feat: modernize application — source, platform artifacts, CI/CD (#3)

.gitea/workflows/techdocs.yml

@@ -0,0 +1,52 @@
+name: Build and Publish TechDocs
+
+on:
+  push:
+    branches: [main]
+    paths:
+      - "docs/**"
+      - "mkdocs.yml"
+      - "catalog-info.yaml"
+  workflow_dispatch: {}
+
+env:
+  AZURE_FEDERATED_TOKEN_FILE: /var/run/secrets/azure/tokens/azure-identity-token
+  AZURE_ACCOUNT_NAME: "bstagecjotdevsttechdocs"
+  ENTITY_NAMESPACE: default
+  ENTITY_KIND: component
+  ENTITY_NAME: demo-raj-1
+
+jobs:
+  build-and-publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+      - name: Install dependencies
+        run: |
+          apt-get update -qq && apt-get install -y python3-pip
+          pip3 install mkdocs-techdocs-core==1.*
+          npm install -g @techdocs/cli
+      - name: Build TechDocs site
+        run: techdocs-cli generate --source-dir . --output-dir ./site --no-docker --verbose
+      - name: Install Azure CLI
+        run: |
+          if ! command -v az &>/dev/null; then curl -sL https://aka.ms/InstallAzureCLIDeb | bash; fi
+      - name: Azure login (OIDC)
+        run: |
+          az login \
+            --service-principal \
+            --username "$AZURE_CLIENT_ID" \
+            --tenant "$AZURE_TENANT_ID" \
+            --federated-token "$(cat $AZURE_FEDERATED_TOKEN_FILE)"
+      - name: Publish TechDocs site
+        run: |
+          techdocs-cli publish \
+            --publisher-type azureBlobStorage \
+            --storage-name "techdocs" \
+            --azureAccountName "$AZURE_ACCOUNT_NAME" \
+            --entity "$ENTITY_NAMESPACE/$ENTITY_KIND/$ENTITY_NAME"

Dockerfile

@@ -0,0 +1,30 @@
+# Multi-stage Dockerfile for Spring Boot Application
+FROM maven:3.9-eclipse-temurin-17 AS build
+WORKDIR /app
+
+# Copy dependency files first for better caching
+COPY pom.xml .
+RUN mvn dependency:go-offline -B
+
+# Copy source code and build
+COPY src ./src
+RUN mvn clean package -DskipTests
+
+# Runtime stage - lean JRE for Spring Boot executable JAR (~200MB vs ~500MB Tomcat)
+FROM mcr.microsoft.com/openjdk/jdk:17-ubuntu
+WORKDIR /app
+
+# Create non-root user for security
+RUN groupadd -g 1001 appuser && useradd -u 1001 -g appuser -s /bin/sh appuser && \
+    chown -R appuser:appuser /app
+USER appuser
+
+COPY --from=build /app/target/*.jar app.jar
+
+EXPOSE 8080
+
+# Health check
+HEALTHCHECK --interval=30s --timeout=3s --start-period=30s --retries=3 \
+  CMD wget --no-verbose --tries=1 --spider http://localhost:8080/actuator/health || exit 1
+
+CMD ["java", "-jar", "app.jar"]

catalog-info.yaml

@@ -1,65 +1,44 @@
-
 apiVersion: backstage.io/v1alpha1
 kind: Component
 metadata:
-  name: demo-raj-1
-  description: 'demo-raj-1 — renovated onto the crucible platform orchestrator'
   annotations:
-    gitea.kyndemo.live/project-slug: validate/demo-raj-1
-    gitea.kyndemo.live/repo-slug: validate/demo-raj-1
-    # The orchestrator names each environment's namespace ns-xxxxx at deploy time, so a
-    # namespace can never be known here -- pinning one only hides the workload. Omitted
-    # deliberately: the Kubernetes plugin then searches every namespace it is given.
-    #
-    # kubernetes-id matches the label the score-workload module propagates from the Score
-    # metadata.labels block. The previous selector, app.humanitec.io/name=..., was a
-    # Humanitec SaaS label that nothing on this platform has ever set.
     backstage.io/kubernetes-id: demo-raj-1
     backstage.io/techdocs-ref: dir:.
-    # Vestigial key names, live values. These drive the Orchestrator tab, which reads
-    # humanitec.dev/orgId and humanitec.dev/projectId; renaming the keys would break every
-    # entity already in the catalog, so the names stay and the values point at crucible.
-    humanitec.dev/orgId: crucible
-    # THE PROJECT IS THE APPLICATION. This was `apps-cluster`, a single project shared by
-    # every renovated app, which is why the Orchestrator tab on any one component listed the
-    # whole estate -- the tab shows a project's environments, and every app's environment
-    # lived in that one project. Now each app owns a project, so the tab shows this app's
-    # stages and nothing else. The deploy workflow creates the project, its runner rule and
-    # its environments on first deploy.
-    humanitec.dev/projectId: demo-raj-1
-    # The environments are now STAGES of this application -- dev, staging, prod -- rather
-    # than one environment named after the component.
-    humanitec.dev/appId: demo-raj-1
     cjot.io/target-domain: apps
+    gitea.kyndemo.live/project-slug: validate/demo-raj-1
+    gitea.kyndemo.live/repo-slug: validate/demo-raj-1
+    grafana.com/dashboard-url: https://grafana.kyndemo.live/d/otel-app-observability-v2/opentelemetry-application-observability?orgId=1&var-app=demo-raj-1
+    grafana/alert-label-selector: app=demo-raj-1
+    grafana/dashboard-selector: uid == 'otel-app-observability-v2'
+    grafana/grafana-instance: default
+    humanitec.dev/appId: demo-raj-1
+    humanitec.dev/orgId: crucible
+    humanitec.dev/projectId: demo-raj-1
     sonarqube.org/project-key: demo-raj-1
-    grafana/grafana-instance: "default"
+  description: "demo-raj-1 \u2014 renovated onto the crucible platform orchestrator"
-    grafana/alert-label-selector: "app=demo-raj-1"
+  links:
-    grafana/dashboard-selector: "uid == 'otel-app-observability-v2'"
+  - icon: dashboard
-    grafana.com/dashboard-url: "https://grafana.kyndemo.live/d/otel-app-observability-v2/opentelemetry-application-observability?orgId=1&var-app=demo-raj-1"
+    title: Orchestrator Console
+    url: https://console.dev.orchestrator.crucible.kyndemo.live/orgs/crucible/projects/demo-raj-1/environments/dev
+  - icon: web
+    title: Live Application
+    url: https://demo-raj-1.apps.dev.crucible.kyndemo.live
+  - icon: github
+    title: Source Repository
+    url: https://gitea.kyndemo.live/validate/demo-raj-1
+  - icon: code
+    title: CI/CD Pipelines
+    url: https://gitea.kyndemo.live/validate/demo-raj-1/actions
+  - icon: dashboard
+    title: Grafana Dashboard
+    url: https://grafana.kyndemo.live/d/otel-app-observability-v2/opentelemetry-application-observability?orgId=1&var-app=demo-raj-1
+  name: demo-raj-1
   tags:
   - platform-orchestrator
   - renovation
-  links:
-    # console.humanitec.dev is the dead SaaS. This is the live crucible console, deep-linked
-    # to the per-application environment the deploy workflow creates.
-    - url: https://console.dev.orchestrator.crucible.kyndemo.live/orgs/crucible/projects/demo-raj-1/environments/dev
-      title: Orchestrator Console
-      icon: dashboard
-    - url: https://demo-raj-1.apps.dev.crucible.kyndemo.live
-      title: Live Application
-      icon: web
-    - url: https://gitea.kyndemo.live/validate/demo-raj-1
-      title: Source Repository
-      icon: github
-    - url: https://gitea.kyndemo.live/validate/demo-raj-1/actions
-      title: CI/CD Pipelines
-      icon: code
-    - url: https://grafana.kyndemo.live/d/otel-app-observability-v2/opentelemetry-application-observability?orgId=1&var-app=demo-raj-1
-      title: Grafana Dashboard
-      icon: dashboard
 spec:
-  type: service
-  lifecycle: experimental
-  owner: platform-engineering
   dependsOn:
   - resource:default/cjot-aks
+  lifecycle: experimental
+  owner: platform-engineering
+  type: service

docs/api.md

@@ -0,0 +1,25 @@
+# API Reference
+
+## Endpoints
+
+### Health Check
+
+```
+GET /health
+```
+
+**Response:**
+```json
+{"status": "UP", "service": "demo-raj-1"}
+```
+
+### Root
+
+```
+GET /
+```
+
+**Response:**
+```json
+{"service": "demo-raj-1", "description": "Modernized demo-raj-1 service", "version": "1.0.0"}
+```

docs/architecture.md

@@ -0,0 +1,15 @@
+# Architecture
+
+## Service Design
+
+demo-raj-1 is a microservice following cloud-native patterns.
+
+## Technology Stack
+
+- **Runtime**: Java Spring Boot
+- **Deployment**: Humanitec Platform Orchestrator
+- **CI/CD**: Gitea Actions → ACR → Humanitec
+
+## Dependencies
+
+See `score.yaml` for external resource dependencies.

docs/index.md

@@ -0,0 +1,32 @@
+# demo-raj-1
+
+Modernized demo-raj-1 service
+
+## Overview
+
+This service is built with **Java Spring Boot** and follows the Golden Path architecture patterns.
+
+### Key Features
+
+- 🚀 Production-ready configuration
+- 📊 Prometheus metrics exposed
+- 🏥 Health check endpoints
+- 🔒 Security scanning in CI/CD
+- 📦 Containerized deployment
+
+## Quick Start
+
+```bash
+git clone https://gitea.kyndemo.live/kyndryl-demos/demo-raj-1.git
+cd demo-raj-1
+```
+
+## Monitoring
+
+- **Metrics**: Prometheus metrics at `/metrics`
+- **Health**: `/health`
+- **Grafana**: [View Dashboard](https://grafana.kyndemo.live/d/app-demo-raj-1)
+
+## Support
+
+Contact the Platform Engineering team.

docs/migration-plan.md

@@ -0,0 +1,45 @@
+# Modernization Plan for demo-raj-1
+
+## Application Type
+Java Application
+
+## Selected Modernization Strategy
+- **Migration Approach**: containerize-optimize
+- **Target Platform**: orchestrator
+- **Observability**: ENABLED (Prometheus metrics, health checks, tracing)
+- **Security Scanning**: ENABLED (Trivy vulnerability scanning)
+
+## Discovery Summary
+### Discovery Report
+
+#### Application Overview
+- **Type**: Java-based application
+- **Framework**: Spring Boot
+- **Build Tools**: Maven and Gradle (dual support)
+- **Purpose**: Likely a web application, possibly related to pet clinic management based on dependencies and API endpoints.
+
+#### Technology Stack
+- **Primary Language**: Java
+- **Frameworks**: Spring Boot (with modules for web, data, validation, caching, and actuator)
+- **Database**: H2 (in-memory), MySQL, PostgreSQL
+- **Frontend**: T...
+
+## Generated Artifacts
+1. **Dockerfile**: Optimized with health checks and metrics endpoints
+2. **score.yaml**: Platform intent with service ports and DNS resource
+3. **CI Workflow**: Automated build/push to ACR with Trivy security scanning
+
+## Next Steps
+1. Review and customize generated artifacts
+2. Test container build and run
+3. Deploy to development environment using score.yaml
+4. Validate application functionality
+5. Promote to staging/production via Humanitec
+
+## Migration Strategy Details
+
+### Containerize Optimize
+Add cloud-native patterns: health checks, metrics, optimized base images.
+
+### Platform: orchestrator
+score.yaml optimized for Azure Container Apps with managed scaling and Azure-specific configuration.

mkdocs.yml

@@ -0,0 +1,13 @@
+site_name: demo-raj-1
+site_description: Modernized demo-raj-1 service
+
+nav:
+  - Home: index.md
+  - Architecture: architecture.md
+  - API Reference: api.md
+
+plugins:
+  - techdocs-core
+
+theme:
+  name: material

openapi.yaml

@@ -0,0 +1,188 @@
+openapi: 3.0.3
+info:
+  title: demo-raj-1
+  description: Modernized demo-raj-1 service
+  version: 1.0.0
+servers:
+- url: https://demo-raj-1.kyndemo.live
+  description: Production
+- url: http://localhost:8080
+  description: Local development
+paths:
+  /health:
+    get:
+      summary: Health check
+      operationId: getHealth
+      tags:
+      - System
+      responses:
+        '200':
+          description: Healthy
+  /vets.html:
+    get:
+      summary: GET /vets.html
+      operationId: getVets.html
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /owners/{ownerId}/owners/{ownerId}:
+    get:
+      summary: GET /owners/{ownerId}/owners/{ownerId}
+      operationId: getOwners_ownerId_owners_ownerId
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+  /owners/{ownerId}/pets/new:
+    get:
+      summary: GET /owners/{ownerId}/pets/new
+      operationId: getOwners_ownerId_pets_new
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+  /owners/{ownerId}/pets/{petId}/edit:
+    get:
+      summary: GET /owners/{ownerId}/pets/{petId}/edit
+      operationId: getOwners_ownerId_pets_petId_edit
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: petId
+        in: path
+        required: true
+        schema:
+          type: string
+  /owners/{ownerId}/pets/{petId}/visits/new:
+    get:
+      summary: GET /owners/{ownerId}/pets/{petId}/visits/new
+      operationId: getOwners_ownerId_pets_petId_visits_new
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+      - name: petId
+        in: path
+        required: true
+        schema:
+          type: string
+  /owners/new:
+    get:
+      summary: GET /owners/new
+      operationId: getOwners_new
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /owners/find:
+    get:
+      summary: GET /owners/find
+      operationId: getOwners_find
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /owners:
+    get:
+      summary: GET /owners
+      operationId: getOwners
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /owners/{ownerId}/edit:
+    get:
+      summary: GET /owners/{ownerId}/edit
+      operationId: getOwners_ownerId_edit
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+  /owners/{ownerId}:
+    get:
+      summary: GET /owners/{ownerId}
+      operationId: getOwners_ownerId
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+      parameters:
+      - name: ownerId
+        in: path
+        required: true
+        schema:
+          type: string
+  /:
+    get:
+      summary: GET /
+      operationId: getRoot
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /oups:
+    get:
+      summary: GET /oups
+      operationId: getOups
+      responses:
+        '200':
+          description: Success
+        '400':
+          description: Bad request
+  /actuator/prometheus:
+    get:
+      summary: Prometheus metrics
+      operationId: getMetrics
+      tags:
+      - System
+      responses:
+        '200':
+          description: text/plain; Prometheus exposition format

score.yaml

@@ -1,55 +1,36 @@
 apiVersion: score.dev/v1b1
-metadata:
-  name: demo-raj-1
-  labels:
-    app: demo-raj-1
-
 containers:
-  main:
+  demo-raj-1:
     image: .
     variables:
-      # The Watcher's OTel work lands in overlays/otel/, which only ArgoCD reads. On the
+      OTEL_SERVICE_NAME: demo-raj-1
-      # orchestrator path nothing consumes that overlay, so without these variables the
+      OTEL_EXPORTER_OTLP_ENDPOINT: http://otel-collector.monitoring.svc.cluster.local:4318
-      # renovated app emits no telemetry at all and never appears in Grafana.
+      OTEL_EXPORTER_OTLP_PROTOCOL: http/protobuf
-      OTEL_SERVICE_NAME: "demo-raj-1"
+      OTEL_RESOURCE_ATTRIBUTES: service.name=demo-raj-1,app=demo-raj-1
-      OTEL_EXPORTER_OTLP_ENDPOINT: "http://otel-collector.monitoring.svc.cluster.local:4318"
+      OTEL_METRICS_EXPORTER: otlp
-      OTEL_EXPORTER_OTLP_PROTOCOL: "http/protobuf"
+      OTEL_TRACES_EXPORTER: otlp
-      OTEL_RESOURCE_ATTRIBUTES: "service.name=demo-raj-1"
+      OTEL_LOGS_EXPORTER: none
-      OTEL_METRICS_EXPORTER: "otlp"
+metadata:
-      OTEL_TRACES_EXPORTER: "otlp"
+  annotations:
-      OTEL_LOGS_EXPORTER: "none"
+    prometheus.io/path: /metrics
-
+    prometheus.io/port: '8080'
-service:
+    prometheus.io/scrape: 'true'
-  ports:
+  labels:
-    web:
+    app: demo-raj-1
-      port: 80
+    backstage.io/kubernetes-id: demo-raj-1
-      targetPort: 8080
+  name: demo-raj-1
-
 resources:
   env:
     type: environment
-
-  # Gives the renovated workload a public HTTPS URL. Without this the deploy still goes
-  # green and the pod still runs -- there is simply no Ingress, no certificate and no
-  # hostname, so the demo's payoff (curl the renovated app) has nothing to hit.
-  #
-  # hostname is hardcoded to the apps domain deliberately: it is the only domain the apps
-  # cluster serves, and both the wildcard A record (*.apps.dev) and the cert-manager
-  # ClusterIssuer are scoped to exactly it.
-  #
-  # service_port is the Score `service.ports.web.port` below (80), NOT the container port.
-  # An Ingress naming a Service or port that does not exist fails at neither plan nor
-  # apply -- it surfaces only as nginx answering 503.
-  #
-  # CAVEAT: modernization-factory's generate_score_yaml rewrites BOTH `port` and
-  # `targetPort` to the detected application port whenever that port is not 8080. An app
-  # on 3000 therefore ends up with a Service on 3000 and this Ingress pointing at a port
-  # that no longer exists. Apps already listening on 8080 (Spring PetClinic among them)
-  # skip that patch entirely and are unaffected.
   ingress:
-    type: workload-ingress
     params:
-      name: demo-raj-1
       hostname: demo-raj-1.apps.dev.crucible.kyndemo.live
+      name: demo-raj-1
       service_name: demo-raj-1
-      service_port: 80
+      service_port: 8080
+    type: workload-ingress
+service:
+  ports:
+    http:
+      port: 8080
+      targetPort: 8080