6 Git und GitHub – Die Basis für GitOps

# Repository initialisieren
git init mein-projekt
cd mein-projekt

# Ersten Commit erstellen
echo "Initial setup" > README.md
git add README.md
git commit -m "Initial commit"

# Commit-Historie anzeigen
git log --oneline --graph

# Branch erstellen - erstellt nur einen neuen Pointer
git branch feature-xyz
# Zeigt jetzt auf denselben Commit wie der aktuelle Branch

# Branch wechseln - bewegt HEAD zu diesem Pointer
git checkout feature-xyz
# oder mit neuerer Syntax:
git switch feature-xyz

# Aktueller Zustand anzeigen
git log --oneline --all --graph

# Neuen Commit auf feature-xyz machen
echo "Feature implementation" > feature.txt
git add feature.txt
git commit -m "Add feature implementation"

# Der Branch-Pointer hat sich automatisch vorwärts bewegt
git log --oneline --all --graph

# Branch-Pointer manuell verschieben (fortgeschritten)
git branch -f feature-xyz HEAD~1  # Pointer um einen Commit zurücksetzen

git checkout main
git merge feature-xyz  # Fast-forward möglich
# Kein Merge-Commit nötig, nur Pointer-Bewegung

git checkout main
echo "Main development" > main.txt
git add main.txt && git commit -m "Main branch work"

git merge feature-xyz  # Erstellt Merge-Commit

# Konflikt-Markierung in Kubernetes-Manifest
apiVersion: apps/v1
kind: Deployment
spec:
<<<<<<< HEAD
  replicas: 3  # Main branch
=======
  replicas: 5  # Feature branch
>>>>>>> feature-xyz

# Konflikt lösen, dann:
git add .
git commit -m "Resolve merge conflict: set replicas to 4"

main         # Production
├── staging  # Staging-Umgebung
└── develop  # Development-Umgebung

# Feature-Branch erstellen
git checkout -b feature/new-monitoring
# Entwicklung durchführen
git commit -m "Add Prometheus configuration"
# Zurück mergen
git checkout develop
git merge feature/new-monitoring

git checkout -b release/v1.2.0
# Sammelt mehrere Features
git merge feature/monitoring
git merge feature/security-updates
# Testing und Bugfixes
git commit -m "Fix configuration issue"
# Release abschließen
git checkout main
git merge release/v1.2.0
git tag v1.2.0

git checkout -b hotfix/security-patch main
# Schnelle Korrektur
git commit -m "security: patch CVE-2024-001"
# In alle relevanten Branches mergen
git checkout main && git merge hotfix/security-patch
git checkout develop && git merge hotfix/security-patch

# Format: <type>(<scope>): <description>

# Beispiele:
feat(apps): add Redis cache for session storage
fix(infra): correct ingress TLS configuration  
config(monitoring): increase Prometheus retention to 30d
security(rbac): implement namespace isolation
docs(readme): update deployment instructions
revert(apps): rollback nginx to v1.20 due to compatibility issues

## Änderungsbeschreibung
**Was:** Erhöhe Replica-Count von 3 auf 5 für web-app
**Warum:** Monitoring zeigt CPU-Bottlenecks bei Spitzenlasten
**Wo:** production/web-app/deployment.yaml

## Auswirkungsanalyse
- **Betroffene Umgebung:** Production
- **Geschätzte Downtime:** Keine (Rolling Update)
- **Resource-Auswirkung:** +67% Pod-Count, +40% CPU-Requests

## Testing
- [x] Lokale Validierung mit kubeval
- [x] Staging-Deployment erfolgreich
- [x] Load-Tests bestanden

## Rollback-Plan
1. git revert dieses Commits
2. ArgoCD sync (~30 Sekunden)
3. Monitoring auf Service-Health prüfen

# Konzeptionelle Darstellung der GitHub Branch Protection
main:
  required_reviews: 2
  dismiss_stale_reviews: true
  require_code_owner_review: true
  required_status_checks:
    - "validate-kubernetes-manifests"
    - "security-scan"
  restrictions:
    teams: ["platform-team", "sre-leads"]

staging:
  required_reviews: 1
  required_status_checks:
    - "validate-kubernetes-manifests"
  restrictions:
    teams: ["developers", "platform-team"]

# .github/CODEOWNERS
# Global fallback
* @platform-team

# Production-Änderungen brauchen erweiterte Reviews
/clusters/production/ @platform-team @sre-team

# Security-relevante Änderungen
/infrastructure/security/ @security-team
**/rbac/ @security-team

# Monitoring-Konfigurationen
**/monitoring/ @sre-team

# .github/workflows/validate.yml
name: Validate Kubernetes Manifests
on:
  pull_request:
    paths: ['**/*.yaml', '**/*.yml']

jobs:
  validate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Setup kubectl
        uses: azure/setup-kubectl@v3
        
      - name: Validate YAML syntax
        run: |
          find . -name "*.yaml" -o -name "*.yml" | while read file; do
            echo "Validating $file"
            kubectl apply --dry-run=client --validate=true -f "$file"
          done
          
      - name: Check resource limits
        run: |
          python scripts/validate-resources.py --strict

# .github/workflows/generate-configs.yml
name: Generate Environment Configs
on:
  push:
    branches: [main]
    paths: ['templates/**']

jobs:
  generate:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          
      - name: Install Kustomize
        run: |
          curl -s "https://raw.githubusercontent.com/kubernetes-sigs/kustomize/master/hack/install_kustomize.sh" | bash
          
      - name: Generate manifests
        run: |
          for env in development staging production; do
            kustomize build overlays/$env > clusters/$env/generated.yaml
          done
          
      - name: Commit generated files
        run: |
          git config --local user.email "action@github.com"
          git config --local user.name "GitHub Action"
          git add clusters/*/generated.yaml
          git diff --staged --quiet || \
            git commit -m "auto: regenerate environment configs" && \
            git push

# .github/workflows/security.yml
name: Security Scan
on: [pull_request]

jobs:
  security:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      
      - name: Run Polaris
        uses: FairwindsOps/polaris/.github/actions/polaris@master
        with:
          config-path: .polaris.yml
          
      - name: Run Trivy
        uses: aquasecurity/trivy-action@master
        with:
          scan-type: 'config'
          scan-ref: '.'

# .github/workflows/deployment-notification.yml
name: Deployment Notification
on:
  push:
    branches: [main]

jobs:
  notify:
    runs-on: ubuntu-latest
    steps:
      - name: Notify deployment
        run: |
          curl -X POST ${{ secrets.SLACK_WEBHOOK }} \
            -H 'Content-type: application/json' \
            --data "{
              \"text\": \"🚀 Production deployment initiated\",
              \"blocks\": [{
                \"type\": \"section\",
                \"text\": {
                  \"type\": \"mrkdwn\",
                  \"text\": \"Commit: \`${{ github.sha }}\`\nAuthor: ${{ github.actor }}\nMessage: ${{ github.event.head_commit.message }}\"
                }
              }]
            }"

# .github/workflows/audit.yml
name: Audit Changes
on:
  push:
    branches: [main, staging, production]

jobs:
  audit:
    runs-on: ubuntu-latest
    steps:
      - name: Log to audit system
        run: |
          curl -X POST https://audit.company.com/api/gitops-changes \
            -H "Authorization: Bearer ${{ secrets.AUDIT_TOKEN }}" \
            -H "Content-Type: application/json" \
            -d '{
              "repository": "${{ github.repository }}",
              "branch": "${{ github.ref_name }}",
              "commit": "${{ github.sha }}",
              "author": "${{ github.actor }}",
              "message": "${{ github.event.head_commit.message }}",
              "timestamp": "${{ github.event.head_commit.timestamp }}"
            }'