spring-on-k8s

spring-on-k8s is a reference implementation of a production-pattern Spring Boot 4 service deployed on Kubernetes. It provides a complete path from source to signed container image, focusing on best practices for runtime operations and delivery. The runtime surface exposes REST controllers with OpenAPI documentation via springdoc-openapi. It includes Micrometer and Prometheus instrumentation for metrics, Actuator-backed liveness and readiness probes, and ConfigMap-driven configuration using Spring's configtree property source. The delivery surface covers deployment via Carvel (ytt and kapp), a local end-to-end testing harness using KinD and cloud-provider-kind, and a supply-chain-hardened GitHub Actions pipeline. The CI/CD process includes Trivy vulnerability scanning, OWASP ZAP dynamic application security testing, and cosign keyless OIDC signing. The project uses a mise-pinned toolchain and Renovate for dependency management. Key features include a multi-stage Docker build with a non-root user, static analysis with Checkstyle and hadolint, secret scanning with gitleaks, and a comprehensive set of Make targets for building, testing, deploying, and security checks. The repository also includes C4 diagrams to visualize the system architecture and deployment views.