# infrastructure/carbon-aware-eks.tf

# Carbon intensity data source
data "http" "carbon_intensity" {
  url = "https://api.electricitymap.org/v3/carbon-intensity/latest?zone=US-CAL"
  
  request_headers = {
    Accept = "application/json"
    Auth-Token = var.carbon_api_key
  }
}

# Carbon-aware EKS cluster configuration
resource "aws_eks_cluster" "green_cluster" {
  name     = "carbon-aware-${var.environment}"
  version  = "1.28"
  role_arn = aws_iam_role.eks_cluster.arn

  vpc_config {
    subnet_ids = var.carbon_optimized_subnets
  }

  # Enable carbon-aware scaling
  scaling_config {
    desired_size = local.carbon_optimal_size
    max_size     = 10
    min_size     = 1
  }

  # Carbon optimization tags
  tags = {
    Environment     = var.environment
    CarbonOptimized = "true"
    CostCenter      = "sustainability"
    AutoShutdown    = "enabled"
  }
}

# Carbon-aware node group
resource "aws_eks_node_group" "carbon_optimized" {
  cluster_name    = aws_eks_cluster.green_cluster.name
  node_group_name = "carbon-optimized-nodes"
  node_role_arn   = aws_iam_role.eks_node_group.arn
  subnet_ids      = var.carbon_optimized_subnets

  scaling_config {
    desired_size = local.calculate_optimal_capacity()
    max_size     = 15
    min_size     = 1
  }

  # Instance types optimized for energy efficiency
  instance_types = ["c6g.4xlarge", "m6g.4xlarge", "r6g.4xlarge"] # Graviton processors

  # Carbon-aware update strategy
  update_config {
    max_unavailable = 1
  }

  lifecycle {
    ignore_changes = [scaling_config[0].desired_size]
  }
}

# Carbon-aware auto-scaling policy
resource "aws_autoscaling_policy" "carbon_aware_scaling" {
  name                   = "carbon-aware-scaling"
  autoscaling_group_name = aws_eks_node_group.carbon_optimized.resources[0].autoscaling_groups[0].name
  policy_type            = "TargetTrackingScaling"

  target_tracking_configuration {
    predefined_metric_specification {
      predefined_metric_type = "ASGAverageCPUUtilization"
    }
    target_value = 65.0 # Optimized for energy efficiency
  }
}

# Locals for carbon calculations
locals {
  carbon_intensity = jsondecode(data.http.carbon_intensity.body).carbonIntensity
  
  # Calculate optimal cluster size based on carbon intensity
  calculate_optimal_capacity = () => {
    var.carbon_intensity < 200 ? 3 : (
      var.carbon_intensity < 400 ? 2 : 1
    )
  }
  
  carbon_optimal_size = local.calculate_optimal_capacity()
}

# Carbon monitoring and alerts
resource "aws_cloudwatch_dashboard" "carbon_dashboard" {
  dashboard_name = "Carbon-Monitoring-${var.environment}"

  dashboard_body = jsonencode({
    widgets = [
      {
        type   = "metric"
        x      = 0
        y      = 0
        width  = 12
        height = 6

        properties = {
          metrics = [
            ["AWS/EKS", "CPUUtilization", "ClusterName", aws_eks_cluster.green_cluster.name],
            [".", "MemoryUtilization", ".", "."],
            [".", "NetworkRxBytes", ".", "."],
            [".", "NetworkTxBytes", ".", "."]
          ]
          view    = "timeSeries"
          stacked = false
          region  = var.aws_region
          title   = "Cluster Performance vs Carbon Intensity"
          period  = 300
        }
      }
    ]
  })
}

# Output carbon efficiency metrics
output "carbon_efficiency_metrics" {
  description = "Carbon efficiency metrics for the deployment"
  value = {
    cluster_name          = aws_eks_cluster.green_cluster.name
    estimated_carbon_savings = local.calculate_carbon_savings()
    optimal_instance_type = "Graviton-based for 40% better performance per watt"
    carbon_aware_scaling  = "Enabled"
  }
}

  

# k8s/carbon-aware-scheduler.yaml
apiVersion: apps/v1
kind: Deployment
metadata:
  name: carbon-aware-scheduler
  namespace: kube-system
  labels:
    app: carbon-aware-scheduler
    sustainability: enabled
spec:
  replicas: 2
  selector:
    matchLabels:
      app: carbon-aware-scheduler
  template:
    metadata:
      labels:
        app: carbon-aware-scheduler
      annotations:
        carbon.optimization/enabled: "true"
    spec:
      serviceAccountName: carbon-scheduler
      containers:
      - name: scheduler
        image: k8s.gcr.io/carbon-aware-scheduler:v2.1.0
        args:
        - --carbon-api-endpoint=https://api.carbonintensity.org
        - --optimization-mode=balanced
        - --carbon-threshold=300
        - --region-preference=us-west-2,eu-west-1,us-east-1
        resources:
          requests:
            cpu: 100m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 1Gi
        env:
        - name: CARBON_API_KEY
          valueFrom:
            secretKeyRef:
              name: carbon-credentials
              key: api-key
        - name: SCHEDULING_STRATEGY
          value: "carbon-aware"
---
# Carbon-aware deployment with resource optimization
apiVersion: apps/v1
kind: Deployment
metadata:
  name: web-app-carbon-optimized
  labels:
    app: web-app
    sustainability-tier: "optimized"
spec:
  replicas: 3
  selector:
    matchLabels:
      app: web-app
  template:
    metadata:
      labels:
        app: web-app
      annotations:
        carbon.scheduling/preferred-time: "low-carbon-hours"
        carbon.scaling/strategy: "carbon-aware"
        autoscaling.alpha.kubernetes.io/conditions: '
          [{
            "type": "CarbonOptimized",
            "status": "True",
            "lastTransitionTime": "2025-01-15T10:00:00Z"
          }]'
    spec:
      affinity:
        nodeAffinity:
          preferredDuringSchedulingIgnoredDuringExecution:
          - weight: 100
            preference:
              matchExpressions:
              - key: kubernetes.io/arch
                operator: In
                values:
                - arm64
          - weight: 80
            preference:
              matchExpressions:
              - key: carbon.efficiency/score
                operator: Gt
                values:
                - "80"
          - weight: 60
            preference:
              matchExpressions:
              - key: topology.kubernetes.io/region
                operator: In
                values:
                - us-west-2
                - eu-west-1
      containers:
      - name: web-app
        image: my-registry/web-app:green-optimized
        ports:
        - containerPort: 8080
        resources:
          requests:
            cpu: 200m
            memory: 256Mi
          limits:
            cpu: 500m
            memory: 512Mi
        env:
        - name: CARBON_OPTIMIZATION
          value: "enabled"
        - name: ENERGY_EFFICIENT_MODE
          value: "true"
        livenessProbe:
          httpGet:
            path: /health
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
          timeoutSeconds: 5
          failureThreshold: 3
        readinessProbe:
          httpGet:
            path: /ready
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        # Carbon-aware lifecycle hooks
        lifecycle:
          preStop:
            exec:
              command: ["/bin/sh", "-c", "echo 'Shutting down during high carbon hours'"]
---
# Carbon-aware HPA configuration
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: web-app-carbon-hpa
  annotations:
    carbon.scaling/strategy: "time-aware"
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: web-app-carbon-optimized
  minReplicas: 2
  maxReplicas: 10
  metrics:
  - type: Resource
    resource:
      name: cpu
      target:
        type: Utilization
        averageUtilization: 65
  - type: Resource
    resource:
      name: memory
      target:
        type: Utilization
        averageUtilization: 75
  behavior:
    scaleDown:
      stabilizationWindowSeconds: 300
      policies:
      - type: Percent
        value: 50
        periodSeconds: 60
      - type: Pods
        value: 2
        periodSeconds: 60
      selectPolicy: Min
    scaleUp:
      stabilizationWindowSeconds: 180
      policies:
      - type: Percent
        value: 25
        periodSeconds: 60
      - type: Pods
        value: 2
        periodSeconds: 60
      selectPolicy: Max
---
# Carbon metrics collector
apiVersion: v1
kind: ConfigMap
metadata:
  name: carbon-metrics-config
data:
  config.yaml: |
    carbon:
      enabled: true
      collection_interval: 5m
      metrics:
        - carbon_intensity
        - energy_consumption
        - cost_per_carbon_unit
      exporters:
        - prometheus
        - cloudwatch
      optimization_rules:
        - name: "scale_down_high_carbon"
          condition: "carbon_intensity > 400"
          action: "scale_replicas_by_percent"
          value: -50
        - name: "prefer_graviton"
          condition: "always"
          action: "node_selector"
          value: "kubernetes.io/arch=arm64"

  

#!/usr/bin/env python3
"""
Green Cloud Analytics: Carbon Footprint Monitoring and Optimization
"""

import asyncio
import aiohttp
import pandas as pd
from datetime import datetime, timedelta
from typing import Dict, List, Optional
from dataclasses import dataclass
import boto3
from prometheus_api_client import PrometheusConnect

@dataclass
class CarbonMetrics:
    timestamp: datetime
    carbon_intensity: float  # gCO2/kWh
    energy_consumption: float  # kWh
    estimated_emissions: float  # gCO2
    cost_usd: float
    region: str
    service: str

class GreenCloudAnalytics:
    def __init__(self, prometheus_url: str, aws_region: str = "us-west-2"):
        self.prometheus = PrometheusConnect(url=prometheus_url)
        self.cloudwatch = boto3.client('cloudwatch', region_name=aws_region)
        self.ce = boto3.client('ce', region_name=aws_region)
        self.carbon_data_cache = {}
        
    async def get_carbon_intensity(self, region: str) -> float:
        """Get real-time carbon intensity for cloud region"""
        cache_key = f"{region}_{datetime.now().strftime('%Y-%m-%d-%H')}"
        
        if cache_key in self.carbon_data_cache:
            return self.carbon_data_cache[cache_key]
        
        # Carbon intensity API (example using Electricity Maps)
        async with aiohttp.ClientSession() as session:
            async with session.get(
                f"https://api.electricitymap.org/v3/carbon-intensity/latest?zone={self._region_to_zone(region)}",
                headers={"auth-token": "YOUR_API_KEY"}
            ) as response:
                data = await response.json()
                carbon_intensity = data.get('carbonIntensity', 300)  # Default fallback
                self.carbon_data_cache[cache_key] = carbon_intensity
                return carbon_intensity
    
    def _region_to_zone(self, region: str) -> str:
        """Map AWS regions to carbon intensity zones"""
        zone_mapping = {
            'us-east-1': 'US-MIDA',
            'us-west-2': 'US-NW-PAC',
            'eu-west-1': 'IE',
            'eu-central-1': 'DE',
            'ap-southeast-1': 'SG'
        }
        return zone_mapping.get(region, 'US-CAL')
    
    async def calculate_service_emissions(self, service: str, region: str, 
                                        duration_hours: int = 1) -> CarbonMetrics:
        """Calculate carbon emissions for a specific cloud service"""
        # Get resource utilization metrics
        cpu_usage = self._get_cpu_usage(service, region, duration_hours)
        memory_usage = self._get_memory_usage(service, region, duration_hours)
        network_io = self._get_network_usage(service, region, duration_hours)
        
        # Calculate energy consumption (simplified model)
        energy_kwh = self._estimate_energy_consumption(cpu_usage, memory_usage, network_io)
        
        # Get carbon intensity
        carbon_intensity = await self.get_carbon_intensity(region)
        
        # Calculate emissions
        emissions_gco2 = energy_kwh * carbon_intensity
        
        # Get cost data
        cost = self._get_service_cost(service, region, duration_hours)
        
        return CarbonMetrics(
            timestamp=datetime.now(),
            carbon_intensity=carbon_intensity,
            energy_consumption=energy_kwh,
            estimated_emissions=emissions_gco2,
            cost_usd=cost,
            region=region,
            service=service
        )
    
    def _estimate_energy_consumption(self, cpu_usage: float, memory_usage: float, 
                                   network_io: float) -> float:
        """Estimate energy consumption based on resource usage"""
        # Simplified energy estimation model
        base_power_w = 50  # Base power for idle instance
        cpu_power_w = cpu_usage * 100  # CPU power scaling
        memory_power_w = memory_usage * 20  # Memory power scaling
        network_power_w = network_io * 5  # Network power scaling
        
        total_power_w = base_power_w + cpu_power_w + memory_power_w + network_power_w
        energy_kwh = (total_power_w * 1) / 1000  # Convert to kWh for 1 hour
        
        return energy_kwh
    
    def _get_cpu_usage(self, service: str, region: str, duration_hours: int) -> float:
        """Get average CPU usage for service"""
        query = f'avg(rate(container_cpu_usage_seconds_total{{service="{service}"}}[{duration_hours}h]))'
        result = self.prometheus.custom_query(query)
        return float(result[0]['value'][1]) if result else 0.5  # Default 50%
    
    def _get_memory_usage(self, service: str, region: str, duration_hours: int) -> float:
        """Get average memory usage for service"""
        query = f'avg(container_memory_usage_bytes{{service="{service}"}} / container_spec_memory_limit_bytes{{service="{service}"}})'
        result = self.prometheus.custom_query(query)
        return float(result[0]['value'][1]) if result else 0.6  # Default 60%
    
    def _get_network_usage(self, service: str, region: str, duration_hours: int) -> float:
        """Get network I/O usage"""
        query = f'avg(rate(container_network_receive_bytes_total{{service="{service}"}}[{duration_hours}h]))'
        result = self.prometheus.custom_query(query)
        return float(result[0]['value'][1]) / 1e6 if result else 10  # Default 10 MB/s
    
    def _get_service_cost(self, service: str, region: str, duration_hours: int) -> float:
        """Get cost for service usage"""
        # Simplified cost estimation
        instance_costs = {
            'c6g.4xlarge': 0.544,
            'm6g.4xlarge': 0.616,
            'r6g.4xlarge': 0.724
        }
        base_cost = instance_costs.get('c6g.4xlarge', 0.5)
        return base_cost * duration_hours
    
    def generate_optimization_recommendations(self, metrics: CarbonMetrics) -> List[Dict]:
        """Generate carbon optimization recommendations"""
        recommendations = []
        
        # High carbon intensity recommendation
        if metrics.carbon_intensity > 400:
            recommendations.append({
                'type': 'carbon_timing',
                'priority': 'high',
                'message': f'High carbon intensity ({metrics.carbon_intensity} gCO2/kWh). Consider shifting workload to low-carbon hours.',
                'estimated_savings': f'{metrics.estimated_emissions * 0.3:.2f} gCO2'
            })
        
        # Resource optimization
        if metrics.energy_consumption > 0.5:  # High energy usage
            recommendations.append({
                'type': 'resource_optimization',
                'priority': 'medium',
                'message': 'High energy consumption detected. Consider right-sizing instances.',
                'estimated_savings': f'{metrics.energy_consumption * 0.2:.2f} kWh'
            })
        
        # Architecture optimization
        if metrics.cost_usd > 1.0:  # High cost
            recommendations.append({
                'type': 'architecture',
                'priority': 'medium',
                'message': 'Consider migrating to Graviton instances for better performance per watt.',
                'estimated_savings': '40% better performance per watt'
            })
        
        return recommendations
    
    async def create_sustainability_report(self, services: List[str]) -> Dict:
        """Generate comprehensive sustainability report"""
        report = {
            'timestamp': datetime.now().isoformat(),
            'services_analyzed': [],
            'total_emissions_gco2': 0,
            'total_energy_kwh': 0,
            'total_cost_usd': 0,
            'recommendations': [],
            'carbon_efficiency_score': 0
        }
        
        for service in services:
            metrics = await self.calculate_service_emissions(service, 'us-west-2')
            report['services_analyzed'].append({
                'service': service,
                'emissions_gco2': metrics.estimated_emissions,
                'energy_kwh': metrics.energy_consumption,
                'cost_usd': metrics.cost_usd,
                'carbon_intensity': metrics.carbon_intensity
            })
            
            report['total_emissions_gco2'] += metrics.estimated_emissions
            report['total_energy_kwh'] += metrics.energy_consumption
            report['total_cost_usd'] += metrics.cost_usd
            
            # Add recommendations
            service_recommendations = self.generate_optimization_recommendations(metrics)
            report['recommendations'].extend(service_recommendations)
        
        # Calculate carbon efficiency score (0-100)
        report['carbon_efficiency_score'] = self._calculate_efficiency_score(report)
        
        return report
    
    def _calculate_efficiency_score(self, report: Dict) -> float:
        """Calculate overall carbon efficiency score"""
        total_work = sum(s['cost_usd'] for s in report['services_analyzed'])  # Using cost as proxy for work
        total_emissions = report['total_emissions_gco2']
        
        if total_emissions == 0:
            return 100
        
        efficiency = total_work / total_emissions
        max_efficiency = 1000  # Theoretical maximum
        score = min(100, (efficiency / max_efficiency) * 100)
        
        return score

# Example usage
async def main():
    analytics = GreenCloudAnalytics(
        prometheus_url="http://prometheus:9090",
        aws_region="us-west-2"
    )
    
    services = ["web-app", "api-service", "database-service"]
    report = await analytics.create_sustainability_report(services)
    
    print("=== Green Cloud Sustainability Report ===")
    print(f"Total Emissions: {report['total_emissions_gco2']:.2f} gCO2")
    print(f"Total Energy: {report['total_energy_kwh']:.2f} kWh")
    print(f"Carbon Efficiency Score: {report['carbon_efficiency_score']:.1f}/100")
    print(f"Recommendations: {len(report['recommendations'])}")
    
    for rec in report['recommendations']:
        print(f"- [{rec['priority'].upper()}] {rec['message']}")

if __name__ == "__main__":
    asyncio.run(main())

  

# .github/workflows/secure-build.yaml
name: Secure Build and Sign

on:
  push:
    branches: [ main ]
  release:
    types: [ published ]

env:
  REGISTRY: ghcr.io
  IMAGE_NAME: ${{ github.repository }}

jobs:
  build-and-sign:
    runs-on: ubuntu-latest
    permissions:
      contents: read
      packages: write
      id-token: write  # Required for Sigstore keyless signing

    steps:
    - name: Checkout repository
      uses: actions/checkout@v4

    - name: Set up Docker Buildx
      uses: docker/setup-buildx-action@v3

    - name: Log into registry
      uses: docker/login-action@v3
      with:
        registry: ${{ env.REGISTRY }}
        username: ${{ github.actor }}
        password: ${{ secrets.GITHUB_TOKEN }}

    - name: Extract metadata
      id: meta
      uses: docker/metadata-action@v4
      with:
        images: ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}
        tags: |
          type=ref,event=branch
          type=ref,event=pr
          type=semver,pattern={{version}}
          type=semver,pattern={{major}}.{{minor}}
          type=sha,prefix={{branch}}-

    - name: Build and push container image
      uses: docker/build-push-action@v5
      with:
        context: .
        push: true
        tags: ${{ steps.meta.outputs.tags }}
        labels: ${{ steps.meta.outputs.labels }}
        cache-from: type=gha
        cache-to: type=gha,mode=max

    - name: Install Cosign
      uses: sigstore/cosign-installer@v3

    - name: Sign container image with keyless signing
      run: |
        # Sign the image with Fulcio certificate
        cosign sign --yes \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

    - name: Generate SBOM and sign it
      run: |
        # Generate Software Bill of Materials
        cosign attest --yes \
          --predicate https://example.com/predicate.json \
          --type custom \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}@${{ steps.build.outputs.digest }}

    - name: Store build provenance
      uses: actions/upload-artifact@v4
      with:
        name: build-provenance
        path: |
          predicate.json
          build-metadata.json
        retention-days: 30

  verify-signatures:
    runs-on: ubuntu-latest
    needs: build-and-sign
    steps:
    - name: Install Cosign
      uses: sigstore/cosign-installer@v3

    - name: Verify container signature
      run: |
        cosign verify \
          --certificate-identity-regexp '.*' \
          --certificate-oidc-issuer https://token.actions.githubusercontent.com \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

    - name: Verify SBOM attestation
      run: |
        cosign verify-attestation \
          --type custom \
          ${{ env.REGISTRY }}/${{ env.IMAGE_NAME }}:${{ github.sha }}

  

#!/usr/bin/env python3
"""
TUF Repository Management for Secure Software Distribution
"""

import json
import hashlib
from datetime import datetime, timedelta
from typing import Dict, List
from tuf.api.metadata import (
    Root, Snapshot, Targets, Timestamp, 
    MetaFile, Role, Key, TopLevelMetadata
)
from tuf.repository import Repository
from securesystemslib.keys import generate_ed25519_key
from securesystemslib.signer import SSlibSigner

class SecureTUFRepository:
    def __init__(self, repo_path: str):
        self.repo_path = repo_path
        self.repository = Repository.create(repo_path)
        self.setup_initial_metadata()
    
    def setup_initial_metadata(self):
        """Initialize TUF repository with root keys and roles"""
        # Generate keys for different roles
        root_key = generate_ed25519_key()
        timestamp_key = generate_ed25519_key()
        snapshot_key = generate_ed25519_key()
        targets_key = generate_ed25519_key()
        
        # Create root metadata
        root = Root(version=1, spec_version="1.0")
        
        # Add keys to root
        root.add_key(root_key, "root")
        root.add_key(timestamp_key, "timestamp")
        root.add_key(snapshot_key, "snapshot")
        root.add_key(targets_key, "targets")
        
        # Set role thresholds
        root.roles["root"] = Role(["root"], 1)
        root.roles["timestamp"] = Role(["timestamp"], 1)
        root.roles["snapshot"] = Role(["snapshot"], 1)
        root.roles["targets"] = Role(["targets"], 1)
        
        # Set expiration dates
        root.expires = datetime.now() + timedelta(days=365)
        
        self.repository.root = root
    
    def add_software_target(self, file_path: str, version: str, 
                          checksums: Dict[str, str]):
        """Add a software target to the repository"""
        target_name = f"application-{version}.tar.gz"
        
        # Create target metadata
        target_info = {
            "length": len(checksums),
            "hashes": checksums,
            "custom": {
                "version": version,
                "release_date": datetime.now().isoformat(),
                "vulnerability_scan": "passed",
                "sbom_digest": hashlib.sha256(
                    f"sbom-{version}".encode()
                ).hexdigest()
            }
        }
        
        # Add target to repository
        self.repository.targets.add_target(target_name, target_info)
    
    def publish_update(self, version: str):
        """Publish a new software version with proper signing"""
        # Update snapshot metadata
        snapshot = Snapshot(version=1)
        snapshot.expires = datetime.now() + timedelta(days=7)
        
        # Update timestamp metadata
        timestamp = Timestamp(version=1)
        timestamp.expires = datetime.now() + timedelta(hours=24)
        
        # Sign all metadata
        self.repository.root.unsigned.version += 1
        self.repository.snapshot = snapshot
        self.repository.timestamp = timestamp
        
        # Write metadata to repository
        self.repository.writeall()
        
        print(f"Published version {version} with TUF protection")
    
    def verify_update_integrity(self, target_name: str) -> bool:
        """Verify the integrity of a software update"""
        try:
            target_info = self.repository.get_targetinfo(target_name)
            if target_info:
                print(f"Target {target_name} verified successfully")
                return True
        except Exception as e:
            print(f"Verification failed: {e}")
            return False

# Example usage
def create_secure_repository():
    repo = SecureTUFRepository("./secure-repo")
    
    # Add software targets with checksums
    checksums = {
        "sha256": "a1b2c3d4e5f6789012345678901234567890123456789012345678901234",
        "sha512": "b2c3d4e5f6789012345678901234567890123456789012345678901234567890"
    }
    
    repo.add_software_target("app-v1.0.0.tar.gz", "1.0.0", checksums)
    repo.publish_update("1.0.0")
    
    # Verify update integrity
    repo.verify_update_integrity("application-1.0.0.tar.gz")

if __name__ == "__main__":
    create_secure_repository()

  

#!/usr/bin/env python3
"""
in-toto Supply Chain Integrity Verification
"""

import json
from datetime import datetime
from pathlib import Path
from in_toto.models.layout import Layout, Step, Inspection
from in_toto.models.metadata import Metablock
from in_toto.runlib import in_toto_run, in_toto_verify
from securesystemslib.keys import generate_ed25519_key
from securesystemslib.signer import SSlibSigner

class SupplyChainIntegrity:
    def __init__(self, project_name: str):
        self.project_name = project_name
        self.layout = self.create_supply_chain_layout()
        self.signing_keys = {}
        
    def create_supply_chain_layout(self) -> Layout:
        """Create in-toto layout defining the supply chain steps"""
        layout = Layout(
            expires=datetime.now().strftime("%Y-%m-%dT%H:%M:%SZ"),
            readme=f"Supply chain layout for {self.project_name}",
            keys={}
        )
        
        # Define supply chain steps
        steps = [
            Step(
                name="clone",
                expected_materials=[["DISALLOW", "*"]],
                expected_products=[["CREATE", "source/*"]],
                pubkeys=[],
                expected_command=["git", "clone"],
                threshold=1
            ),
            Step(
                name="security-scan",
                expected_materials=[["MATCH", "source/*", "WITH", "PRODUCTS", "FROM", "clone"]],
                expected_products=[["CREATE", "scan-results/*"]],
                pubkeys=[],
                expected_command=["trivy", "scan"],
                threshold=1
            ),
            Step(
                name="build",
                expected_materials=[
                    ["MATCH", "source/*", "WITH", "PRODUCTS", "FROM", "clone"],
                    ["MATCH", "scan-results/*", "WITH", "PRODUCTS", "FROM", "security-scan"]
                ],
                expected_products=[["CREATE", "artifacts/*"]],
                pubkeys=[],
                expected_command=["docker", "build"],
                threshold=1
            ),
            Step(
                name="sign",
                expected_materials=[["MATCH", "artifacts/*", "WITH", "PRODUCTS", "FROM", "build"]],
                expected_products=[["CREATE", "signatures/*"]],
                pubkeys=[],
                expected_command=["cosign", "sign"],
                threshold=1
            ),
            Step(
                name="deploy",
                expected_materials=[
                    ["MATCH", "artifacts/*", "WITH", "PRODUCTS", "FROM", "build"],
                    ["MATCH", "signatures/*", "WITH", "PRODUCTS", "FROM", "sign"]
                ],
                expected_products=[["CREATE", "deployment/*"]],
                pubkeys=[],
                expected_command=["kubectl", "apply"],
                threshold=1
            )
        ]
        
        layout.steps = steps
        
        # Define final inspection
        inspection = Inspection(
            name="verify-supply-chain",
            expected_materials=[["MATCH", "*", "WITH", "PRODUCTS", "FROM", "deploy"]],
            expected_products=[],
            run=["bash", "-c", "echo 'Supply chain verification complete'"]
        )
        
        layout.inspect = [inspection]
        return layout
    
    def generate_signing_keys(self):
        """Generate signing keys for each step in the supply chain"""
        steps = ["clone", "security-scan", "build", "sign", "deploy"]
        
        for step in steps:
            key = generate_ed25519_key()
            self.signing_keys[step] = key
            self.layout.keys[key["keyid"]] = key
            # Add key to corresponding step
            for layout_step in self.layout.steps:
                if layout_step.name == step:
                    layout_step.pubkeys = [key["keyid"]]
    
    def execute_supply_chain_step(self, step_name: str, command: list, 
                                materials: list, products: list):
        """Execute a supply chain step with in-toto recording"""
        try:
            # Run the step with in-toto recording
            in_toto_run(
                step_name=step_name,
                product_list=products,
                material_list=materials,
                command=command,
                signing_key=self.signing_keys[step_name]
            )
            print(f"Step {step_name} completed and recorded")
            return True
        except Exception as e:
            print(f"Step {step_name} failed: {e}")
            return False
    
    def verify_supply_chain(self, link_dir: str = ".in-toto") -> bool:
        """Verify the entire supply chain integrity"""
        try:
            # Save layout to file
            layout_metadata = Metablock(signed=self.layout)
            with open("root.layout", "w") as f:
                layout_metadata.dump(f)
            
            # Verify the supply chain
            in_toto_verify(
                layout_path="root.layout",
                link_dir=link_dir
            )
            print("Supply chain verification successful!")
            return True
        except Exception as e:
            print(f"Supply chain verification failed: {e}")
            return False

# Example usage
def run_secure_supply_chain():
    sc = SupplyChainIntegrity("my-secure-app")
    sc.generate_signing_keys()
    
    # Execute supply chain steps
    steps = [
        {
            "name": "clone",
            "command": ["git", "clone", "https://github.com/example/repo.git", "source"],
            "materials": [],
            "products": ["source/"]
        },
        {
            "name": "security-scan", 
            "command": ["trivy", "fs", "--format", "json", "source/"],
            "materials": ["source/"],
            "products": ["scan-results/"]
        },
        {
            "name": "build",
            "command": ["docker", "build", "-t", "my-app:latest", "source/"],
            "materials": ["source/", "scan-results/"],
            "products": ["artifacts/"]
        }
    ]
    
    for step in steps:
        success = sc.execute_supply_chain_step(
            step["name"], step["command"], step["materials"], step["products"]
        )
        if not success:
            print(f"Supply chain broken at step: {step['name']}")
            return
    
    # Verify entire supply chain
    sc.verify_supply_chain()

if __name__ == "__main__":
    run_secure_supply_chain()

  

# observability/otel-collector-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: otel-collector-conf
  namespace: observability
data:
  otel-collector-config: |
    receivers:
      otlp:
        protocols:
          grpc:
            endpoint: 0.0.0.0:4317
          http:
            endpoint: 0.0.0.0:4318
      
      prometheus:
        config:
          global:
            scrape_interval: 30s
          scrape_configs:
            - job_name: 'kubernetes-pods'
              kubernetes_sd_configs:
                - role: pod
              relabel_configs:
                - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_scrape]
                  action: keep
                  regex: true
                - source_labels: [__meta_kubernetes_pod_annotation_prometheus_io_path]
                  action: replace
                  target_label: __metrics_path__
                  regex: (.+)
                - source_labels: [__address__, __meta_kubernetes_pod_annotation_prometheus_io_port]
                  action: replace
                  regex: ([^:]+)(?::\d+)?;(\d+)
                  replacement: $1:$2
                  target_label: __address__
    
    processors:
      batch:
        timeout: 10s
        send_batch_size: 1000
      resource:
        attributes:
          - key: k8s.cluster.name
            value: "production-cluster"
            action: upsert
      memory_limiter:
        check_interval: 1s
        limit_mib: 2000
        spike_limit_mib: 500
    
    exporters:
      logging:
        loglevel: debug
      prometheus:
        endpoint: "0.0.0.0:9090"
        namespace: app_metrics
        const_labels:
          cluster: "production"
      jaeger:
        endpoint: jaeger-collector.observability:14250
        tls:
          insecure: true
    
    service:
      pipelines:
        metrics:
          receivers: [otlp, prometheus]
          processors: [batch, memory_limiter, resource]
          exporters: [logging, prometheus]
        traces:
          receivers: [otlp]
          processors: [batch, memory_limiter, resource]
          exporters: [logging, jaeger]

  

# app/observability/instrumentation.py
import os
from opentelemetry import trace
from opentelemetry.sdk.trace import TracerProvider
from opentelemetry.sdk.trace.export import BatchSpanProcessor
from opentelemetry.sdk.resources import Resource
from opentelemetry.exporter.otlp.proto.grpc.trace_exporter import OTLPSpanExporter
from opentelemetry.instrumentation.fastapi import FastAPIInstrumentor
from opentelemetry.instrumentation.requests import RequestsInstrumentor
from opentelemetry.instrumentation.redis import RedisInstrumentor
from opentelemetry.instrumentation.sqlalchemy import SQLAlchemyInstrumentor

def setup_tracing(service_name: str, endpoint: str = None):
    """
    Initialize distributed tracing for the application
    """
    # Create tracer provider with resource attributes
    resource = Resource.create({
        "service.name": service_name,
        "service.version": os.getenv("APP_VERSION", "1.0.0"),
        "deployment.environment": os.getenv("ENVIRONMENT", "development")
    })
    
    tracer_provider = TracerProvider(resource=resource)
    
    # Configure OTLP exporter
    otlp_exporter = OTLPSpanExporter(
        endpoint=endpoint or os.getenv("OTLP_ENDPOINT", "otel-collector:4317"),
        insecure=True
    )
    
    # Add batch processor
    span_processor = BatchSpanProcessor(otlp_exporter)
    tracer_provider.add_span_processor(span_processor)
    
    # Set the global tracer provider
    trace.set_tracer_provider(tracer_provider)
    
    # Auto-instrument common libraries
    FastAPIInstrumentor().instrument()
    RequestsInstrumentor().instrument()
    RedisInstrumentor().instrument()
    SQLAlchemyInstrumentor().instrument()
    
    return trace.get_tracer(__name__)

# Example usage in FastAPI application
from fastapi import FastAPI
import requests

app = FastAPI(title="User Service")

# Initialize tracing
tracer = setup_tracing("user-service")

@app.get("/users/{user_id}")
async def get_user(user_id: int):
    with tracer.start_as_current_span("get_user_request") as span:
        span.set_attribute("user.id", user_id)
        
        # This call will be automatically traced
        response = requests.get(f"http://profile-service/profiles/{user_id}")
        
        span.set_attribute("http.status_code", response.status_code)
        return response.json()

# Custom tracing for business logic
def process_user_order(user_id: int, order_data: dict):
    with tracer.start_as_current_span("process_user_order") as span:
        span.set_attribute("user.id", user_id)
        span.set_attribute("order.total", order_data.get("total", 0))
        
        # Business logic here
        result = validate_order(user_id, order_data)
        span.set_attribute("order.valid", result.is_valid)
        
        return result

def validate_order(user_id: int, order_data: dict):
    with tracer.start_as_current_span("validate_order") as span:
        # Validation logic
        span.add_event("order_validation_started")
        
        # Simulate validation steps
        is_valid = len(order_data.get("items", [])) > 0
        span.set_attribute("validation.items_count", len(order_data.get("items", [])))
        
        span.add_event("order_validation_completed")
        return type('Result', (), {'is_valid': is_valid})()

  

# observability/fluent-bit-config.yaml
apiVersion: v1
kind: ConfigMap
metadata:
  name: fluent-bit-config
  namespace: observability
  labels:
    k8s-app: fluent-bit
data:
  fluent-bit.conf: |
    [SERVICE]
        Daemon Off
        Flush 1
        Log_Level info
        Parsers_File parsers.conf
        HTTP_Server On
        HTTP_Listen 0.0.0.0
        HTTP_Port 2020
    
    [INPUT]
        Name tail
        Path /var/log/containers/*.log
        Parser docker
        Tag kube.*
        Mem_Buf_Limit 50MB
        Skip_Long_Lines On
    
    [FILTER]
        Name kubernetes
        Match kube.*
        Merge_Log On
        Keep_Log Off
        K8S-Logging.Parser On
        K8S-Logging.Exclude On
    
    [FILTER]
        Name nest
        Match kube.*
        Operation nest
        Wildcard pod_name
        Nest_under kubernetes
        Remove_prefix pod_name
    
    [FILTER]
        Name modify
        Match kube.*
        Rename log message
        Rename stream log_stream
    
    [OUTPUT]
        Name loki
        Match kube.*
        Host loki.observability.svc.cluster.local
        Port 3100
        Labels job=fluent-bit, cluster=production
        Label_keys $kubernetes['namespace_name'],$kubernetes['pod_name'],$kubernetes['container_name']
        Remove_keys kubernetes,stream,docker
    
    [OUTPUT]
        Name es
        Match kube.*
        Host elasticsearch.observability.svc.cluster.local
        Port 9200
        Index fluent-bit
        Type flb_type
        Retry_Limit False

  parsers.conf: |
    [PARSER]
        Name docker
        Format json
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%LZ
        Time_Keep On
    
    [PARSER]
        Name json
        Format json
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%LZ
    
    [PARSER]
        Name regex
        Format regex
        Regex ^(?[^ ]+) (?stdout|stderr) (?[P|F]) (?.+)$
        Time_Key time
        Time_Format %Y-%m-%dT%H:%M:%S.%L%z

  

# gitops/observability-app.yaml
apiVersion: argoproj.io/v1alpha1
kind: Application
metadata:
  name: observability-stack
  namespace: argocd
spec:
  project: default
  source:
    repoURL: https://github.com/your-org/observability-as-code.git
    targetRevision: main
    path: kubernetes/observability
    helm:
      valueFiles:
        - values-production.yaml
      parameters:
        - name: global.clusterName
          value: "production-cluster"
        - name: prometheus.storage.size
          value: "100Gi"
        - name: loki.persistence.size
          value: "50Gi"
  
  destination:
    server: https://kubernetes.default.svc
    namespace: observability
  
  syncPolicy:
    automated:
      prune: true
      selfHeal: true
    syncOptions:
      - CreateNamespace=true
      - ApplyOutOfSyncOnly=true
  
  ignoreDifferences:
    - group: apps
      kind: Deployment
      jqPathExpressions:
        - .spec.replicas

---
# kubernetes/observability/kustomization.yaml
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: observability

resources:
  - namespace.yaml
  - prometheus-stack/
  - loki-stack/
  - jaeger/
  - grafana/
  - otel-collector/
  - alerts/
  - dashboards/

configMapGenerator:
  - name: observability-config
    files:
      - prometheus-rules.yaml
      - alertmanager-config.yaml
      - logging-pipelines.yaml

patchesStrategicMerge:
  - resource-limits-patch.yaml

---
# kubernetes/observability/alerts/critical-alerts.yaml
apiVersion: monitoring.coreos.com/v1
kind: PrometheusRule
metadata:
  name: critical-alerts
  namespace: observability
spec:
  groups:
    - name: kubernetes-apps
      rules:
        - alert: HighErrorRate
          expr: |
            rate(http_requests_total{status=~"5.."}[5m]) * 100
            /
            rate(http_requests_total[5m]) > 10
          for: 2m
          labels:
            severity: critical
            team: platform
          annotations:
            summary: "High error rate detected"
            description: "Error rate is {{ $value }}% for service {{ $labels.service }}"
        
        - alert: PodCrashLooping
          expr: |
            rate(kube_pod_container_status_restarts_total[15m]) * 60 * 5 > 0
          for: 5m
          labels:
            severity: warning
          annotations:
            summary: "Pod is crash looping"
            description: "Pod {{ $labels.pod }} in namespace {{ $labels.namespace }} is restarting frequently"

  

# slo/user-service-slo.yaml
apiVersion: sloth.slok.dev/v1
kind: PrometheusServiceLevel
metadata:
  name: user-service
  namespace: observability
spec:
  service: "user-service"
  labels:
    team: "user-platform"
    tier: "1"
  
  slos:
    - name: "availability"
      objective: 99.9
      description: "User service HTTP availability SLO"
      sli:
        events:
          errorQuery: sum(rate(http_request_duration_seconds_count{job="user-service", status=~"5.."}[{{.window}}]))
          totalQuery: sum(rate(http_request_duration_seconds_count{job="user-service"}[{{.window}}]))
      alerting:
        name: UserServiceAvailabilityWarning
        labels:
          severity: warning
          channel: "#alerts-platform"
        annotations:
          summary: "User service availability SLO warning"
          description: "User service availability is currently at {{.sli}}% (objective: 99.9%)"
        
        name: UserServiceAvailabilityCritical
        labels:
          severity: critical
          channel: "#alerts-critical"
        annotations:
          summary: "User service availability SLO critical"
          description: "User service availability is currently at {{.sli}}% (objective: 99.9%)"
    
    - name: "latency"
      objective: 99.5
      description: "User service API latency SLO"
      sli:
        events:
          errorQuery: |
            sum(rate(http_request_duration_seconds_bucket{job="user-service", le="0.5"}[{{.window}}]))
          totalQuery: sum(rate(http_request_duration_seconds_count{job="user-service"}[{{.window}}]))
      alerting:
        name: UserServiceLatencyWarning
        labels:
          severity: warning
        annotations:
          summary: "User service latency SLO warning"
        
        name: UserServiceLatencyCritical
        labels:
          severity: critical

---
# slo/slo-renderer-job.yaml
apiVersion: batch/v1
kind: CronJob
metadata:
  name: slo-renderer
  namespace: observability
spec:
  schedule: "*/5 * * * *"
  jobTemplate:
    spec:
      template:
        spec:
          containers:
          - name: sloth
            image: slok/sloth:latest
            args:
            - generate
            - -i
            - /slo/manifests
            - -o
            - /slo/generated
            - --label
            - sloth.slok.dev/role=generated
            volumeMounts:
            - name: slo-manifests
              mountPath: /slo/manifests
            - name: slo-generated
              mountPath: /slo/generated
          volumes:
          - name: slo-manifests
            configMap:
              name: slo-manifests
          - name: slo-generated
            emptyDir: {}
          restartPolicy: OnFailure