Overview¶
The installation guide installs the Tradeval platform at a third-party customer site, with its own domain, its own addressing plan and its own external services. It covers a single-tenant instance: one installation, one domain, one realm. It does not describe a multi-tenant installation.
What gets installed¶
The installation stacks five elements.
- A Talos cluster, six virtual machines on a hypervisor (three control-plane, three workers), with kube-vip to publish a single entry address.
- A
corelayer, common to every customer: network (Calico, kube-vip), ingress (Traefik), certificate issuance (cert-manager), internal DNS resolution (CoreDNS), secret vault (Vault, External Secrets Operator). - An application layer, specific to the customer once parameterised: Keycloak for authentication, the .NET microservices, the Next.js portals.
- A public exposure, limited to three hosts (
hub,portal,auth), published by a Cloudflare tunnel, with no inbound port open on the firewall. - An internal exposure, for the portals and interfaces that must never reach the internet, accessed over VPN.
The repository this guide describes, and its reference¶
This guide does not install itself: every one of its commands runs from a clone of the
trade.infra repository, which carries the manifests and the scripts. This guide describes
that repository at a given reference, handed over by the vendor with this archive, and not its
current state.
That distinction is not a formality. The pages that follow assert facts counted on the
repository: eleven application images, three LoadBalancer Services, ten HPAs, twelve families of
substitution, eleven manifests that reference acr-pull-secret. Those counts are true of the
repository at the reference described, and of it alone. A repository cloned later may carry a
twelfth API or one more LoadBalancer Service: the counts of this guide then become wrong, with
nothing signalling it, and the operator who finds twelve images where the page announces eleven
has no way of knowing which of the two sources prevails.
Before starting, compare the reference of the clone with the one the vendor handed over:
If the two differ, ask for the version of the guide that matches the repository, or the reference of the repository that matches this guide. Do not arbitrate on site between two sources: a divergent count is the symptom of a repository more recent than the guide, not of a failed installation. How to obtain the clone, the repository URL and the working directory are at the top of the "Verify" section of the Prerequisites.
Who this guide is for¶
The intended reader is an operator who does not know this repository. They have:
- physical or hypervisor access to the target hardware;
- a Cloudflare account on the customer's domain;
- access to the external data layer (application database, event bus, cache, search engine, object storage, SMTP).
They do not have the historical context of the team that built the platform. Everything they need in order to install and operate the instance is written in this guide, or explicitly pointed at the page that details it.
Required skills¶
- Kubernetes: reading manifests,
kubectl, diagnosing pods that do not start. - DNS: zone management, A and TXT records, delegation.
- TLS: certificates, chain of trust, ACME challenges.
- Talos basics: immutable machine driven by API, no classic shell access.
The guide teaches none of these notions. It assumes they are known and focuses on what is specific to tradeval.
Expected duration per batch¶
An order-of-magnitude estimate, not timed on a real customer deployment. It serves to plan an intervention window, not as a contractual reference.
| Batch | Pages | Contents | Estimated duration |
|---|---|---|---|
| Preparation | 01 to 03 | reading, reserving accesses and addresses, filling in the customer sheet | half a day |
| Understanding | 04 and 05 | target architecture, order in which the layers are applied | half a day |
| Installation | 06 and 07 | step-by-step installation, secret configuration | one day to one day and a half |
| Verification and go-live | 08 and 09 | observability, conformance recipe | half a day |
| Getting started with operations | 10 and 11 | troubleshooting, day-to-day operating procedures | half a day |
Reading order¶
| Page | Role |
|---|---|
| Overview | what gets installed, who the guide is for, required skills, expected duration, reading order |
| Prerequisites | hardware and hypervisor, addressing plan to reserve, DNS zone and Cloudflare account, external data layer, operator workstation tooling, accounts and accesses |
| Parameters | the customer sheet: every variable, its example, the files it reaches, the effect of a wrong value |
| Architecture | deployment view, separation between what is fixed and what is parameterisable |
| Strategy | order of application and dependencies between layers, the place of ArgoCD, probes and HPA, update and rollback |
| Step by step | the sequence of operations: Talos, core layer, Vault and secrets, certificates, data layer, Keycloak and realm, applications, exposure |
| Configuration | Vault and ESO, ConfigMaps, variables frozen at build time, inventory of sources per service |
| Observability | which monitoring stack to deploy, dashboards, what remains to be decided (initial installation, retention, alerting) |
| Validation | conformance recipe after installation, executable |
| Troubleshooting | symptom, cause, fix |
| Operations | backups and restore, certificate renewal, updating and adding a service |
What this guide does not cover¶
- Migrating data from an existing system.
- Installation in a constrained environment without access to Cloudflare: that case would require a certificate issuance method other than the DNS-01 challenge, hence a prior architecture decision. Out of scope for this guide, to be handled with the vendor before any commitment.
- The application content of the services and project management on the customer side.
- The architecture decisions themselves, their rejected alternatives and their accepted consequences: they are held by the vendor and are not delivered with this guide. This guide says what to install and how, not why those choices were made.