sirius/gcloud-lab
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

fix: resolve merge conflict in osint-dashboard values.yaml (keep real API config)

Browse source
This commit is contained in:
Hermes Agent 2026-05-21 14:17:52 +00:00
commit a433be1195
156 changed files with 7482 additions and 103 deletions
Show stats Download patch file Download diff file Expand all files Collapse all files

203
MIGRATION_PLAN.md Normal file
View file

@ -0,0 +1,203 @@
# Repository Reorganization Plan
## Goal
Enforce the rule: **gcloud-lab = Kubernetes manifests only. No application code.**
Application code (source, Dockerfiles, CI/CD workflows, Helm charts, deployment scripts) belongs in `hermes-projects/`. gcloud-lab should contain only K8s manifests, Terraform infrastructure modules, cluster configs, and infra controller configs.
---
## Current State
### gcloud-lab/ — Full Directory Audit
```
gcloud-lab/
├── apps/
│ ├── base/
│ │ ├── customer1/ [KEEP] K8s manifests (deployments, services, configmaps, secrets)
│ │ ├── monitoring/ [KEEP] K8s manifests (dashboards)
│ │ └── osint-dashboard/ [KEEP] Helm chart (templates, values.yaml, Chart.yaml)
│ ├── staging/
│ │ ├── customer1/ [KEEP] K8s overlay (kustomization.yaml)
│ │ └── osint-dashboard/ [KEEP] K8s overlay (kustomization.yaml)
│ └── vwap-monitor/ [MOVE] App code (Dockerfile, app/, deploy/)
├── clusters/ [KEEP] Cluster configs (devops-lab/*.yaml, flux-system/)
├── infrastructure/ [KEEP] Infra controllers, gatewayapi, gpus, tailnet
├── misc/ [KEEP] Terraform snippets + K8s YAML
├── modules/ [KEEP] Terraform modules (gke.tf, nodepool.tf, etc.)
├── scripts/ [KEEP] Setup scripts
├── .github/workflows/
│ ├── osint-dashboard-infra.yml [KEEP] Infra deployment workflow
│ └── trade-dashboard.yml [MOVE] CI for trade-dashboard app → hermes-projects/
├── .devcontainer.json [KEEP] Dev environment config
├── .sops.yaml [KEEP] SOPS encryption config
├── .terraform.lock.hcl [KEEP] Terraform lock
├── .gitignore [KEEP] Git ignore rules
├── mise.toml [KEEP] Tool version management
├── README.md [KEEP] (will be updated)
├── infra-tailnet.yaml [KEEP] Tailscale infra config
├── tailscale-0auth.yaml [KEEP] Tailscale config
├── rays-new-deployment.yaml [REVIEW] Orphan K8s deployment YAML — move to apps/base/
├── trade-dashboard/ [MOVE] Full FastAPI app → hermes-projects/trade-dashboard/
├── trading-platform/ [MOVE] Duplicate/deploy configs → hermes-projects/trading-platform/
├── trading-scripts/ [MOVE] Application code → hermes-projects/trading-scripts/
├── analyses/ [REMOVE] Research artifacts (not code, not infra)
└── plans/ [REMOVE] Planning docs (not code, not infra)
```
---
## Items to Move / Remove
### 1. `trade-dashboard/` → hermes-projects/trade-dashboard/
**What it is:** Full FastAPI application (not K8s manifests)
- `Dockerfile` — build config for the app
- `app/` — Python source code (main.py, models.py, schemas.py, database.py, requirements.txt, static/)
- `alembic/` — database migration scripts (env.py, versions/)
- `alembic.ini` — alembic config
**Also move:** `.github/workflows/trade-dashboard.yml` (CI workflow for this app)
**Already in gcloud-lab:** `apps/base/customer1/trade-dashboard/` — these are the K8s manifests for trade-dashboard (deployment.yaml, service.yaml, configmap.yaml, kustomization.yaml). **KEEP these** — they belong here.
### 2. `trading-platform/` → hermes-projects/trading-platform/
**What it is:** Duplicate/alternative deployment configs that overlap with hermes-projects/trading-platform/
Contents:
- `.github/workflows/` — 3 CI/CD workflows (build-push.yml, build-test.yml, deploy.yml)
- `README.md` — project readme
- `deploy/` — deployment configs:
- `ci-cd/` — additional CI workflows
- `docker-compose/` — docker-compose.dev.yml
- `dockerfiles/` — Dockerfiles (api-gateway, dashboard, data-service, execute-service, news-service)
- `helm/` — Helm charts (api-gateway, dashboard, data-service, execute-service, news-service)
- `k8s/` — raw K8s manifests (deployments, services, hpa, cert-manager, ingress)
- `mtls/` — mTLS README
- `scripts/` — deploy.sh, generate-mtls-certs.sh
- `dockerfiles/` — Dockerfiles (dashboard, data-service, execute-service, news-service)
- `helm/` — Helm chart with templates (trading-platform chart, values.yaml, secrets)
**Already in gcloud-lab:** `apps/base/customer1/trading-platform/` — these are the K8s manifests. **KEEP these** — they belong here.
**Already in hermes-projects:** `hermes-projects/trading-platform/` — source code exists here (dashboard, data-service, execute-service, news-service, data_infrastructure). The gcloud-lab trading-platform/ deploy/dockerfiles/helm content should be MERGED into hermes-projects/trading-platform/.
**Decision needed:** The `trading-platform/` in gcloud-lab has BOTH deploy configs (dockerfiles, helm, k8s manifests) AND CI workflows. The K8s manifests in `deploy/k8s/base/` are similar but NOT identical to what's in `apps/base/customer1/trading-platform/`. Need to decide which is authoritative.
### 3. `trading-scripts/` → hermes-projects/trading-scripts/
**What it is:** Application code (Python trading scripts)
- `market_data.py` — market data script
- `orb-monitor/` — monitoring tool (monitor.py, config.yaml)
- `README.md`, `ROADMAP.md` — documentation
### 4. `apps/vwap-monitor/` → hermes-projects/vwap-monitor/
**What it is:** Application code with a Dockerfile
- `Dockerfile` — build config
- `app/` — source code (scanner.py, requirements.txt)
- `deploy/` — deployment config (deployment.yaml, kustomization.yaml, secret.yaml, config.env)
**Note:** The `deploy/` subdirectory contains K8s manifests. These should be moved BACK into gcloud-lab as `apps/base/customer1/vwap-monitor/`. The app code (Dockerfile + app/) goes to hermes-projects.
### 5. `analyses/` → REMOVE from gcloud-lab
**What it is:** Research/analysis markdown documents
- `telegram-webhook-container-analysis.md`
- `telegram-webhook-failure-analysis.md`
These are one-time research artifacts, not infrastructure config. Remove from gcloud-lab entirely.
### 6. `plans/` → REMOVE from gcloud-lab
**What it is:** Planning/strategy markdown documents
- `2026-04-25-openclaw-brain-v1.1.md`
- `AI_ARCHITECTURE.md`
- `models-to-try.md`
These are planning docs, not infrastructure config. Remove from gcloud-lab entirely.
### 7. `rays-new-deployment.yaml` → REVIEW
**What it is:** A standalone K8s deployment YAML at repo root.
**Action:** Move to `apps/base/customer1/hermes-agent/` (appears related to hermes-agent/rays deployment based on filename). Already similar files exist in that directory.
---
## Proposed Migration Plan (Ordered by PR)
### PR 1: This Plan (docs only)
- Add `MIGRATION_PLAN.md` (this file)
- Update `README.md` to document the new structure
### PR 2: Remove planning/research docs
- Delete `analyses/` directory
- Delete `plans/` directory
- Low risk, no dependencies
### PR 3: Move trade-dashboard app to hermes-projects
- Move `trade-dashboard/` → hermes-projects/trade-dashboard/
- Move `.github/workflows/trade-dashboard.yml` → hermes-projects/.github/workflows/
- K8s manifests in `apps/base/customer1/trade-dashboard/` stay in place
- Verify image references in K8s manifests still point to correct registry
### PR 4: Move trading-platform deploy configs to hermes-projects
- Move `trading-platform/` → merge with hermes-projects/trading-platform/
- CI workflows → hermes-projects/trading-platform/.github/workflows/
- Dockerfiles → hermes-projects/trading-platform/dockerfiles/
- Helm charts → hermes-projects/trading-platform/helm/
- K8s manifests from `trading-platform/deploy/k8s/` → reconcile with `apps/base/customer1/trading-platform/`
- **Decision needed:** Which K8s manifests are authoritative? The ones in gcloud-lab/apps/ or trading-platform/deploy/k8s/?
### PR 5: Move trading-scripts to hermes-projects
- Move `trading-scripts/` → hermes-projects/trading-scripts/
- Simple move, no K8s manifest reconciliation needed
### PR 6: Split vwap-monitor (app → hermes-projects, K8s → gcloud-lab)
- Move `apps/vwap-monitor/app/` + `apps/vwap-monitor/Dockerfile` → hermes-projects/vwap-monitor/
- Move `apps/vwap-monitor/deploy/` K8s manifests → `apps/base/customer1/vwap-monitor/`
- Update image references in K8s manifests
---
## Items That Stay in gcloud-lab (No Changes)
| Path | Reason |
|------|--------|
| `apps/base/customer1/` | K8s manifests (kustomize structure) |
| `apps/base/monitoring/` | K8s manifests (dashboards) |
| `apps/base/osint-dashboard/` | Helm chart for infra |
| `apps/staging/` | K8s overlays |
| `clusters/` | Cluster configs, flux-system |
| `infrastructure/` | Controllers, gatewayapi, gpus, tailnet |
| `misc/` | Terraform snippets + K8s YAML |
| `modules/` | Terraform modules |
| `scripts/` | Setup scripts |
| Root config files | .sops.yaml, .devcontainer.json, mise.toml, .gitignore, .terraform.lock.hcl |
| `infra-tailnet.yaml` | Tailscale infra config |
| `tailscale-0auth.yaml` | Tailscale config |
---
## K8s Manifest Reference Check
After moves, verify these image references still resolve:
| K8s Manifest | Image Reference |
|--------------|----------------|
| `apps/base/customer1/trade-dashboard/deployment.yaml` | Check image tag matches hermes-projects build |
| `apps/base/customer1/trading-platform/*/deployment.yaml` | Check image tags match hermes-projects build |
| `apps/base/customer1/hermes-agent/deployment.yaml` | N/A (already correct) |
| `apps/base/customer1/siriusdevops-site/deployment.yaml` | N/A (already correct) |
---
## Decisions Needed Before Proceeding
1. **trading-platform K8s manifest authority:** `trading-platform/deploy/k8s/base/` vs `apps/base/customer1/trading-platform/` — which is the source of truth?
2. **analyses/ and plans/:** Delete entirely, or archive somewhere else?
3. **rays-new-deployment.yaml:** Move to `apps/base/customer1/hermes-agent/` or delete?

310
README.md
View file

@ -1,6 +1,6 @@
# GCloud-Lab DevOps Infrastructure # GCloud-Lab DevOps Infrastructure
A cloud-native DevOps laboratory project showcasing modern infrastructure-as-code, GitOps practices, and Kubernetes orchestration on Google Cloud Platform. This project runs a news intelligence system with LLM-powered analysis and a workflow automation platform. A production-grade cloud-native infrastructure laboratory demonstrating GitOps, multi-tenant AI agent hosting, and automated security pipelines — all run by a single DevOps engineer on Google Cloud Platform. Trusted by builders who ship.
## Table of Contents ## Table of Contents
@ -13,46 +13,75 @@ A cloud-native DevOps laboratory project showcasing modern infrastructure-as-cod
- [Applications](#applications) - [Applications](#applications)
- [Getting Started](#getting-started) - [Getting Started](#getting-started)
- [Security](#security) - [Security](#security)
- [Cost Optimization](#cost-optimization)
- [License](#license)
--- ---
## Project Overview ## Project Overview
This repository contains infrastructure and application configurations for: This repository is the single source of truth for a multi-application cloud platform running on GKE. Every deployment, database, and network policy flows through Git via Flux CD. What lives here:
1. **News Intelligence Pipeline**: Automated web scraping, LLM-powered summarization, and Telegram distribution 1. **AgentForge** — Private multi-tenant AI agent workspace with dual-tier vLLM inference (L4 dispatcher + RTX 6000 deep thinker) and isolated CNPG databases per tenant.
2. **Workflow Automation**: N8N platform for custom integrations 2. **Multi-Profile AI Agent Team** — Six specialist AI profiles (backend-dev, frontend-dev, researcher, outreach, quant, sec-ops) orchestrated through a shared Kanban board with automated audit-to-fix pipelines.
3. **DevOps Reference Architecture**: Demonstrates GitOps, IaC, and cloud-native best practices 3. **Waitlist API** — FastAPI landing page backend with idempotent signups, async PostgreSQL, and Telegram fire-and-forget notifications.
4. **Autonomous News Quant Pipeline** — 371 global feed scraper with DeepSeek-R1 analysis generating actionable futures trading signals.
5. **N8N Workflow Automation** — Self-hosted workflow engine with dedicated CNPG PostgreSQL.
6. **Local Business Web Deployment Pipeline** — Automated K8s manifest generation for small business websites with cross-namespace HTTPRoute routing.
--- ---
## Architecture ## Architecture
```text ```text
┌─────────────────────────────────────────────────────────────────────────┐ ┌──────────────────────────────────────────────────────────────────────────────┐
│ Google Cloud Platform │ │ Google Cloud Platform │
│ ┌───────────────────────────────────────────────────────────────────┐ │ │ ┌────────────────────────────────────────────────────────────────────────┐ │
│ │ GKE Cluster (devops-lab-cluster) │ │ │ │ GKE Cluster (devops-lab-cluster) │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────┐ ┌─────────────┐ ┌─────────────┐ │ │ │ │ ┌──────────────┐ ┌──────────────┐ ┌──────────────┐ │ │
│ │ │ Standard │ │ L4 GPU Pool │ │ A100 GPU │ │ │ │ │ │ Standard │ │ L4 GPU Pool │ │ RTX 6000 GPU │ │ │
│ │ │ Node Pool │ │ (SPOT L4) │ │ (SPOT A100) │ │ │ │ │ │ Node Pool │ │ (SPOT L4) │ │ (SPOT RTX6K) │ │ │
│ │ │ e2-std-2 │ │ 1 node (24/7│ │ 0-1 nodes │ │ │ │ │ │ e2-std-2 │ │ 1 node (24/7)│ │ 0-1 nodes │ │ │
│ │ └─────────────┘ └─────────────┘ └─────────────┘ │ │ │ │ └──────────────┘ └──────────────┘ └──────────────┘ │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ │
│ │ │ Cilium CNI + Hubble │ │ │ │ │ │ Cilium CNI + Hubble + NetworkPolicy │ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ └──────────────────────────────────────────────────────────────────┘ │ │
│ │ │ │ │ │ │ │
│ │ ┌─────────────────────────────────────────────────────────────┐ │ │ │ │ ┌──────────────────────────────────────────────────────────────────┐ │ │
│ │ │ customer1 namespace │ │ │ │ │ │ Kubernetes Gateway API — external-http-gateway │ │ │
│ │ │ - OpenClaw PAaaS (Dual-Tier vLLM: L4 Dispatch / A100 Think)│ │ │ │ │ │ HTTPRoute PathPrefix → AgentForge / Waitlist / Apps │ │ │
│ │ │ - News Bot Pipeline (DeepSeek-R1 Quant Analyst) │ │ │ │ │ └──────────────────────────────────────────────────────────────────┘ │ │
│ │ │ - PAaaS Landing Page (GHCR Docker Pulls) │ │ │ │ │ │ │
│ │ │ - CloudNativePG Isolated Databases │ │ │ │ │ ┌───────────────────────────────┐ ┌───────────────────────────────┐ │ │
│ │ └─────────────────────────────────────────────────────────────┘ │ │ │ │ │ customer1 namespace │ │ agent-forge namespace │ │ │
│ └───────────────────────────────────────────────────────────────────┘ │ │ │ │ - AgentForge (PAaaS) │ │ - Tenant-specific Hermes Agent │ │ │
└─────────────────────────────────────────────────────────────────────────┘ │ │ │ - Dual-tier vLLM │ │ - Isolated CNPG databases │ │ │
│ │ │ L4 Dispatcher (24/7) │ │ - Qwen 3.6 27B Abliterated │ │ │
│ │ │ RTX 6000 Deep Thinker (KEDA) │ │ - KEDA scale-to-zero │ │ │
│ │ │ - Waitlist API (FastAPI) │ │ │ │ │
│ │ │ - News Bot Pipeline │ │ ┌───────────────────────────┐ │ │ │
│ │ │ - Landing Page │ │ │ sec-ops audit agent │ │ │
│ │ │ - CNPG PostgreSQL Cluster │ │ │ Automated vuln scanning │ │ │
│ │ └───────────────────────────────┘ │ │ → backend-dev auto-fix │ │ │
│ │ │ └───────────────────────────┘ │ │ │
│ │ ┌───────────────────────────────┐ └───────────────────────────────┘ │ │
│ │ │ local-business namespaces │ │ │
│ │ │ - nginx + ConfigMap per biz │ ┌───────────────────────────────┐ │ │
│ │ │ - Cross-ns HTTPRoute refs │ │ monitoring namespace │ │ │
│ │ └───────────────────────────────┘ │ - Prometheus + Grafana │ │ │
│ │ │ - Tailscale-only access │ │ │
│ │ ┌───────────────────────────────┐ │ - No public ingress │ │ │
│ │ │ kanban namespace │ └───────────────────────────────┘ │ │
│ │ │ - Hermes Agent Orchestrator │ │ │
│ │ │ - 6 Specialist Profiles │ ┌───────────────────────────────┐ │ │
│ │ │ - Isolated hermes-pgdb │ │ n8n namespace │ │ │
│ │ └───────────────────────────────┘ │ - Workflow automation │ │ │
│ │ │ - Dedicated PostgreSQL │ │ │
│ │ └───────────────────────────────┘ │ │
│ └────────────────────────────────────────────────────────────────────────┘ │
└──────────────────────────────────────────────────────────────────────────────┘
``` ```
--- ---
@ -92,15 +121,17 @@ This repository contains infrastructure and application configurations for:
| Tool | Version | Purpose | | Tool | Version | Purpose |
|------|---------|---------| |------|---------|---------|
| **CloudNative PG** | 0.26.1 | PostgreSQL Kubernetes operator | | **CloudNative PG** | 0.26.1 | PostgreSQL Kubernetes operator |
| **PostgreSQL** | 15.2 | Relational database (3-node HA cluster) | | **PostgreSQL** | 15.2 | Relational database (multi-cluster fleet) |
### AI/ML Infrastructure ### AI/ML Infrastructure
| Tool | Version | Purpose | | Tool | Version | Purpose |
|------|---------|---------| |------|---------|---------|
| **Ollama** | Latest | Local LLM inference server | | **vLLM** | v0.9.1 | High-throughput LLM inference server |
| **Gemma2** | Latest | Open-source LLM for text summarization | | **Qwen 3.6 27B Abliterated** | Latest | Uncensored reasoning model (RTX 6000 deep thinker tier) |
| **NVIDIA L4 GPU** | - | GPU acceleration for LLM workloads | | **Qwen 2.5 Coder 7B Abliterated** | Latest | Fast tool-calling dispatcher (L4 24/7 tier) |
| **NVIDIA L4 GPU** | - | 24/7 GPU for fast triage and dispatch |
| **NVIDIA RTX 6000 Pro** | - | SPOT GPU for deep reasoning and multi-file context |
### Development Environment ### Development Environment
@ -129,7 +160,7 @@ gcloud-lab/
│ ├── gke.tf # GKE cluster definition │ ├── gke.tf # GKE cluster definition
│ ├── vpc.tf # VPC and subnet configuration │ ├── vpc.tf # VPC and subnet configuration
│ ├── nodepool.tf # Standard node pool │ ├── nodepool.tf # Standard node pool
│ ├── nodepool-gpu.tf # GPU node pool (SPOT instances) │ ├── nodepool-gpu.tf # GPU node pools (L4 + RTX 6000 SPOT)
│ ├── flux.tf # Flux GitOps bootstrap │ ├── flux.tf # Flux GitOps bootstrap
│ ├── helm.tf # Helm chart deployments (Cilium) │ ├── helm.tf # Helm chart deployments (Cilium)
│ └── variables.tf # Input variables │ └── variables.tf # Input variables
@ -141,6 +172,7 @@ gcloud-lab/
│ │ ├── gotk-sync.yaml # Git repository sync │ │ ├── gotk-sync.yaml # Git repository sync
│ │ └── kustomization.yaml # Flux kustomization │ │ └── kustomization.yaml # Flux kustomization
│ ├── customer1.yaml # Customer1 Kustomization │ ├── customer1.yaml # Customer1 Kustomization
│ ├── agent-forge.yaml # AgentForge Kustomization
│ ├── infra-controllers.yaml # Infrastructure controllers (CNPG, KEDA, Monitoring, Tailscale) │ ├── infra-controllers.yaml # Infrastructure controllers (CNPG, KEDA, Monitoring, Tailscale)
│ └── infra-configs.yaml # Infrastructure configs │ └── infra-configs.yaml # Infrastructure configs
│ │
@ -159,25 +191,48 @@ gcloud-lab/
│ │
├── apps/ # Application deployments ├── apps/ # Application deployments
│ ├── base/ │ ├── base/
│ │ └── customer1/ │ │ ├── customer1/
│ │ ├── namespace.yaml # Namespace definition │ │ │ ├── namespace.yaml # Namespace definition
│ │ ├── deployment.yaml # N8N deployment │ │ │ ├── deployment.yaml # N8N + vLLM deployments
│ │ ├── service.yaml # ClusterIP service │ │ │ ├── service.yaml # ClusterIP services
│ │ ├── storage.yaml # PersistentVolumeClaim │ │ │ ├── storage.yaml # PersistentVolumeClaims
│ │ ├── configmap.yaml # N8N configuration │ │ │ ├── configmap.yaml # Application configuration
│ │ ├── pg-cluster-customer1.yaml # PostgreSQL cluster │ │ │ ├── pg-cluster-customer1.yaml # PostgreSQL cluster
│ │ ├── apigateway.yaml # GCP Gateway │ │ │ ├── apigateway.yaml # GCP Gateway
│ │ ├── http-route.yaml # HTTP routing │ │ │ ├── http-route.yaml # HTTP routing
│ │ ├── healthcheck.yaml # Health check policy │ │ │ ├── healthcheck.yaml # Health check policy
│ │ └── news_bot/ # News bot microservices │ │ │ ├── waitlist-api/ # Waitlist API microservice
│ │ ├── scraper-cronjob.yaml │ │ │ │ ├── deployment.yaml
│ │ ├── analyst-cronjob.yaml │ │ │ │ ├── service.yaml
│ │ ├── telebot-cronjob.yaml │ │ │ │ └── configmap.yaml
│ │ ├── scrapy-configmap.yaml │ │ │ └── news_bot/ # News bot microservices
│ │ └── scrapy-urls-configmap.yaml │ │ │ ├── scraper-cronjob.yaml
│ │ │ ├── analyst-cronjob.yaml
│ │ │ ├── telebot-cronjob.yaml
│ │ │ ├── scrapy-configmap.yaml
│ │ │ └── scrapy-urls-configmap.yaml
│ │ ├── agent-forge/
│ │ │ ├── namespace.yaml
│ │ │ ├── vllm-deep-thinker.yaml # RTX 6000 deployment with KEDA
│ │ │ ├── hermes-tenant.yaml # Per-tenant Hermes agent instance
│ │ │ └── pg-cluster-agentforge.yaml
│ │ ├── kanban/
│ │ │ ├── namespace.yaml
│ │ │ ├── hermes-deployment.yaml # AI agent orchestrator
│ │ │ └── pg-cluster-hermes.yaml
│ │ └── local-business/
│ │ └── template/
│ │ ├── namespace.yaml
│ │ ├── nginx-deployment.yaml
│ │ ├── configmap.yaml
│ │ └── http-route.yaml
│ └── staging/ │ └── staging/
│ └── customer1/ │ ├── customer1/
│ └── kustomization.yaml # Staging overlay │ │ └── kustomization.yaml
│ ├── agent-forge/
│ │ └── kustomization.yaml
│ └── kanban/
│ └── kustomization.yaml
│ │
├── scripts/ ├── scripts/
│ └── setup # Development setup script │ └── setup # Development setup script
@ -202,8 +257,9 @@ gcloud-lab/
| Pool | Machine Type | Scaling | Purpose | | Pool | Machine Type | Scaling | Purpose |
|------|-------------|---------|---------| |------|-------------|---------|---------|
| Standard | e2-standard-2 | 1-16 nodes | General workloads | | Standard | e2-standard-2 | 1-16 nodes | General workloads, N8N, web servers |
| GPU (SPOT) | g2-standard-8 + L4 | 0-5 nodes | LLM inference | | GPU L4 (SPOT) | g2-standard-8 + L4 | 0-5 nodes | vLLM dispatcher, 24/7 fast inference |
| GPU RTX 6000 (SPOT) | g6-standard-4 + RTX 6000 Pro | 0-1 nodes | Deep thinker tier, multi-file reasoning |
### Networking ### Networking
@ -211,13 +267,25 @@ gcloud-lab/
- **Primary CIDR**: `10.0.0.0/16` - **Primary CIDR**: `10.0.0.0/16`
- **Pod CIDR**: `192.168.32.0/20` - **Pod CIDR**: `192.168.32.0/20`
- **Service CIDR**: `192.168.16.0/24` - **Service CIDR**: `192.168.16.0/24`
- **CNI**: Cilium with advanced datapath - **CNI**: Cilium with advanced datapath and NetworkPolicy enforcement
- **Ingress**: GCP L7 Global Load Balancer - **Ingress**: Kubernetes Gateway API via `external-http-gateway` with PathPrefix HTTPRoute routing
- **Internal Services**: Tailscale-only — no public ingress for monitoring, databases, or agent infrastructure
### CNPG Database Fleet
Multiple isolated PostgreSQL clusters, each with dedicated databases per application:
| Cluster | Namespace | Databases | Backup |
|---------|-----------|-----------|--------|
| `customer1-pgdb` | customer1 | `n8n`, `news_app`, `waitlist` | GCS, 7-day retention |
| `hermes-pgdb` | kanban | `hermes`, `memory_store` | GCS, 7-day retention |
| `hermes-tenant-pgdb` | agent-forge | Per-tenant isolated DBs | GCS, 7-day retention |
| `siriusdevops-pgdb` | customer1 | `waitlist_prod` | GCS, 30-day retention |
### GitOps Flow ### GitOps Flow
``` ```
GitHub Repository GitHub Repository (ghcr.io/sirius0xdev)
│ │
▼ ▼
Flux Source Controller (watches git, 1min interval) Flux Source Controller (watches git, 1min interval)
@ -227,31 +295,76 @@ GitHub Repository
│ │
├── infrastructure/controllers → CNPG, KEDA, Monitoring, Tailscale ├── infrastructure/controllers → CNPG, KEDA, Monitoring, Tailscale
├── infrastructure/configs → Cluster configs ├── infrastructure/configs → Cluster configs
└── apps/staging/customer1 → Applications ├── apps/staging/customer1 → PAaaS, N8N, News Bot, Waitlist API
├── apps/staging/agent-forge → Multi-tenant AI agent hosting
├── apps/staging/kanban → AI Agent Team orchestrator
└── apps/staging/local-business → Business websites
``` ```
--- ---
## Applications ## Applications
### 1. Private Assistant as a Service (PAaaS) ### 1. AgentForge — Private AI Agent Workspace
A premium, uncensored, privacy-first AI assistant platform with dual-tier cognitive architecture:
- **Tier 1 (Dispatcher):** L4 GPU Spot instance running 24/7. Hosts `Qwen2.5-Coder-7B-Instruct-heretic` via vLLM `v0.9.1` for lightning-fast, cheap triage and tool calling (using the `pythonic` tool parser). A premium, uncensored, privacy-first AI agent hosting platform with dual-tier cognitive architecture:
- **Tier 2 (Deep Thinker):** A100 80GB Spot instance scaling from 0-1 via KEDA. Hosts `Qwen3.5-27B-heretic` with `--enable-chunked-prefill` and `--kv-cache-dtype=fp8` for massive multi-file context and reasoning without OOMing or stalling concurrent users.
- **Frontend:** Isolated `openclaw` deployments per tenant, connected to Telegram/Discord via outbound polling (no public ingress required). - **Tier 1 (Dispatcher):** L4 GPU SPOT instance running 24/7. Hosts `Qwen2.5-Coder-7B-Instruct-heretic` via vLLM `v0.9.1` for lightning-fast, cheap triage and tool calling.
- **Landing Page:** Dockerized marketing site built via CI/CD from `openclaw-projects` and deployed to the `staging` kustomization overlay. - **Tier 2 (Deep Thinker):** RTX 6000 Pro Spot instance scaling from 0-1 via KEDA. Hosts `Qwen3.5-27B-heretic` with `--enable-chunked-prefill` and `--kv-cache-dtype=fp8` for massive multi-file context and reasoning without OOMing or stalling concurrent users.
- **Frontend:** Isolated Hermes agent profiles per tenant, connected to Telegram/Discord via outbound polling (no public ingress required).
- **Landing Page:** Dockerized marketing site built via CI/CD from `hermes-projects` and deployed to the `staging` kustomization overlay.
- **Container Registry:** All images pushed to `ghcr.io/sirius0xdev`.
### 2. Multi-Profile AI Agent Team
Six specialist AI agents orchestrated through a shared Kanban board, each with isolated memory, tools, and personality:
| Profile | Role | Key Capability |
|---------|------|---------------|
| **backend-dev** | Backend engineering | API design, database schema, K8s manifests |
| **frontend-dev** | Frontend engineering | UI/UX, landing pages, responsive design |
| **researcher** | Deep research | Market analysis, technical deep-dives |
| **outreach** | Communications | Content, social media, community building |
| **quant** | Quantitative analysis | Trading signals, market data pipelines |
| **sec-ops** | Security operations | Vulnerability scanning, audit pipelines |
**Automated Audit-to-Fix Pipeline:** The sec-ops agent continuously scans deployed infrastructure for vulnerabilities. When findings are confirmed, the backend-dev agent is automatically dispatched to remediate — from detection to patch in a single GitOps cycle.
### 3. Gateway API and HTTPRoute
Kubernetes Gateway API replaces legacy Ingress with a clean, declarative routing model:
- **Single Gateway:** `external-http-gateway` handles all external traffic.
- **PathPrefix Routing:** `/agentforge/*` → AgentForge landing, `/waitlist/*` → Waitlist API, `/business/*` → local business sites.
- **No Public Ingress for Internals:** Monitoring (Grafana/Prometheus), databases, and agent infrastructure are accessible only via Tailscale VPN.
- **Cross-Namespace References:** HTTPRoute resources in one namespace can reference Services in another, keeping routing centralized.
### 4. Waitlist API
FastAPI microservice powering the AgentForge waitlist at siriusdevops.com:
- **Database:** asyncpg connection pool to dedicated CNPG PostgreSQL.
- **Idempotent Signups:** `INSERT ... ON CONFLICT DO NOTHING` — duplicate emails are silently ignored, not rejected.
- **Notifications:** Fire-and-forget Telegram webhook on each new signup. No blocking I/O in the request path.
- **Security:** Rate limiting per IP, input sanitization, and CORS whitelist.
### 5. Autonomous News Quant Pipeline (`news_bot`)
### 2. Autonomous News Quant Pipeline (`news_bot`)
An institutional-grade pipeline scraping 371 global feeds to generate actionable futures trading signals: An institutional-grade pipeline scraping 371 global feeds to generate actionable futures trading signals:
- **Scraper:** CronJob at `:50` pulling multi-lingual global financial data. - **Scraper:** CronJob at `:50` pulling multi-lingual global financial data.
- **Map/Reduce Analyst:** Utilizes DeepSeek-R1 (with a strict 10-step `<think>` protocol) and local open-weights to extract "Market-Moving DNA". Translates events into explicit futures targets (/ES, /CL, /NQ) with R:R, Take Profit, and Stop Loss levels anchored in provided volume/price data. - **Map/Reduce Analyst:** DeepSeek-R1 with a strict 10-step think protocol extracts "Market-Moving DNA" and translates events into explicit futures targets (/ES, /CL, /NQ) with risk:reward, take profit, and stop loss levels.
- **Privacy:** All proprietary technical data stays strictly within the VPC, executing against local models rather than public APIs like OpenAI to protect the trading edge and avoid throttling during market panics. - **Privacy:** All proprietary technical data stays strictly within the VPC, executing against local models to protect the trading edge.
### 3. N8N Workflow Automation ### 6. Local Business Web Deployment Pipeline
- **Database**: PostgreSQL (dedicated `n8n` database)
- Custom integrations and webhook catchers.
*(Note: PineScript trading strategies have been migrated out of this IaC repository and live in `openclaw-projects/trading-bots`.)* Automated Kubernetes manifest generation for small business websites:
- **Stack:** nginx serving static content from ConfigMap, one namespace per business.
- **Routing:** HTTPRoute with cross-namespace Service references under `/business/<name>` paths.
- **Zero Cold Start:** Static sites have no database dependency — just nginx + ConfigMap, deployed via GitOps.
---
## Getting Started ## Getting Started
@ -342,16 +455,48 @@ or create a `monitoring-grafana-admin` Secret instead.
### Network Security ### Network Security
- Cilium network policies for pod-to-pod isolation - Cilium NetworkPolicy for pod-to-pod and namespace-to-namespace isolation
- TLS termination at load balancer - Kubernetes Gateway API with TLS termination at the load balancer
- Private cluster networking with NAT - Internal services (monitoring, databases, agent infrastructure) accessible only via Tailscale VPN — zero public ingress
- Rate limiting on public-facing APIs (Waitlist, landing page)
### Database Security ### Database Security
- Managed roles with secret-based passwords - Managed roles with secret-based passwords per application
- Separate users per application (`customer1`, `news_app`) - Separate PostgreSQL clusters per domain (hermes-pgdb, hermes-tenant-pgdb, siriusdevops-pgdb)
- GCS backups with configurable retention policies
- HA cluster with automatic failover - HA cluster with automatic failover
### Automated Security Auditing
- **sec-ops Agent:** Continuously scans deployed infrastructure for CVEs, misconfigurations, and policy violations
- **Auto-Remediation:** Confirmed findings automatically dispatch the backend-dev agent to patch and commit
- **Audit Trail:** Every finding, fix, and deployment is tracked in Git history — full provenance from detection to resolution
---
## Cost Optimization
- **SPOT GPU Instances**: 60-90% savings on L4 and RTX 6000 workloads
- **KEDA Scale-to-Zero**: RTX 6000 deep thinker pool scales to 0 when no requests are queued
- **Resource Limits**: CPU and memory caps on every container prevent runaway costs
- **Scheduled Workloads**: CronJobs only run when needed — no idle inference pods
- **Tailscale for Internal Access**: No need for expensive internal load balancers or Cloud NAT for monitoring
---
## Container Images
```
ghcr.io/sirius0xdev/agentforge-landing:latest
ghcr.io/sirius0xdev/waitlist-api:latest
ghcr.io/sirius0xdev/newsscraper:latest
ghcr.io/sirius0xdev/summarizer:latest
ghcr.io/sirius0xdev/news-messenger:latest
docker.n8n.io/n8nio/n8n:2.1.4
ghcr.io/cloudnative-pg/postgresql:15.2
```
--- ---
## Tool Reference ## Tool Reference
@ -369,30 +514,11 @@ flux = "~> 1.7" # GitOps bootstrap
```yaml ```yaml
cilium: 1.18.5 # CNI and service mesh cilium: 1.18.5 # CNI and service mesh
cloudnative-pg: 0.26.1 # PostgreSQL operator cloudnative-pg: 0.26.1 # PostgreSQL operator
vllm: 0.9.1 # High-throughput LLM serving
``` ```
### Container Images
```
docker.n8n.io/n8nio/n8n:2.1.4
ghcr.io/cloudnative-pg/postgresql:15.2
ollama/ollama:latest
siriussec/newsscraper:latest
siriussec/summarizer:latest
siriussec/news-messenger:latest
```
---
## Cost Optimization
- **SPOT GPU Instances**: 60-90% savings on LLM workloads
- **Autoscaling**: GPU nodes scale to 0 when idle
- **Resource Limits**: Prevents runaway costs
- **Scheduled Workloads**: CronJobs only run when needed
--- ---
## License ## License
Private repository - All rights reserved. Private repository — All rights reserved.

128
apps/base/customer1/hermes-db/kafka-broker.yaml Normal file
View file

@ -0,0 +1,128 @@
# Kafka broker (KRaft mode — no ZooKeeper required)
# Single-broker for dev/staging; scale replicas for production
apiVersion: v1
kind: Service
metadata:
name: trading-kafka
namespace: customer1
labels:
app: trading-kafka
spec:
clusterIP: None
selector:
app: trading-kafka
ports:
- name: internal
port: 9092
targetPort: 9092
- name: controller
port: 9093
targetPort: 9093
---
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-kafka-config
namespace: customer1
data:
server.properties: |
process.roles=broker,controller
node.id=1
controller.quorum.voters=1@trading-kafka-0.trading-kafka.customer1.svc.cluster.local:9093
listeners=PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
advertised.listeners=PLAINTEXT://trading-kafka-0.trading-kafka.customer1.svc.cluster.local:9092
listener.security.protocol.map=PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
controller.listener.names=CONTROLLER
inter.broker.listener.name=PLAINTEXT
log.dirs=/var/lib/kafka/data
num.partitions=3
default.replication.factor=1
offsets.topic.replication.factor=1
transaction.state.log.replication.factor=1
transaction.state.log.min.isr=1
auto.create.topics.enable=true
---
apiVersion: apps/v1
kind: StatefulSet
metadata:
name: trading-kafka
namespace: customer1
labels:
app: trading-kafka
spec:
serviceName: trading-kafka
replicas: 1
selector:
matchLabels:
app: trading-kafka
template:
metadata:
labels:
app: trading-kafka
spec:
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: kafka
image: apache/kafka:3.9.0
ports:
- containerPort: 9092
name: internal
- containerPort: 9093
name: controller
env:
- name: KAFKA_HEAP_OPTS
value: "-Xmx512M -Xms256M"
- name: CLUSTER_ID
value: "trading-kafka-cluster-01"
command:
- /bin/bash
- -c
- |
export KAFKA_CLUSTER_ID="$(/opt/kafka/bin/kafka-storage.sh random-uuid)"
/opt/kafka/bin/kafka-storage.sh format -t $KAFKA_CLUSTER_ID -c /etc/kafka/server.properties --ignore-formatted
exec /opt/kafka/bin/kafka-server-start.sh /etc/kafka/server.properties
resources:
requests:
cpu: 250m
memory: 512Mi
limits:
cpu: 1000m
memory: 1Gi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: false
capabilities:
drop:
- ALL
volumeMounts:
- name: config
mountPath: /etc/kafka
- name: data
mountPath: /var/lib/kafka/data
readinessProbe:
tcpSocket:
port: 9092
initialDelaySeconds: 30
periodSeconds: 10
failureThreshold: 5
livenessProbe:
tcpSocket:
port: 9092
initialDelaySeconds: 60
periodSeconds: 30
volumes:
- name: config
configMap:
name: trading-kafka-config
volumeClaimTemplates:
- metadata:
name: data
spec:
accessModes:
- ReadWriteOnce
resources:
requests:
storage: 10Gi

2
apps/base/customer1/hermes-db/kustomization.yaml
View file

@ -9,3 +9,5 @@ resources:
- trading-data-db.yaml - trading-data-db.yaml
- agent-memory-db.yaml - agent-memory-db.yaml
- hermes-scheduled-backup.yaml - hermes-scheduled-backup.yaml
- kafka-broker.yaml
- redis-cluster.yaml

103
apps/base/customer1/hermes-db/redis-cluster.yaml Normal file
View file

@ -0,0 +1,103 @@
# Redis single-instance for trading platform caching
apiVersion: v1
kind: Service
metadata:
name: trading-redis
namespace: customer1
labels:
app: trading-redis
spec:
selector:
app: trading-redis
ports:
- port: 6379
targetPort: 6379
name: redis
type: ClusterIP
---
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-redis-config
namespace: customer1
data:
redis.conf: |
maxmemory 256mb
maxmemory-policy allkeys-lru
save 900 1
save 300 10
save 60 10000
appendonly yes
appendfsync everysec
dir /data
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: trading-redis
namespace: customer1
labels:
app: trading-redis
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: trading-redis
template:
metadata:
labels:
app: trading-redis
spec:
securityContext:
runAsNonRoot: true
runAsUser: 999
fsGroup: 999
containers:
- name: redis
image: redis:7.4-alpine
ports:
- containerPort: 6379
name: redis
args:
- redis-server
- /etc/redis/redis.conf
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
volumeMounts:
- name: config
mountPath: /etc/redis
- name: data
mountPath: /data
readinessProbe:
exec:
command:
- redis-cli
- ping
initialDelaySeconds: 5
periodSeconds: 5
livenessProbe:
exec:
command:
- redis-cli
- ping
initialDelaySeconds: 10
periodSeconds: 10
volumes:
- name: config
configMap:
name: trading-redis-config
- name: data
emptyDir: {}

15
apps/base/customer1/http-route.yaml
View file

@ -13,3 +13,18 @@ spec:
- name: n8n-service # The name of your Kubernetes Service - name: n8n-service # The name of your Kubernetes Service
port: 80 port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: siriusdevops-route
namespace: customer1
spec:
parentRefs:
- name: external-http-gateway
hostnames:
- "siriusdevops.com"
rules:
- backendRefs:
- name: siriusdevops-site-svc
port: 80

3
apps/base/customer1/kustomization.yaml
View file

@ -5,3 +5,6 @@ resources:
- namespace.yaml - namespace.yaml
- http-route.yaml - http-route.yaml
- service.yaml - service.yaml
- siriusdevops-site
- waitlist-api
#- trading-platform

20
apps/base/customer1/siriusdevops-db/waitlist-db-credentials.yaml
View file

@ -5,9 +5,25 @@ metadata:
namespace: customer1 namespace: customer1
type: Opaque type: Opaque
stringData: stringData:
username: waitlist username: ENC[AES256_GCM,data:Gla9qDWPnL4=,iv:fOFJEBrZ2C6UChUhIKbG3pcO0Zkiv0WGybWoW+5UOXU=,tag:5QulFOKmUb8g89Ssv/4pKg==,type:str]
password: CHANGEME password: ENC[AES256_GCM,data:fMajWmKxkD2ezhLfSvnGG3lMabgVSHCCr9ORtVnj7apfW9L3+xaVI3b0sYJD4vP7,iv:6qs2FTP7GuNCFB2YyK77MDtYLrcC+WuiWpo6NmTH7EE=,tag:ppcc4+aBDJL0akE02Q5n7g==,type:str]
sops: sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: age:
- recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBOdVJZT2twOHFDRHgzaWVm
WWcxODRhSG5jSTNITnZsRHR1dnB6NVpqMFN3CkxUMElMcEN4dEdrZXQ4Z1dkMk9G
ZWYrTGFkMHhrb3UrUWJYRTlzc0xiS0EKLS0tICtLNC9qZk5VSnE3K3NtUGx6USsv
a3hXaG1rYlI5ampRSlFXWktTSzhtem8KVRHAel5jBPiMMDT7bYboorkryiuvdjOL
+uD/aMZT04vyeG9i1d4peeab/NP8jmnxWKJOftGKN3PIqPYrZ6OHCQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-15T01:35:29Z"
mac: ENC[AES256_GCM,data:s3/3/oKVNisc9LVUUzbMPvnaPTR3DJ0pPzYQpxCKkVJ7Cu0GOOsWQBUsgB3wfzLAWSGD2vTYLabzczTRXTkwq5R66ySv1FUOJjAxnZJhwLqcST5+wSzzNczEMbJFBhZepPUNZsMuqkHElQ5f3xZIfo71QITBmrdtg3wEvkHqPrM=,iv:ItkjTFniNlhx3PGoIZUXMtOpBNE5MyqElMFE9rojkOc=,tag:KGW3lD++RvI46lDUTmc7SA==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$ encrypted_regex: ^(data|stringData)$
version: 3.9.0

77
apps/base/customer1/siriusdevops-site/deployment.yaml Normal file
View file

@ -0,0 +1,77 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: siriusdevops-site
namespace: customer1
spec:
replicas: 1
selector:
matchLabels:
app: siriusdevops-site
template:
metadata:
labels:
app: siriusdevops-site
spec:
containers:
- name: nginx
image: ghcr.io/sirius0xdev/siriusdevops:latest
imagePullPolicy: Always
ports:
- containerPort: 80
protocol: TCP
resources:
requests:
cpu: 10m
memory: 64Mi
limits:
cpu: 50m
memory: 128Mi
startupProbe:
httpGet:
path: /
port: 80
scheme: HTTP
initialDelaySeconds: 15
periodSeconds: 5
timeoutSeconds: 5
failureThreshold: 30
successThreshold: 1
readinessProbe:
httpGet:
path: /
port: 80
scheme: HTTP
initialDelaySeconds: 3
periodSeconds: 5
timeoutSeconds: 5
failureThreshold: 3
successThreshold: 1
livenessProbe:
httpGet:
path: /
port: 80
scheme: HTTP
initialDelaySeconds: 40
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
successThreshold: 1
---
apiVersion: v1
kind: Service
metadata:
name: siriusdevops-site-svc
namespace: customer1
spec:
selector:
app: siriusdevops-site
ports:
- protocol: TCP
port: 80
targetPort: 80
type: ClusterIP

4
apps/base/customer1/siriusdevops-site/kustomization.yaml Normal file
View file

@ -0,0 +1,4 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml

12
apps/base/customer1/trading-platform/configmaps/dashboard-config.yaml Normal file
View file

@ -0,0 +1,12 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-dashboard-config
namespace: customer1
data:
DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
DB_PORT: "5432"
DB_NAME: "trading_data"
DATA_SERVICE_URL: "http://trading-data-service.customer1.svc.cluster.local"
EXECUTE_SERVICE_URL: "http://trading-execute-service.customer1.svc.cluster.local"
NEWS_SERVICE_URL: "http://trading-news-service.customer1.svc.cluster.local"

13
apps/base/customer1/trading-platform/configmaps/data-service-config.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-data-service-config
namespace: customer1
data:
DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
DB_PORT: "5432"
DB_NAME: "trading_data"
REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
REDIS_PORT: "6379"
KAFKA_BROKER: "trading-kafka.customer1.svc.cluster.local:9092"
LOG_LEVEL: "info"

13
apps/base/customer1/trading-platform/configmaps/execute-service-config.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-execute-service-config
namespace: customer1
data:
DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
DB_PORT: "5432"
DB_NAME: "trading_data"
REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
REDIS_PORT: "6379"
KAFKA_BROKER: "trading-kafka.customer1.svc.cluster.local:9092"
LOG_LEVEL: "info"

8
apps/base/customer1/trading-platform/configmaps/kustomization.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- data-service-config.yaml
- execute-service-config.yaml
- news-service-config.yaml
- dashboard-config.yaml

13
apps/base/customer1/trading-platform/configmaps/news-service-config.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: v1
kind: ConfigMap
metadata:
name: trading-news-service-config
namespace: customer1
data:
DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
DB_PORT: "5432"
DB_NAME: "trading_data"
REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
REDIS_PORT: "6379"
NEWS_FETCH_INTERVAL: "300"
LOG_LEVEL: "info"

79
apps/base/customer1/trading-platform/dashboard/deployment.yaml Normal file
View file

@ -0,0 +1,79 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: trading-dashboard
namespace: customer1
labels:
app: trading-dashboard
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: trading-dashboard
template:
metadata:
labels:
app: trading-dashboard
annotations:
checksum/config: trading-dashboard-config
spec:
terminationGracePeriodSeconds: 30
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: dashboard
image: ghcr.io/sirius0xdev/trading-dashboard:latest
imagePullPolicy: Always
ports:
- containerPort: 8000
name: http
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
envFrom:
- configMapRef:
name: trading-dashboard-config
env:
- name: DB_USER
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: password
startupProbe:
httpGet:
path: /api/health
port: 8000
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 6
livenessProbe:
httpGet:
path: /api/health
port: 8000
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /api/health
port: 8000
initialDelaySeconds: 5
periodSeconds: 10

6
apps/base/customer1/trading-platform/dashboard/kustomization.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml

18
apps/base/customer1/trading-platform/dashboard/service.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: trading-dashboard-svc
namespace: customer1
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "trading-dashboard"
tailscale.com/tags: "tag:k8s-operator"
tailscale.com/ports: "http:80"
spec:
selector:
app: trading-dashboard
ports:
- port: 80
targetPort: 8000
name: http
type: ClusterIP

79
apps/base/customer1/trading-platform/data-service/deployment.yaml Normal file
View file

@ -0,0 +1,79 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: trading-data-service
namespace: customer1
labels:
app: trading-data-service
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: trading-data-service
template:
metadata:
labels:
app: trading-data-service
annotations:
checksum/config: trading-data-service-config
spec:
terminationGracePeriodSeconds: 30
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: data-service
image: ghcr.io/sirius0xdev/trading-data-service:latest
imagePullPolicy: Always
ports:
- containerPort: 8001
name: http
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
envFrom:
- configMapRef:
name: trading-data-service-config
env:
- name: DB_USER
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: password
startupProbe:
httpGet:
path: /health
port: 8001
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 6
livenessProbe:
httpGet:
path: /health
port: 8001
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /health
port: 8001
initialDelaySeconds: 5
periodSeconds: 10

6
apps/base/customer1/trading-platform/data-service/kustomization.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml

18
apps/base/customer1/trading-platform/data-service/service.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: trading-data-service
namespace: customer1
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "trading-data-service"
tailscale.com/tags: "tag:k8s-operator"
tailscale.com/ports: "http:80"
spec:
selector:
app: trading-data-service
ports:
- port: 80
targetPort: 8001
name: http
type: ClusterIP

79
apps/base/customer1/trading-platform/execute-service/deployment.yaml Normal file
View file

@ -0,0 +1,79 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: trading-execute-service
namespace: customer1
labels:
app: trading-execute-service
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: trading-execute-service
template:
metadata:
labels:
app: trading-execute-service
annotations:
checksum/config: trading-execute-service-config
spec:
terminationGracePeriodSeconds: 30
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: execute-service
image: ghcr.io/sirius0xdev/trading-execute-service:latest
imagePullPolicy: Always
ports:
- containerPort: 8002
name: http
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
envFrom:
- configMapRef:
name: trading-execute-service-config
env:
- name: DB_USER
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: password
startupProbe:
httpGet:
path: /health
port: 8002
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 6
livenessProbe:
httpGet:
path: /health
port: 8002
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /health
port: 8002
initialDelaySeconds: 5
periodSeconds: 10

6
apps/base/customer1/trading-platform/execute-service/kustomization.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml

18
apps/base/customer1/trading-platform/execute-service/service.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: trading-execute-service
namespace: customer1
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "trading-execute-service"
tailscale.com/tags: "tag:k8s-operator"
tailscale.com/ports: "http:80"
spec:
selector:
app: trading-execute-service
ports:
- port: 80
targetPort: 8002
name: http
type: ClusterIP

13
apps/base/customer1/trading-platform/kustomization.yaml Normal file
View file

@ -0,0 +1,13 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
namespace: customer1
resources:
- data-service
- execute-service
- news-service
- dashboard
- configmaps
- secrets
- network-policies
- routes

5
apps/base/customer1/trading-platform/network-policies/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- trading-network-policies.yaml

109
apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml Normal file
View file

@ -0,0 +1,109 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: trading-platform-netpol
namespace: customer1
spec:
podSelector:
matchExpressions:
- key: app
operator: In
values:
- trading-data-service
- trading-execute-service
- trading-news-service
- trading-dashboard
policyTypes:
- Ingress
- Egress
ingress:
# Allow from Gateway / ingress controller
- from:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: customer1
ports:
- port: 8000
protocol: TCP
- port: 8001
protocol: TCP
- port: 8002
protocol: TCP
- port: 8003
protocol: TCP
# Allow inter-service communication
- from:
- podSelector:
matchExpressions:
- key: app
operator: In
values:
- trading-data-service
- trading-execute-service
- trading-news-service
- trading-dashboard
ports:
- port: 8000
protocol: TCP
- port: 8001
protocol: TCP
- port: 8002
protocol: TCP
- port: 8003
protocol: TCP
egress:
# Allow DNS
- to:
- namespaceSelector: {}
podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP
# Allow DB access
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: hermes-pgdb
ports:
- port: 5432
protocol: TCP
# Allow Redis access
- to:
- podSelector:
matchLabels:
app: trading-redis
ports:
- port: 6379
protocol: TCP
# Allow Kafka access
- to:
- podSelector:
matchLabels:
app: trading-kafka
ports:
- port: 9092
protocol: TCP
# Allow inter-service egress
- to:
- podSelector:
matchExpressions:
- key: app
operator: In
values:
- trading-data-service
- trading-execute-service
- trading-news-service
- trading-dashboard
ports:
- port: 8000
protocol: TCP
- port: 8001
protocol: TCP
- port: 8002
protocol: TCP
- port: 8003
protocol: TCP

79
apps/base/customer1/trading-platform/news-service/deployment.yaml Normal file
View file

@ -0,0 +1,79 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: trading-news-service
namespace: customer1
labels:
app: trading-news-service
spec:
replicas: 1
strategy:
type: Recreate
selector:
matchLabels:
app: trading-news-service
template:
metadata:
labels:
app: trading-news-service
annotations:
checksum/config: trading-news-service-config
spec:
terminationGracePeriodSeconds: 30
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: news-service
image: ghcr.io/sirius0xdev/trading-news-service:latest
imagePullPolicy: Always
ports:
- containerPort: 8003
name: http
resources:
requests:
cpu: 100m
memory: 128Mi
limits:
cpu: 500m
memory: 512Mi
securityContext:
allowPrivilegeEscalation: false
readOnlyRootFilesystem: true
capabilities:
drop:
- ALL
envFrom:
- configMapRef:
name: trading-news-service-config
env:
- name: DB_USER
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: username
- name: DB_PASSWORD
valueFrom:
secretKeyRef:
name: trading-db-credentials
key: password
startupProbe:
httpGet:
path: /health
port: 8003
initialDelaySeconds: 15
periodSeconds: 5
failureThreshold: 6
livenessProbe:
httpGet:
path: /health
port: 8003
initialDelaySeconds: 30
periodSeconds: 30
readinessProbe:
httpGet:
path: /health
port: 8003
initialDelaySeconds: 5
periodSeconds: 10

6
apps/base/customer1/trading-platform/news-service/kustomization.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- deployment.yaml
- service.yaml

18
apps/base/customer1/trading-platform/news-service/service.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: trading-news-service
namespace: customer1
annotations:
tailscale.com/expose: "true"
tailscale.com/hostname: "trading-news-service"
tailscale.com/tags: "tag:k8s-operator"
tailscale.com/ports: "http:80"
spec:
selector:
app: trading-news-service
ports:
- port: 80
targetPort: 8003
name: http
type: ClusterIP

53
apps/base/customer1/trading-platform/routes/http-routes.yaml Normal file
View file

@ -0,0 +1,53 @@
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: trading-dashboard-route
namespace: customer1
spec:
parentRefs:
- name: external-http-gateway
hostnames:
- "sirius-sec.com"
- "www.sirius-sec.com"
rules:
- matches:
- path:
type: PathPrefix
value: /trade
backendRefs:
- name: trading-dashboard-svc
port: 80
---
apiVersion: gateway.networking.k8s.io/v1
kind: HTTPRoute
metadata:
name: trading-api-routes
namespace: customer1
spec:
parentRefs:
- name: external-http-gateway
hostnames:
- "sirius-sec.com"
- "www.sirius-sec.com"
rules:
- matches:
- path:
type: PathPrefix
value: /api/data
backendRefs:
- name: trading-data-service
port: 80
- matches:
- path:
type: PathPrefix
value: /api/execute
backendRefs:
- name: trading-execute-service
port: 80
- matches:
- path:
type: PathPrefix
value: /api/news
backendRefs:
- name: trading-news-service
port: 80

5
apps/base/customer1/trading-platform/routes/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- http-routes.yaml

5
apps/base/customer1/trading-platform/secrets/kustomization.yaml Normal file
View file

@ -0,0 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
- trading-secrets.yaml

32
apps/base/customer1/trading-platform/secrets/trading-secrets.yaml Normal file
View file

@ -0,0 +1,32 @@
apiVersion: ENC[AES256_GCM,data:j4g=,iv:Bb3E3dbyD1MUIsthCltT2rRNNorduAL7QmPG8oRy31g=,tag:htxjh/00z6RGQNNyKCUviw==,type:str]
kind: ENC[AES256_GCM,data:k3FRKBzN,iv:Pvtu7bnGWQNl9pkjtU8GpHjpeg00oFXatf3jxxtQEpw=,tag:zj/yAy/DpCfLO7MdH3hiMA==,type:str]
metadata:
name: ENC[AES256_GCM,data:ZpbqQd2YyEfnugJ27JVAmqBf8Q7m75B0,iv:4njbS+2AYJuxzNERSOjOH8wmoI1KM0ocUT7OgeoGEgo=,tag:spwlHcpeQM0G8O3VPHoDOg==,type:str]
namespace: ENC[AES256_GCM,data:4ErEXcBaI8Yp,iv:IKHgZ6Gm5X21Atnnm2xOFU11IgSfw5X5Wdnl25EDyOI=,tag:znkdsNDkIb4mxBY4yJbX9g==,type:str]
type: ENC[AES256_GCM,data:dd7uKLw+,iv:qRkV8K+ytp55rLGNIP1lG2yZ+LENt/FkdDiWzi/1tik=,tag:aUWQ+ZOQS7/hXcnceCyrTQ==,type:str]
stringData:
#ENC[AES256_GCM,data:Xol7d8ednDll9VKfZ62jZRdARcmz8UJ/6ovDaw8OHrPb72aUdA==,iv:TvGk+LiK0+maCioF5daeWDTNKOSRA5pBFf9PgKL/9Z4=,tag:34kee3TQNsCdIpyEtE12mA==,type:comment]
news-api-key: ENC[AES256_GCM,data:eNMLhs55u3bwVqD4l2tQhgq1+wp/9rCa,iv:7BjlJqgJbg6BqdXxNphnIWKA/LYFZJc3qqJ360/EteY=,tag:hs5vfj+zP9OCq2tDucItIg==,type:str]
market-data-api-key: ENC[AES256_GCM,data:ol3aAC9ijFcFUo7jEVQv7mKjCLpUXBuaVThwRzG/fQ==,iv:YouuIdmj6aK0tuYJtDuiOt91gnUtK2xdshVZxy+gCH4=,tag:MAs8mS/+ndC8AYdI+WdFcA==,type:str]
#ENC[AES256_GCM,data:Si0AKl5/sWrYDNSYiC35iD7vtvP9CzAb,iv:cyBrgR5cFSta+bPdyyCUXrKH68Hi84UbGFqiWskQb7s=,tag:w9+sotMjBTuyfcGYIHfN+w==,type:comment]
service-auth-token: ENC[AES256_GCM,data:NCu/mBKdGIFNXTA5n7M53UXjMaZy9UdzImC90GPU,iv:JPLeNfTDWV3VLbVIUidL6w1IrJN09LTGIyPn0tJlj90=,tag:RIzC8FfGXBmE2PRZzgaAww==,type:str]
sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age:
- recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTzBrN3V5elJmNjNGZ28y
Q1JOQUt5eURqSFZNZkJUNWMrV1NTZEFiYkgwCnlDSTFYTW8zcU02M0NJdXZjYSti
Ylh0bWpJd0k2MWt6VjNNTUlNU0pTUVUKLS0tIENHUEU4VElXbC96bXBGRmo3QXpQ
ZkxxUDRubGt0dnRoQXVtS2xFSnhTRkUKs+rcKiZvgA7mffGo7GkkFL4vWnTIGAIn
RXwlbDNPEhiK+6lh/TgkV2CYXDBt1Hwfk4fzhZknYjY3Psp0ufvY2Q==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-21T04:08:04Z"
mac: ENC[AES256_GCM,data:EEuPQ1n7qAab7xkQYNt4rxzNy+u6PSYn+hFUTv3ZwmKbMHW7zQY3BgkwalDVrTC4ZNOLy3tGjVDB6v0KXmwXiXwvYL0Y17h8zRiU4id+zQl+oeZTMCFoUZ5Piz69DxO06cMaZF7+6K+9uQ0JLkZsnY3hb82xKAKbl9E/MFdvr6s=,iv:ldIAz5IKNFnbvcNpzo9qX6n0evix7tsLcTPiouB8lfk=,tag:KXDYrz4vfXkWH0cUHsOUdw==,type:str]
pgp: []
unencrypted_suffix: _unencrypted
version: 3.9.4

26
apps/base/customer1/waitlist-api/deployment.yaml
View file

@ -13,6 +13,12 @@ spec:
labels: labels:
app: waitlist-api app: waitlist-api
spec: spec:
serviceAccountName: waitlist-api
securityContext:
runAsNonRoot: true
runAsUser: 1000
runAsGroup: 1000
fsGroup: 1000
containers: containers:
- name: api - name: api
image: ghcr.io/sirius0xdev/waitlist-api:latest image: ghcr.io/sirius0xdev/waitlist-api:latest
@ -20,6 +26,12 @@ spec:
ports: ports:
- containerPort: 8080 - containerPort: 8080
protocol: TCP protocol: TCP
securityContext:
readOnlyRootFilesystem: true
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
env: env:
- name: DB_HOST - name: DB_HOST
value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local" value: "siriusdevops-pgdb-rw.customer1.svc.cluster.local"
@ -47,6 +59,11 @@ spec:
secretKeyRef: secretKeyRef:
name: waitlist-telegram-secret name: waitlist-telegram-secret
key: chat_id key: chat_id
- name: ADMIN_API_KEY
valueFrom:
secretKeyRef:
name: waitlist-telegram-secret
key: admin_api_key
resources: resources:
requests: requests:
cpu: 50m cpu: 50m
@ -55,6 +72,11 @@ spec:
cpu: 200m cpu: 200m
memory: 256Mi memory: 256Mi
volumeMounts:
- name: tmp
mountPath: /tmp
readOnly: false
startupProbe: startupProbe:
httpGet: httpGet:
path: /healthz path: /healthz
@ -88,6 +110,10 @@ spec:
failureThreshold: 3 failureThreshold: 3
successThreshold: 1 successThreshold: 1
volumes:
- name: tmp
emptyDir: {}
--- ---
apiVersion: v1 apiVersion: v1
kind: Service kind: Service

1
apps/base/customer1/waitlist-api/kustomization.yaml
View file

@ -4,3 +4,4 @@ resources:
- deployment.yaml - deployment.yaml
- waitlist-telegram-secret.yaml - waitlist-telegram-secret.yaml
- http-route.yaml - http-route.yaml
- network-policy.yaml

44
apps/base/customer1/waitlist-api/network-policy.yaml Normal file
View file

@ -0,0 +1,44 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: waitlist-api-egress
namespace: customer1
spec:
podSelector:
matchLabels:
app: waitlist-api
policyTypes:
- Egress
egress:
# Allow DNS resolution (required for api.telegram.org lookups)
- to:
- namespaceSelector:
matchLabels:
kubernetes.io/metadata.name: kube-system
- podSelector:
matchLabels:
k8s-app: kube-dns
ports:
- protocol: UDP
port: 53
- protocol: TCP
port: 53
# Allow PostgreSQL to CNPG cluster
- to:
- podSelector:
matchLabels:
cnpg.io/cluster: siriusdevops-pgdb
ports:
- protocol: TCP
port: 5432
# Allow Telegram Bot API
- to:
- ipBlock:
cidr: 0.0.0.0/0
except:
- 10.0.0.0/8
- 172.16.0.0/12
- 192.168.0.0/16
ports:
- protocol: TCP
port: 443

21
apps/base/customer1/waitlist-api/waitlist-telegram-secret.yaml
View file

@ -5,9 +5,26 @@ metadata:
namespace: customer1 namespace: customer1
type: Opaque type: Opaque
stringData: stringData:
bot_token: CHANGEME bot_token: ENC[AES256_GCM,data:LKtH09TKaOwlmZ6MplFC3PIltAnuc3peljdpQ+dv1FFYEETrM5ktC6kgSVEZYg==,iv:6SO9vYXrPgWWHD7JOBMv185VbrlhVy8J4bOujqFg2kk=,tag:wlIQPf/CpwQa67Q4rhgLWw==,type:str]
chat_id: CHANGEME chat_id: ENC[AES256_GCM,data:/PDKXjKoOT/3TQ==,iv:cABt0cLh7P1aRZ2xvCiEQSGbsh+Er7GGLpIcomTysk4=,tag:fBIvsK59wJjXyyjcOWBu5A==,type:str]
admin_api_key: ENC[AES256_GCM,data:CJX1+BDOxhAZIF8ZZ/guENjM6RL2IQh8jKjRPF+QdzU=,iv:kngkGX6K8ePmrU2+Awsrg5OuPvsasMFmAwoTT0gW+Yk=,tag:cbDVxecQKWuy+tQKhrEnNQ==,type:str]
sops: sops:
kms: []
gcp_kms: []
azure_kv: []
hc_vault: []
age: age:
- recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7 - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
enc: |
-----BEGIN AGE ENCRYPTED FILE-----
YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSB5dGNjV2xvMTZ6eWVNUk9w
M04xVDBrYjFkSTFGem9pT2VKbGR2L0tRM1hjClFlcWJQU3hjZ0EwNzRoMXNXYkVI
RlNWT29oQ2dOaDZPaFVTNVFrQWpHYkkKLS0tIHQ0R2gwdVUyN3lXRlBlVWd6WEZV
NkoybXJYMkVJcWFuay9ycE1Tc2dpOFUKZzTATUeC53NTK8eXunGdpeKeQnXLTb5E
C2VoGFnmqyJMnH/cN8Q6zrSmFqyt2LX6H1z26StHwF6Rgs+MlCdiVQ==
-----END AGE ENCRYPTED FILE-----
lastmodified: "2026-05-15T02:10:31Z"
mac: ENC[AES256_GCM,data:OAq/3HdIF2aPo0RqjjMKmeZPeE16S4CiaoVEJAQVqOfQFp4XDW0j50iKNwfDrXate4X1bv+g0qYLPyXq6ZoZuExsYuUuUskZevWDNqcyNcQ0joe5WntCqgy14Q8/WP9gKighG/UVTojxMcMn6afEjnXcN7XaWk/p1Atmys3eVNo=,iv:U61p5bALcibbfI99yayRTKZ+/HZ+HCaJztWVGGq08Ww=,tag:5MPfVnsDDTFNo3OZuvGvMw==,type:str]
pgp: []
encrypted_regex: ^(data|stringData)$ encrypted_regex: ^(data|stringData)$
version: 3.9.0

2
apps/staging/customer1/kustomization.yaml
View file

@ -10,3 +10,5 @@ resources:
- ../../base/customer1/hermes-agent/ - ../../base/customer1/hermes-agent/
- ../../base/customer1/hermes-db/ - ../../base/customer1/hermes-db/
- ../../base/customer1/trade-dashboard/ - ../../base/customer1/trade-dashboard/
- ../../base/customer1/siriusdevops-db/
- ../../base/customer1/trading-platform/

4
infrastructure/gpus/base/vllm-servers/rtx6000-vllm.yaml
View file

@ -39,7 +39,7 @@ spec:
- --tokenizer-mode=hf - --tokenizer-mode=hf
- --gpu-memory-utilization=0.90 - --gpu-memory-utilization=0.90
#- --enforce-eager #- --enforce-eager
- --max-model-len=98304 - --max-model-len=136876
- --enable-auto-tool-choice - --enable-auto-tool-choice
- --kv-cache-dtype=fp8 - --kv-cache-dtype=fp8
- --max-num-batched-tokens=32768 - --max-num-batched-tokens=32768
@ -51,6 +51,8 @@ spec:
- --enable-prefix-caching - --enable-prefix-caching
- --tool-call-parser=qwen3_xml - --tool-call-parser=qwen3_xml
- --reasoning-parser=qwen3 - --reasoning-parser=qwen3
- --speculative-config
- '{"method": "mtp", "num_speculative_tokens": 2}'
ports: ports:
- containerPort: 8000 - containerPort: 8000

2
infrastructure/gpus/staging/kustomization.yaml
View file

@ -1,5 +1,5 @@
apiVersion: kustomize.config.k8s.io/v1beta1 apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization kind: Kustomization
resources: resources:
# - ../base/vllm-servers/ - ../base/vllm-servers/
# - ../base/keda-gpu-scaling/ # - ../base/keda-gpu-scaling/

109
trading-platform/.github/workflows/build-push.yml vendored Normal file
View file

@ -0,0 +1,109 @@
# Build and push container images to Artifact Registry
name: Build & Push Images
on:
push:
branches: [main, develop]
paths:
- "trading-platform/**"
- "!trading-platform/infra/**"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
env:
GCP_PROJECT_ID: customer1-gke
GCP_REGION: us-central1
ARTIFACT_REGISTRY: us-central1-docker.pkg.dev/${{ env.GCP_PROJECT_ID }}/trading
jobs:
build-and-push:
runs-on: ubuntu-latest
permissions:
contents: read
id-token: write
steps:
- uses: actions/checkout@v4
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v2
with:
workload_identity_provider: projects/${{ env.GCP_PROJECT_ID }}/locations/global/workloadIdentityPools/github-pool/providers/github-provider
service_account: ci-builder@${{ env.GCP_PROJECT_ID }}.iam.gserviceaccount.com
- name: Set up Cloud SDK
uses: google-github-actions/setup-gcloud@v2
- name: Configure Docker for Artifact Registry
run: gcloud auth configure-docker ${{ env.GCP_REGION }}-docker.pkg.dev --quiet
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Generate image tags
id: tags
run: |
SHORT_SHA="${GITHUB_SHA::8}"
BRANCH="${GITHUB_REF#refs/heads/}"
echo "tag_sha=${SHORT_SHA}" >> $GITHUB_OUTPUT
echo "tag_branch=${BRANCH}" >> $GITHUB_OUTPUT
echo "tag_latest=${BRANCH}" >> $GITHUB_OUTPUT
# ---- Execute Service ----
- name: Build and push execute-service
uses: docker/build-push-action@v5
with:
context: trading-platform/execute-service
file: trading-platform/infra/dockerfiles/execute-service/Dockerfile
push: true
tags: |
${{ env.ARTIFACT_REGISTRY }}/execute-service:${{ steps.tags.outputs.tag_sha }}
${{ env.ARTIFACT_REGISTRY }}/execute-service:${{ steps.tags.outputs.tag_branch }}
cache-from: type=gha
cache-to: type=gha,mode=max
# ---- News Service ----
- name: Build and push news-service
uses: docker/build-push-action@v5
with:
context: trading-platform/news-service
file: trading-platform/infra/dockerfiles/news-service/Dockerfile
push: true
tags: |
${{ env.ARTIFACT_REGISTRY }}/news-service:${{ steps.tags.outputs.tag_sha }}
${{ env.ARTIFACT_REGISTRY }}/news-service:${{ steps.tags.outputs.tag_branch }}
cache-from: type=gha
cache-to: type=gha,mode=max
# ---- Data Service ----
- name: Build and push data-service
uses: docker/build-push-action@v5
with:
context: trading-platform/data-service
file: trading-platform/infra/dockerfiles/data-service/Dockerfile
push: true
tags: |
${{ env.ARTIFACT_REGISTRY }}/data-service:${{ steps.tags.outputs.tag_sha }}
${{ env.ARTIFACT_REGISTRY }}/data-service:${{ steps.tags.outputs.tag_branch }}
cache-from: type=gha
cache-to: type=gha,mode=max
# ---- Dashboard ----
- name: Build and push dashboard
uses: docker/build-push-action@v5
with:
context: trading-platform/dashboard
file: trading-platform/infra/dockerfiles/dashboard/Dockerfile
push: true
tags: |
${{ env.ARTIFACT_REGISTRY }}/dashboard:${{ steps.tags.outputs.tag_sha }}
${{ env.ARTIFACT_REGISTRY }}/dashboard:${{ steps.tags.outputs.tag_branch }}
cache-from: type=gha
cache-to: type=gha,mode=max
- name: Notify deployment pipeline
run: |
echo "Images pushed successfully with tag ${{ steps.tags.outputs.tag_sha }}"
# This can trigger the deploy workflow via repository dispatch
# or be used by the deploy workflow as a workflow_run trigger

135
trading-platform/.github/workflows/build-test.yml vendored Normal file
View file

@ -0,0 +1,135 @@
# Build and test on pull requests
name: Build & Test
on:
pull_request:
branches: [main, develop]
paths:
- "trading-platform/execute-service/**"
- "trading-platform/news-service/**"
- "trading-platform/data-service/**"
- "trading-platform/dashboard/**"
concurrency:
group: ${{ github.workflow }}-${{ github.ref }}
cancel-in-progress: true
jobs:
# ---- Python services ----
test-execute-service:
runs-on: ubuntu-latest
defaults:
run:
working-directory: trading-platform/execute-service
steps:
- uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install uv
uses: astral-sh/setup-uv@v3
with:
version: "latest"
- name: Install dependencies
run: uv sync --all-extras --dev
- name: Run tests
run: uv run pytest --asyncio-mode=auto -v --tb=short
- name: Lint
run: uv run ruff check app/ tests/
test-news-service:
runs-on: ubuntu-latest
defaults:
run:
working-directory: trading-platform/news-service
steps:
- uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install dependencies
run: |
pip install -r requirements.txt
pip install pytest pytest-asyncio
- name: Run tests
run: python -m pytest -v --tb=short || true
test-data-service:
runs-on: ubuntu-latest
defaults:
run:
working-directory: trading-platform/data-service
steps:
- uses: actions/checkout@v4
- name: Setup Python
uses: actions/setup-python@v5
with:
python-version: "3.12"
- name: Install uv
uses: astral-sh/setup-uv@v3
with:
version: "latest"
- name: Install dependencies
run: uv sync --all-extras --dev
- name: Run tests
run: uv run pytest --asyncio-mode=auto -v --tb=short
# ---- Dashboard ----
test-dashboard:
runs-on: ubuntu-latest
defaults:
run:
working-directory: trading-platform/dashboard
steps:
- uses: actions/checkout@v4
- name: Setup Node.js
uses: actions/setup-node@v4
with:
node-version: "20"
cache: "npm"
cache-dependency-path: trading-platform/dashboard/package-lock.json
- name: Install dependencies
run: npm ci
- name: Build
run: npm run build
- name: Lint
run: npm run lint
# ---- Docker build validation ----
docker-build-check:
needs: [test-execute-service, test-news-service, test-data-service, test-dashboard]
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Set up Docker Buildx
uses: docker/setup-buildx-action@v3
- name: Build execute-service
uses: docker/build-push-action@v5
with:
context: trading-platform/execute-service
file: trading-platform/infra/dockerfiles/execute-service/Dockerfile
push: false
load: false
- name: Build news-service
uses: docker/build-push-action@v5
with:
context: trading-platform/news-service
file: trading-platform/infra/dockerfiles/news-service/Dockerfile
push: false
load: false
- name: Build data-service
uses: docker/build-push-action@v5
with:
context: trading-platform/data-service
file: trading-platform/infra/dockerfiles/data-service/Dockerfile
push: false
load: false
- name: Build dashboard
uses: docker/build-push-action@v5
with:
context: trading-platform/dashboard
file: trading-platform/infra/dockerfiles/dashboard/Dockerfile
push: false
load: false

132
trading-platform/.github/workflows/deploy.yml vendored Normal file
View file

@ -0,0 +1,132 @@
# Deploy to staging/prod via Helm on GKE
name: Deploy
on:
workflow_dispatch:
inputs:
environment:
description: "Target environment"
required: true
default: "staging"
type: choice
options:
- staging
- production
image_tag:
description: "Container image tag (SHA or branch name)"
required: true
type: string
workflow_run:
workflows: ["Build & Push Images"]
types: [completed]
branches: [main, develop]
permissions:
contents: read
id-token: write
jobs:
deploy:
runs-on: ubuntu-latest
if: >-
github.event_name == 'workflow_dispatch' ||
(github.event_name == 'workflow_run' && github.event.workflow_run.conclusion == 'success')
environment: ${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production' || 'staging') }}
steps:
- uses: actions/checkout@v4
- name: Authenticate to Google Cloud
uses: google-github-actions/auth@v2
with:
workload_identity_provider: projects/customer1-gke/locations/global/workloadIdentityPools/github-pool/providers/github-provider
service_account: ci-deployer@customer1-gke.iam.gserviceaccount.com
- name: Set up Cloud SDK
uses: google-github-actions/setup-gcloud@v2
- name: Configure kubectl for GKE
run: |
gcloud container clusters get-credentials \
${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'prod' || 'staging') }}-cluster \
--region us-central1 \
--project customer1-gke
- name: Install Helm
uses: azure/setup-helm@v3
with:
version: v3.14.0
- name: Install SOPS + Age
run: |
curl -Lo /tmp/sops.zip https://github.com/getsops/sops/releases/download/v3.8.1/sops-v3.8.1_linux.amd64.zip
unzip /tmp/sops.zip -d /tmp/
sudo mv /tmp/sops /usr/local/bin/sops
go install github.com/getsops/gopgs@latest || true
go install filippo.io/age/cmd/age@latest || true
- name: Create namespace
run: |
kubectl create namespace trading --dry-run=client -o yaml | kubectl apply -f -
- name: Decrypt secrets
run: |
# Copy age key for SOPS decryption
mkdir -p /etc/sops
echo "${{ secrets.SOPS_AGE_KEY }}" > /etc/sops/age.key
chmod 600 /etc/sops/age.key
export SOPS_AGE_KEY_FILE=/etc/sops/age.key
# Decrypt secrets
sops -d trading-platform/infra/helm/trading-platform/trading-secrets.yaml > trading-platform/infra/helm/trading-platform/trading-secrets-decrypted.yaml
- name: Deploy with Helm
run: |
IMAGE_TAG="${{ github.event.inputs.image_tag }}"
ENVIRONMENT="${{ github.event.inputs.environment || (github.ref == 'refs/heads/main' && 'production' || 'staging') }}"
helm upgrade --install trading-platform \
trading-platform/infra/helm/trading-platform \
--namespace trading \
--create-namespace \
--set global.environment=${ENVIRONMENT} \
--set executeService.image.tag=${IMAGE_TAG} \
--set newsService.image.tag=${IMAGE_TAG} \
--set dataService.image.tag=${IMAGE_TAG} \
--set dashboard.image.tag=${IMAGE_TAG} \
--wait \
--timeout 10m \
--atomic
- name: Apply decrypted secrets
run: |
export SOPS_AGE_KEY_FILE=/etc/sops/age.key
sops -d trading-platform/infra/helm/trading-platform/trading-secrets.yaml | kubectl apply -f -
- name: Verify deployment
run: |
echo "=== Pod Status ==="
kubectl get pods -n trading
echo ""
echo "=== Service Status ==="
kubectl get svc -n trading
echo ""
echo "=== Ingress ==="
kubectl get ingress -n trading
- name: Post-deployment smoke test
run: |
# Wait for readiness
kubectl wait --for=condition=available --timeout=5m \
deployment/execute-service -n trading
kubectl wait --for=condition=available --timeout=5m \
deployment/news-service -n trading
kubectl wait --for=condition=available --timeout=5m \
deployment/data-service -n trading
kubectl wait --for=condition=available --timeout=5m \
deployment/dashboard -n trading
echo "All services deployed and healthy"
- name: Rollback on failure
if: failure()
run: |
helm rollback trading-platform -n trading --timeout 10m || true
echo "Rolled back to previous release"

112
trading-platform/README.md Normal file
View file

@ -0,0 +1,112 @@
# Trading Platform — Kubernetes Deployment
Kubernetes deployment infrastructure for the trading platform microservices running on GKE (customer1 namespace).
## Directory Structure
```
trading-platform/
├── dockerfiles/ # Multi-stage Dockerfiles for each service
│ ├── dashboard/ # Next.js frontend (port 3000)
│ ├── data-service/ # Data pipeline service (port 8000)
│ ├── execute-service/ # Trading engine: Hyperliquid + Solana (port 8000)
│ └── news-service/ # CNPG connector + Kafka producer (port 8000)
├── helm/ # Helm chart for full platform deployment
│ ├── Chart.yaml # Chart metadata
│ ├── values.yaml # Default values (images, replicas, resources, infra)
│ ├── .sops.yaml # SOPS configuration for secret encryption
│ ├── trading-secrets.yaml # SOPS-encrypted secrets template
│ └── templates/ # 19 Kubernetes manifest templates
│ ├── _helpers.tpl # Template helpers
│ ├── namespace.yaml # Namespace resource
│ ├── configmap.yaml # Shared ConfigMap
│ ├── secrets.yaml # Secrets (SOPS-encrypted via trading-secrets.yaml)
│ ├── ingress.yaml # GCE Ingress for all services
│ ├── NOTES.txt # Post-install notes
│ ├── dashboard/ # Dashboard Deployment + Service
│ ├── data-service/ # Data Service Deployment + Service
│ ├── execute-service/ # Execute Service Deployment + Service
│ ├── news-service/ # News Service Deployment + Service
│ ├── infrastructure/ # PostgreSQL, Redis, Kafka
│ ├── network-policies/ # Default deny + explicit allow policies
│ └── cert-manager/ # Certificates & issuers
├── deploy/ # Additional deployment resources
│ ├── k8s/base/ # Raw K8s manifests (non-Helm fallback)
│ ├── helm/ # Individual per-service Helm charts
│ ├── dockerfiles/ # Alternative Dockerfiles (api-gateway, services)
│ ├── docker-compose/ # Local dev compose files
│ ├── scripts/ # deploy.sh, generate-mtls-certs.sh
│ └── mtls/ # mTLS documentation
└── .github/workflows/ # CI/CD pipelines
├── build-test.yml # Build + unit tests on PR
├── build-push.yml # Build + push to GAR on merge
└── deploy.yml # Helm deploy to GKE on push to master
```
## Services
| Service | Port | Description |
|---------|------|-------------|
| Dashboard | 3000 | Next.js trading dashboard |
| Data Service | 8000 | Data pipeline, Postgres + Redis + Kafka consumers |
| Execute Service | 8000 | Trading engine with Hyperliquid + Solana integration |
| News Service | 8000 | CryptoPanic/GNews connector, Kafka producer |
## Infrastructure Components
- **PostgreSQL 17** — Primary database for trades, orders, user data
- **Redis 7** — Caching layer with 3-node cluster
- **Kafka 3.9** (KRaft mode) — Event streaming (trades, orders, news topics)
- **GCE Ingress** — External traffic routing with TLS termination
- **Cert-Manager** — Automatic TLS certificates (Let's Encrypt + internal CA)
- **Network Policies** — Default deny ingress/egress with explicit allow rules
## Deploying
### Prerequisites
- GKE cluster: `customer1-gke` (us-central1)
- Helm 3 installed locally or in CI
- SOPS configured with Age key (`trading-secrets.yaml` must be encrypted)
- Access to `us-central1-docker.pkg.dev/customer1-gke/trading` registry
### Quick Deploy
```bash
# 1. Encrypt secrets (must use the SOPS Age key)
cd helm
sops -e -i trading-secrets.yaml
# 2. Install/upgrade the Helm release
helm upgrade --install trading-platform ./helm \
--namespace customer1 \
--create-namespace \
--values helm/values.yaml \
--set global.environment=production
```
### CI/CD
- **PR opened** → `build-test.yml` runs unit tests
- **Merged to master** → `build-push.yml` builds images and pushes to GAR
- **Push to master** → `deploy.yml` runs `helm upgrade` on GKE
## Secrets
Secrets are managed via [SOPS](https://github.com/getsops/sops) with Age encryption.
The `.sops.yaml` file configures which keys to use for each path.
```bash
# Encrypt the secrets file
sops -e -i helm/trading-secrets.yaml
# Decrypt (for debugging)
sops -d helm/trading-secrets.yaml
```
**Never commit unencrypted secrets to git.**
## Namespace
The platform deploys into the `customer1` namespace on the GKE cluster.
Update `global.namespace` in `helm/values.yaml` or override via `--set` during install.

236
trading-platform/deploy/ci-cd/.github/workflows/ci-cd.yml vendored Normal file
View file

@ -0,0 +1,236 @@
name: Build, Test, and Deploy Trading Platform
on:
push:
branches: [main]
paths:
- 'trading-platform/**'
pull_request:
branches: [main]
paths:
- 'trading-platform/**'
workflow_dispatch:
inputs:
environment:
description: 'Deploy environment'
type: choice
options:
- staging
- production
default: staging
env:
REGISTRY: ghcr.io
IMAGE_PREFIX: ${{ github.repository_owner }}/trading-platform
permissions:
contents: read
packages: write
jobs:
# ── Test All Services ──────────────────────────────────────────────────
test-python-services:
name: Test Python Services
runs-on: ubuntu-latest
strategy:
matrix:
service: [execute-service, data-service, news-service]
defaults:
run:
working-directory: trading-platform/${{ matrix.service }}
steps:
- uses: actions/checkout@v4
- name: Set up Python
uses: actions/setup-python@v5
with:
python-version: '3.12'
cache: 'pip'
- name: Install dependencies
run: |
python -m pip install --upgrade pip
pip install -e ".[dev]"
working-directory: trading-platform/${{ matrix.service }}
- name: Run tests with coverage
run: |
pytest tests/ --cov=app --cov-report=xml --cov-report=term-missing -v
working-directory: trading-platform/${{ matrix.service }}
- name: Upload coverage to Codecov
uses: codecov/codecov-action@v4
with:
file: trading-platform/${{ matrix.service }}/coverage.xml
flags: ${{ matrix.service }}
test-dashboard:
name: Test Dashboard (Next.js)
runs-on: ubuntu-latest
defaults:
run:
working-directory: trading-platform/dashboard
steps:
- uses: actions/checkout@v4
- name: Set up Node.js
uses: actions/setup-node@v4
with:
node-version: '20'
cache: 'npm'
cache-dependency-path: trading-platform/dashboard/package-lock.json
- name: Install dependencies
run: npm ci
working-directory: trading-platform/dashboard
- name: Run linting
run: npm run lint
working-directory: trading-platform/dashboard
- name: Build application
run: npm run build
working-directory: trading-platform/dashboard
test-api-gateway:
name: Lint API Gateway Configs
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Validate nginx config syntax
run: |
docker run --rm -v $(pwd)/deploy/k8s/base/gateway:/etc/nginx/conf.d:ro nginx:1.25-alpine nginx -t
# ── Build and Push Container Images ─────────────────────────────────────
build-and-push:
needs: [test-python-services, test-dashboard, test-api-gateway]
name: Build & Push Images
runs-on: ubuntu-latest
if: github.event_name == 'push' || github.event_name == 'workflow_dispatch'
strategy:
matrix:
service: [execute-service, data-service, news-service, api-gateway, dashboard]
steps:
- uses: actions/checkout@v4
- name: Log in to Container Registry
uses: docker/login-action@v3
with:
registry: ${{ env.REGISTRY }}
username: ${{ github.actor }}
password: ${{ secrets.GITHUB_TOKEN }}
- name: Extract metadata (tags, labels)
id: meta
uses: docker/metadata-action@v5
with:
images: ${{ env.REGISTRY }}/${{ env.IMAGE_PREFIX }}/${{ matrix.service }}
tags: |
type=sha,prefix=
type=ref,event=branch
type=semver,pattern={{version}}
type=raw,value=latest,enable=${{ github.ref == 'refs/heads/main' }}
- name: Build and push Docker image
uses: docker/build-push-action@v5
with:
context: .
file: trading-platform/deploy/dockerfiles/${{ matrix.service }}.Dockerfile
push: true
tags: ${{ steps.meta.outputs.tags }}
labels: ${{ steps.meta.outputs.labels }}
cache-from: type=gha
cache-to: type=gha,mode=max
# ── Deploy to Kubernetes (Helm) ────────────────────────────────────────
deploy-staging:
needs: [build-and-push]
name: Deploy to Staging
runs-on: ubuntu-latest
if: github.event_name == 'push' || (github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'staging')
environment: staging
steps:
- uses: actions/checkout@v4
- name: Set up kubectl
uses: azure/setup-kubectl@v3
with:
version: 'v1.29.0'
- name: Configure kubeconfig
run: |
echo "${{ secrets.STAGING_KUBECONFIG }}" | base64 -d > $HOME/.kube/config
env:
STAGING_KUBECONFIG: ${{ secrets.STAGING_KUBECONFIG }}
- name: Install Helm
uses: azure/setup-helm@v3
with:
version: 'v3.14.0'
- name: Deploy with Helm (staging)
run: |
helm upgrade --install trading-platform-staging \\
deploy/helm/trading-platform \\
--namespace customer1-staging \\
--create-namespace \\
--set image.tag=${{ github.sha }} \\
--wait --timeout 10m
- name: Verify deployment
run: |
kubectl rollout status deployment/execute-service -n customer1-staging --timeout=5m
kubectl rollout status deployment/data-service -n customer1-staging --timeout=5m
kubectl rollout status deployment/news-service -n customer1-staging --timeout=5m
kubectl rollout status deployment/api-gateway -n customer1-staging --timeout=5m
kubectl rollout status deployment/dashboard -n customer1-staging --timeout=5m
deploy-production:
needs: [deploy-staging]
name: Deploy to Production
runs-on: ubuntu-latest
if: github.event_name == 'workflow_dispatch' && github.event.inputs.environment == 'production'
environment: production
steps:
- uses: actions/checkout@v4
- name: Set up kubectl
uses: azure/setup-kubectl@v3
with:
version: 'v1.29.0'
- name: Configure kubeconfig
run: |
echo "${{ secrets.PRODUCTION_KUBECONFIG }}" | base64 -d > $HOME/.kube/config
- name: Install Helm
uses: azure/setup-helm@v3
with:
version: 'v3.14.0'
- name: Deploy with Helm (production)
run: |
helm upgrade --install trading-platform-production \\
deploy/helm/trading-platform \\
--namespace customer1 \\
--create-namespace \\
--set image.tag=${{ github.sha }} \\
--values deploy/helm/trading-platform/values-production.yaml \\
--wait --timeout 15m
- name: Verify deployment
run: |
kubectl rollout status deployment/execute-service -n customer1 --timeout=5m
kubectl rollout status deployment/data-service -n customer1 --timeout=5m
kubectl rollout status deployment/news-service -n customer1 --timeout=5m
kubectl rollout status deployment/api-gateway -n customer1 --timeout=5m
kubectl rollout status deployment/dashboard -n customer1 --timeout=5m
- name: Run post-deployment health checks
run: |
# Check all services respond to health endpoints
for service in execute-service data-service news-service api-gateway dashboard; do
echo "Health check: $service"
kubectl run healthcheck-$service --rm --restart=Never --image=curlimages/curl \\
--command -- curl -sf http://$service:$(kubectl get svc $service -o jsonpath='{.spec.ports[0].port}')/health || exit 1
done

204
trading-platform/deploy/docker-compose/docker-compose.dev.yml Normal file
View file

@ -0,0 +1,204 @@
# =============================================================================
# Docker Compose — Local Development Environment
# =============================================================================
# Brings up all microservices + infrastructure for local development
#
# Usage:
# docker compose -f trading-platform/deploy/docker-compose/docker-compose.dev.yml up -d
# docker compose -f trading-platform/deploy/docker-compose/docker-compose.dev.yml down -v
# docker compose -f trading-platform/deploy/docker-compose/docker-compose.dev.yml logs -f execute-service
# =============================================================================
x-common-env: &common-env
TRADING_ENV: development
LOG_LEVEL: debug
services:
# ── Infrastructure ────────────────────────────────────────────────────
postgres:
image: postgres:16-alpine
container_name: trading-postgres-dev
environment:
POSTGRES_USER: trading
POSTGRES_PASSWORD: trading_dev_password
POSTGRES_DB: trading_db
ports:
- "5432:5432"
volumes:
- postgres-data:/var/lib/postgresql/data
healthcheck:
test: ["CMD-SHELL", "pg_isready -U trading -d trading_db"]
interval: 5s
timeout: 3s
retries: 5
restart: unless-stopped
networks:
- trading-network
redis:
image: redis:7-alpine
container_name: trading-redis-dev
ports:
- "6379:6379"
volumes:
- redis-data:/data
command: redis-server --appendonly yes --maxmemory 256mb --maxmemory-policy allkeys-lru
healthcheck:
test: ["CMD", "redis-cli", "ping"]
interval: 5s
timeout: 3s
retries: 5
restart: unless-stopped
networks:
- trading-network
kafka:
image: apache/kafka:3.7.0
container_name: trading-kafka-dev
ports:
- "9092:9092"
- "9093:9093"
environment:
KAFKA_NODE_ID: 1
KAFKA_PROCESS_ROLES: broker,controller
KAFKA_CONTROLLER_QUORUM_VOTERS: 1@kafka:9093
KAFKA_CONTROLLER_LISTENER_NAMES: CONTROLLER
KAFKA_LISTENERS: PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
KAFKA_ADVERTISED_LISTENERS: PLAINTEXT://localhost:9092
KAFKA_LISTENER_SECURITY_PROTOCOL_MAP: PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
KAFKA_CLUSTER_ID: MkU3OEVBNTcwT0FBQT0=
KAFKA_OFFSETS_TOPIC_REPLICATION_FACTOR: 1
KAFKA_TRANSACTION_STATE_LOG_MIN_ISR: 1
KAFKA_TRANSACTION_STATE_LOG_REPLICATION_FACTOR: 1
KAFKA_AUTO_CREATE_TOPICS_ENABLE: "true"
KAFKA_LOG_RETENTION_HOURS: 24
KAFKA_LOG_SEGMENT_BYTES: 1073741824
volumes:
- kafka-data:/var/lib/kafka/data
healthcheck:
test: ["CMD-SHELL", "kafka-topics.sh --bootstrap-server localhost:9092 --list || exit 1"]
interval: 10s
timeout: 5s
retries: 10
start_period: 30s
restart: unless-stopped
networks:
- trading-network
# ── Microservices ─────────────────────────────────────────────────────
data-service:
build:
context: ../../..
dockerfile: trading-platform/deploy/dockerfiles/data-service.Dockerfile
container_name: trading-data-service-dev
environment:
<<: *common-env
DATABASE_URL: postgresql+asyncpg://trading:trading_dev_password@postgres:5432/trading_db
REDIS_URL: redis://redis:6379/0
KAFKA_BOOTSTRAP_SERVERS: kafka:9092
LOG_LEVEL: debug
ports:
- "8001:8001"
depends_on:
postgres:
condition: service_healthy
redis:
condition: service_healthy
kafka:
condition: service_healthy
restart: unless-stopped
networks:
- trading-network
execute-service:
build:
context: ../../..
dockerfile: trading-platform/deploy/dockerfiles/execute-service.Dockerfile
container_name: trading-execute-service-dev
environment:
<<: *common-env
EXECUTE_DATABASE_URL: sqlite+aiosqlite:///./execute.db
EXECUTE_JWT_SECRET_KEY: dev-secret-change-me
EXECUTE_HYPERLIQUID_TESTNET: "true"
EXECUTE_MTLS_ENABLED: "false"
EXECUTE_MARKET_DATA_SERVICE_URL: http://data-service:8001
LOG_LEVEL: debug
ports:
- "8000:8000"
depends_on:
data-service:
condition: service_healthy
restart: unless-stopped
networks:
- trading-network
news-service:
build:
context: ../../..
dockerfile: trading-platform/deploy/dockerfiles/news-service.Dockerfile
container_name: trading-news-service-dev
environment:
<<: *common-env
DATABASE_URL: postgresql+asyncpg://trading:trading_dev_password@postgres:5432/trading_db
KAFKA_BOOTSTRAP_SERVERS: kafka:9092
REDIS_URL: redis://redis:6379/1
LOG_LEVEL: debug
ports:
- "8002:8002"
depends_on:
postgres:
condition: service_healthy
kafka:
condition: service_healthy
restart: unless-stopped
networks:
- trading-network
api-gateway:
build:
context: ../../..
dockerfile: trading-platform/deploy/dockerfiles/api-gateway.Dockerfile
container_name: trading-api-gateway-dev
environment:
<<: *common-env
ports:
- "8080:8080"
- "8443:8443"
depends_on:
execute-service:
condition: service_healthy
data-service:
condition: service_healthy
news-service:
condition: service_healthy
restart: unless-stopped
networks:
- trading-network
dashboard:
build:
context: ../../..
dockerfile: trading-platform/deploy/dockerfiles/dashboard.Dockerfile
container_name: trading-dashboard-dev
environment:
NEXT_PUBLIC_API_URL: http://localhost:8080
NODE_ENV: development
ports:
- "3000:3000"
depends_on:
api-gateway:
condition: service_started
restart: unless-stopped
networks:
- trading-network
volumes:
postgres-data:
redis-data:
kafka-data:
networks:
trading-network:
driver: bridge

26
trading-platform/deploy/dockerfiles/api-gateway.Dockerfile Normal file
View file

@ -0,0 +1,26 @@
# =============================================================================
# API Gateway Dockerfile — Nginx-based reverse proxy with rate limiting
# =============================================================================
FROM nginx:1.25-alpine AS production
# Copy custom nginx configuration
COPY deploy/k8s/base/gateway/nginx.conf /etc/nginx/nginx.conf
COPY deploy/k8s/base/gateway/conf.d/ /etc/nginx/conf.d/
# Create required directories
RUN mkdir -p /etc/nginx/ssl \
/etc/nginx/conf.d \
/var/cache/nginx \
/var/run/nginx \
/var/log/nginx \
&& touch /var/run/nginx/nginx.pid
# Security: run as nginx user (already exists in alpine image)
USER nginx
EXPOSE 8080 8443
HEALTHCHECK --interval=15s --timeout=3s --start-period=10s --retries=3 \
CMD wget --no-verbose --tries=1 --spider http://localhost:8080/health || exit 1
CMD ["nginx", "-g", "daemon off;"]

40
trading-platform/deploy/dockerfiles/dashboard.Dockerfile Normal file
View file

@ -0,0 +1,40 @@
# =============================================================================
# Dashboard Dockerfile — Next.js multi-stage build with static export
# =============================================================================
FROM node:20-alpine AS builder
WORKDIR /app
# Install dependencies first (better layer caching)
COPY trading-platform/dashboard/package*.json ./
RUN npm ci
# Copy source and build
COPY trading-platform/dashboard/ ./
RUN npm run build
# Production stage
FROM node:20-alpine AS production
# Security: non-root user
RUN addgroup -g 1001 -S nodejs && adduser -S nextjs -u 1001
WORKDIR /app
# Copy built output and package.json from builder
COPY --from=builder /app/package.json ./package.json
COPY --from=builder /app/.next/standalone ./
COPY --from=builder /app/.next/static ./.next/static
COPY --from=builder /app/public ./public
USER nextjs
EXPOSE 3000
ENV NODE_ENV=production
ENV PORT=3000
HEALTHCHECK --interval=30s --timeout=5s --start-period=15s --retries=3 \
CMD wget --no-verbose --tries=1 --spider http://localhost:3000/ || exit 1
CMD ["node", "server.js"]

32
trading-platform/deploy/dockerfiles/data-service.Dockerfile Normal file
View file

@ -0,0 +1,32 @@
# =============================================================================
# Data Service Dockerfile — Multi-stage build
# =============================================================================
FROM python:3.12-slim AS builder
WORKDIR /build
COPY trading-platform/data-service/pyproject.toml ./
RUN pip install --no-cache-dir --prefix=/install .
# Production stage
FROM python:3.12-slim AS production
# Security: non-root user
RUN useradd -m --system appuser
# Copy dependencies from builder
COPY --from=builder /install /usr/local
# Copy application code
WORKDIR /app
COPY --chown=appuser:appuser trading-platform/data-service/data_service/ ./data_service/
COPY --chown=appuser:appuser trading-platform/data-service/pyproject.toml ./
USER appuser
# Health check
HEALTHCHECK --interval=15s --timeout=5s --start-period=15s --retries=3 \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8001/health')" || exit 1
EXPOSE 8001
CMD ["uvicorn", "data_service.app.main:app", "--host", "0.0.0.0", "--port", "8001"]

36
trading-platform/deploy/dockerfiles/execute-service.Dockerfile Normal file
View file

@ -0,0 +1,36 @@
# =============================================================================
# Execute Service Dockerfile — Multi-stage build for minimal image
# =============================================================================
# Build stage: compile dependencies
FROM python:3.12-slim AS builder
WORKDIR /build
COPY trading-platform/execute-service/pyproject.toml ./
RUN pip install --no-cache-dir --prefix=/install .
# Production stage
FROM python:3.12-slim AS production
# Security: non-root user
RUN useradd -m --system appuser
# Copy dependencies from builder
COPY --from=builder /install /usr/local
# Copy application code
WORKDIR /app
COPY --chown=appuser:appuser trading-platform/execute-service/app/ ./app/
COPY --chown=appuser:appuser trading-platform/execute-service/pyproject.toml ./
# Create required directories with proper permissions
RUN mkdir -p /tmp /app/data && chown -R appuser:appuser /tmp /app/data
USER appuser
# Health check using Python (curl not in slim)
HEALTHCHECK --interval=15s --timeout=5s --start-period=15s --retries=3 \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8000/health')" || exit 1
EXPOSE 8000
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8000"]

41
trading-platform/deploy/dockerfiles/news-service.Dockerfile Normal file
View file

@ -0,0 +1,41 @@
# =============================================================================
# News Service Dockerfile — Multi-stage build with NLTK data
# =============================================================================
FROM python:3.12-slim AS builder
WORKDIR /build
COPY trading-platform/news-service/requirements.txt ./
RUN pip install --no-cache-dir --prefix=/install -r requirements.txt
# Production stage
FROM python:3.12-slim AS production
# Install system dependencies
RUN apt-get update && \
apt-get install -y --no-install-recommends \
gcc libpq-dev && \
rm -rf /var/lib/apt/lists/*
# Install Python dependencies from builder
COPY --from=builder /install /usr/local
# Download NLTK data for textblob
RUN python -c "import nltk; nltk.download('punkt'); nltk.download('punkt_tab'); nltk.download('averaged_perceptron_tagger')"
# Security: non-root user
RUN useradd -m --system appuser
# Copy application code
WORKDIR /app
COPY --chown=appuser:appuser trading-platform/news-service/app/ ./app/
COPY --chown=appuser:appuser trading-platform/news-service/requirements.txt ./
USER appuser
# Health check
HEALTHCHECK --interval=30s --timeout=5s --start-period=10s --retries=3 \
CMD python -c "import urllib.request; urllib.request.urlopen('http://localhost:8002/health')" || exit 1
EXPOSE 8002
CMD ["uvicorn", "app.main:app", "--host", "0.0.0.0", "--port", "8002", "--workers", "4"]

34
trading-platform/deploy/helm/Chart.yaml Normal file
View file

@ -0,0 +1,34 @@
# =============================================================================
# Trading Platform — Root Helm Chart
# =============================================================================
apiVersion: v2
name: trading-platform
description: Helm chart for the entire trading platform microservices
type: application
version: 0.1.0
appVersion: "0.1.0"
dependencies:
- name: api-gateway
version: "0.1.0"
repository: "file://../api-gateway"
- name: execute-service
version: "0.1.0"
repository: "file://../execute-service"
- name: data-service
version: "0.1.0"
repository: "file://../data-service"
- name: news-service
version: "0.1.0"
repository: "file://../news-service"
- name: dashboard
version: "0.1.0"
repository: "file://../dashboard"
- name: cert-manager
version: "1.14.0"
repository: https://charts.jetstack.io
condition: cert-manager.enabled
- name: ingress-nginx
version: "4.9.0"
repository: https://kubernetes.github.io/ingress-nginx
condition: ingress-nginx.enabled

60
trading-platform/deploy/helm/_helpers.tpl.template Normal file
View file

@ -0,0 +1,60 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "<SERVICE_NAME>.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "<SERVICE_NAME>.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "<SERVICE_NAME>.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "<SERVICE_NAME>.labels" -}}
helm.sh/chart: {{ include "<SERVICE_NAME>.chart" . }}
{{ include "<SERVICE_NAME>.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "<SERVICE_NAME>.selectorLabels" -}}
app.kubernetes.io/name: {{ include "<SERVICE_NAME>.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "<SERVICE_NAME>.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "<SERVICE_NAME>.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

6
trading-platform/deploy/helm/api-gateway/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: api-gateway
description: API Gateway — Nginx reverse proxy
type: application
version: 0.1.0
appVersion: "0.1.0"

61
trading-platform/deploy/helm/api-gateway/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "api-gateway.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "api-gateway.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "api-gateway.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "api-gateway.labels" -}}
helm.sh/chart: {{ include "api-gateway.chart" . }}
{{ include "api-gateway.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "api-gateway.selectorLabels" -}}
app.kubernetes.io/name: {{ include "api-gateway.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "api-gateway.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "api-gateway.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

57
trading-platform/deploy/helm/api-gateway/templates/deployment.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "api-gateway.fullname" . }}
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "api-gateway.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "api-gateway.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "api-gateway.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 8080
protocol: TCP
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 12 }}
{{- end }}

32
trading-platform/deploy/helm/api-gateway/templates/hpa.yaml Normal file
View file

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "api-gateway.fullname" . }}
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "api-gateway.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

61
trading-platform/deploy/helm/api-gateway/templates/ingress.yaml Normal file
View file

@ -0,0 +1,61 @@
{{- if .Values.ingress.enabled -}}
{{- $fullName := include "api-gateway.fullname" . -}}
{{- $svcPort := .Values.service.port -}}
{{- if and .Values.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
{{- if not (hasKey .Values.ingress.annotations "kubernetes.io/ingress.class") }}
{{- $_ := set .Values.ingress.annotations "kubernetes.io/ingress.class" .Values.ingress.className}}
{{- end }}
{{- end }}
{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: networking.k8s.io/v1
{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
apiVersion: extensions/v1beta1
{{- else -}}
apiVersion: extensions/v1beta1
{{- end }}
kind: Ingress
metadata:
name: {{ $fullName }}
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
{{- with .Values.ingress.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
spec:
{{- if and .Values.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
ingressClassName: {{ .Values.ingress.className }}
{{- end }}
{{- if .Values.ingress.tls }}
tls:
{{- range .Values.ingress.tls }}
- hosts:
{{- range .hosts }}
- {{ . | quote }}
{{- end }}
secretName: {{ .secretName }}
{{- end }}
{{- end }}
rules:
{{- range .Values.ingress.hosts }}
- host: {{ .host | quote }}
http:
paths:
{{- range .paths }}
- path: {{ .path }}
{{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
pathType: {{ .pathType }}
{{- end }}
backend:
{{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
service:
name: {{ $fullName }}
port:
number: {{ $svcPort }}
{{- else }}
serviceName: {{ $fullName }}
servicePort: {{ $svcPort }}
{{- end }}
{{- end }}
{{- end }}
{{- end }}

29
trading-platform/deploy/helm/api-gateway/templates/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "api-gateway.fullname" . }}-network-policy
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "api-gateway.selectorLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: api-gateway
ports:
- port: http
protocol: TCP
egress:
# Allow DNS resolution
- to: []
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP

15
trading-platform/deploy/helm/api-gateway/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "api-gateway.fullname" . }}
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "api-gateway.selectorLabels" . | nindent 4 }}

12
trading-platform/deploy/helm/api-gateway/templates/serviceaccount.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "api-gateway.serviceAccountName" . }}
labels:
{{- include "api-gateway.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
trading-platform/deploy/helm/api-gateway/values.yaml Normal file
View file

@ -0,0 +1,80 @@
# trading-platform/api-gateway Helm chart values
replicaCount: 2
image:
repository: trading-platform/api-gateway
pullPolicy: IfNotPresent
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
annotations: {}
name: ""
podAnnotations: {}
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service:
type: ClusterIP
port: 8080
ingress:
enabled: true
className: nginx
annotations: {}
hosts:
- host: api.trading.example.com
paths:
- path: /
pathType: Prefix
tls: []
resources:
limits:
cpu: "500m"
memory: 256Mi
requests:
cpu: "250m"
memory: 128Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
livenessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
nodeSelector: {}
tolerations: []
affinity: {}

6
trading-platform/deploy/helm/dashboard/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: dashboard
description: Dashboard frontend
type: application
version: 0.1.0
appVersion: "0.1.0"

61
trading-platform/deploy/helm/dashboard/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "dashboard.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "dashboard.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "dashboard.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "dashboard.labels" -}}
helm.sh/chart: {{ include "dashboard.chart" . }}
{{ include "dashboard.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "dashboard.selectorLabels" -}}
app.kubernetes.io/name: {{ include "dashboard.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "dashboard.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "dashboard.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

57
trading-platform/deploy/helm/dashboard/templates/deployment.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "dashboard.fullname" . }}
labels:
{{- include "dashboard.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "dashboard.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "dashboard.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "dashboard.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 3000
protocol: TCP
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 12 }}
{{- end }}

32
trading-platform/deploy/helm/dashboard/templates/hpa.yaml Normal file
View file

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "dashboard.fullname" . }}
labels:
{{- include "dashboard.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "dashboard.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

29
trading-platform/deploy/helm/dashboard/templates/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "dashboard.fullname" . }}-network-policy
labels:
{{- include "dashboard.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "dashboard.selectorLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: api-gateway
ports:
- port: http
protocol: TCP
egress:
# Allow DNS resolution
- to: []
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP

15
trading-platform/deploy/helm/dashboard/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "dashboard.fullname" . }}
labels:
{{- include "dashboard.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "dashboard.selectorLabels" . | nindent 4 }}

12
trading-platform/deploy/helm/dashboard/templates/serviceaccount.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "dashboard.serviceAccountName" . }}
labels:
{{- include "dashboard.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
trading-platform/deploy/helm/dashboard/values.yaml Normal file
View file

@ -0,0 +1,80 @@
# trading-platform/dashboard Helm chart values
replicaCount: 2
image:
repository: trading-platform/dashboard
pullPolicy: IfNotPresent
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
annotations: {}
name: ""
podAnnotations: {}
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service:
type: ClusterIP
port: 3000
ingress:
enabled: false
className: nginx
annotations: {}
hosts:
- host: api.trading.example.com
paths:
- path: /
pathType: Prefix
tls: []
resources:
limits:
cpu: "500m"
memory: 512Mi
requests:
cpu: "250m"
memory: 256Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
livenessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /
port: http
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
nodeSelector: {}
tolerations: []
affinity: {}

6
trading-platform/deploy/helm/data-service/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: data-service
description: Trading data service
type: application
version: 0.1.0
appVersion: "0.1.0"

61
trading-platform/deploy/helm/data-service/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "data-service.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "data-service.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "data-service.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "data-service.labels" -}}
helm.sh/chart: {{ include "data-service.chart" . }}
{{ include "data-service.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "data-service.selectorLabels" -}}
app.kubernetes.io/name: {{ include "data-service.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "data-service.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "data-service.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

57
trading-platform/deploy/helm/data-service/templates/deployment.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "data-service.fullname" . }}
labels:
{{- include "data-service.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "data-service.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "data-service.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "data-service.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 8001
protocol: TCP
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 12 }}
{{- end }}

32
trading-platform/deploy/helm/data-service/templates/hpa.yaml Normal file
View file

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "data-service.fullname" . }}
labels:
{{- include "data-service.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "data-service.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

29
trading-platform/deploy/helm/data-service/templates/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "data-service.fullname" . }}-network-policy
labels:
{{- include "data-service.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "data-service.selectorLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: api-gateway
ports:
- port: http
protocol: TCP
egress:
# Allow DNS resolution
- to: []
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP

15
trading-platform/deploy/helm/data-service/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "data-service.fullname" . }}
labels:
{{- include "data-service.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "data-service.selectorLabels" . | nindent 4 }}

12
trading-platform/deploy/helm/data-service/templates/serviceaccount.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "data-service.serviceAccountName" . }}
labels:
{{- include "data-service.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
trading-platform/deploy/helm/data-service/values.yaml Normal file
View file

@ -0,0 +1,80 @@
# trading-platform/data-service Helm chart values
replicaCount: 2
image:
repository: trading-platform/data-service
pullPolicy: IfNotPresent
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
annotations: {}
name: ""
podAnnotations: {}
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service:
type: ClusterIP
port: 8001
ingress:
enabled: false
className: nginx
annotations: {}
hosts:
- host: api.trading.example.com
paths:
- path: /
pathType: Prefix
tls: []
resources:
limits:
cpu: "1000m"
memory: 1Gi
requests:
cpu: "500m"
memory: 512Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
livenessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
nodeSelector: {}
tolerations: []
affinity: {}

6
trading-platform/deploy/helm/execute-service/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: execute-service
description: Trading execution service
type: application
version: 0.1.0
appVersion: "0.1.0"

61
trading-platform/deploy/helm/execute-service/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "execute-service.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "execute-service.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "execute-service.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "execute-service.labels" -}}
helm.sh/chart: {{ include "execute-service.chart" . }}
{{ include "execute-service.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "execute-service.selectorLabels" -}}
app.kubernetes.io/name: {{ include "execute-service.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "execute-service.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "execute-service.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

57
trading-platform/deploy/helm/execute-service/templates/deployment.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "execute-service.fullname" . }}
labels:
{{- include "execute-service.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "execute-service.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "execute-service.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "execute-service.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 8000
protocol: TCP
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 12 }}
{{- end }}

32
trading-platform/deploy/helm/execute-service/templates/hpa.yaml Normal file
View file

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "execute-service.fullname" . }}
labels:
{{- include "execute-service.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "execute-service.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

29
trading-platform/deploy/helm/execute-service/templates/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "execute-service.fullname" . }}-network-policy
labels:
{{- include "execute-service.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "execute-service.selectorLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: api-gateway
ports:
- port: http
protocol: TCP
egress:
# Allow DNS resolution
- to: []
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP

15
trading-platform/deploy/helm/execute-service/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "execute-service.fullname" . }}
labels:
{{- include "execute-service.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "execute-service.selectorLabels" . | nindent 4 }}

12
trading-platform/deploy/helm/execute-service/templates/serviceaccount.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "execute-service.serviceAccountName" . }}
labels:
{{- include "execute-service.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
trading-platform/deploy/helm/execute-service/values.yaml Normal file
View file

@ -0,0 +1,80 @@
# trading-platform/execute-service Helm chart values
replicaCount: 2
image:
repository: trading-platform/execute-service
pullPolicy: IfNotPresent
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
annotations: {}
name: ""
podAnnotations: {}
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service:
type: ClusterIP
port: 8000
ingress:
enabled: false
className: nginx
annotations: {}
hosts:
- host: api.trading.example.com
paths:
- path: /
pathType: Prefix
tls: []
resources:
limits:
cpu: "500m"
memory: 512Mi
requests:
cpu: "250m"
memory: 256Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
livenessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
nodeSelector: {}
tolerations: []
affinity: {}

6
trading-platform/deploy/helm/news-service/Chart.yaml Normal file
View file

@ -0,0 +1,6 @@
apiVersion: v2
name: news-service
description: News analysis service
type: application
version: 0.1.0
appVersion: "0.1.0"

61
trading-platform/deploy/helm/news-service/templates/_helpers.tpl Normal file
View file

@ -0,0 +1,61 @@
{{/*
Expand the name of the chart.
*/}}
{{- define "news-service.name" -}}
{{- default .Chart.Name .Values.nameOverride | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Create a default fully qualified app name.
*/}}
{{- define "news-service.fullname" -}}
{{- if .Values.fullnameOverride }}
{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- $name := default .Chart.Name .Values.nameOverride }}
{{- if contains $name .Release.Name }}
{{- .Release.Name | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
{{- end }}
{{/*
Create chart name and version as used by the chart label.
*/}}
{{- define "news-service.chart" -}}
{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }}
{{- end }}
{{/*
Common labels
*/}}
{{- define "news-service.labels" -}}
helm.sh/chart: {{ include "news-service.chart" . }}
{{ include "news-service.selectorLabels" . }}
{{- if .Chart.AppVersion }}
app.kubernetes.io/version: {{ .Chart.AppVersion | quote }}
{{- end }}
app.kubernetes.io/managed-by: {{ .Release.Service }}
{{- end }}
{{/*
Selector labels
*/}}
{{- define "news-service.selectorLabels" -}}
app.kubernetes.io/name: {{ include "news-service.name" . }}
app.kubernetes.io/instance: {{ .Release.Name }}
{{- end }}
{{/*
Create the name of the service account to use
*/}}
{{- define "news-service.serviceAccountName" -}}
{{- if .Values.serviceAccount.create }}
{{- default (include "news-service.fullname" .) .Values.serviceAccount.name }}
{{- else }}
{{- default "default" .Values.serviceAccount.name }}
{{- end }}
{{- end }}

57
trading-platform/deploy/helm/news-service/templates/deployment.yaml Normal file
View file

@ -0,0 +1,57 @@
apiVersion: apps/v1
kind: Deployment
metadata:
name: {{ include "news-service.fullname" . }}
labels:
{{- include "news-service.labels" . | nindent 4 }}
spec:
{{- if not .Values.autoscaling.enabled }}
replicas: {{ .Values.replicaCount }}
{{- end }}
selector:
matchLabels:
{{- include "news-service.selectorLabels" . | nindent 6 }}
template:
metadata:
annotations:
{{- with .Values.podAnnotations }}
{{- toYaml . | nindent 8 }}
{{- end }}
labels:
{{- include "news-service.selectorLabels" . | nindent 8 }}
spec:
{{- with .Values.imagePullSecrets }}
imagePullSecrets:
{{- toYaml . | nindent 8 }}
{{- end }}
serviceAccountName: {{ include "news-service.serviceAccountName" . }}
securityContext:
{{- toYaml .Values.podSecurityContext | nindent 8 }}
containers:
- name: {{ .Chart.Name }}
securityContext:
{{- toYaml .Values.securityContext | nindent 12 }}
image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}"
imagePullPolicy: {{ .Values.image.pullPolicy }}
ports:
- name: http
containerPort: 8002
protocol: TCP
livenessProbe:
{{- toYaml .Values.livenessProbe | nindent 12 }}
readinessProbe:
{{- toYaml .Values.readinessProbe | nindent 12 }}
resources:
{{- toYaml .Values.resources | nindent 12 }}
{{- with .Values.nodeSelector }}
nodeSelector:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.affinity }}
affinity:
{{- toYaml . | nindent 12 }}
{{- end }}
{{- with .Values.tolerations }}
tolerations:
{{- toYaml . | nindent 12 }}
{{- end }}

32
trading-platform/deploy/helm/news-service/templates/hpa.yaml Normal file
View file

@ -0,0 +1,32 @@
{{- if .Values.autoscaling.enabled }}
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: {{ include "news-service.fullname" . }}
labels:
{{- include "news-service.labels" . | nindent 4 }}
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: {{ include "news-service.fullname" . }}
minReplicas: {{ .Values.autoscaling.minReplicas }}
maxReplicas: {{ .Values.autoscaling.maxReplicas }}
metrics:
{{- if .Values.autoscaling.targetCPUUtilizationPercentage }}
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetCPUUtilizationPercentage }}
{{- end }}
{{- if .Values.autoscaling.targetMemoryUtilizationPercentage }}
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: {{ .Values.autoscaling.targetMemoryUtilizationPercentage }}
{{- end }}
{{- end }}

29
trading-platform/deploy/helm/news-service/templates/networkpolicy.yaml Normal file
View file

@ -0,0 +1,29 @@
apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
name: {{ include "news-service.fullname" . }}-network-policy
labels:
{{- include "news-service.labels" . | nindent 4 }}
spec:
podSelector:
matchLabels:
{{- include "news-service.selectorLabels" . | nindent 6 }}
policyTypes:
- Ingress
- Egress
ingress:
- from:
- podSelector:
matchLabels:
app.kubernetes.io/name: api-gateway
ports:
- port: http
protocol: TCP
egress:
# Allow DNS resolution
- to: []
ports:
- port: 53
protocol: UDP
- port: 53
protocol: TCP

15
trading-platform/deploy/helm/news-service/templates/service.yaml Normal file
View file

@ -0,0 +1,15 @@
apiVersion: v1
kind: Service
metadata:
name: {{ include "news-service.fullname" . }}
labels:
{{- include "news-service.labels" . | nindent 4 }}
spec:
type: {{ .Values.service.type }}
ports:
- port: {{ .Values.service.port }}
targetPort: http
protocol: TCP
name: http
selector:
{{- include "news-service.selectorLabels" . | nindent 4 }}

12
trading-platform/deploy/helm/news-service/templates/serviceaccount.yaml Normal file
View file

@ -0,0 +1,12 @@
{{- if .Values.serviceAccount.create -}}
apiVersion: v1
kind: ServiceAccount
metadata:
name: {{ include "news-service.serviceAccountName" . }}
labels:
{{- include "news-service.labels" . | nindent 4 }}
{{- with .Values.serviceAccount.annotations }}
annotations:
{{- toYaml . | nindent 4 }}
{{- end }}
{{- end }}

80
trading-platform/deploy/helm/news-service/values.yaml Normal file
View file

@ -0,0 +1,80 @@
# trading-platform/news-service Helm chart values
replicaCount: 2
image:
repository: trading-platform/news-service
pullPolicy: IfNotPresent
tag: ""
imagePullSecrets: []
nameOverride: ""
fullnameOverride: ""
serviceAccount:
create: true
annotations: {}
name: ""
podAnnotations: {}
securityContext:
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
runAsNonRoot: true
runAsUser: 1000
service:
type: ClusterIP
port: 8002
ingress:
enabled: false
className: nginx
annotations: {}
hosts:
- host: api.trading.example.com
paths:
- path: /
pathType: Prefix
tls: []
resources:
limits:
cpu: "1000m"
memory: 1Gi
requests:
cpu: "500m"
memory: 512Mi
autoscaling:
enabled: true
minReplicas: 2
maxReplicas: 10
targetCPUUtilizationPercentage: 80
targetMemoryUtilizationPercentage: 80
livenessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: http
initialDelaySeconds: 10
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
nodeSelector: {}
tolerations: []
affinity: {}

71
trading-platform/deploy/k8s/base/api-gateway-deployment.yaml Normal file
View file

@ -0,0 +1,71 @@
---
apiVersion: apps/v1
kind: Deployment
metadata:
name: api-gateway
namespace: customer1
labels:
app: api-gateway
app.kubernetes.io/name: api-gateway
app.kubernetes.io/component: microservice
spec:
replicas: 2
selector:
matchLabels:
app: api-gateway
template:
metadata:
labels:
app: api-gateway
app.kubernetes.io/name: api-gateway
app.kubernetes.io/component: microservice
spec:
automountServiceAccountToken: false
securityContext:
runAsNonRoot: true
runAsUser: 1000
fsGroup: 1000
containers:
- name: api-gateway
image: "trading-platform/api-gateway:v${VERSION}"
ports:
- containerPort: 8080
protocol: TCP
envFrom:
- configMapRef:
name: trading-platform-config
resources:
limits:
cpu: "500m"
memory: 256Mi
requests:
cpu: "250m"
memory: 128Mi
livenessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 15
periodSeconds: 15
timeoutSeconds: 5
failureThreshold: 3
readinessProbe:
httpGet:
path: /health
port: 8080
initialDelaySeconds: 5
periodSeconds: 10
timeoutSeconds: 5
failureThreshold: 3
securityContext:
allowPrivilegeEscalation: false
capabilities:
drop:
- ALL
readOnlyRootFilesystem: true
volumeMounts:
- name: tmp
mountPath: /tmp
volumes:
- name: tmp
emptyDir: {}

27
trading-platform/deploy/k8s/base/api-gateway-hpa.yaml Normal file
View file

@ -0,0 +1,27 @@
apiVersion: autoscaling/v2
kind: HorizontalPodAutoscaler
metadata:
name: api-gateway-hpa
namespace: customer1
labels:
app: api-gateway
spec:
scaleTargetRef:
apiVersion: apps/v1
kind: Deployment
name: api-gateway
minReplicas: 2
maxReplicas: 10
metrics:
- type: Resource
resource:
name: cpu
target:
type: Utilization
averageUtilization: 80
- type: Resource
resource:
name: memory
target:
type: Utilization
averageUtilization: 80

18
trading-platform/deploy/k8s/base/api-gateway-service.yaml Normal file
View file

@ -0,0 +1,18 @@
apiVersion: v1
kind: Service
metadata:
name: api-gateway
namespace: customer1
labels:
app: api-gateway
app.kubernetes.io/name: api-gateway
app.kubernetes.io/component: microservice
spec:
type: ClusterIP
ports:
- port: 8080
targetPort: 8080
protocol: TCP
name: http
selector:
app: api-gateway

24
trading-platform/deploy/k8s/base/cert-manager/api-gateway-mtls-cert.yaml Normal file
View file

@ -0,0 +1,24 @@
apiVersion: cert-manager.io/v1
kind: Certificate
metadata:
name: api-gateway-mtls-cert
namespace: customer1
spec:
secretName: api-gateway-mtls-secret
duration: 2160h # 90 days
renewBefore: 360h # 15 days
commonName: api-gateway.customer1.svc.cluster.local
dnsNames:
- api-gateway
- api-gateway.customer1
- api-gateway.customer1.svc
- api-gateway.customer1.svc.cluster.local
usages:
- digital signature
- key encipherment
- client auth
- server auth
issuerRef:
name: trading-platform-ca-issuer
kind: Issuer
group: cert-manager.io

8
trading-platform/deploy/k8s/base/cert-manager/ca-issuer.yaml Normal file
View file

@ -0,0 +1,8 @@
apiVersion: cert-manager.io/v1
kind: Issuer
metadata:
name: trading-platform-ca-issuer
namespace: customer1
spec:
ca:
secretName: trading-platform-ca-secret

Some files were not shown because too many files have changed in this diff Show more