- Add build-pgvector-image.yml GH Actions workflow for GCR
- Set imageName to gcr.io/devops-lab-cluster/postgres-pgvector:15.2-0.8.0
- Image change only (CNPG rule: no config changes in same update)
Short hostname "trade" (matches /trade HTTPRoute) instead of "trading-dashboard".
This fixes the "Could not resolve host: trading-dashboard" error on tailnet devices while keeping the same annotation style as Grafana.
The /health/ready endpoint calls await initialize() on Hyperliquid and Solana executors. Without explicit timeout, the default 1s probe timeout caused repeated failures even though the app was running.
Added timeoutSeconds: 10 + reduced readiness failureThreshold.
This is the final piece for the "running but not ready" state.
Next.js standalone mode needs a writable /tmp directory for cache, temp files, and logs.
With , the container was crashing after "Ready in 228ms" (EOF in log stream).
Added the standard emptyDir volumeMount used by other services.
This should make the dashboard stable and accessible on tailnet.
The service was 'running but not ready' because:
- startupProbe used /health (always-ok) with only failureThreshold: 6 (~30s grace)
- Executor initialization (Hyperliquid SDK network calls + Solana client) takes longer
Now uses /health/ready (checks actual executor state) with failureThreshold: 30 (~5min grace), matching the pattern used for data-service and dashboard.
Also updated Helm template for consistency.
Matches the exact annotation pattern used for other tailnet services (Grafana, trade-dashboard, hermes-webui, etc.).
This ensures the Tailscale operator correctly maps the exposed port after the 3000 change.
Gives ~5min grace period for heavy lifespan init (Redis, DB, executors, model loading).
Addresses 'up but not ready' state on data-service and dashboard (0/1 Ready).
Live manifests in apps/base/customer1/... updated (source of truth). Helm templates can be synced later.
See gke-hermes-infrastructure skill (trading-startup-probe-fix-2026-05-26.md).
Previous PR #139 added the secret to trading-platform/deploy/k8s/base/
but the live cluster uses apps/base/customer1/trading-platform/ kustomize.
- Create execute-service-jwt-secret.yaml (SOPS encrypted) in secrets/
- Add to secrets/ kustomization.yaml resources
- Wire JWT_SECRET_KEY env var in execute-service deployment
- Points to execute-service-jwt-secret via secretKeyRef
- Remove imageName (was never applied, live cluster uses default CNPG image)
- Remove maintenance_work_mem (live cluster has no custom parameters)
- Set postgresql: {} to match live state
- Keep memory role superuser: true (the only needed change)
Fixes CNPG admission webhook: 'Can't change image name and configuration at the same time'
CNPG version on cluster does not support .spec.sql on Database CR.
The rag-init-job.yaml already handles RAG schema initialization separately.
Unblocks Flux dry-run for agent-memory-rag.
- Add allowedExtensions: ['*'] so roles can CREATE EXTENSION
- Grant superuser to 'memory' role (was createdb/createrole, insufficient)
- Needed for mem0 plugin pgvector backend on agent_memory DB
Unblocks kanban task t_3d94b392
- Add trading_dashboard role + Database CR on siriusdevops-pgdb
- Create SOPS-encrypted credentials secret (template)
- Update trade-dashboard to use the new dedicated DB
- New host: siriusdevops-pgdb-rw
- New database: trading_dashboard
- New credentials secret
- Add REDIS_URL env var using variable expansion from the existing
trading-data-service-config ConfigMap (REDIS_HOST + REDIS_PORT).
- This resolves the 'connecting to localhost:6379' crash on startup.
- Matches the actual infrastructure configuration in customer1.
- DB password: random 48-char hex string
- admin_api_key: random 32-char hex string
- Telegram bot_token/chat_id still CHANGEME — fill before deploying
- deployment.yaml: securityContext (runAsNonRoot, readOnlyRootFilesystem, drop ALL caps)
- network-policy.yaml: egress only to CNPG PG (5432) + api.telegram.org (443)
- kustomization.yaml: register new NetworkPolicy resource
- waitlist-telegram-secret: add admin_api_key field
