Phase 1: Helm Chart - Ledger Service Deployment

[MattiasGees]

Overview

Update the Helm chart to deploy the new Ledger Service alongside existing components.

Dependencies

• Phase 1: Ledger Service - HTTP Handlers & SPIFFE mTLS Server #31 (Ledger Service HTTP Handlers)

Tasks

• Create templates/ledger-deployment.yaml
• Create templates/ledger-service.yaml
• Create templates/ledger-serviceaccount.yaml
• Add Ledger config to templates/configmap.yaml
• Update values.yaml with Ledger configuration
• Add SPIRE registration entries for Ledger Service
• Update PostgreSQL init script for TrustBank schema
• Add feature flags for TrustBank modules

New Values

trustbank:
  enabled: true

ledgerService:
  replicaCount: 1
  image:
    repository: ghcr.io/mattiasgees/spiffe-demo/spiffe-demo
    tag: latest
  service:
    port: 8443
  config:
    postgresqlHost: "spiffe-demo-postgresql"
    postgresqlUser: "ledger-service"

SPIRE Registration

# Ledger Service identity
spiffe://{{ .Values.spiffe.trustdomain }}/ns/{{ .Release.Namespace }}/sa/ledger-service

# Authorized to connect to:
# - PostgreSQL (X.509)

# Authorized clients:
# - Customer Service

Testing Requirements

• Helm lint passes
• Helm template renders correctly
• Test deployment in local cluster
• Test SPIFFE identity registration
• Test service-to-service connectivity
• Test feature flag enable/disable

Acceptance Criteria

• helm upgrade --install deploys Ledger Service
• SPIFFE identity correctly registered
• mTLS works between Customer and Ledger
• PostgreSQL X.509 auth works
• Feature flag can disable TrustBank components
• Clean uninstall removes all resources

Labels

phase-1 helm deployment