B システム設計/インフラ — banner-api GCE Ingress→Gateway API移行（HTTPRoute重み付けトラフィック分割 × HealthCheckPolicy × GCPBackendPolicy（Cloud Armor接続） × DataDogメトリクスベース段階的カナリア昇格(10%→50%→100%)・自動ロールバック）（MOps 販促システムチーム バナー配信API カナリアリリース事故 Bad→Good）

📋 コピー# ── Gateway（GKE Gateway Controller、外部公開）──────
resource "kubernetes_manifest" "banner_gateway" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1"
    kind       = "Gateway"
    metadata = { name = "banner-gateway", namespace = "mops" }
    spec = {
      gatewayClassName = "gke-l7-global-external-managed"
      listeners = [{
        name = "https", port = 443, protocol = "HTTPS"
        tls = {
          mode = "Terminate"
          certificateRefs = [{ name = "banner-api-tls-cert" }]
        }
      }]
    }
  }
}

# ── HealthCheckPolicy（修正③: readiness実態に合わせる）──
resource "kubernetes_manifest" "banner_healthcheck_policy" {
  manifest = {
    apiVersion = "networking.gke.io/v1"
    kind       = "HealthCheckPolicy"
    metadata   = { name = "banner-api-healthcheck", namespace = "mops" }
    spec = {
      targetRef = { group = "", kind = "Service", name = "banner-api-stable" }
      default = {
        checkIntervalSec = 10, timeoutSec = 5
        healthyThreshold = 2, unhealthyThreshold = 3
        config = {
          type = "HTTP"
          httpHealthCheck = { requestPath = "/healthz", port = 8080 }
        }
      }
    }
  }
}

# ── GCPBackendPolicy（修正④: Cloud Armor接続）──────
resource "kubernetes_manifest" "banner_backend_policy" {
  manifest = {
    apiVersion = "networking.gke.io/v1"
    kind       = "GCPBackendPolicy"
    metadata   = { name = "banner-api-backend-policy", namespace = "mops" }
    spec = {
      targetRef = { group = "", kind = "Service", name = "banner-api-stable" }
      default = { securityPolicy = google_compute_security_policy.banner_api_armor.name }
    }
  }
}

resource "google_compute_security_policy" "banner_api_armor" {
  name = "banner-api-armor-policy"
  rule {
    action = "throttle", priority = 1000
    match {
      versioned_expr = "SRC_IPS_V1"
      config { src_ip_ranges = ["*"] }
    }
    rate_limit_options {
      conform_action = "allow", exceed_action = "deny(429)"
      rate_limit_threshold { count = 100, interval_sec = 60 }  # ボット対策
    }
  }
  rule {
    action = "allow", priority = 2147483647
    match { versioned_expr = "SRC_IPS_V1", config { src_ip_ranges = ["*"] } }
  }
}

# ── HTTPRoute（修正①②: ネイティブ重み付け分割）──────
resource "kubernetes_manifest" "banner_httproute" {
  manifest = {
    apiVersion = "gateway.networking.k8s.io/v1"
    kind       = "HTTPRoute"
    metadata   = { name = "banner-api-route", namespace = "mops" }
    spec = {
      parentRefs = [{ name = "banner-gateway" }]
      rules = [{
        matches = [{ path = { type = "PathPrefix", value = "/banners" } }]
        backendRefs = [
          { name = "banner-api-stable", port = 80, weight = var.canary_weight_stable },
          { name = "banner-api-canary", port = 80, weight = var.canary_weight_canary },
        ]
      }]
    }
  }
}

# 修正⑦: 重みをTerraform変数として明示（暗黙のマジックナンバー排除）
variable "canary_weight_canary" { type = number, default = 10 }
variable "canary_weight_stable" { type = number, default = 90 }