Wiremi Kubernetes Deployment

A comprehensive microservices-based financial technology platform deployed on Kubernetes with robust security controls and infrastructure components.

🏗️ Architecture Overview

Wiremi is a fintech platform consisting of multiple microservices handling different aspects of financial operations:

Savings Management - Account and savings operations
Investment Management - Portfolio and investment handling
Loan Processing - Loan origination and servicing
Escrow Services - Secure transaction escrow
Administrative Functions - Backend administration
Content Management - Blog and content services

📋 Prerequisites

Kubernetes cluster (v1.20+)
Helm 3.x
kubectl configured for your cluster
Docker registry access (AWS ECR)
NGINX Ingress Controller installed

🚀 Quick Start

1. Clone the Repository

git clone <repository-url>
cd wiremi-kubernetes

2. Deploy Infrastructure Components

# Deploy PostgreSQL database
kubectl apply -f postgres/

# Deploy Redis cache
kubectl apply -f redis-k8s.yml

# Deploy RabbitMQ message queue
kubectl apply -f rabbitmq/

3. Deploy Core Services

# Install the Helm chart
helm install wiremi-app ./helm/wiremi-chart/

# Or upgrade existing deployment
helm upgrade wiremi-app ./helm/wiremi-chart/

4. Verify Deployment

# Check all pods are running
kubectl get pods

# Check services
kubectl get services

# Check ingress
kubectl get ingress

🏛️ Service Architecture

Core Application Services

Service	Port	Purpose	Image
app	5001	Main application orchestrator	`975050286506.dkr.ecr.us-east-1.amazonaws.com/app`
savings	8900	Savings account management	`975050286506.dkr.ecr.us-east-1.amazonaws.com/savings`
invest	8902	Investment portfolio management	`975050286506.dkr.ecr.us-east-1.amazonaws.com/invest`
loans	8904	Loan processing and servicing	`975050286506.dkr.ecr.us-east-1.amazonaws.com/loans`
escrows	8903	Escrow transaction handling	`975050286506.dkr.ecr.us-east-1.amazonaws.com/escrows`
admin	8901	Administrative functions	`975050286506.dkr.ecr.us-east-1.amazonaws.com/admin`
blog	8003	Content management system	`975050286506.dkr.ecr.us-east-1.amazonaws.com/blog`
frontendadmin	3000	Admin dashboard UI	`975050286506.dkr.ecr.us-east-1.amazonaws.com/frontendadmin`

Infrastructure Services

Service	Port	Purpose	Configuration
PostgreSQL	5432	Primary database	10Gi storage, shared across services
Redis	6379	Cache and sessions	Password-protected, 256MB limit
RabbitMQ	5672/15672	Message queue	Management UI, persistent storage

🌐 Network Configuration

Domain Routing

The application uses domain-based routing through NGINX Ingress:

Primary API Domain: `backendapp.wiremi.ca`

/api/* → savings service (port 8900)
/loans/* → loans service (port 8904)
/invest/* → invest service (port 8902)
/escrow/* → escrows service (port 8903)
/* → app service (port 5001) - fallback

Administrative Domains

admin.wiremi.ca → admin service (port 8901)
backoffice.wiremi.ca → frontendadmin service (port 3000)

Content Domain

blog.wiremi.ca → blog service (port 8003)

Network Security

Network policies implement zero-trust networking:

Default deny-all traffic policy
Explicit allow rules for service communication
Database access restricted to application pods only
External API access controlled via egress policies

🔐 Security Configuration

Pod Security Standards

All services run with enhanced security:

securityContext:
  runAsNonRoot: true
  runAsUser: 1000
  allowPrivilegeEscalation: false
  readOnlyRootFilesystem: false
  capabilities:
    drop: ["ALL"]

Secret Management

⚠️ IMPORTANT: Production credentials have been removed for security.

Current secret configuration requires external management:

Database credentials
AWS access keys
Payment processor APIs (Plaid, PayPal, Stripe)
Communication services (Twilio)
JWT secrets

Recommended: Use AWS Secrets Manager, HashiCorp Vault, or External Secrets Operator.

📊 Resource Requirements

Minimum Cluster Resources

CPU: 6 cores total
Memory: 8GB total
Storage: 15GB persistent storage

Service Resource Allocation

# High-traffic services (app, financial services)
resources:
  limits:
    cpu: 1000m
    memory: 1Gi
  requests:
    cpu: 500m
    memory: 500Mi

# Low-traffic services (blog, admin)
resources:
  limits:
    cpu: 500m
    memory: 500Mi
  requests:
    cpu: 200m
    memory: 250Mi

🗄️ Data Management

Database Configuration

Engine: PostgreSQL 13
Storage: 10Gi persistent volume
Access: Shared across all microservices
Backup: Manual (recommend automated backup solution)

Cache Configuration

Engine: Redis 7.0-alpine
Memory: 256MB with LRU eviction
Persistence: Append-only file enabled
Authentication: Password-protected

Message Queue

Engine: RabbitMQ 3.12 with management plugin
Storage: 1Gi persistent per node
Features: Clustering support, health checks
UI: Management interface on port 15672

📈 Monitoring & Logging

Logging Stack (EFK)

# Deploy Fluentd log collector
kubectl apply -f efk/fluentd-config.yaml
kubectl apply -f efk/elastic-stack.yaml

# Access Loki for log aggregation
kubectl apply -f loki-ingress.yml

Health Monitoring

Liveness and readiness probes on all services
Resource monitoring via Kubernetes metrics
Custom application health endpoints

🔧 Operations

Deployment Commands

# Deploy everything
kubectl apply -f .
helm install wiremi-app ./helm/wiremi-chart/

# Update services
helm upgrade wiremi-app ./helm/wiremi-chart/

# Scale a service
kubectl scale deployment savings --replicas=3

# Rolling restart
kubectl rollout restart deployment/app

Troubleshooting

# Check pod status
kubectl get pods -o wide

# View pod logs
kubectl logs -f deployment/app

# Debug networking
kubectl exec -it <pod-name> -- nc -zv postgres-service 5432

# Check network policies
kubectl get networkpolicy
kubectl describe networkpolicy default-deny-all

# Validate secrets
kubectl get secrets
kubectl describe secret app-secret

Common Issues

Pod startup failures
- Check security context compatibility
- Verify file permissions for non-root user
- Review resource limits
Network connectivity issues
- Verify network policy rules
- Check service labels and selectors
- Confirm ingress controller status
Database connection failures
- Verify PostgreSQL pod status
- Check database credentials in secrets
- Test network connectivity to database

🔄 CI/CD Integration

GitHub Actions (Recommended)

# .github/workflows/deploy.yml
name: Deploy to Kubernetes
on:
  push:
    branches: [main]
jobs:
  deploy:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v2
      - name: Deploy to cluster
        run: |
          helm upgrade --install wiremi-app ./helm/wiremi-chart/

Manual Deployment

# Build and push images
docker build -t $ECR_REPO/app:$TAG .
docker push $ECR_REPO/app:$TAG

# Update image tags in values.yaml
helm upgrade wiremi-app ./helm/wiremi-chart/ --set image.tag=$TAG

🏥 Backup & Recovery

Database Backup

# Create database backup
kubectl exec deployment/postgres -- pg_dump -U postgres postgres > backup.sql

# Restore from backup
kubectl exec -i deployment/postgres -- psql -U postgres postgres < backup.sql

Configuration Backup

# Backup all configurations
kubectl get all,configmap,secret,ingress,networkpolicy -o yaml > cluster-backup.yaml

# Backup Helm releases
helm list --all-namespaces -o yaml > helm-releases.yaml

📏 Scaling Guidelines

Horizontal Scaling

# Scale individual services
kubectl scale deployment app --replicas=3
kubectl scale deployment savings --replicas=2

# Auto-scaling (HPA)
kubectl autoscale deployment app --cpu-percent=70 --min=2 --max=10

Vertical Scaling

# Update resource limits in Helm values
resources:
  limits:
    cpu: 2000m
    memory: 2Gi
  requests:
    cpu: 1000m
    memory: 1Gi

🔒 Security Checklist

Pre-Production Security Tasks

Implement external secret management
Rotate all exposed credentials
Enable TLS for inter-service communication
Configure network policies for all services
Set up RBAC with service accounts
Enable audit logging
Implement image scanning
Configure backup and disaster recovery

Security Monitoring

Set up security alerts
Monitor network policy violations
Track authentication failures
Monitor resource usage anomalies

🌍 Environment Management

Development Environment

# Deploy with development settings
helm install wiremi-dev ./helm/wiremi-chart/ -f values-dev.yaml

Production Environment

# Deploy with production settings
helm install wiremi-prod ./helm/wiremi-chart/ -f values-prod.yaml

📞 Support & Troubleshooting

Logs Access

# Application logs
kubectl logs -f -l app=app

# Infrastructure logs
kubectl logs -f -l app=postgres
kubectl logs -f -l app=redis
kubectl logs -f -l app=rabbitmq

Performance Monitoring

# Resource usage
kubectl top pods
kubectl top nodes

# Service endpoints
kubectl get endpoints

🔗 External Dependencies

Required External Services

AWS ECR - Container image registry
AWS S3 - File storage
External APIs - Plaid, PayPal, Stripe, Twilio
DNS - Domain management for ingress

Optional Components

Prometheus/Grafana - Advanced monitoring
Jaeger - Distributed tracing
Istio - Service mesh for advanced traffic management

📚 Additional Resources

🤝 Contributing

Fork the repository
Create a feature branch
Test changes in development environment
Submit a pull request with detailed description

📄 License

[Add your license information here]

Last Updated: 2025-06-28
Version: 1.0
Maintainer: Wiremi DevOps Team

Name		Name	Last commit message	Last commit date
.github/workflows		.github/workflows
chatwoo		chatwoo
efk		efk
helm		helm
main		main
postgres		postgres
rabbitmq		rabbitmq
.DS_Store		.DS_Store
.gitignore		.gitignore
KUBERNETES-FOR-BEGINNERS.md		KUBERNETES-FOR-BEGINNERS.md
README.md		README.md
SECURITY-CONFIGURATION.md		SECURITY-CONFIGURATION.md
escrow-dep.yml		escrow-dep.yml
escrow-service.yml		escrow-service.yml
hold.yaml		hold.yaml
invest-dep.yml		invest-dep.yml
invest-service.yml		invest-service.yml
k.json		k.json
loki-ingress.yml		loki-ingress.yml
redis-k8s.yml		redis-k8s.yml

Latest commit

History

Folders and files

Repository files navigation