diff --git a/envs/dev/sealed-secrets/platform-api-secret.yaml b/envs/dev/sealed-secrets/platform-api-secret.yaml
new file mode 100644
index 0000000..beebf46
--- /dev/null
+++ b/envs/dev/sealed-secrets/platform-api-secret.yaml
@@ -0,0 +1,80 @@
+replicaCount: 1          # provisioning PDB → KHÔNG scale
+
+image:
+  repository: renolation/dbiz-platform-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8080
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40     # platform-api chạy Liquibase golden template, start lâu
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"       # khớp -Xmx3g + overhead
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: platform.dev.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "platform"
+  LOG_FILE: "/tmp/dbiz-platform.log"
+  # Oracle Platform DB
+  SPRING_DATASOURCE_URL: "jdbc:oracle:thin:@//oracle-db:1521/CORE_FOUNDATION"
+  SPRING_DATASOURCE_USERNAME: "FOUNDATION"
+  SPRING_LIQUIBASE_CHANGE_LOG: "classpath:db/changelog/db.changelog-master.xml"
+  SPRING_LIQUIBASE_DEFAULT_SCHEMA: "FOUNDATION"
+  # Redis
+  SPRING_DATA_REDIS_HOST: "redis"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
+  # S3 (SeaweedFS)
+  S3_ENDPOINT: "http://seaweedfs-s3:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888"
+  # Tenant provisioning — Oracle CDB/PDB
+  DBIZ_TENANT_ORACLE_HOST: "oracle-db"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_PDB: "CORE_FOUNDATION"
+  DBIZ_CDB_URL: "jdbc:oracle:thin:@//oracle-db:1521/TESTDB"
+  DBIZ_CDB_USERNAME: "sys as sysdba"
+  # Golden template
+  DBIZ_GOLDEN_PDB_NAME: "CORE_FOUNDATION"
+  DBIZ_GOLDEN_SCHEMA: "FOUNDATION"
+  DBIZ_GOLDEN_SNAPSHOT_COPY: "false"
+  DBIZ_GOLDEN_ENT_TIERS: "ENTERPRISE"
+  DBIZ_GOLDEN_DB_LINK: "golden_link"
+  DBIZ_GOLDEN_CREATE_FILE_DEST: "+DATA"
+  # Service URLs
+  DBIZ_TENANT_API_URL: "http://tenant-api:8081"
+  DBIZ_PROMETHEUS_URL: "http://192.168.110.74:9090"
+  DBIZ_AUTONOMOUS_INTERNAL_URL: "https://autonomous-api.dbiz.com/api/v1/internal"
+  # Job queue
+  DBIZ_PLATFORM_JOB_MAX_CONCURRENT: "5"
+  DBIZ_PLATFORM_JOB_TIMEOUT_MINUTES: "60"
+  DBIZ_PLATFORM_GOLDEN_TEMPLATE_LIQUIBASE_UPDATE: "true"
+  DBIZ_STORAGE_TOTAL_BYTES: "5497558138880"
+  # Tắt OpenTelemetry (chưa có collector)
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - SPRING_DATASOURCE_PASSWORD
+  - DBIZ_CDB_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - DBIZ_GOLDEN_PDB_ADMIN_PASSWORD
+  - S3_SECRET_KEY
+  - DBIZ_AUTONOMOUS_INTERNAL_API_KEY
\ No newline at end of file
diff --git a/envs/dev/sealed-secrets/tenant-api-secret.yaml b/envs/dev/sealed-secrets/tenant-api-secret.yaml
new file mode 100644
index 0000000..c0272d8
--- /dev/null
+++ b/envs/dev/sealed-secrets/tenant-api-secret.yaml
@@ -0,0 +1,66 @@
+replicaCount: 1
+
+image:
+  repository: renolation/dbiz-tenant-api
+  tag: "latest"
+  pullPolicy: Always
+
+service:
+  port: 8081
+
+probe:
+  path: /actuator/health
+  initialDelaySeconds: 90
+  periodSeconds: 10
+  failureThreshold: 40
+
+resources:
+  requests:
+    memory: "1Gi"
+    cpu: "500m"
+  limits:
+    memory: "3584Mi"
+    cpu: "2"
+
+ingress:
+  enabled: true
+  className: traefik
+  host: tenant.dev.dbiz.local
+
+env:
+  SPRING_PROFILES_ACTIVE: "tenant"
+  # Oracle Platform DB (tenant resolution)
+  DBIZ_PLATFORM_DB_URL: "jdbc:oracle:thin:@//oracle-db:1521/CORE_FOUNDATION"
+  DBIZ_PLATFORM_DB_USERNAME: "FOUNDATION"
+  # Tenant DB — Oracle PDB
+  DBIZ_TENANT_DB_DEFAULT_URL: "jdbc:oracle:thin:@//oracle-db:1521/CORE_FOUNDATION"
+  DBIZ_TENANT_DB_DEFAULT_USERNAME: "FOUNDATION"
+  DBIZ_TENANT_ORACLE_HOST: "oracle-db"
+  DBIZ_TENANT_ORACLE_PORT: "1521"
+  DBIZ_TENANT_ORACLE_APP_SCHEMA: "FOUNDATION"
+  # Redis
+  SPRING_DATA_REDIS_HOST: "redis"
+  # Kafka
+  SPRING_KAFKA_BOOTSTRAP_SERVERS: "kafka:9092"
+  # S3
+  S3_ENDPOINT: "http://seaweedfs-s3:8888"
+  S3_ACCESS_KEY: "admin"
+  S3_REGION: "ap-southeast-1"
+  S3_PUBLIC_ENDPOINT: "http://seaweedfs-s3:8888"
+  # App URLs
+  DBIZ_IDP_BASE_URL: "https://id.dbiz.com"
+  DBIZ_APPS_TENANT_ADMIN_URL_PATTERN: "https://{tenantCode}.dbiz.com/admin"
+  DBIZ_APPS_AUTONOMOUS_URL_PATTERN: "https://{tenantCode}.dbiz.com/autonomous"
+  DBIZ_CMS_PUBLIC_TENANT: "OFFICIAL"
+  # Tắt OpenTelemetry
+  OTEL_SDK_DISABLED: "true"
+  # JVM
+  JAVA_TOOL_OPTIONS: "-Xms512m -Xmx3g -XX:+UseG1GC -XX:MaxGCPauseMillis=200"
+
+secretKeys:
+  - DBIZ_PLATFORM_DB_PASSWORD
+  - DBIZ_TENANT_DB_DEFAULT_PASSWORD
+  - DBIZ_TENANT_PASSWORD
+  - SPRING_DATA_REDIS_PASSWORD
+  - S3_SECRET_KEY
+  - EXCHANGE_KEY
\ No newline at end of file