ERI Reference Implementation Blueprint

Production Deployment Guide for Kubernetes and Cloud Environments

1.1 Overview

This document provides a complete reference implementation blueprint for deploying the ERI system in production Kubernetes and cloud environments. The blueprint includes all necessary configurations, deployment manifests, and operational procedures.

1.2 Architecture Overview

1.2.1 High-Level Architecture

+-----------------------------------------------------+
|                  Load Balancer                   |
|                   (External Access)                |
+---------------------+-------------------------------+
                      |
                      v
+-----------------------------------------------------+
|              Ingress Controller                |
|              (TLS Termination)                |
+---------------------+-------------------------------+
                      |
                      v
+-----------------------------------------------------+
|              ERI System Namespace               |
|                                             |
|  +-----------------+ +-----------------+ +--------+ |
|  | Control Plane | | Execution Plane | | NVD    | |
|  |   (NZK+NVA)   | |    (NVC)      | | (NVD)  | |
|  +-----------------+ +-----------------+ +--------+ |
|                                             |
|  +-----------------+ +-----------------+         |
|  | Regeneration | | Monitoring     |         |
|  |    (NVR)      | |   (Prometheus) |         |
|  +-----------------+ +-----------------+         |
+-----------------------------------------------------+

1.2.2 Component Responsibilities

1.3 Kubernetes Deployment

1.3.1 Namespace Configuration

apiVersion: v1
kind: Namespace
metadata:
  name: eri-system
  labels:
    name: eri-system
    purpose: "eri-governance-system"
    security-level: "critical"
---
apiVersion: v1
kind: ResourceQuota
metadata:
  name: eri-system-quota
  namespace: eri-system
spec:
  hard:
    requests.cpu: "26"
    requests.memory: "36Gi"
    persistentvolumeclaims: "0"
    services: "10"
    secrets: "20"
    configmaps: "20"
---
apiVersion: v1
kind: LimitRange
metadata:
  name: eri-system-limits
  namespace: eri-system
spec:
  limits:
    default:
      cpu: "2"
      memory: "4Gi"
    defaultRequest:
      cpu: "100m"
      memory: "128Mi"

1.3.2 Control Plane Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eri-control-plane
  namespace: eri-system
  labels:
    app: eri-control-plane
    tier: control
spec:
  replicas: 3
  selector:
    matchLabels:
      app: eri-control-plane
  template:
    metadata:
      labels:
        app: eri-control-plane
        tier: control
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nzk
        image: novafuse/nzk:v2.0.0
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 1Gi
        env:
        - name: LOG_LEVEL
          value: "INFO"
        - name: METRICS_PORT
          value: "8080"
        - name: TRUTH_SOURCES
          value: "external,attested,signed"
        ports:
        - containerPort: 8080
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health/nzk
            port: 8080
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready/nzk
            port: 8080
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/eri/config
          readOnly: true
        - name: secrets
          mountPath: /etc/eri/secrets
          readOnly: true
      - name: nva
        image: novafuse/nva:v2.0.0
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 250m
            memory: 512Mi
          limits:
            cpu: 500m
            memory: 1Gi
        env:
        - name: LOG_LEVEL
          value: "INFO"
        - name: METRICS_PORT
          value: "8081"
        - name: POLICY_SOURCE
          value: "external-policy-store"
        ports:
        - containerPort: 8081
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health/nva
            port: 8081
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready/nva
            port: 8081
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/eri/config
          readOnly: true
        - name: secrets
          mountPath: /etc/eri/secrets
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: eri-config
      - name: secrets
        secret:
          secretName: eri-secrets
---
apiVersion: v1
kind: Service
metadata:
  name: eri-control-plane
  namespace: eri-system
  labels:
    app: eri-control-plane
    tier: control
spec:
  selector:
    app: eri-control-plane
  ports:
  - name: nzk
    port: 8080
    targetPort: 8080
  - name: nva
    port: 8081
    targetPort: 8081
  type: ClusterIP

1.3.3 Execution Plane Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eri-execution-plane
  namespace: eri-system
  labels:
    app: eri-execution-plane
    tier: execution
spec:
  replicas: 5
  selector:
    matchLabels:
      app: eri-execution-plane
  template:
    metadata:
      labels:
        app: eri-execution-plane
        tier: execution
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nvc
        image: novafuse/nvc:v2.0.0
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 1000m
            memory: 2Gi
        env:
        - name: LOG_LEVEL
          value: "INFO"
        - name: METRICS_PORT
          value: 8082
        - name: EXECUTION_TIMEOUT
          value: "30s"
        - name: STABILITY_CHECK_INTERVAL
          value: "5s"
        ports:
        - containerPort: 8082
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health/nvc
            port: 8082
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready/nvc
            port: 8082
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/eri/config
          readOnly: true
        - name: execution-workspace
          mountPath: /workspace
        - name: secrets
          mountPath: /etc/eri/secrets
          readOnly: true
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
      volumes:
      - name: config
        configMap:
          name: eri-config
      - name: execution-workspace
        emptyDir:
          sizeLimit: 1Gi
      - name: secrets
        secret:
          secretName: eri-secrets
---
apiVersion: v1
kind: Service
metadata:
  name: eri-execution-plane
  namespace: eri-system
  labels:
    app: eri-execution-plane
    tier: execution
spec:
  selector:
    app: eri-execution-plane
  ports:
  - name: nvc
    port: 8082
    targetPort: 8082
  type: ClusterIP

1.3.4 Survival Plane Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eri-survival-plane
  namespace: eri-system
  labels:
    app: eri-survival-plane
    tier: survival
spec:
  replicas: 2
  selector:
    matchLabels:
      app: eri-survival-plane
  template:
    metadata:
      labels:
        app: eri-survival-plane
        tier: survival
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nvd
        image: novafuse/nvd:v2.0.0
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 1000m
            memory: 2Gi
          limits:
            cpu: 2000m
            memory: 4Gi
        env:
        - name: LOG_LEVEL
          value: "INFO"
        - name: METRICS_PORT
          value: 8083
        - name: DESTRUCTION_TIMEOUT
          value: "10s"
        - name: MEMORY_CLEANUP_INTERVAL
          value: "1s"
        ports:
        - containerPort: 8083
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health/nvd
            port: 8083
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready/nvd
            port: 8083
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/eri/config
          readOnly: true
        - name: destruction-volume
          mountPath: /destruction
        - name: secrets
          mountPath: /etc/eri/secrets
          readOnly: true
        securityContext:
          allowPrivilegeEscalation: false
          readOnlyRootFilesystem: false
      volumes:
      - name: config
        configMap:
          name: eri-config
      - name: destruction-volume
        emptyDir:
          sizeLimit: 2Gi
      - name: secrets
        secret:
          secretName: eri-secrets
---
apiVersion: v1
kind: Service
metadata:
  name: eri-survival-plane
  namespace: eri-system
  labels:
    app: eri-survival-plane
    tier: survival
spec:
  selector:
    app: eri-survival-plane
  ports:
  - name: nvd
    port: 8083
    targetPort: 8083
  type: ClusterIP

1.3.5 Regeneration Plane Deployment

apiVersion: apps/v1
kind: Deployment
metadata:
  name: eri-regeneration-plane
  namespace: eri-system
  labels:
    app: eri-regeneration-plane
    tier: regeneration
spec:
  replicas: 2
  selector:
    matchLabels:
      app: eri-regeneration-plane
  template:
    metadata:
      labels:
        app: eri-regeneration-plane
        tier: regeneration
    spec:
      securityContext:
        runAsNonRoot: true
        runAsUser: 1000
        fsGroup: 1000
        allowPrivilegeEscalation: false
        readOnlyRootFilesystem: true
        capabilities:
          drop:
            - ALL
        seccompProfile:
          type: RuntimeDefault
      containers:
      - name: nvr
        image: novafuse/nvr:v2.0.0
        imagePullPolicy: Always
        resources:
          requests:
            cpu: 500m
            memory: 1Gi
          limits:
            cpu: 1000m
            memory: 2Gi
        env:
        - name: LOG_LEVEL
          value: "INFO"
        - name: METRICS_PORT
          value: 8084
        - name: RECONSTRUCTION_TIMEOUT
          value: "60s"
        - name: EXTERNAL_TRUTH_SOURCES
          value: "external-trust-store"
        ports:
        - containerPort: 8084
          name: metrics
          protocol: TCP
        livenessProbe:
          httpGet:
            path: /health/nvr
            port: 8084
          initialDelaySeconds: 30
          periodSeconds: 10
        readinessProbe:
          httpGet:
            path: /ready/nvr
            port: 8084
          initialDelaySeconds: 5
          periodSeconds: 5
        volumeMounts:
        - name: config
          mountPath: /etc/eri/config
          readOnly: true
        - name: provenance-store
          mountPath: /provenance
        - name: secrets
          mountPath: /etc/eri/secrets
          readOnly: true
      volumes:
      - name: config
        configMap:
          name: eri-config
      - name: provenance-store
        persistentVolumeClaim:
          claimName: eri-provenance-pvc
      - name: secrets
        secret:
          secretName: eri-secrets
---
apiVersion: v1
kind: Service
metadata:
  name: eri-regeneration-plane
  namespace: eri-system
  labels:
    app: eri-regeneration-plane
    tier: regeneration
spec:
  selector:
    app: eri-regeneration-plane
  ports:
  - name: nvr
    port: 8084
    targetPort: 8084
  type: ClusterIP

1.4 Storage Configuration

1.4.1 Provenance Storage

apiVersion: v1
kind: PersistentVolumeClaim
metadata:
  name: eri-provenance-pvc
  namespace: eri-system
spec:
  accessModes:
    - ReadWriteOnce
  resources:
    requests:
      storage: 100Gi
  storageClassName: fast-ssd
---
apiVersion: v1
kind: PersistentVolume
metadata:
  name: eri-provenance-pv
spec:
  capacity:
    storage: 100Gi
  accessModes:
    - ReadWriteOnce
  persistentVolumeReclaimPolicy: Retain
  storageClassName: fast-ssd
  hostPath:
    path: /data/eri-provenance

1.5 Configuration Management

1.5.1 ConfigMap

apiVersion: v1
kind: ConfigMap
metadata:
  name: eri-config
  namespace: eri-system
data:
  nzk.yaml: |
    identity_providers:
      - name: "internal-ldap"
        url: "ldap://ldap.internal:389"
        base_dn: "dc=internal,dc=company"
      - name: "external-oauth"
        url: "https://oauth.external.com"
        client_id: "eri-system"
    attestation_requirements:
      min_proof_length: 256
      max_proof_age: 300
      required_fields: ["identity_id", "timestamp", "signature"]
  nva.yaml: |
    policy_sources:
      - name: "internal-policy-store"
        url: "https://policy.internal.com"
      - name: "external-compliance"
        url: "https://compliance.external.com"
    alignment_thresholds:
      default: 0.8
      high_security: 0.95
      low_security: 0.6
    evaluation_timeout: 5s
  nvc.yaml: |
    execution_limits:
      max_execution_time: 30s
      max_memory_usage: 1GB
      max_cpu_usage: 1000m
    stability_checks:
      interval: 5s
      timeout: 2s
      resource_monitoring: true
  nvd.yaml: |
    destruction_methods:
      - cryptographic_erasure
      - memory_zeroization
      - cache_invalidation
    destruction_timeout: 10s
    verification_required: true
    audit_retention: true
  nvr.yaml: |
    reconstruction_methods:
      - deterministic_rebuild
      - provenance_verification
      - external_truth_validation
    reconstruction_timeout: 60s
    external_truth_sources:
      - name: "external-trust-store"
        url: "https://trust.external.com"
        verification_required: true
      - name: "blockchain-oracle"
        url: "https://blockchain.external.com"
        verification_required: true

1.5.2 Secrets

apiVersion: v1
kind: Secret
metadata:
  name: eri-secrets
  namespace: eri-system
type: Opaque
data:
  nzk-credentials.yaml: <base64-encoded-credentials>
  nva-signing-keys.yaml: <base64-encoded-keys>
  nvc-encryption-keys.yaml: <base64-encoded-keys>
  nvd-destruction-keys.yaml: <base64-encoded-keys>
  nvr-reconstruction-keys.yaml: <base64-encoded-keys>

1.6 Network Configuration

1.6.1 Network Policies

apiVersion: networking.k8s.io/v1
kind: NetworkPolicy
metadata:
  name: eri-network-policy
  namespace: eri-system
spec:
  podSelector: {}
  policyTypes:
  - Ingress
  - Egress
  ingress:
  - from:
    - namespaceSelector:
        matchLabels:
          name: external-trust
    - namespaceSelector:
        matchLabels:
          name: external-compliance
    - namespaceSelector:
        matchLabels:
          name: external-policy
    ports:
    - protocol: TCP
      port: 443
  egress:
  - to:
    - namespaceSelector:
        matchLabels:
          name: external-trust
    - namespaceSelector:
        matchLabels:
          name: external-compliance
    - namespaceSelector:
        matchLabels:
          name: external-policy
    ports:
    - protocol: TCP
      port: 443

1.6.2 Ingress Configuration

apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
  name: eri-ingress
  namespace: eri-system
  annotations:
    nginx.ingress.kubernetes.io/rewrite-target: /
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
spec:
  tls:
  - hosts:
    - eri.company.com
    secretName: eri-tls
  rules:
  - host: eri.company.com
    http:
      paths:
      - path: /api/nzk
        pathType: Prefix
        backend:
          service:
            name: eri-control-plane
            port:
              number: 8080
      - path: /api/nva
        pathType: Prefix
        backend:
          service:
            name: eri-control-plane
            port:
              number: 8081
      - path: /api/nvc
        pathType: Prefix
        backend:
          service:
            name: eri-execution-plane
            port:
              number: 8082
      - path: /api/nvd
        pathType: Prefix
        backend:
          service:
            name: eri-survival-plane
            port:
              number: 8083
      - path: /api/nvr
        pathType: Prefix
        backend:
          service:
            name: eri-regeneration-plane
            port:
              number: 8084

1.7 Monitoring and Observability

1.7.1 Prometheus Configuration

apiVersion: v1
kind: ServiceMonitor
metadata:
  name: eri-metrics
  namespace: eri-system
  labels:
    app: eri-system
spec:
  selector:
    matchLabels:
      app: eri-control-plane
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics
---
apiVersion: v1
kind: ServiceMonitor
metadata:
  name: eri-execution-metrics
  namespace: eri-system
  labels:
    app: eri-system
spec:
  selector:
    matchLabels:
      app: eri-execution-plane
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics
---
apiVersion: v1
kind: ServiceMonitor
metadata:
  name: eri-survival-metrics
  namespace: eri-system
  labels:
    app: eri-system
spec:
  selector:
    matchLabels:
      app: eri-survival-plane
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics
---
apiVersion: v1
kind: ServiceMonitor
metadata:
  name: eri-regeneration-metrics
  namespace: eri-system
  labels:
    app: eri-system
spec:
  selector:
    matchLabels:
      app: eri-regeneration-plane
  endpoints:
  - port: metrics
    interval: 30s
    path: /metrics

1.7.2 Grafana Dashboard

{
  "dashboard": {
    "title": "ERI System Monitoring",
    "panels": [
      {
        "title": "Control Plane Metrics",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(nzk_verification_count_total[5m])",
            "legendFormat": "{{legend}}"
          },
          {
            "expr": "rate(nva_evaluation_count_total[5m])",
            "legendFormat": "{{legend}}"
          }
        ]
      },
      {
        "title": "Execution Plane Metrics",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(nvc_execution_count_total[5m])",
            "legendFormat": "{{legend}}"
          },
          {
            "expr": "nvc_execution_duration_seconds",
            "legendFormat": "{{legend}}"
          }
        ]
      },
      {
        "title": "Survival Plane Metrics",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(nvd_destruction_count_total[5m])",
            "legendFormat": "{{legend}}"
          },
          {
            "expr": "nvd_memory_cleanup_duration_seconds",
            "legendFormat": "{{legend}}"
          }
        ]
      },
      {
        "title": "Regeneration Plane Metrics",
        "type": "graph",
        "targets": [
          {
            "expr": "rate(nvr_reconstruction_count_total[5m])",
            "legendFormat": "{{legend}}"
          },
          {
            "expr": "nvr_reconstruction_duration_seconds",
            "legendFormat": "{{legend}}"
          }
        ]
      }
    ]
  }
}

1.8 Security Configuration

1.8.1 Pod Security Policies

apiVersion: policy/v1beta1
kind: PodSecurityPolicy
metadata:
  name: eri-psp
  namespace: eri-system
spec:
  privileged: false
  allowPrivilegeEscalation: false
  requiredDropCapabilities:
    - ALL
  volumes:
    - 'configMap'
    - 'emptyDir'
    - 'projected'
    - 'secret'
    - 'persistentVolumeClaim'
  runAsUser:
    rule: 'MustRunAsNonRoot'
  seLinux:
    rule: 'RunAsAny'
  fsGroup:
    rule: 'RunAsAny'

1.8.2 RBAC Configuration

apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRole
metadata:
  name: eri-operator
rules:
- apiGroups: [""]
  resources: ["pods", "services", "configmaps", "secrets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
- apiGroups: ["apps"]
  resources: ["deployments", "replicasets"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete", "scale"]
- apiGroups: ["networking.k8s.io"]
  resources: ["networkpolicies", "ingresses"]
  verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
---
apiVersion: rbac.authorization.k8s.io/v1
kind: ClusterRoleBinding
metadata:
  name: eri-operator-binding
subjects:
- kind: ServiceAccount
  name: eri-operator
  namespace: eri-system
roleRef:
  kind: ClusterRole
  name: eri-operator
  apiGroup: rbac.authorization.k8s.io
---
apiVersion: v1
kind: ServiceAccount
metadata:
  name: eri-operator
  namespace: eri-system
automountServiceAccountToken: false

1.9 Deployment Automation

1.9.1 Helm Chart Structure

eri-helm-chart/
  Chart.yaml
  values.yaml
  templates/
    deployment.yaml
    service.yaml
    configmap.yaml
    secret.yaml
    networkpolicy.yaml
    rbac.yaml
  charts/
    control-plane/
    execution-plane/
    survival-plane/
    regeneration-plane/

1.9.2 Values.yaml

# Default values for ERI system deployment
global:
  imageRegistry: "novafuse"
  imageTag: "v2.0.0"
  imagePullPolicy: "Always"

controlPlane:
  replicas: 3
  resources:
    requests:
      cpu: 250m
      memory: 512Mi
    limits:
      cpu: 500m
      memory: 1Gi

executionPlane:
  replicas: 5
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 1000m
      memory: 2Gi

survivalPlane:
  replicas: 2
  resources:
    requests:
      cpu: 1000m
      memory: 2Gi
    limits:
      cpu: 2000m
      memory: 4Gi

regenerationPlane:
  replicas: 2
  resources:
    requests:
      cpu: 500m
      memory: 1Gi
    limits:
      cpu: 1000m
      memory: 2Gi

storage:
  provenance:
    size: 100Gi
    storageClass: fast-ssd

ingress:
  enabled: true
  host: eri.company.com
  tlsSecretName: eri-tls

monitoring:
  prometheus:
    enabled: true
  grafana:
    enabled: true

security:
  podSecurityPolicy:
    enabled: true
  rbac:
      enabled: true

1.9.3 Deployment Script

#!/bin/bash
# ERI System Deployment Script

set -e

# Configuration
NAMESPACE="eri-system"
HELM_CHART_PATH="./eri-helm-chart"
VALUES_FILE="./values-production.yaml"

echo "Deploying ERI system to namespace: $NAMESPACE"

# Create namespace
kubectl create namespace $NAMESPACE --dry-run=client
kubectl create namespace $NAMESPACE || echo "Namespace $NAMESPACE already exists"

# Deploy ERI system using Helm
helm upgrade --install eri-system $HELM_CHARTART_PATH \
  --namespace $NAMESPACE \
  --values $VALUES_FILE \
  --wait \
  --timeout 10m

# Verify deployment
echo "Verifying deployment..."
kubectl rollout status deployment/eri-control-plane --namespace $NAMESPACE
kubectl rollout status deployment/eri-execution-plane --namespace $NAMESPACE
kubectl rollout status deployment/eri-survival-plane --namespace $NAMESPACE
kubectl rollout status deployment/eri-regeneration-plane --namespace $NAMESPACE

# Check pod status
echo "Checking pod status..."
kubectl get pods -n $NAMESPACE -l

# Check services
echo "Checking services..."
kubectl get services -n $NAMESPACE

echo "ERI system deployment completed successfully!"

1.10 Operational Procedures

1.10.1 Health Checks

#!/bin/bash
# ERI System Health Check Script

NAMESPACE="eri-system"

echo "Performing ERI system health check..."

# Check pod status
echo "=== Pod Status ==="
kubectl get pods -n $NAMESPACE -o wide

# Check service endpoints
echo "=== Service Endpoints ==="
kubectl get services -n $NAMESPACE

# Check recent logs
echo "=== Recent Logs ==="
kubectl logs -n $NAMESPACE -l --tail=100

# Check metrics
echo "=== Metrics Endpoints ==="
for service in eri-control-plane eri-execution-plane eri-survival-plane eri-regeneration-plane; do
  echo "Checking $service metrics..."
  kubectl port-forward -n $NAMESPACE svc/$service 8080:8080 &
  PF_PID=$!
  sleep 2
  curl -s http://localhost:8080/health || echo "Health check failed for $service"
  kill $PF_PID 2>/dev/null
done

echo "Health check completed!"

1.10.2 Scaling Procedures

#!/bin/bash
# ERI System Scaling Script

NAMESPACE="eri-system"
COMPONENT=$1
REPLICAS=$2

if [ -z "$COMPONENT" ] || [ -z "$REPLICAS" ]; then
  echo "Usage: $0 <component> <replicas>"
  echo "Components: control-plane, execution-plane, survival-plane, regeneration-plane"
  exit 1
fi

echo "Scaling $COMPONENT to $REPLICAS replicas..."

kubectl scale deployment eri-$COMPONENT --replicas=$REPLICAS -n $NAMESPACE

echo "Waiting for scaling to complete..."
kubectl rollout status deployment/eri-$COMPONENT -n $NAMESPACE --timeout=300s

echo "Scaling completed!"

1.10.3 Update Procedures

#!/bin/bash
# ERI System Update Script

NAMESPACE="eri-system"
NEW_VERSION=$1

if [ -z "$NEW_VERSION" ]; then
  echo "Usage: $0 <new-version>"
  exit 1
fi

echo "Updating ERI system to version $NEW_VERSION..."

# Update image tags
kubectl set image deployment/eri-control-plane novafuse/nzk:$NEW_VERSION -n $NAMESPACE
kubectl set image deployment/eri-control-plane novafuse/nva:$NEW_VERSION -n $NAMESPACE
kubectl set image deployment/eri-execution-plane novafuse/nvc:$NEW_VERSION -n $NAMESPACE
kubectl set image deployment/eri-survival-plane novafuse/nvd:$NEW_VERSION -n $NAMESPACE
kubectl set image deployment/eri-regeneration-plane novafuse/nvr:$NEW_VERSION -n $NAMESPACE

# Restart deployments
kubectl rollout restart deployment/eri-control-plane -n $NAMESPACE
kubectl rollout restart deployment/eri-execution-plane -n $NAMESPACE
kubectl rollout restart deployment/eri-survival-plane -n $NAMESPACE
kubectl rollout restart deployment/eri-regeneration-plane -n $NAMESPACE

echo "Waiting for updates to complete..."
kubectl rollout status deployment/eri-control-plane -n $NAMESPACE --timeout=300s
kubectl rollout status deployment/eri-execution-plane -n $NAMESPACE --timeout=300s
kubectl rollout status deployment/eri-survival-plane -n $NAMESPACE --timeout=300s
kubectl rollout status deployment/eri-regeneration-plane -n $NAMESPACE --timeout=300s

echo "Update completed!"

1.11 Conclusion

The ERI Reference Implementation Blueprint provides:

• Complete Kubernetes deployment configuration for all ERI components
• Production-ready security configurations with RBAC and network policies
• Comprehensive monitoring setup with Prometheus and Grafana
• Automated deployment scripts and Helm chart integration
• Operational procedures for health checks, scaling, and updates

This blueprint enables organizations to deploy the ERI system in production Kubernetes environments with confidence, ensuring all components are properly configured, secured, and monitored according to the ERI system's mathematical guarantees and security requirements.