spring:
  cloud:
    gateway:
      routes:
        - id: account-service
          uri: lb://account-service
          predicates:
            - Path=/api/v1/accounts/**
          filters:
            - name: RequestRateLimiter
              args:
                redis-rate-limiter.replenishRate: 100
                redis-rate-limiter.burstCapacity: 200

{
  "iss": "https://auth.bank.com/auth/realms/bank",
  "sub": "a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "aud": "account-service",
  "exp": 1715239200,
  "iat": 1715235600,
  "realm_access": {
    "roles": ["bank_admin", "account_viewer"]
  },
  "resource_access": {
    "account-service": {
      "roles": ["read", "write"]
    }
  }
}

# application.yml in Config Server
spring:
  cloud:
    config:
      server:
        git:
          uri: https://git.bank.com/config-repo
          default-label: main
          search-paths: '{application}'

# bootstrap.yml in each microservice
spring:
  application:
    name: account-service
  cloud:
    config:
      uri: http://config-server:8888
      fail-fast: true
      retry:
        initial-interval: 1000
        max-attempts: 5

spring:
  cloud:
    vault:
      host: vault.bank.com
      port: 8200
      scheme: https
      authentication: KUBERNETES
      kubernetes:
        role: account-service
        service-account-token-file: /var/run/secrets/kubernetes.io/serviceaccount/token
      database:
        enabled: true
        role: account-db-role
        backend: database

@Configuration
@EnableCaching
public class RedisConfig {

    @Bean
    public RedisCacheManager cacheManager(RedisConnectionFactory factory) {
        RedisCacheConfiguration config = RedisCacheConfiguration.defaultCacheConfig()
            .entryTtl(Duration.ofMinutes(5))
            .serializeKeysWith(
                RedisSerializationContext.SerializationPair.fromSerializer(
                    new StringRedisSerializer()))
            .serializeValuesWith(
                RedisSerializationContext.SerializationPair.fromSerializer(
                    new GenericJackson2JsonRedisSerializer()));

        return RedisCacheManager.builder(factory)
            .cacheDefaults(config)
            .build();
    }
}

{
  "event_id": "evt_a1b2c3d4-e5f6-7890-abcd-ef1234567890",
  "event_type": "TRANSACTION_COMPLETED",
  "source": "transaction-service",
  "timestamp": "2026-05-09T10:00:00Z",
  "trace_id": "trace_abc123",
  "data": {
    "transaction_id": "txn_987654",
    "from_account": "ACC-1001",
    "to_account": "ACC-2002",
    "amount": 500.0,
    "currency": "USD",
    "status": "COMPLETED"
  }
}

@Service
public class EventPublisher {

    private final KafkaTemplate<String, DomainEvent> kafkaTemplate;

    public EventPublisher(KafkaTemplate<String, DomainEvent> kafkaTemplate) {
        this.kafkaTemplate = kafkaTemplate;
    }

    public void publish(DomainEvent event) {
        kafkaTemplate.send(event.getTopic(), event.getEventId(), event);
    }
}

@Component
public class NotificationConsumer {

    @KafkaListener(topics = {
        "user-events",
        "transaction-events",
        "payment-events"
    }, groupId = "notification-service")
    public void handleEvent(DomainEvent event) {
        switch (event.getEventType()) {
            case "TRANSACTION_COMPLETED" -> sendTransactionNotification(event);
            case "PAYMENT_RECEIVED" -> sendPaymentNotification(event);
            case "USER_REGISTERED" -> sendWelcomeEmail(event);
        }
    }
}

@Configuration
public class TracingConfig {

    @Bean
    public Tracer tracer() {
        return BraveTracer.create(
            Tracing.newBuilder()
                .localServiceName("account-service")
                .spanReporter(ZipkinReporter.create(
                    "http://zipkin:9411/api/v2/spans"))
                .build()
        );
    }
}

@RestController
public class AccountController {

    private final MeterRegistry meterRegistry;
    private final Counter accountCreatedCounter;

    public AccountController(MeterRegistry meterRegistry) {
        this.meterRegistry = meterRegistry;
        this.accountCreatedCounter = Counter.builder("accounts.created.total")
            .description("Total number of accounts created")
            .register(meterRegistry);
    }

    @PostMapping
    public ResponseEntity<Account> createAccount(@RequestBody AccountRequest request) {
        Account account = accountService.create(request);
        accountCreatedCounter.increment();
        return ResponseEntity.status(201).body(account);
    }
}

{
  "timestamp": "2026-05-09T10:00:00.123Z",
  "level": "INFO",
  "service": "account-service",
  "trace_id": "trace_abc123",
  "span_id": "span_def456",
  "user_id": "usr_7890",
  "message": "Account created successfully",
  "account_id": "ACC-1001",
  "duration_ms": 45
}

@Configuration
@EnableWebSecurity
@EnableMethodSecurity
public class SecurityConfig {

    @Bean
    public SecurityFilterChain filterChain(HttpSecurity http) throws Exception {
        http
            .csrf(AbstractHttpConfigurer::disable)
            .sessionManagement(session ->
                session.sessionCreationPolicy(SessionCreationPolicy.STATELESS))
            .authorizeHttpRequests(auth -> auth
                .requestMatchers("/api/v1/admin/**").hasRole("BANK_ADMIN")
                .requestMatchers("/api/v1/accounts/**").hasAnyRole("BANK_USER", "BANK_ADMIN")
                .requestMatchers("/api/v1/transactions/**").authenticated()
                .anyRequest().authenticated()
            )
            .oauth2ResourceServer(oauth2 ->
                oauth2.jwt(Customizer.withDefaults()));

        return http.build();
    }
}

FROM eclipse-temurin:21-jre-alpine AS builder
WORKDIR /app
COPY target/*.jar app.jar
RUN java -Djarmode=layertools -jar app.jar extract

FROM eclipse-temurin:21-jre-alpine
RUN addgroup -S appgroup && adduser -S appuser -G appgroup
WORKDIR /app
COPY --from=builder /app/dependencies/ ./
COPY --from=builder /app/spring-boot-loader/ ./
COPY --from=builder /app/snapshot-dependencies/ ./
COPY --from=builder /app/application/ ./
USER appuser
EXPOSE 8080
ENTRYPOINT ["java", "org.springframework.boot.loader.launch.JarLauncher"]

apiVersion: apps/v1
kind: Deployment
metadata:
  name: account-service
  namespace: banking
spec:
  replicas: 3
  selector:
    matchLabels:
      app: account-service
  template:
    metadata:
      labels:
        app: account-service
    spec:
      serviceAccountName: account-service-sa
      containers:
        - name: account-service
          image: bank.registry/account-service:latest
          ports:
            - containerPort: 8080
          env:
            - name: SPRING_PROFILES_ACTIVE
              value: 'k8s'
            - name: VAULT_ADDR
              value: 'https://vault.bank.com:8200'
          resources:
            requests:
              memory: '512Mi'
              cpu: '250m'
            limits:
              memory: '1Gi'
              cpu: '500m'
          livenessProbe:
            httpGet:
              path: /actuator/health/liveness
              port: 8080
            initialDelaySeconds: 30
            periodSeconds: 10
          readinessProbe:
            httpGet:
              path: /actuator/health/readiness
              port: 8080
            initialDelaySeconds: 20
            periodSeconds: 5
---
apiVersion: v1
kind: Service
metadata:
  name: account-service
  namespace: banking
spec:
  selector:
    app: account-service
  ports:
    - port: 8080
      targetPort: 8080

apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
  name: account-service-hpa
  namespace: banking
spec:
  scaleTargetRef:
    apiVersion: apps/v1
    kind: Deployment
    name: account-service
  minReplicas: 3
  maxReplicas: 10
  metrics:
    - type: Resource
      resource:
        name: cpu
        target:
          type: Utilization
          averageUtilization: 70
    - type: Resource
      resource:
        name: memory
        target:
          type: Utilization
          averageUtilization: 80