History

Sirius Devops 9ca32408b1 Fix: readiness probe for execute-service uses /health/ready Change readiness probe from /health (always ok) to /health/ready (checks executor initialization state). Applied to both: - apps/base K8s deployment - Helm chart template Pairs with app fix making executor init non-blocking.		2026-05-25 05:39:24 +00:00
..
.github/workflows	feat: add trading platform K8s deployment infrastructure	2026-05-17 22:15:00 +00:00
deploy	fix(trading-platform): add startupProbe to data-service, execute-service, and dashboard in customer1	2026-05-25 04:57:59 +00:00
dockerfiles	feat: add trading platform K8s deployment infrastructure	2026-05-17 22:15:00 +00:00
helm	Fix: readiness probe for execute-service uses /health/ready	2026-05-25 05:39:24 +00:00
scripts/solana-funding	feat(devops): add Solana quant bot K8s/Helm, CI/CD, observability, and funding	2026-05-24 04:46:58 +00:00
README.md	feat: add trading platform K8s deployment infrastructure	2026-05-17 22:15:00 +00:00

README.md

Trading Platform — Kubernetes Deployment

Kubernetes deployment infrastructure for the trading platform microservices running on GKE (customer1 namespace).

Directory Structure

trading-platform/
├── dockerfiles/           # Multi-stage Dockerfiles for each service
│   ├── dashboard/         # Next.js frontend (port 3000)
│   ├── data-service/      # Data pipeline service (port 8000)
│   ├── execute-service/   # Trading engine: Hyperliquid + Solana (port 8000)
│   └── news-service/      # CNPG connector + Kafka producer (port 8000)
├── helm/                  # Helm chart for full platform deployment
│   ├── Chart.yaml         # Chart metadata
│   ├── values.yaml        # Default values (images, replicas, resources, infra)
│   ├── .sops.yaml         # SOPS configuration for secret encryption
│   ├── trading-secrets.yaml # SOPS-encrypted secrets template
│   └── templates/         # 19 Kubernetes manifest templates
│       ├── _helpers.tpl           # Template helpers
│       ├── namespace.yaml         # Namespace resource
│       ├── configmap.yaml         # Shared ConfigMap
│       ├── secrets.yaml           # Secrets (SOPS-encrypted via trading-secrets.yaml)
│       ├── ingress.yaml           # GCE Ingress for all services
│       ├── NOTES.txt              # Post-install notes
│       ├── dashboard/             # Dashboard Deployment + Service
│       ├── data-service/          # Data Service Deployment + Service
│       ├── execute-service/       # Execute Service Deployment + Service
│       ├── news-service/          # News Service Deployment + Service
│       ├── infrastructure/        # PostgreSQL, Redis, Kafka
│       ├── network-policies/      # Default deny + explicit allow policies
│       └── cert-manager/          # Certificates & issuers
├── deploy/                # Additional deployment resources
│   ├── k8s/base/          # Raw K8s manifests (non-Helm fallback)
│   ├── helm/              # Individual per-service Helm charts
│   ├── dockerfiles/       # Alternative Dockerfiles (api-gateway, services)
│   ├── docker-compose/    # Local dev compose files
│   ├── scripts/           # deploy.sh, generate-mtls-certs.sh
│   └── mtls/              # mTLS documentation
└── .github/workflows/     # CI/CD pipelines
    ├── build-test.yml     # Build + unit tests on PR
    ├── build-push.yml     # Build + push to GAR on merge
    └── deploy.yml         # Helm deploy to GKE on push to master

Services

Service	Port	Description
Dashboard	3000	Next.js trading dashboard
Data Service	8000	Data pipeline, Postgres + Redis + Kafka consumers
Execute Service	8000	Trading engine with Hyperliquid + Solana integration
News Service	8000	CryptoPanic/GNews connector, Kafka producer

Infrastructure Components

PostgreSQL 17 — Primary database for trades, orders, user data
Redis 7 — Caching layer with 3-node cluster
Kafka 3.9 (KRaft mode) — Event streaming (trades, orders, news topics)
GCE Ingress — External traffic routing with TLS termination
Cert-Manager — Automatic TLS certificates (Let's Encrypt + internal CA)
Network Policies — Default deny ingress/egress with explicit allow rules

Deploying

Prerequisites

GKE cluster: customer1-gke (us-central1)
Helm 3 installed locally or in CI
SOPS configured with Age key (trading-secrets.yaml must be encrypted)
Access to us-central1-docker.pkg.dev/customer1-gke/trading registry

Quick Deploy

# 1. Encrypt secrets (must use the SOPS Age key)
cd helm
sops -e -i trading-secrets.yaml

# 2. Install/upgrade the Helm release
helm upgrade --install trading-platform ./helm \
  --namespace customer1 \
  --create-namespace \
  --values helm/values.yaml \
  --set global.environment=production

CI/CD

PR opened → build-test.yml runs unit tests
Merged to master → build-push.yml builds images and pushes to GAR
Push to master → deploy.yml runs helm upgrade on GKE

Secrets

Secrets are managed via SOPS with Age encryption. The .sops.yaml file configures which keys to use for each path.

# Encrypt the secrets file
sops -e -i helm/trading-secrets.yaml

# Decrypt (for debugging)
sops -d helm/trading-secrets.yaml

Never commit unencrypted secrets to git.

Namespace

The platform deploys into the customer1 namespace on the GKE cluster. Update global.namespace in helm/values.yaml or override via --set during install.