Title: Docker Compose To Kubernetes Migration
Domain: computing_math — Infrastructure Engineering & Cloud Operations

Summary: Migrate a 3-tier Docker Compose web app (React, Flask, PostgreSQL) to a production-grade Helm chart on local Minikube, plus matching Terraform and a CI/CD pipeline; deliverables are scored on a weighted Helm/Terraform/CI/CD/verification rubric.

Task prompt:
You are migrating a Docker Compose 3-tier web application (React frontend, Flask backend, PostgreSQL) to a production-grade Kubernetes deployment on a local Minikube cluster.

## Working Directory
Task root on this VM:
- `base`

Agent-visible inputs:
- Compose source + app code: `base/input/app/`
- Architecture spec:        `base/input/requirements.md`
- Task README:              `base/input/README.md`

Use the task-local software entry points under `base/software` rather
than raw PATH commands:
- Docker:     `base/software/docker`
- Minikube:   `base/software/minikube`
- kubectl:    `base/software/kubectl`
- Helm:       `base/software/helm`
- Terraform:  `base/software/terraform`
- Trivy:      `base/software/trivy`

Write all deliverables here:
- `base/output`

## Required Deliverables

1. Helm chart at `output/helm/webapp-chart/`:
   - `Chart.yaml` (valid YAML, with `name`)
   - `values.yaml`
   - Templates covering 8 Kubernetes resources:
     Deployment/frontend (2 replicas, limits 256Mi/500m),
     Deployment/backend  (2 replicas, limits 512Mi/1000m, readiness + liveness
       probes on `/health`),
     StatefulSet/db      (1 replica, PVC request 5Gi),
     ConfigMap, Secret (base64 only — no plaintext), HPA (min=2, max=5, 70% CPU),
     NetworkPolicy (only backend tier may reach db tier), Ingress
     (`/` → frontend, `/api` → backend). Every resource must carry the label
     `app=webapp`.

2. Terraform config at `output/terraform/`:
   - `required_providers` block
   - every `variable` has a `description`
   - at least one `output` block
   - Minikube resource references `cni=calico` and addons
     `ingress`, `metrics-server`, `storage-provisioner`

3. GitHub Actions workflow at
   `output/.github/workflows/deploy.yml` with 5 stages:
   `build` (`docker build`), `test` (`pytest` + `npm test`), `security`
   (`trivy`), `deploy` (`helm upgrade`), `verify` (`rollout status`).

4. Live verification text snapshots under
   `output/verification/` — `pods.txt`, `services.txt`,
   `helm-status.txt`, `health-check.txt` — captured from the running cluster.

## Expected Minikube Startup

```
base/software/minikube start --driver=docker --cpus=4 --memory=8192 --kubernetes-version=v1.29.0 --cni=calico --addons=ingress,metrics-server,storage-provisioner
```

The `software/minikube`, `software/kubectl`, and `software/helm` wrappers
already point their kube state and caches at `/media/user/data/...` so the
root partition does not fill. Calico is required for NetworkPolicy
enforcement; metrics-server is required for HPA to report a CPU target.

## Success Criteria

- `Chart.yaml` parses as YAML and declares a `name` (hard gate otherwise).
- `values.yaml` is present (hard gate otherwise).
- Secrets must carry only base64-encoded values (no plaintext) (hard gate otherwise).
- `helm template` renders the chart without error (hard gate otherwise).
- Static checks (Helm resource coverage, config correctness, Terraform, CI/CD,
  verification files) contribute up to 70% of the score.
- Verification snapshots (pod status / services / health endpoint) contribute
  up to another ~21%. Full credit requires a running Minikube cluster.

The agent must:
Read `input/requirements.md` and `input/README.md` first; these list the architectural targets and which resources, replicas, probes, and policies must end up in the Helm chart.
Use the task-local wrappers under `software/` instead of raw PATH commands: `software/docker`, `software/minikube`, `software/kubectl`, `software/helm`, `software/terraform`, and `software/trivy`.
Author a Helm chart under `output/helm/webapp-chart/` with valid `Chart.yaml`, `values.yaml`, and templates for 8 resources: Deployment/frontend (2 replicas, limits 256Mi/500m), Deployment/backend (2 replicas, limits 512Mi/1000m, readiness + liveness probes), StatefulSet/db (PVC 5Gi), ConfigMap, Secret (base64 only, no `stringData`), HPA (min=2 max=5, 70% CPU), NetworkPolicy (only backend→db), Ingress (`/`→frontend, `/api`→backend). Every resource must carry the label `app=webapp`.
Author Terraform under `output/terraform/` with a `required_providers` block, described variables, at least one `output` block, and a Minikube resource referencing `cni=calico` plus the `ingress`, `metrics-server`, and `storage-provisioner` addons.
Author `output/.github/workflows/deploy.yml` with five stages: `build` (docker build), `test` (pytest + npm test), `security` (trivy), `deploy` (helm upgrade), `verify` (rollout status).
Bring up Minikube with `software/minikube start --driver=docker --cpus=4 --memory=8192 --kubernetes-version=v1.29.0 --cni=calico --addons=ingress,metrics-server,storage-provisioner`; the wrapper already stores state on the data disk.
Deploy the Helm chart and capture `output/verification/{pods.txt,services.txt,helm-status.txt,health-check.txt}` from the running cluster (pods all `Running`, services with non-empty CLUSTER-IP, `health-check.txt` mentioning `200` and `healthy`).
Do not introduce plaintext secrets via `stringData:` and do not delete or modify anything under `input/`.

Software: Docker
Minikube
kubectl
Helm
Terraform
Trivy
Python

Input files:
name: Architecture spec
format: markdown
path: input/requirements.md
description: Detailed Kubernetes spec: replicas, resource limits, HPA, NetworkPolicy, probes, CI/CD stages.
name: Task README
format: markdown
path: input/README.md
description: Public agent-facing task overview; lists deliverables and Minikube startup command without revealing hidden scoring details.
name: Docker Compose source
format: yaml
path: input/app/docker-compose.yml
description: Three-service Compose definition (frontend:3000, backend:5000, db:5432) and dependency graph.
name: Frontend app
format: directory
path: input/app/frontend/
description: React app with multi-stage Dockerfile (Node 18 build + Nginx serve).
name: Backend app
format: directory
path: input/app/backend/
description: Flask API source, Dockerfile, `requirements.txt`, and pytest tests.
name: Database init
format: sql
path: input/app/db/init.sql
description: PostgreSQL schema plus seed rows used to validate the StatefulSet bring-up.
name: Software wrappers
format: text
path: software/README.txt
description: Pinned task-local wrapper contract for `software/docker`, `software/minikube`, `software/kubectl`, `software/helm`, `software/terraform`, and `software/trivy`.