- news-app-db.yaml: point Database CR to siriusdevops-pgdb
- All ConfigMaps: DB_HOST=siriusdevops-pgdb-rw, LLM_BASE_URL for vLLM
- hermes-pgdb now dedicated to pgvector/RAG for agents only
- Aligns with CNPG extension pattern and active kanban (devops startupProbes, backend exec-service)
PR to master per repo rules.
- Add build-pgvector-image.yml GH Actions workflow for GCR
- Set imageName to gcr.io/devops-lab-cluster/postgres-pgvector:15.2-0.8.0
- Image change only (CNPG rule: no config changes in same update)
- Add 'trading' managed role to siriusdevops-pgdb cluster
- Move trading-db-credentials from hermes-db to siriusdevops-db
- Create trading-data-db.yaml (Database kind) pointing to siriusdevops-pgdb
- Update DB_HOST in all 4 trading-platform configmaps to siriusdevops-pgdb-rw
- Remove trading-data-db.yaml and trading-db-credentials.yaml from hermes-db
- Update siriusdevops-db kustomization.yaml to include new resources
The Tailscale operator v0.40+ requires a ProxyGroup CRD to actually
expose services via the operator - annotations on the Service alone
are insufficient. This adds the missing ProxyGroup resource.
Also fixes the tailnet kustomization.yaml which referenced proxygroup
files that did not exist in that directory (they live in controllers/
and are deployed separately).
Short hostname "trade" (matches /trade HTTPRoute) instead of "trading-dashboard".
This fixes the "Could not resolve host: trading-dashboard" error on tailnet devices while keeping the same annotation style as Grafana.
The /health/ready endpoint calls await initialize() on Hyperliquid and Solana executors. Without explicit timeout, the default 1s probe timeout caused repeated failures even though the app was running.
Added timeoutSeconds: 10 + reduced readiness failureThreshold.
This is the final piece for the "running but not ready" state.
Next.js standalone mode needs a writable /tmp directory for cache, temp files, and logs.
With , the container was crashing after "Ready in 228ms" (EOF in log stream).
Added the standard emptyDir volumeMount used by other services.
This should make the dashboard stable and accessible on tailnet.
The service was 'running but not ready' because:
- startupProbe used /health (always-ok) with only failureThreshold: 6 (~30s grace)
- Executor initialization (Hyperliquid SDK network calls + Solana client) takes longer
Now uses /health/ready (checks actual executor state) with failureThreshold: 30 (~5min grace), matching the pattern used for data-service and dashboard.
Also updated Helm template for consistency.
Matches the exact annotation pattern used for other tailnet services (Grafana, trade-dashboard, hermes-webui, etc.).
This ensures the Tailscale operator correctly maps the exposed port after the 3000 change.
Gives ~5min grace period for heavy lifespan init (Redis, DB, executors, model loading).
Addresses 'up but not ready' state on data-service and dashboard (0/1 Ready).
Live manifests in apps/base/customer1/... updated (source of truth). Helm templates can be synced later.
See gke-hermes-infrastructure skill (trading-startup-probe-fix-2026-05-26.md).
- Points to ghcr.io/sirius0xdev/trading-execute-service:7b77854 (includes model_validator for POSTGRES_PASSWORD etc.)
- Sets pullPolicy: Always to ensure fresh image on rollout.
- This resolves the persistent SQLite OperationalError on startup.
See hermes-projects commit 7b77854 for the code change + RUNBOOK.md.
After merge, run helm upgrade or kubectl rollout restart.
Previous PR #139 added the secret to trading-platform/deploy/k8s/base/
but the live cluster uses apps/base/customer1/trading-platform/ kustomize.
- Create execute-service-jwt-secret.yaml (SOPS encrypted) in secrets/
- Add to secrets/ kustomization.yaml resources
- Wire JWT_SECRET_KEY env var in execute-service deployment
- Points to execute-service-jwt-secret via secretKeyRef
- Remove imageName (was never applied, live cluster uses default CNPG image)
- Remove maintenance_work_mem (live cluster has no custom parameters)
- Set postgresql: {} to match live state
- Keep memory role superuser: true (the only needed change)
Fixes CNPG admission webhook: 'Can't change image name and configuration at the same time'
CNPG version on cluster does not support .spec.sql on Database CR.
The rag-init-job.yaml already handles RAG schema initialization separately.
Unblocks Flux dry-run for agent-memory-rag.
