feat: add trading-platform K8s manifests for customer1

- Scaffold trading-platform under apps/base/customer1/trading-platform/
- Add 4 microservice deployments: data-service, execute-service, news-service, dashboard
- Add ConfigMaps with DB/Kafka/Redis connection configs
- Add HTTPRoutes via Gateway API (external-http-gateway)
- Add NetworkPolicies for inter-service and DB/Kafka/Redis egress
- Add SOPS-encrypted secrets (age key)
- Add Kafka (KRaft) and Redis infrastructure to hermes-db/
- Update root and staging kustomizations

All containers: non-root, readOnlyRootFilesystem, resource limits, health probes
Images: ghcr.io/sirius0xdev/trading-{service}:latest

apps/base/customer1/hermes-db/kafka-broker.yaml

@@ -0,0 +1,128 @@
+# Kafka broker (KRaft mode — no ZooKeeper required)
+# Single-broker for dev/staging; scale replicas for production
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-kafka
+  namespace: customer1
+  labels:
+    app: trading-kafka
+spec:
+  clusterIP: None
+  selector:
+    app: trading-kafka
+  ports:
+    - name: internal
+      port: 9092
+      targetPort: 9092
+    - name: controller
+      port: 9093
+      targetPort: 9093
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-kafka-config
+  namespace: customer1
+data:
+  server.properties: |
+    process.roles=broker,controller
+    node.id=1
+    controller.quorum.voters=1@trading-kafka-0.trading-kafka.customer1.svc.cluster.local:9093
+    listeners=PLAINTEXT://0.0.0.0:9092,CONTROLLER://0.0.0.0:9093
+    advertised.listeners=PLAINTEXT://trading-kafka-0.trading-kafka.customer1.svc.cluster.local:9092
+    listener.security.protocol.map=PLAINTEXT:PLAINTEXT,CONTROLLER:PLAINTEXT
+    controller.listener.names=CONTROLLER
+    inter.broker.listener.name=PLAINTEXT
+    log.dirs=/var/lib/kafka/data
+    num.partitions=3
+    default.replication.factor=1
+    offsets.topic.replication.factor=1
+    transaction.state.log.replication.factor=1
+    transaction.state.log.min.isr=1
+    auto.create.topics.enable=true
+---
+apiVersion: apps/v1
+kind: StatefulSet
+metadata:
+  name: trading-kafka
+  namespace: customer1
+  labels:
+    app: trading-kafka
+spec:
+  serviceName: trading-kafka
+  replicas: 1
+  selector:
+    matchLabels:
+      app: trading-kafka
+  template:
+    metadata:
+      labels:
+        app: trading-kafka
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: kafka
+          image: apache/kafka:3.9.0
+          ports:
+            - containerPort: 9092
+              name: internal
+            - containerPort: 9093
+              name: controller
+          env:
+            - name: KAFKA_HEAP_OPTS
+              value: "-Xmx512M -Xms256M"
+            - name: CLUSTER_ID
+              value: "trading-kafka-cluster-01"
+          command:
+            - /bin/bash
+            - -c
+            - |
+              export KAFKA_CLUSTER_ID="$(/opt/kafka/bin/kafka-storage.sh random-uuid)"
+              /opt/kafka/bin/kafka-storage.sh format -t $KAFKA_CLUSTER_ID -c /etc/kafka/server.properties --ignore-formatted
+              exec /opt/kafka/bin/kafka-server-start.sh /etc/kafka/server.properties
+          resources:
+            requests:
+              cpu: 250m
+              memory: 512Mi
+            limits:
+              cpu: 1000m
+              memory: 1Gi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: false
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config
+              mountPath: /etc/kafka
+            - name: data
+              mountPath: /var/lib/kafka/data
+          readinessProbe:
+            tcpSocket:
+              port: 9092
+            initialDelaySeconds: 30
+            periodSeconds: 10
+            failureThreshold: 5
+          livenessProbe:
+            tcpSocket:
+              port: 9092
+            initialDelaySeconds: 60
+            periodSeconds: 30
+      volumes:
+        - name: config
+          configMap:
+            name: trading-kafka-config
+  volumeClaimTemplates:
+    - metadata:
+        name: data
+      spec:
+        accessModes:
+          - ReadWriteOnce
+        resources:
+          requests:
+            storage: 10Gi

apps/base/customer1/hermes-db/kustomization.yaml

@@ -9,3 +9,5 @@ resources:
   - trading-data-db.yaml
   - agent-memory-db.yaml
   - hermes-scheduled-backup.yaml
+  - kafka-broker.yaml
+  - redis-cluster.yaml

apps/base/customer1/hermes-db/redis-cluster.yaml

@@ -0,0 +1,103 @@
+# Redis single-instance for trading platform caching
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-redis
+  namespace: customer1
+  labels:
+    app: trading-redis
+spec:
+  selector:
+    app: trading-redis
+  ports:
+    - port: 6379
+      targetPort: 6379
+      name: redis
+  type: ClusterIP
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-redis-config
+  namespace: customer1
+data:
+  redis.conf: |
+    maxmemory 256mb
+    maxmemory-policy allkeys-lru
+    save 900 1
+    save 300 10
+    save 60 10000
+    appendonly yes
+    appendfsync everysec
+    dir /data
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trading-redis
+  namespace: customer1
+  labels:
+    app: trading-redis
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trading-redis
+  template:
+    metadata:
+      labels:
+        app: trading-redis
+    spec:
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 999
+        fsGroup: 999
+      containers:
+        - name: redis
+          image: redis:7.4-alpine
+          ports:
+            - containerPort: 6379
+              name: redis
+          args:
+            - redis-server
+            - /etc/redis/redis.conf
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          volumeMounts:
+            - name: config
+              mountPath: /etc/redis
+            - name: data
+              mountPath: /data
+          readinessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 5
+            periodSeconds: 5
+          livenessProbe:
+            exec:
+              command:
+                - redis-cli
+                - ping
+            initialDelaySeconds: 10
+            periodSeconds: 10
+      volumes:
+        - name: config
+          configMap:
+            name: trading-redis-config
+        - name: data
+          emptyDir: {}

apps/base/customer1/kustomization.yaml

@@ -7,3 +7,4 @@ resources:
   - service.yaml
   - siriusdevops-site
   - waitlist-api
+  - trading-platform

apps/base/customer1/trading-platform/configmaps/dashboard-config.yaml

@@ -0,0 +1,12 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-dashboard-config
+  namespace: customer1
+data:
+  DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
+  DB_PORT: "5432"
+  DB_NAME: "trading_data"
+  DATA_SERVICE_URL: "http://trading-data-service.customer1.svc.cluster.local"
+  EXECUTE_SERVICE_URL: "http://trading-execute-service.customer1.svc.cluster.local"
+  NEWS_SERVICE_URL: "http://trading-news-service.customer1.svc.cluster.local"

apps/base/customer1/trading-platform/configmaps/data-service-config.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-data-service-config
+  namespace: customer1
+data:
+  DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
+  DB_PORT: "5432"
+  DB_NAME: "trading_data"
+  REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
+  REDIS_PORT: "6379"
+  KAFKA_BROKER: "trading-kafka.customer1.svc.cluster.local:9092"
+  LOG_LEVEL: "info"

apps/base/customer1/trading-platform/configmaps/execute-service-config.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-execute-service-config
+  namespace: customer1
+data:
+  DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
+  DB_PORT: "5432"
+  DB_NAME: "trading_data"
+  REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
+  REDIS_PORT: "6379"
+  KAFKA_BROKER: "trading-kafka.customer1.svc.cluster.local:9092"
+  LOG_LEVEL: "info"

apps/base/customer1/trading-platform/configmaps/kustomization.yaml

@@ -0,0 +1,8 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - data-service-config.yaml
+  - execute-service-config.yaml
+  - news-service-config.yaml
+  - dashboard-config.yaml

apps/base/customer1/trading-platform/configmaps/news-service-config.yaml

@@ -0,0 +1,13 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: trading-news-service-config
+  namespace: customer1
+data:
+  DB_HOST: "hermes-pgdb-rw.customer1.svc.cluster.local"
+  DB_PORT: "5432"
+  DB_NAME: "trading_data"
+  REDIS_HOST: "trading-redis.customer1.svc.cluster.local"
+  REDIS_PORT: "6379"
+  NEWS_FETCH_INTERVAL: "300"
+  LOG_LEVEL: "info"

apps/base/customer1/trading-platform/dashboard/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trading-dashboard
+  namespace: customer1
+  labels:
+    app: trading-dashboard
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trading-dashboard
+  template:
+    metadata:
+      labels:
+        app: trading-dashboard
+      annotations:
+        checksum/config: trading-dashboard-config
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: dashboard
+          image: ghcr.io/sirius0xdev/trading-dashboard:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8000
+              name: http
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          envFrom:
+            - configMapRef:
+                name: trading-dashboard-config
+          env:
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: password
+          startupProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /api/health
+              port: 8000
+            initialDelaySeconds: 5
+            periodSeconds: 10

apps/base/customer1/trading-platform/dashboard/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

apps/base/customer1/trading-platform/dashboard/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-dashboard-svc
+  namespace: customer1
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "trading-dashboard"
+    tailscale.com/tags: "tag:k8s-operator"
+    tailscale.com/ports: "http:80"
+spec:
+  selector:
+    app: trading-dashboard
+  ports:
+    - port: 80
+      targetPort: 8000
+      name: http
+  type: ClusterIP

apps/base/customer1/trading-platform/data-service/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trading-data-service
+  namespace: customer1
+  labels:
+    app: trading-data-service
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trading-data-service
+  template:
+    metadata:
+      labels:
+        app: trading-data-service
+      annotations:
+        checksum/config: trading-data-service-config
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: data-service
+          image: ghcr.io/sirius0xdev/trading-data-service:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8001
+              name: http
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          envFrom:
+            - configMapRef:
+                name: trading-data-service-config
+          env:
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: password
+          startupProbe:
+            httpGet:
+              path: /health
+              port: 8001
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8001
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8001
+            initialDelaySeconds: 5
+            periodSeconds: 10

apps/base/customer1/trading-platform/data-service/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

apps/base/customer1/trading-platform/data-service/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-data-service
+  namespace: customer1
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "trading-data-service"
+    tailscale.com/tags: "tag:k8s-operator"
+    tailscale.com/ports: "http:80"
+spec:
+  selector:
+    app: trading-data-service
+  ports:
+    - port: 80
+      targetPort: 8001
+      name: http
+  type: ClusterIP

apps/base/customer1/trading-platform/execute-service/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trading-execute-service
+  namespace: customer1
+  labels:
+    app: trading-execute-service
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trading-execute-service
+  template:
+    metadata:
+      labels:
+        app: trading-execute-service
+      annotations:
+        checksum/config: trading-execute-service-config
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: execute-service
+          image: ghcr.io/sirius0xdev/trading-execute-service:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8002
+              name: http
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          envFrom:
+            - configMapRef:
+                name: trading-execute-service-config
+          env:
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: password
+          startupProbe:
+            httpGet:
+              path: /health
+              port: 8002
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8002
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8002
+            initialDelaySeconds: 5
+            periodSeconds: 10

apps/base/customer1/trading-platform/execute-service/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

apps/base/customer1/trading-platform/execute-service/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-execute-service
+  namespace: customer1
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "trading-execute-service"
+    tailscale.com/tags: "tag:k8s-operator"
+    tailscale.com/ports: "http:80"
+spec:
+  selector:
+    app: trading-execute-service
+  ports:
+    - port: 80
+      targetPort: 8002
+      name: http
+  type: ClusterIP

apps/base/customer1/trading-platform/kustomization.yaml

@@ -0,0 +1,13 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+namespace: customer1
+
+resources:
+  - data-service
+  - execute-service
+  - news-service
+  - dashboard
+  - configmaps
+  - secrets
+  - network-policies
+  - routes

apps/base/customer1/trading-platform/network-policies/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - trading-network-policies.yaml

apps/base/customer1/trading-platform/network-policies/trading-network-policies.yaml

@@ -0,0 +1,109 @@
+apiVersion: networking.k8s.io/v1
+kind: NetworkPolicy
+metadata:
+  name: trading-platform-netpol
+  namespace: customer1
+spec:
+  podSelector:
+    matchExpressions:
+      - key: app
+        operator: In
+        values:
+          - trading-data-service
+          - trading-execute-service
+          - trading-news-service
+          - trading-dashboard
+  policyTypes:
+    - Ingress
+    - Egress
+  ingress:
+    # Allow from Gateway / ingress controller
+    - from:
+        - namespaceSelector:
+            matchLabels:
+              kubernetes.io/metadata.name: customer1
+      ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8001
+          protocol: TCP
+        - port: 8002
+          protocol: TCP
+        - port: 8003
+          protocol: TCP
+    # Allow inter-service communication
+    - from:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values:
+                  - trading-data-service
+                  - trading-execute-service
+                  - trading-news-service
+                  - trading-dashboard
+      ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8001
+          protocol: TCP
+        - port: 8002
+          protocol: TCP
+        - port: 8003
+          protocol: TCP
+  egress:
+    # Allow DNS
+    - to:
+        - namespaceSelector: {}
+          podSelector:
+            matchLabels:
+              k8s-app: kube-dns
+      ports:
+        - port: 53
+          protocol: UDP
+        - port: 53
+          protocol: TCP
+    # Allow DB access
+    - to:
+        - podSelector:
+            matchLabels:
+              cnpg.io/cluster: hermes-pgdb
+      ports:
+        - port: 5432
+          protocol: TCP
+    # Allow Redis access
+    - to:
+        - podSelector:
+            matchLabels:
+              app: trading-redis
+      ports:
+        - port: 6379
+          protocol: TCP
+    # Allow Kafka access
+    - to:
+        - podSelector:
+            matchLabels:
+              app: trading-kafka
+      ports:
+        - port: 9092
+          protocol: TCP
+    # Allow inter-service egress
+    - to:
+        - podSelector:
+            matchExpressions:
+              - key: app
+                operator: In
+                values:
+                  - trading-data-service
+                  - trading-execute-service
+                  - trading-news-service
+                  - trading-dashboard
+      ports:
+        - port: 8000
+          protocol: TCP
+        - port: 8001
+          protocol: TCP
+        - port: 8002
+          protocol: TCP
+        - port: 8003
+          protocol: TCP

apps/base/customer1/trading-platform/news-service/deployment.yaml

@@ -0,0 +1,79 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: trading-news-service
+  namespace: customer1
+  labels:
+    app: trading-news-service
+spec:
+  replicas: 1
+  strategy:
+    type: Recreate
+  selector:
+    matchLabels:
+      app: trading-news-service
+  template:
+    metadata:
+      labels:
+        app: trading-news-service
+      annotations:
+        checksum/config: trading-news-service-config
+    spec:
+      terminationGracePeriodSeconds: 30
+      securityContext:
+        runAsNonRoot: true
+        runAsUser: 1000
+        fsGroup: 1000
+      containers:
+        - name: news-service
+          image: ghcr.io/sirius0xdev/trading-news-service:latest
+          imagePullPolicy: Always
+          ports:
+            - containerPort: 8003
+              name: http
+          resources:
+            requests:
+              cpu: 100m
+              memory: 128Mi
+            limits:
+              cpu: 500m
+              memory: 512Mi
+          securityContext:
+            allowPrivilegeEscalation: false
+            readOnlyRootFilesystem: true
+            capabilities:
+              drop:
+                - ALL
+          envFrom:
+            - configMapRef:
+                name: trading-news-service-config
+          env:
+            - name: DB_USER
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: username
+            - name: DB_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: trading-db-credentials
+                  key: password
+          startupProbe:
+            httpGet:
+              path: /health
+              port: 8003
+            initialDelaySeconds: 15
+            periodSeconds: 5
+            failureThreshold: 6
+          livenessProbe:
+            httpGet:
+              path: /health
+              port: 8003
+            initialDelaySeconds: 30
+            periodSeconds: 30
+          readinessProbe:
+            httpGet:
+              path: /health
+              port: 8003
+            initialDelaySeconds: 5
+            periodSeconds: 10

apps/base/customer1/trading-platform/news-service/kustomization.yaml

@@ -0,0 +1,6 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - deployment.yaml
+  - service.yaml

apps/base/customer1/trading-platform/news-service/service.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: trading-news-service
+  namespace: customer1
+  annotations:
+    tailscale.com/expose: "true"
+    tailscale.com/hostname: "trading-news-service"
+    tailscale.com/tags: "tag:k8s-operator"
+    tailscale.com/ports: "http:80"
+spec:
+  selector:
+    app: trading-news-service
+  ports:
+    - port: 80
+      targetPort: 8003
+      name: http
+  type: ClusterIP

apps/base/customer1/trading-platform/routes/http-routes.yaml

@@ -0,0 +1,53 @@
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: trading-dashboard-route
+  namespace: customer1
+spec:
+  parentRefs:
+    - name: external-http-gateway
+  hostnames:
+    - "sirius-sec.com"
+    - "www.sirius-sec.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /trade
+      backendRefs:
+        - name: trading-dashboard-svc
+          port: 80
+---
+apiVersion: gateway.networking.k8s.io/v1
+kind: HTTPRoute
+metadata:
+  name: trading-api-routes
+  namespace: customer1
+spec:
+  parentRefs:
+    - name: external-http-gateway
+  hostnames:
+    - "sirius-sec.com"
+    - "www.sirius-sec.com"
+  rules:
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /api/data
+      backendRefs:
+        - name: trading-data-service
+          port: 80
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /api/execute
+      backendRefs:
+        - name: trading-execute-service
+          port: 80
+    - matches:
+        - path:
+            type: PathPrefix
+            value: /api/news
+      backendRefs:
+        - name: trading-news-service
+          port: 80

apps/base/customer1/trading-platform/routes/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - http-routes.yaml

apps/base/customer1/trading-platform/secrets/kustomization.yaml

@@ -0,0 +1,5 @@
+apiVersion: kustomize.config.k8s.io/v1beta1
+kind: Kustomization
+
+resources:
+  - trading-secrets.yaml

apps/base/customer1/trading-platform/secrets/trading-secrets.yaml

@@ -0,0 +1,32 @@
+apiVersion: ENC[AES256_GCM,data:j4g=,iv:Bb3E3dbyD1MUIsthCltT2rRNNorduAL7QmPG8oRy31g=,tag:htxjh/00z6RGQNNyKCUviw==,type:str]
+kind: ENC[AES256_GCM,data:k3FRKBzN,iv:Pvtu7bnGWQNl9pkjtU8GpHjpeg00oFXatf3jxxtQEpw=,tag:zj/yAy/DpCfLO7MdH3hiMA==,type:str]
+metadata:
+    name: ENC[AES256_GCM,data:ZpbqQd2YyEfnugJ27JVAmqBf8Q7m75B0,iv:4njbS+2AYJuxzNERSOjOH8wmoI1KM0ocUT7OgeoGEgo=,tag:spwlHcpeQM0G8O3VPHoDOg==,type:str]
+    namespace: ENC[AES256_GCM,data:4ErEXcBaI8Yp,iv:IKHgZ6Gm5X21Atnnm2xOFU11IgSfw5X5Wdnl25EDyOI=,tag:znkdsNDkIb4mxBY4yJbX9g==,type:str]
+type: ENC[AES256_GCM,data:dd7uKLw+,iv:qRkV8K+ytp55rLGNIP1lG2yZ+LENt/FkdDiWzi/1tik=,tag:aUWQ+ZOQS7/hXcnceCyrTQ==,type:str]
+stringData:
+    #ENC[AES256_GCM,data:Xol7d8ednDll9VKfZ62jZRdARcmz8UJ/6ovDaw8OHrPb72aUdA==,iv:TvGk+LiK0+maCioF5daeWDTNKOSRA5pBFf9PgKL/9Z4=,tag:34kee3TQNsCdIpyEtE12mA==,type:comment]
+    news-api-key: ENC[AES256_GCM,data:eNMLhs55u3bwVqD4l2tQhgq1+wp/9rCa,iv:7BjlJqgJbg6BqdXxNphnIWKA/LYFZJc3qqJ360/EteY=,tag:hs5vfj+zP9OCq2tDucItIg==,type:str]
+    market-data-api-key: ENC[AES256_GCM,data:ol3aAC9ijFcFUo7jEVQv7mKjCLpUXBuaVThwRzG/fQ==,iv:YouuIdmj6aK0tuYJtDuiOt91gnUtK2xdshVZxy+gCH4=,tag:MAs8mS/+ndC8AYdI+WdFcA==,type:str]
+    #ENC[AES256_GCM,data:Si0AKl5/sWrYDNSYiC35iD7vtvP9CzAb,iv:cyBrgR5cFSta+bPdyyCUXrKH68Hi84UbGFqiWskQb7s=,tag:w9+sotMjBTuyfcGYIHfN+w==,type:comment]
+    service-auth-token: ENC[AES256_GCM,data:NCu/mBKdGIFNXTA5n7M53UXjMaZy9UdzImC90GPU,iv:JPLeNfTDWV3VLbVIUidL6w1IrJN09LTGIyPn0tJlj90=,tag:RIzC8FfGXBmE2PRZzgaAww==,type:str]
+sops:
+    kms: []
+    gcp_kms: []
+    azure_kv: []
+    hc_vault: []
+    age:
+        - recipient: age1uuxf066xuuqgvjppxfcmqkwfcufnwp3wcwnl9h20g9k4l8nkw9jsaungf7
+          enc: |
+            -----BEGIN AGE ENCRYPTED FILE-----
+            YWdlLWVuY3J5cHRpb24ub3JnL3YxCi0+IFgyNTUxOSBFTzBrN3V5elJmNjNGZ28y
+            Q1JOQUt5eURqSFZNZkJUNWMrV1NTZEFiYkgwCnlDSTFYTW8zcU02M0NJdXZjYSti
+            Ylh0bWpJd0k2MWt6VjNNTUlNU0pTUVUKLS0tIENHUEU4VElXbC96bXBGRmo3QXpQ
+            ZkxxUDRubGt0dnRoQXVtS2xFSnhTRkUKs+rcKiZvgA7mffGo7GkkFL4vWnTIGAIn
+            RXwlbDNPEhiK+6lh/TgkV2CYXDBt1Hwfk4fzhZknYjY3Psp0ufvY2Q==
+            -----END AGE ENCRYPTED FILE-----
+    lastmodified: "2026-05-21T04:08:04Z"
+    mac: ENC[AES256_GCM,data:EEuPQ1n7qAab7xkQYNt4rxzNy+u6PSYn+hFUTv3ZwmKbMHW7zQY3BgkwalDVrTC4ZNOLy3tGjVDB6v0KXmwXiXwvYL0Y17h8zRiU4id+zQl+oeZTMCFoUZ5Piz69DxO06cMaZF7+6K+9uQ0JLkZsnY3hb82xKAKbl9E/MFdvr6s=,iv:ldIAz5IKNFnbvcNpzo9qX6n0evix7tsLcTPiouB8lfk=,tag:KXDYrz4vfXkWH0cUHsOUdw==,type:str]
+    pgp: []
+    unencrypted_suffix: _unencrypted
+    version: 3.9.4

apps/staging/customer1/kustomization.yaml

@@ -11,3 +11,4 @@ resources:
   - ../../base/customer1/hermes-db/
   - ../../base/customer1/trade-dashboard/
   - ../../base/customer1/siriusdevops-db/
+  - ../../base/customer1/trading-platform/