=~"legacy-.*"}[24h]) * 100

    # Availability Improvement
    migration_uptime_improvement:
      query: |
        (
          avg_over_time(up{service="migrated"}[30d]) -
          avg_over_time(up{service="legacy"}[30d])
        ) * 100

    # Cost Optimization
    migration_cost_reduction:
      query: |
        (
          sum(rate(container_cpu_usage_seconds_total{pod=~"legacy-.*"}[24h])) * 0.05 +
          sum(avg_over_time(container_memory_usage_bytes{pod=~"legacy-.*"}[24h])) / 1024/1024/1024 * 0.01 -
          sum(rate(container_cpu_usage_seconds_total{pod=~"migrated-.*"}[24h])) * 0.05 -
          sum(avg_over_time(container_memory_usage_bytes{pod=~"migrated-.*"}[24h])) / 1024/1024/1024 * 0.01
        ) * 24 * 30

# Migration Assessment Report
kubectl get configmap migration-assessment -o jsonpath='{.data.report\.json}' | jq '
{
  "total_applications": (.applications | length),
  "migration_strategies": (.applications | group_by(.strategy) | map({strategy: .[0].strategy, count: length})),
  "complexity_distribution": (.applications | group_by(.complexity) | map({complexity: .[0].complexity, count: length})),
  "estimated_effort_weeks": (.applications | map(.effort_weeks) | add),
  "high_risk_applications": (.applications | map(select(.risk == "high")) | length)
}'

#!/bin/bash
# Pre-Migration Checklist
echo "=== Pre-Migration Checklist ==="
kubectl get pods -l app=$APP_NAME -o wide
kubectl get pvc -l app=$APP_NAME
kubectl get secrets -l app=$APP_NAME
kubectl get configmaps -l app=$APP_NAME

# Database Backup
kubectl exec deployment/$APP_NAME -- pg_dump -U user database > backup-$(date +%Y%m%d).sql

# Performance Baseline
kubectl top pods -l app=$APP_NAME
curl -s http://$APP_NAME/metrics | grep -E "(request_duration|error_rate)"

# Migration Execution
kubectl apply -f migration-manifests/$APP_NAME/
kubectl rollout status deployment/$APP_NAME-migrated

# Post-Migration Validation
kubectl get pods -l app=$APP_NAME-migrated -o wide
curl -s http://$APP_NAME-migrated/health
kubectl logs deployment/$APP_NAME-migrated --tail=100

echo "✅ Migration completed for $APP_NAME"

# Stateful Application Migration mit Volume-Cloning
apiVersion: apps/v1
kind: StatefulSet
metadata:
  name: database-migration
spec:
  serviceName: database
  replicas: 1
  template:
    spec:
      containers:
        - name: postgres
          image: postgres:14
          env:
            - name: PGDATA
              value: /var/lib/postgresql/data/pgdata
          volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql/data
      initContainers:
        - name: data-migrator
          image: postgres:14
          command:
            - /bin/bash
            - -c
            - |
              # Clone von Legacy-Volume
              pg_basebackup -h legacy-db -U postgres -D /var/lib/postgresql/data/pgdata -W
              # Konfiguration anpassen
              echo "wal_level = replica" >> /var/lib/postgresql/data/pgdata/postgresql.conf
          volumeMounts:
            - name: postgres-storage
              mountPath: /var/lib/postgresql/data
  volumeClaimTemplates:
    - metadata:
        name: postgres-storage
      spec:
        accessModes: ['ReadWriteOnce']
        storageClassName: fast-ssd
        resources:
          requests:
            storage: 100Gi

# Legacy Service Integration über Ambassador
apiVersion: apps/v1
kind: Deployment
metadata:
  name: legacy-ambassador
spec:
  replicas: 2
  template:
    spec:
      containers:
        - name: ambassador
          image: envoyproxy/envoy:v1.27.0
          ports:
            - containerPort: 8080
          volumeMounts:
            - name: envoy-config
              mountPath: /etc/envoy
      volumes:
        - name: envoy-config
          configMap:
            name: envoy-legacy-bridge
---
apiVersion: v1
kind: ConfigMap
metadata:
  name: envoy-legacy-bridge
data:
  envoy.yaml: |
    static_resources:
      listeners:
      - name: legacy_listener
        address:
          socket_address:
            address: 0.0.0.0
            port_value: 8080
        filter_chains:
        - filters:
          - name: envoy.filters.network.http_connection_manager
            typed_config:
              "@type": type.googleapis.com/envoy.extensions.filters.network.http_connection_manager.v3.HttpConnectionManager
              route_config:
                name: legacy_route
                virtual_hosts:
                - name: legacy_service
                  domains: ["*"]
                  routes:
                  - match:
                      prefix: "/legacy-api/"
                    route:
                      cluster: legacy_cluster
                      prefix_rewrite: "/"
                  - match:
                      prefix: "/"
                    route:
                      cluster: new_service_cluster
      clusters:
      - name: legacy_cluster
        connect_timeout: 5s
        type: STRICT_DNS
        load_assignment:
          cluster_name: legacy_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: legacy-mainframe.company.local
                    port_value: 8080
      - name: new_service_cluster
        connect_timeout: 5s
        type: STRICT_DNS
        load_assignment:
          cluster_name: new_service_cluster
          endpoints:
          - lb_endpoints:
            - endpoint:
                address:
                  socket_address:
                    address: new-service
                    port_value: 8080

# Data Integrity Validation Job
apiVersion: batch/v1
kind: CronJob
metadata:
  name: data-integrity-check
spec:
  schedule: '*/15 * * * *' # Alle 15 Minuten
  jobTemplate:
    spec:
      template:
        spec:
          containers:
            - name: data-validator
              image: data-validator:v1.0
              command:
                - python
                - -c
                - |
                  import psycopg2
                  import hashlib
                  import json

                  # Verbindungen zu beiden DBs
                  legacy_conn = psycopg2.connect("host=legacy-db dbname=app user=readonly")
                  cloud_conn = psycopg2.connect("host=cloud-db dbname=app user=readonly")

                  # Checksummen-Vergleich
                  def calculate_table_checksum(conn, table):
                      cursor = conn.cursor()
                      cursor.execute(f"SELECT md5(string_agg(concat_ws('|', *), '')) FROM {table} ORDER BY id")
                      return cursor.fetchone()[0]

                  # Validierung aller kritischen Tabellen
                  critical_tables = ['users', 'orders', 'payments', 'inventory']
                  validation_results = {}

                  for table in critical_tables:
                      legacy_checksum = calculate_table_checksum(legacy_conn, table)
                      cloud_checksum = calculate_table_checksum(cloud_conn, table)
                      
                      validation_results[table] = {
                          'legacy_checksum': legacy_checksum,
                          'cloud_checksum': cloud_checksum,
                          'integrity_status': 'OK' if legacy_checksum == cloud_checksum else 'MISMATCH',
                          'timestamp': datetime.now().isoformat()
                      }

                  # Alert bei Mismatch
                  mismatches = [t for t, r in validation_results.items() if r['integrity_status'] == 'MISMATCH']
                  if mismatches:
                      send_alert(f"Data integrity mismatch in tables: {', '.join(mismatches)}")

                  print(json.dumps(validation_results))
          restartPolicy: OnFailure