A+B 複合 — Generic[T] × Ok[T]/Err × ParamSpec × TypeIs（型安全 Result 型 Bad→Good Ch2/Ch4/Ch10）× GKE Gateway API × HTTPRoute × ReferenceGrant × GCPManagedCertificate × SSL Policy MODERN（Terraform）

📋 コピー# 正常系
res1: Ok[int] | Err = run_job(int, "42")
if is_ok(res1):
    val: int = res1.value   # mypy: int として正確に推論（Any ではない）
    print(val + 1)          # → 43

# 異常系（例外を Err に変換）
res2: Ok[int] | Err = run_job(int, "not_a_number")
if is_ok(res2):
    print(res2.value)
else:
    # TypeIs の双方向ナローイング: ここでは res2 が Err として推論される
    print(res2.message)     # → "int 失敗: invalid literal for int()..."
    print(type(res2.exc))   # → <class 'ValueError'>（握りつぶし禁止）

# 複数ジョブの集計
jobs = [run_job(int, s) for s in ["1", "2", "bad", "4"]]
oks, errs = collect_results(jobs)
print(oks)       # → [1, 2, 4]
print(len(errs)) # → 1

# Ok は frozen=True で変更不可（値オブジェクトの不変性）
res3 = run_job(str.upper, "hello")
if is_ok(res3):
    try:
        res3.value = "world"  # type: ignore[misc]
    except Exception:
        print("FrozenInstanceError: slots=True で変更不可")

# PEP 695 型エイリアス
r: Result[str] = Ok(value="hello")
print(isinstance(r, Ok))  # → True

# ParamSpec 型安全確認
def fetch(url: str, timeout: int) -> bytes:
    return b"response"

res4: Ok[bytes] | Err = run_job(fetch, "https://example.com", 30)
# run_job(fetch, "https://example.com", "not_int")  # mypy: 型エラー（P 保持）

📋 コピー# terraform/modules/mops-gateway/main.tf
# GKE Gateway API × HTTPRoute × ReferenceGrant × GCPManagedCertificate

locals {
  project_id     = var.project_id
  region         = var.region
  domain_mops    = "api.mops.example.com"
  domain_payment = "api.payment.example.com"
}

# ── 1. GCPManagedCertificate — TLS 証明書の自動管理 ─────────────────────────────
# Before: certbot cron で手動更新（更新失敗リスク・監視必要）
# After: Google が自動プロビジョニング・更新（zero-ops）
resource "kubernetes_manifest" "mops_cert" {
  manifest = {
    apiVersion = "networking.gke.io/v1"
    kind       = "ManagedCertificate"
    metadata = {
      name      = "mops-cert"
      namespace = "gateway-ns"
    }
    spec = {
      # 両ドメインを 1 つの ManagedCertificate で管理（SAN 証明書）
      domains = [local.domain_mops, local.domain_payment]
    }
  }
}

# ── 2. SSL Policy — TLS 1.2+ / 推奨暗号スイートのみ ────────────────────────────
# Before: SSL ポリシー未設定（TLS 1.0/1.1・弱い暗号が使用可能）
# After: MODERN プロファイルで TLS 1.2+ のみ許可（PCI DSS 準拠）
resource "google_compute_ssl_policy" "mops_ssl_policy" {
  name            = "mops-ssl-policy"
  project         = local.project_id
  profile         = "MODERN"     # ECDHE-ECDSA-AES128-GCM-SHA256 等の推奨スイートのみ
  min_tls_version = "TLS_1_2"   # TLS 1.0/1.1 を拒否
}

# ── 3. FrontendConfig — HTTP → HTTPS リダイレクト ────────────────────────────────
resource "kubernetes_manifest" "mops_frontend_config" {
  manifest = {
    apiVersion = "networking.gke.io/v1beta1"
    kind       = "FrontendConfig"
    metadata = {
      name      = "mops-frontend-config"
      namespace = "gateway-ns"
    }
    spec = {
      redirectToHttps = {
        enabled          = true
        responseCodeName = "MOVED_PERMANENTLY_DEFAULT"  # 301 リダイレクト
      }
      sslPolicy = google_compute_ssl_policy.mops_ssl_policy.name
    }
  }
  depends_on = [google_compute_ssl_policy.mops_ssl_policy]
}

# ── 4. Gateway — GKE L7 External Load Balancer ──────────────────────────────────
# Before: NGINX Ingress（コントローラー自前運用・アップグレード負荷）
# After: GKE マネージド GatewayClass（インフラを Google が管理）
resource "kubernetes_manifest" "mops_gateway" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1"
    kind       = "Gateway"
    metadata = {
      name      = "mops-gateway"
      namespace = "gateway-ns"
      annotations = {
        # GCPManagedCertificate を参照
        "networking.gke.io/managed-certificates"   = "mops-cert"
        # FrontendConfig で HTTP→HTTPS リダイレクト + SSL Policy を適用
        "networking.gke.io/v1beta1.FrontendConfig" = "mops-frontend-config"
      }
    }
    spec = {
      # GKE が提供する GatewayClass（自前で GatewayClass を作成不要）
      gatewayClassName = "gke-l7-global-external-managed"
      listeners = [
        # HTTP :80 → FrontendConfig で 301 リダイレクト
        {
          name     = "http"
          port     = 80
          protocol = "HTTP"
          allowedRoutes = { namespaces = { from = "All" } }
        },
        # HTTPS :443 — TLS を Gateway で終端（バックエンドは HTTP）
        {
          name     = "https"
          port     = 443
          protocol = "HTTPS"
          tls = {
            mode = "Terminate"  # TLS を Gateway で終端
            certificateRefs = [
              {
                group = "networking.gke.io"
                kind  = "ManagedCertificate"
                name  = "mops-cert"  # GCPManagedCertificate を参照
              }
            ]
          }
          # 全 namespace からの HTTPRoute アタッチを許可（ReferenceGrant で更に絞る）
          allowedRoutes = { namespaces = { from = "All" } }
        }
      ]
    }
  }
  depends_on = [
    kubernetes_manifest.mops_cert,
    kubernetes_manifest.mops_frontend_config,
  ]
}

# ── 5. ReferenceGrant — クロス namespace 参照の明示的許可 ────────────────────────
# Before: Ingress は namespace スコープ → クロス ns 参照不可（同一 ns に同居）
# After: ReferenceGrant で「参照される側」が許可を宣言（セキュリティ向上）
#
# 重要: ReferenceGrant は参照「される」側の namespace に配置する

resource "kubernetes_manifest" "mops_reference_grant" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1beta1"
    kind       = "ReferenceGrant"
    metadata = {
      name      = "allow-gateway-ns"
      namespace = "mops"  # ← 参照「される」側の namespace に配置
    }
    spec = {
      from = [
        {
          group     = "gateway.networking.k8s.io"
          kind      = "Gateway"
          namespace = "gateway-ns"  # ← 参照「する」側
        }
      ]
      to = [
        {
          group = ""      # core API group（Service）
          kind  = "Service"  # mops namespace の Service への参照を許可
        }
      ]
    }
  }
}

resource "kubernetes_manifest" "payment_reference_grant" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1beta1"
    kind       = "ReferenceGrant"
    metadata = {
      name      = "allow-gateway-ns"
      namespace = "payment"  # ← 決済チームが自分の namespace で許可を管理
    }
    spec = {
      from = [
        {
          group     = "gateway.networking.k8s.io"
          kind      = "Gateway"
          namespace = "gateway-ns"
        }
      ]
      to = [{ group = ""; kind = "Service" }]
    }
  }
}

# ── 6. HTTPRoute — MOps API パスルーティング（mops namespace）────────────────────
resource "kubernetes_manifest" "mops_api_route" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1"
    kind       = "HTTPRoute"
    metadata = {
      name      = "mops-api-route"
      namespace = "mops"  # MOps チームが自分の namespace で管理
    }
    spec = {
      parentRefs = [
        {
          name        = "mops-gateway"
          namespace   = "gateway-ns"  # クロス ns 参照（ReferenceGrant が許可）
          sectionName = "https"       # HTTPS listener のみに限定
        }
      ]
      hostnames = [local.domain_mops]
      rules = [
        {
          matches = [{ path = { type = "PathPrefix"; value = "/api/mops" } }]
          backendRefs = [
            {
              name      = "mops-api-svc"
              port      = 8080
              namespace = "mops"
              weight    = 100
            }
          ]
          # セキュリティヘッダーをレスポンスに追加
          filters = [
            {
              type = "ResponseHeaderModifier"
              responseHeaderModifier = {
                add = [
                  {
                    name  = "Strict-Transport-Security"
                    value = "max-age=31536000; includeSubDomains; preload"  # HSTS
                  },
                  {
                    name  = "X-Content-Type-Options"
                    value = "nosniff"
                  },
                  {
                    name  = "X-Frame-Options"
                    value = "DENY"
                  }
                ]
              }
            }
          ]
        }
      ]
    }
  }
  depends_on = [
    kubernetes_manifest.mops_gateway,
    kubernetes_manifest.mops_reference_grant,
  ]
}

# ── 7. HTTPRoute — 決済 API（payment namespace）────────────────────────────────
resource "kubernetes_manifest" "payment_api_route" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1"
    kind       = "HTTPRoute"
    metadata = {
      name      = "payment-api-route"
      namespace = "payment"  # 決済チームが自分の namespace で管理（PCI DSS スコープ分離）
    }
    spec = {
      parentRefs = [
        {
          name        = "mops-gateway"
          namespace   = "gateway-ns"
          sectionName = "https"
        }
      ]
      hostnames = [local.domain_payment]
      rules = [
        {
          matches = [{ path = { type = "PathPrefix"; value = "/api/payment" } }]
          backendRefs = [
            {
              name      = "payment-api-svc"
              port      = 8080
              namespace = "payment"
              weight    = 100
            }
          ]
        }
      ]
    }
  }
  depends_on = [
    kubernetes_manifest.mops_gateway,
    kubernetes_manifest.payment_reference_grant,
  ]
}