Gives ~5min grace period for heavy lifespan init (Redis, DB, executors, model loading).
Addresses 'up but not ready' state on data-service and dashboard (0/1 Ready).
Live manifests in apps/base/customer1/... updated (source of truth). Helm templates can be synced later.
See gke-hermes-infrastructure skill (trading-startup-probe-fix-2026-05-26.md).
- Points to ghcr.io/sirius0xdev/trading-execute-service:7b77854 (includes model_validator for POSTGRES_PASSWORD etc.)
- Sets pullPolicy: Always to ensure fresh image on rollout.
- This resolves the persistent SQLite OperationalError on startup.
See hermes-projects commit 7b77854 for the code change + RUNBOOK.md.
After merge, run helm upgrade or kubectl rollout restart.
Previous PR #139 added the secret to trading-platform/deploy/k8s/base/
but the live cluster uses apps/base/customer1/trading-platform/ kustomize.
- Create execute-service-jwt-secret.yaml (SOPS encrypted) in secrets/
- Add to secrets/ kustomization.yaml resources
- Wire JWT_SECRET_KEY env var in execute-service deployment
- Points to execute-service-jwt-secret via secretKeyRef
- Remove imageName (was never applied, live cluster uses default CNPG image)
- Remove maintenance_work_mem (live cluster has no custom parameters)
- Set postgresql: {} to match live state
- Keep memory role superuser: true (the only needed change)
Fixes CNPG admission webhook: 'Can't change image name and configuration at the same time'
CNPG version on cluster does not support .spec.sql on Database CR.
The rag-init-job.yaml already handles RAG schema initialization separately.
Unblocks Flux dry-run for agent-memory-rag.
- Add allowedExtensions: ['*'] so roles can CREATE EXTENSION
- Grant superuser to 'memory' role (was createdb/createrole, insufficient)
- Needed for mem0 plugin pgvector backend on agent_memory DB
Unblocks kanban task t_3d94b392
- Add trading_dashboard role + Database CR on siriusdevops-pgdb
- Create SOPS-encrypted credentials secret (template)
- Update trade-dashboard to use the new dedicated DB
- New host: siriusdevops-pgdb-rw
- New database: trading_dashboard
- New credentials secret
- Add REDIS_URL env var using variable expansion from the existing
trading-data-service-config ConfigMap (REDIS_HOST + REDIS_PORT).
- This resolves the 'connecting to localhost:6379' crash on startup.
- Matches the actual infrastructure configuration in customer1.
- F8: Correct NATS_URLS, REDIS_URL, MINIO_ENDPOINT to use actual service names
(nats, redis-master, minio) instead of fullname-prefixed names that don't exist
- F9: Split combined ConfigMap+StatefulSet in nats/statefulset.yaml into separate
configmap.yaml and statefulset.yaml files for maintainability
- Fix PostgreSQL topologySpreadConstraints label selector (cnpg.io/cluster)
- Fix Ingress HTTPRoutes: route API and WS traffic to correct backends
- Fix API NetworkPolicy port mismatch (4000 -> 8000)
- Fix MinIO bucket index syntax (_0 -> 0) in ConfigMap
- Add postgresql.port and postgresql.database to values.yaml
- Add container-level securityContext to API deployment
- Restrict monitoring NetworkPolicy ingress to monitoring namespace
- Enable readOnlyRootFilesystem for MinIO container
- Add activeDeadlineSeconds (3600s) to all 4 CronJobs
