From 8e2cbd40defbd98a3d5355f75ed287420a67079c Mon Sep 17 00:00:00 2001
From: Tim Olson <tim@dexorder.com>
Date: Wed, 1 Apr 2026 21:44:51 -0400
Subject: [PATCH] prod fixes

---
 deploy/k8s/prod/kustomization.yaml  |  2 ++
 deploy/k8s/prod/sandbox-config.yaml | 40 +++++++++++++++++++++++++++++
 2 files changed, 42 insertions(+)
 create mode 100644 deploy/k8s/prod/sandbox-config.yaml

diff --git a/deploy/k8s/prod/kustomization.yaml b/deploy/k8s/prod/kustomization.yaml
index bf70e081..c6c70bac 100644
--- a/deploy/k8s/prod/kustomization.yaml
+++ b/deploy/k8s/prod/kustomization.yaml
@@ -13,6 +13,8 @@ resources:
   - namespaces.yaml
   # Prod infrastructure (postgres, minio, kafka, flink, relay, ingestor, qdrant, dragonfly, iceberg)
   - infrastructure.yaml
+  # Sandbox namespace resources (go to sandbox namespace, not ai)
+  - sandbox-config.yaml
   # gateway-config ConfigMap is intentionally excluded from kustomize.
   # It contains an op:// reference for the DB password. Apply via:
   #   bin/config-update prod gateway-config
diff --git a/deploy/k8s/prod/sandbox-config.yaml b/deploy/k8s/prod/sandbox-config.yaml
new file mode 100644
index 00000000..198ca2ec
--- /dev/null
+++ b/deploy/k8s/prod/sandbox-config.yaml
@@ -0,0 +1,40 @@
+# Sandbox ConfigMap in sandbox namespace
+# Mounted into dynamically created sandbox pods at /app/config/config.yaml
+---
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: sandbox-config
+  namespace: sandbox
+  labels:
+    app.kubernetes.io/name: sandbox
+    app.kubernetes.io/component: config
+data:
+  config.yaml: |
+    data_dir: "/app/data"
+
+    user:
+      timezone: "UTC"
+
+    data:
+      iceberg:
+        catalog_name: "dexorder"
+        catalog_uri: "http://iceberg-catalog.ai.svc.cluster.local:8181"
+        namespace: "trading"
+        s3_endpoint: "http://minio.ai.svc.cluster.local:9000"
+
+      relay:
+        endpoint: "tcp://relay.ai.svc.cluster.local:5559"
+        notification_endpoint: "tcp://relay.ai.svc.cluster.local:5558"
+        timeout_ms: 5000
+
+    strategies:
+      max_concurrent: 5
+      default_timeout_minutes: 60
+
+    alerts:
+      max_active: 100
+
+    logging:
+      level: "INFO"
+      include_timestamps: true