Migrate trading platform DB egress rule from hermes-pgdb to siriusdevops-pgdb to complete the trading DB migration. The configmaps already point to siriusdevops-pgdb-rw but the network policy still allowed egress to the old cluster.
Tailscale proxy pods run in the tailscale namespace, so the existing customer1-only namespaceSelector blocked proxy → dashboard traffic.
Dashboard listens on port 3000 but NetworkPolicy only allowed 8000-8003. This blocked all traffic including Tailscale proxy connections to trade:3000.
- Scaffold trading-platform under apps/base/customer1/trading-platform/ - Add 4 microservice deployments: data-service, execute-service, news-service, dashboard - Add ConfigMaps with DB/Kafka/Redis connection configs - Add HTTPRoutes via Gateway API (external-http-gateway) - Add NetworkPolicies for inter-service and DB/Kafka/Redis egress - Add SOPS-encrypted secrets (age key) - Add Kafka (KRaft) and Redis infrastructure to hermes-db/ - Update root and staging kustomizations All containers: non-root, readOnlyRootFilesystem, resource limits, health probes Images: ghcr.io/sirius0xdev/trading-{service}:latest
