gcloud-lab/trading-platform

Trading Platform — Kubernetes Deployment

Kubernetes deployment infrastructure for the trading platform microservices running on GKE (customer1 namespace).

Directory Structure

trading-platform/
├── dockerfiles/           # Multi-stage Dockerfiles for each service
│   ├── dashboard/         # Next.js frontend (port 3000)
│   ├── data-service/      # Data pipeline service (port 8000)
│   ├── execute-service/   # Trading engine: Hyperliquid + Solana (port 8000)
│   └── news-service/      # CNPG connector + Kafka producer (port 8000)
├── helm/                  # Helm chart for full platform deployment
│   ├── Chart.yaml         # Chart metadata
│   ├── values.yaml        # Default values (images, replicas, resources, infra)
│   ├── .sops.yaml         # SOPS configuration for secret encryption
│   ├── trading-secrets.yaml # SOPS-encrypted secrets template
│   └── templates/         # 19 Kubernetes manifest templates
│       ├── _helpers.tpl           # Template helpers
│       ├── namespace.yaml         # Namespace resource
│       ├── configmap.yaml         # Shared ConfigMap
│       ├── secrets.yaml           # Secrets (SOPS-encrypted via trading-secrets.yaml)
│       ├── ingress.yaml           # GCE Ingress for all services
│       ├── NOTES.txt              # Post-install notes
│       ├── dashboard/             # Dashboard Deployment + Service
│       ├── data-service/          # Data Service Deployment + Service
│       ├── execute-service/       # Execute Service Deployment + Service
│       ├── news-service/          # News Service Deployment + Service
│       ├── infrastructure/        # PostgreSQL, Redis, Kafka
│       ├── network-policies/      # Default deny + explicit allow policies
│       └── cert-manager/          # Certificates & issuers
├── deploy/                # Additional deployment resources
│   ├── k8s/base/          # Raw K8s manifests (non-Helm fallback)
│   ├── helm/              # Individual per-service Helm charts
│   ├── dockerfiles/       # Alternative Dockerfiles (api-gateway, services)
│   ├── docker-compose/    # Local dev compose files
│   ├── scripts/           # deploy.sh, generate-mtls-certs.sh
│   └── mtls/              # mTLS documentation
└── .github/workflows/     # CI/CD pipelines
    ├── build-test.yml     # Build + unit tests on PR
    ├── build-push.yml     # Build + push to GAR on merge
    └── deploy.yml         # Helm deploy to GKE on push to master

Services

Service	Port	Description
Dashboard	3000	Next.js trading dashboard
Data Service	8000	Data pipeline, Postgres + Redis + Kafka consumers
Execute Service	8000	Trading engine with Hyperliquid + Solana integration
News Service	8000	CryptoPanic/GNews connector, Kafka producer

Infrastructure Components

• PostgreSQL 17 — Primary database for trades, orders, user data
• Redis 7 — Caching layer with 3-node cluster
• Kafka 3.9 (KRaft mode) — Event streaming (trades, orders, news topics)
• GCE Ingress — External traffic routing with TLS termination
• Cert-Manager — Automatic TLS certificates (Let's Encrypt + internal CA)
• Network Policies — Default deny ingress/egress with explicit allow rules

Deploying

Prerequisites

• GKE cluster: customer1-gke (us-central1)
• Helm 3 installed locally or in CI
• SOPS configured with Age key (trading-secrets.yaml must be encrypted)
• Access to us-central1-docker.pkg.dev/customer1-gke/trading registry

Quick Deploy

# 1. Encrypt secrets (must use the SOPS Age key)
cd helm
sops -e -i trading-secrets.yaml

# 2. Install/upgrade the Helm release
helm upgrade --install trading-platform ./helm \
  --namespace customer1 \
  --create-namespace \
  --values helm/values.yaml \
  --set global.environment=production

CI/CD

• PR opened → build-test.yml runs unit tests
• Merged to master → build-push.yml builds images and pushes to GAR
• Push to master → deploy.yml runs helm upgrade on GKE

Secrets

Secrets are managed via SOPS with Age encryption. The .sops.yaml file configures which keys to use for each path.

# Encrypt the secrets file
sops -e -i helm/trading-secrets.yaml

# Decrypt (for debugging)
sops -d helm/trading-secrets.yaml

Never commit unencrypted secrets to git.

Namespace

The platform deploys into the customer1 namespace on the GKE cluster. Update global.namespace in helm/values.yaml or override via --set during install.