From 637014cf233a763fa4e9fd8c48bdaa5a148cd70d Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Wed, 24 Jun 2026 10:01:48 -0300 Subject: [PATCH 001/113] feat(charts): add streaming-hub Helm chart (#1569) * feat(streaming-hub): add Helm chart Multi-component chart for the streaming-hub service, based on the go-boilerplate-ddd template with the reporter per-role convention. - mode: all (default, one Deployment) | split (ingest + delivery), the three roles compete for one Kafka consumer group so the switch is either/or, guarded by a values.schema.json enum - shared ConfigMap + Secret; per-role STREAMING_HUB_ROLE and Postgres pool sizing injected as explicit env (wins over envFrom) - /healthz liveness, /readyz readiness; distroless nonroot 65532, RO rootfs, drop ALL, RuntimeDefault; SIGTERM self-drain (no preStop) - bootstrap-postgres job + ingress conditional; otel via HOST_IP:4317 - every STREAMING_HUB_*/PLUGIN_AUTH_* key verified 1:1 against streaming-hub/.env.reference Phase 1 of docs/plans/2026-06-23-streaming-hub-helm-and-gitops.md. Claude-Session: https://claude.ai/code/session_016Bv8y35GWdpgNdhGVs28JZ * fix(charts): harden streaming-hub chart per CodeRabbit review - terminationGracePeriodSeconds 30 -> 80 (source-derived SIGTERM drain ceiling; prevents SIGKILL of a still-draining pod -> duplicate delivery; not the suggested 90 -- .env.reference says "NOT a magic 90") - automountServiceAccountToken: false (configurable) -- hub makes no K8s API calls - PDB: hasKey+ne-nil guard so maxUnavailable: 0 renders (was swallowed by `with`) - bootstrap-postgres: escape single quotes in SQL string literals so a password containing ' can't break CREATE ROLE Claude-Session: https://claude.ai/code/session_016Bv8y35GWdpgNdhGVs28JZ --- charts/streaming-hub/.helmignore | 24 ++ charts/streaming-hub/Chart.yaml | 33 ++ charts/streaming-hub/README.md | 188 ++++++++ charts/streaming-hub/docs/TOPOLOGY.md | 55 +++ .../streaming-hub/templates/_deployment.tpl | 251 +++++++++++ charts/streaming-hub/templates/_helpers.tpl | 111 +++++ .../templates/all/deployment.yaml | 3 + charts/streaming-hub/templates/all/hpa.yaml | 3 + charts/streaming-hub/templates/all/pdb.yaml | 3 + .../streaming-hub/templates/all/service.yaml | 3 + .../templates/bootstrap-postgres.yaml | 154 +++++++ charts/streaming-hub/templates/configmap.yaml | 23 + .../templates/delivery/deployment.yaml | 3 + .../streaming-hub/templates/delivery/hpa.yaml | 3 + .../streaming-hub/templates/delivery/pdb.yaml | 3 + .../templates/delivery/service.yaml | 3 + .../templates/ingest/deployment.yaml | 3 + .../streaming-hub/templates/ingest/hpa.yaml | 3 + .../streaming-hub/templates/ingest/pdb.yaml | 3 + .../templates/ingest/service.yaml | 3 + charts/streaming-hub/templates/ingress.yaml | 52 +++ charts/streaming-hub/templates/secrets.yaml | 28 ++ .../templates/serviceaccount.yaml | 13 + charts/streaming-hub/values-template.yaml | 50 +++ charts/streaming-hub/values.schema.json | 43 ++ charts/streaming-hub/values.yaml | 404 ++++++++++++++++++ 26 files changed, 1465 insertions(+) create mode 100644 charts/streaming-hub/.helmignore create mode 100644 charts/streaming-hub/Chart.yaml create mode 100644 charts/streaming-hub/README.md create mode 100644 charts/streaming-hub/docs/TOPOLOGY.md create mode 100644 charts/streaming-hub/templates/_deployment.tpl create mode 100644 charts/streaming-hub/templates/_helpers.tpl create mode 100644 charts/streaming-hub/templates/all/deployment.yaml create mode 100644 charts/streaming-hub/templates/all/hpa.yaml create mode 100644 charts/streaming-hub/templates/all/pdb.yaml create mode 100644 charts/streaming-hub/templates/all/service.yaml create mode 100644 charts/streaming-hub/templates/bootstrap-postgres.yaml create mode 100644 charts/streaming-hub/templates/configmap.yaml create mode 100644 charts/streaming-hub/templates/delivery/deployment.yaml create mode 100644 charts/streaming-hub/templates/delivery/hpa.yaml create mode 100644 charts/streaming-hub/templates/delivery/pdb.yaml create mode 100644 charts/streaming-hub/templates/delivery/service.yaml create mode 100644 charts/streaming-hub/templates/ingest/deployment.yaml create mode 100644 charts/streaming-hub/templates/ingest/hpa.yaml create mode 100644 charts/streaming-hub/templates/ingest/pdb.yaml create mode 100644 charts/streaming-hub/templates/ingest/service.yaml create mode 100644 charts/streaming-hub/templates/ingress.yaml create mode 100644 charts/streaming-hub/templates/secrets.yaml create mode 100644 charts/streaming-hub/templates/serviceaccount.yaml create mode 100644 charts/streaming-hub/values-template.yaml create mode 100644 charts/streaming-hub/values.schema.json create mode 100644 charts/streaming-hub/values.yaml diff --git a/charts/streaming-hub/.helmignore b/charts/streaming-hub/.helmignore new file mode 100644 index 00000000..8e258349 --- /dev/null +++ b/charts/streaming-hub/.helmignore @@ -0,0 +1,24 @@ +# Patterns to ignore when building packages. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ +# Chart docs are not part of the packaged artifact. +docs/ +README.md diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml new file mode 100644 index 00000000..0cb23156 --- /dev/null +++ b/charts/streaming-hub/Chart.yaml @@ -0,0 +1,33 @@ +apiVersion: v2 +name: streaming-hub-helm +description: >- + Lerian streaming-hub — consumes lib-streaming CloudEvents from Kafka/Redpanda + and fans them out to per-tenant SaaS/BYOC subscribers. Multi-component chart + with a runtime STREAMING_HUB_ROLE model (mode: all | split). +type: application +# version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real +# chart version on merge — do NOT hand-pick a final number here. +version: 0.1.0 +appVersion: "1.0.0" +annotations: + lerian.studio/chart-type: multi-component +home: https://github.com/LerianStudio/streaming-hub +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/streaming-hub + - https://github.com/LerianStudio/streaming-hub +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" +keywords: + - streaming + - cloudevents + - kafka + - redpanda + - fan-out + - lerian +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 +# NO dependencies block by deliberate design (deviation from reporter/midaz): +# OTEL is env-wired via the OTEL_EXPORTER_OTLP_ENDPOINT downward-API override, +# not bundled as an otel-collector-lerian subchart. Declaring it would force an +# OCI pull on every `helm lint` / `helm template`. Kafka/Redpanda and Postgres +# are shared external infra, never subcharts here. diff --git a/charts/streaming-hub/README.md b/charts/streaming-hub/README.md new file mode 100644 index 00000000..606b3ddc --- /dev/null +++ b/charts/streaming-hub/README.md @@ -0,0 +1,188 @@ +# streaming-hub Helm chart + +Deploys **streaming-hub** — the Lerian service that consumes +[`lib-streaming`](https://github.com/LerianStudio) CloudEvents from +Kafka/Redpanda and fans them out to per-tenant SaaS/BYOC subscribers. + +This is a **multi-component** chart built on one image and one binary, selected +at runtime into a role via `STREAMING_HUB_ROLE`. There are **no** database, +broker, or OTEL subcharts — Kafka/Redpanda and PostgreSQL are shared external +infra, and OTEL is env-wired (see [External dependencies](#external-dependencies)). + +--- + +## Chart Contract + +- Chart type: `multi-component` +- Required secrets: `secrets.STREAMING_HUB_POSTGRES_DSN` (the DSN carries the DB password); `secrets.STREAMING_HUB_KAFKA_SCRAM_USERNAME` + `secrets.STREAMING_HUB_KAFKA_SCRAM_PASSWORD` (when the broker requires SASL/SCRAM); `secrets.STREAMING_HUB_KEK_REF` (KEK reference for the F10 envelope crypto — `secrets.STREAMING_HUB_DEV_KEK` for dev only). SaaS-only, required when `STREAMING_HUB_MULTI_TENANT_ENABLED=true`: `secrets.STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY` and `secrets.STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD`. All blank by default — provide inline or set `streamingHub.useExistingSecret` + `streamingHub.existingSecretName` (the path GitOps uses, with a Vault-injected Secret). +- Dependency notes: **No bundled subcharts.** Kafka/Redpanda and PostgreSQL are shared external infra — supply `common.configmap.STREAMING_HUB_KAFKA_BROKERS` and `secrets.STREAMING_HUB_POSTGRES_DSN`. OTEL is env-wired to a node-local collector (`HOST_IP:4317`, gated on `streamingHub.telemetry.enabled`) — there is no OTEL collector subchart. The optional `bootstrap-postgres` Job provisions the hub's single database when `global.externalPostgresDefinitions.enabled=true`. +- Production overrides: choose `streamingHub.mode` (`all` vs `split`); size per-role `replicaCount` / `autoscaling` / `resources` and the Postgres pool (`poolMaxOpenConns` / `poolMaxIdleConns`) honoring **Σ(replicas × poolMaxOpenConns) ≤ Postgres `max_connections`**; set `image.tag`, `ingress`, and the secrets (inline or `useExistingSecret`). +- Source/license: Source is in `github.com/LerianStudio/helm`; license is Apache-2.0. + +--- + +## The `mode` switch (read this first) + +`streamingHub.mode` decides the topology. It is an **either/or**: + +| `mode` | Renders | `STREAMING_HUB_ROLE` | When | +|---------|---------|----------------------|------| +| `all` (default) | ONE Deployment + Service (+ HPA/PDB) | `all` | Single co-resident deployment. The dev-st target. Byte-equivalent to the historical single binary. | +| `split` | TWO Deployments + Services (ingest + delivery), each with its own HPA/PDB | `ingest` / `delivery` | Ingest and delivery scaled independently as N + M replicas. | + +### > **DOUBLE-CONSUME HAZARD — the load-bearing rule** + +> **NEVER run a `mode: all` release AND a `mode: split` release against the same +> Kafka/Redpanda cluster.** All three roles (`all`, `ingest`) join the **one** +> ingest consumer group. An `all` pod and an `ingest` pod consuming together +> means **every event is double-consumed and double-delivered.** The `mode` +> switch enforces either/or within a single release — do not defeat it by +> deploying two releases that overlap. + +### Worked example — `mode: all` (dev-st) + +```yaml +streamingHub: + mode: all + all: + replicaCount: 1 + poolMaxOpenConns: 25 # role=all holds both planes' connections + poolMaxIdleConns: 12 +``` + +Renders: `streaming-hub-all` Deployment + `streaming-hub-all` Service, plus the +shared `streaming-hub` ConfigMap + Secret + ServiceAccount. One consumer-group +member set — no double-consume possible. + +### Worked example — `mode: split` (independent scaling) + +```yaml +streamingHub: + mode: split + ingest: + replicaCount: 3 + poolMaxOpenConns: 8 # consume-poll + inbox tx + partition-cron + poolMaxIdleConns: 4 + autoscaling: { enabled: true, minReplicas: 3, maxReplicas: 4 } + delivery: + replicaCount: 2 + poolMaxOpenConns: 16 # 8 dispatch workers + reclaim + dlq + delivery /readyz + poolMaxIdleConns: 10 + autoscaling: { enabled: true, minReplicas: 2, maxReplicas: 4 } +``` + +Renders `streaming-hub-ingest` and `streaming-hub-delivery` Deployments + +Services + HPAs, sharing the one ConfigMap + Secret. Each Deployment gets its +own `STREAMING_HUB_ROLE` and pool sizing as **explicit per-Deployment env** +(which wins over the shared `envFrom`). + +--- + +## Connection-budget invariant + +streaming-hub owns **ONE** shared PostgreSQL database. Every open connection on +every pod of every role draws from that single `max_connections` budget. + +> **Σ over all running pods of `(replicas × poolMaxOpenConns)` + headroom ≤ PostgreSQL `max_connections`.** +> Under HPA, use `maxReplicas` (not `replicaCount`) in the sum. + +Worked example (`max_connections = 100`, `mode: split`): + +| Role | replicas | poolMaxOpenConns | connections | +|------|----------|------------------|-------------| +| ingest | 3 | 8 | 24 | +| delivery | 4 | 16 | 64 | +| **total** | | | **88** (leaves 12 for admin/migrations) ✅ | + +Adding an `all` pod (25) → `88 + 25 = 113 > 100` ❌. The `mode` either/or already +forbids that combination; the budget math is why it also matters operationally. +See `streaming-hub/.env.reference` (`STREAMING_HUB_POSTGRES_MAX_OPEN_CONNS`) for +the per-role rationale (all 25/12, ingest 8/4, delivery 16/10). + +--- + +## Health, drain, and termination + +- **Probes** (verified against the hub source / Dockerfile, on the `http` port `8080`): + - `livenessProbe`: `GET /healthz` — stays `200` throughout drain. + - `readinessProbe`: `GET /readyz` — flips `NotReady` (503) **first** on SIGTERM so the endpoints controller drains the pod from the Service. +- **No `preStop` hook.** The hub **self-drains on SIGTERM**: the exec-form + ENTRYPOINT delivers SIGTERM straight to PID 1, and the lib-commons Launcher + runs the HTTP → consumer → dispatcher teardown. +- **`terminationGracePeriodSeconds` defaults to `80` — the hub's derived SIGTERM + drain ceiling — and MUST stay at or above it.** At the shipped + `STREAMING_HUB_SHUTDOWN_TIMEOUT=30s` + `STREAMING_HUB_PRE_STOP_DRAIN_TIMEOUT=5s` + the ceiling is `30s` (HTTP) + `5s` (consumer final-commit) + `30s` (dispatcher, + `min(ShutdownTimeout, 55s)`) + `10s` slack = `75s`, plus the `5s` pre-stop wait + = **`80s`**. If you tune those knobs up, recompute and raise this knob to match, + or the orchestrator SIGKILLs a still-draining replica (risking a duplicate + delivery). See `.env.reference`. + +--- + +## Secrets sourcing + +Two mutually-exclusive paths: + +| `useExistingSecret` | Behavior | +|---------------------|----------| +| `false` (default) | The chart renders `templates/secret.yaml` from `streamingHub.secrets` (base64-encoded; **empty values are skipped**, so unset SaaS/dev keys never ship blank). | +| `true` | **No** Secret is rendered. Deployments reference `existingSecretName`. This is the **gitops/Vault path** (an external secret is projected into the named Secret) and is the production default. | + +Sensitive keys (all in `streamingHub.secrets`, all default `""`): +`STREAMING_HUB_POSTGRES_DSN`, `STREAMING_HUB_KAFKA_SCRAM_USERNAME`, +`STREAMING_HUB_KAFKA_SCRAM_PASSWORD`, `STREAMING_HUB_KEK_REF`, +`STREAMING_HUB_DEV_KEK` (dev only), `STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY`, +`STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD`. + +--- + +## External dependencies + +This chart provisions **none** of the following — they live outside it: + +- **Kafka / Redpanda** — the CloudEvents bus the hub consumes. Point + `STREAMING_HUB_KAFKA_BROKERS` at the cluster; supply SASL/SCRAM creds via the + Secret when `STREAMING_HUB_KAFKA_SCRAM_MECHANISM` is set. +- **PostgreSQL** — the single hub-owned database (`tenant_id` is a column, not a + per-tenant DB). Either point `STREAMING_HUB_POSTGRES_DSN` at a pre-provisioned + managed host, **or** enable `global.externalPostgresDefinitions.enabled` to run + the bootstrap Job that creates the hub's one DB + role on a shared host. +- **OTEL collector** — **not** a subchart (deliberate; declaring it would force + an OCI pull on `helm lint`/`template`). When `streamingHub.telemetry.enabled=true` + (a chart-level toggle, not an app env var), the Deployment injects `HOST_IP` via + the downward API and sets `OTEL_EXPORTER_OTLP_ENDPOINT=$(HOST_IP):4317` + (node-local DaemonSet collector). + +--- + +## Top-level values + +| Key | Default | Description | +|-----|---------|-------------| +| `streamingHub.mode` | `all` | Topology switch: `all` \| `split`. Schema-enforced enum. | +| `streamingHub.image.repository` | `ghcr.io/lerianstudio/streaming-hub` | Image repo. | +| `streamingHub.image.tag` | `""` | Empty falls back to `Chart.appVersion`. | +| `streamingHub.image.pullPolicy` | `IfNotPresent` | | +| `streamingHub.imagePullSecrets` | `[{name: ghcr-credential}]` | Private registry pull secrets. | +| `streamingHub.service.type` | `ClusterIP` | Lerian convention (Ingress fronts external). | +| `streamingHub.service.port` | `8080` | Control-plane HTTP port. | +| `streamingHub.ingress.enabled` | `false` | Control-plane API ingress (opt-in per env). | +| `streamingHub.serviceAccount.create` | `true` | | +| `streamingHub.terminationGracePeriodSeconds` | `80` | Defaults to the ~80s drain ceiling; keep at or above it. | +| `streamingHub.securityContext` | nonroot 65532, drop ALL, RO rootfs, RuntimeDefault | Distroless:nonroot. | +| `streamingHub.useExistingSecret` | `false` | `true` = Vault/gitops path. | +| `streamingHub.existingSecretName` | `""` | Required when `useExistingSecret`. | +| `streamingHub.common.configmap` | (documented set) | Shared non-sensitive env. Every key is verbatim in `.env.reference`. | +| `streamingHub.secrets` | (all `""`) | Shared sensitive env. Empty values skipped. | +| `streamingHub..replicaCount` | `1` | Per role: `all` / `ingest` / `delivery`. | +| `streamingHub..poolMaxOpenConns` | all `25` / ingest `8` / delivery `16` | Postgres pool (connection-budget invariant). | +| `streamingHub..poolMaxIdleConns` | all `12` / ingest `4` / delivery `10` | | +| `streamingHub..autoscaling.enabled` | `false` | HPA per role (`autoscaling/v2`, CPU+memory). | +| `streamingHub..pdb.enabled` | `false` | PodDisruptionBudget per role (`policy/v1`). | +| `global.externalPostgresDefinitions.enabled` | `false` | Bootstrap Job for the hub's one DB/role. | + +For the full env contract (defaults, required-in-SaaS markers, the F4 tenant +caution, KEK source vars), see `streaming-hub/.env.reference`. + +See [`docs/TOPOLOGY.md`](docs/TOPOLOGY.md) for the role model in depth. diff --git a/charts/streaming-hub/docs/TOPOLOGY.md b/charts/streaming-hub/docs/TOPOLOGY.md new file mode 100644 index 00000000..1e87aa25 --- /dev/null +++ b/charts/streaming-hub/docs/TOPOLOGY.md @@ -0,0 +1,55 @@ +# streaming-hub deployment topology + +streaming-hub ships as **one image, one binary**, selected into a role at +**runtime** via `STREAMING_HUB_ROLE` ∈ `{all, ingest, delivery}`. There is no +build-time split — no `cmd/ingest`/`cmd/delivery`, no `ARG ROLE`. This chart +exposes that runtime choice through the single `streamingHub.mode` switch. + +## The role model + +Every role serves the **full** Fiber control plane on `:8080` +(`/healthz`, `/readyz`, `/metrics`, `/v1`, `/admin`). The role gates **which +background Launcher Apps register** and **which Kafka clients dial** — not which +HTTP routes mount. + +| Role | Background apps | Kafka clients | Postgres pool (open/idle) | +|------|-----------------|---------------|---------------------------| +| `all` | every app (ingest + delivery co-resident) | all three | 25 / 12 | +| `ingest` | consumer + manifest-refresh + partition-cron + idempotency-reaper | ingest consumer only | 8 / 4 | +| `delivery` | dispatcher + dlq-consumer + dlq-prune + topic-reconciler | DLQ + reconciler-admin | 16 / 10 | + +## How the chart maps mode → workloads + +- **`mode: all`** → `templates/all/*` render: one `streaming-hub-all` Deployment + with `STREAMING_HUB_ROLE=all`, plus its Service (and HPA/PDB when enabled). +- **`mode: split`** → `templates/ingest/*` and `templates/delivery/*` render: + two Deployments (`streaming-hub-ingest`, `streaming-hub-delivery`) with the + matching role env, plus their Services (and per-role HPA/PDB). + +The shared singletons (`templates/configmap.yaml`, `templates/secret.yaml`, +`templates/serviceaccount.yaml`) are role-invariant and rendered exactly once +regardless of mode. The Deployment/Service/HPA/PDB bodies are a single +parameterized partial (`templates/_deployment.tpl`) invoked by thin +mode-gated wrappers — no per-role body duplication. + +### Why the role-specific vars are explicit `env`, not in the ConfigMap + +`STREAMING_HUB_ROLE` and the Postgres pool sizes differ per role. Kubernetes env +precedence is **`env` > `envFrom`**, so the chart injects those three vars as +explicit per-Deployment `env:` while everything role-invariant stays in the one +shared ConfigMap consumed via `envFrom`. A role's pool size therefore cleanly +overrides any shared default, and the ConfigMap never has to fork per role. + +## Independent scaling and the consumer group + +In `mode: split`, ingest and delivery scale independently as **N + M** replicas +in one ingest consumer group; delivery's DLQ consumer is a structurally-disjoint +second group. Background singleton crons stay singleton across replicas via the +hub's `internal/shared/dblock` advisory-lock registry — the chart does not need +to pin them to a single replica. + +> **Never overlap `mode: all` with `mode: split` on the same Kafka cluster.** +> `all` and `ingest` join the same consumer group → double-consume. See the +> README's double-consume hazard callout. + +For the full architecture, see `streaming-hub/docs/architecture.md`. diff --git a/charts/streaming-hub/templates/_deployment.tpl b/charts/streaming-hub/templates/_deployment.tpl new file mode 100644 index 00000000..7baae9eb --- /dev/null +++ b/charts/streaming-hub/templates/_deployment.tpl @@ -0,0 +1,251 @@ +{{/* +============================================================================= +streaming-hub.deployment — the shared, component-parameterized Deployment. +Input: dict { root (the root context "."), component ("all"|"ingest"|"delivery") }. + +All three roles run the SAME image and serve the SAME full control plane on +:8080. They differ ONLY in: + - STREAMING_HUB_ROLE (the literal component) + - Postgres pool sizing (poolMaxOpenConns / poolMaxIdleConns) + - replicas / resources / scheduling + +The role-specific vars are injected as EXPLICIT per-Deployment env, which WINS +over envFrom (k8s precedence: env > envFrom). So a per-role pool size cleanly +overrides any shared default, and the shared ConfigMap deliberately omits +STREAMING_HUB_ROLE / the pool vars. +============================================================================= +*/}} +{{- define "streaming-hub.deployment" -}} +{{- $ := .root -}} +{{- $component := .component -}} +{{- $cfg := index $.Values.streamingHub $component -}} +{{- $sh := $.Values.streamingHub -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "streaming-hub.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" $ }} + labels: + {{- include "streaming-hub.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $sh.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + revisionHistoryLimit: {{ $sh.revisionHistoryLimit | default 10 }} + {{- with $sh.deploymentStrategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + {{- if not $cfg.autoscaling.enabled }} + replicas: {{ $cfg.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "streaming-hub.componentSelectorLabels" (dict "context" $ "component" $component) | nindent 6 }} + template: + metadata: + labels: + {{- include "streaming-hub.labels" (dict "context" $ "component" $component) | nindent 8 }} + {{- with $sh.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with $sh.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "streaming-hub.serviceAccountName" $ }} + automountServiceAccountToken: {{ $sh.serviceAccount.automountServiceAccountToken | default false }} + terminationGracePeriodSeconds: {{ $sh.terminationGracePeriodSeconds | default 80 }} + {{- with $sh.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: streaming-hub + securityContext: + {{- toYaml $sh.securityContext | nindent 12 }} + image: "{{ $sh.image.repository }}:{{ include "streaming-hub.defaultTag" $ }}" + imagePullPolicy: {{ $sh.image.pullPolicy }} + ports: + - name: http + containerPort: {{ $sh.service.port }} + protocol: TCP + envFrom: + - secretRef: + name: {{ include "streaming-hub.secretName" $ }} + - configMapRef: + name: {{ include "streaming-hub.fullname" $ }} + env: + # --- role differentiator (explicit env WINS over envFrom) --- + - name: STREAMING_HUB_ROLE + value: {{ $component | quote }} + - name: STREAMING_HUB_POSTGRES_MAX_OPEN_CONNS + value: {{ $cfg.poolMaxOpenConns | quote }} + - name: STREAMING_HUB_POSTGRES_MAX_IDLE_CONNS + value: {{ $cfg.poolMaxIdleConns | quote }} + {{- with $sh.extraEnvVars }} + {{- range . }} + - name: {{ .name }} + value: {{ .value | quote }} + {{- end }} + {{- end }} + {{- if $sh.telemetry.enabled }} + # OTEL endpoint is overridden per-pod via the node host IP (DaemonSet + # collector pattern). Gated on the CHART-level streamingHub.telemetry.enabled. + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + livenessProbe: + httpGet: + path: /healthz + port: http + initialDelaySeconds: {{ $sh.livenessProbe.initialDelaySeconds | default 15 }} + periodSeconds: {{ $sh.livenessProbe.periodSeconds | default 20 }} + timeoutSeconds: {{ $sh.livenessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ $sh.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $sh.livenessProbe.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: /readyz + port: http + initialDelaySeconds: {{ $sh.readinessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ $sh.readinessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $sh.readinessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ $sh.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $sh.readinessProbe.failureThreshold | default 3 }} + resources: + {{- toYaml $cfg.resources | nindent 12 }} + {{- with $cfg.nodeSelector | default $sh.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $cfg.affinity | default $sh.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $cfg.tolerations | default $sh.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end -}} + + +{{/* +============================================================================= +streaming-hub.service — the shared, component-parameterized ClusterIP Service. +Input: dict { root, component }. One Service per active role, selecting only +that role's pods via componentSelectorLabels. +============================================================================= +*/}} +{{- define "streaming-hub.service" -}} +{{- $ := .root -}} +{{- $component := .component -}} +{{- $sh := $.Values.streamingHub -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "streaming-hub.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" $ }} + labels: + {{- include "streaming-hub.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $sh.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ $sh.service.type }} + ports: + - port: {{ $sh.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "streaming-hub.componentSelectorLabels" (dict "context" $ "component" $component) | nindent 4 }} +{{- end -}} + + +{{/* +============================================================================= +streaming-hub.hpa — the shared, component-parameterized HPA (autoscaling/v2). +Input: dict { root, component }. Emitted only when that role's +autoscaling.enabled. CONNECTION-BUDGET HAZARD: maxReplicas multiplies the +Postgres connection draw — Σ(maxReplicas × poolMaxOpenConns) ≤ max_connections. +============================================================================= +*/}} +{{- define "streaming-hub.hpa" -}} +{{- $ := .root -}} +{{- $component := .component -}} +{{- $cfg := index $.Values.streamingHub $component -}} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "streaming-hub.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" $ }} + labels: + {{- include "streaming-hub.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "streaming-hub.componentFullname" (dict "context" $ "component" $component) }} + minReplicas: {{ $cfg.autoscaling.minReplicas }} + maxReplicas: {{ $cfg.autoscaling.maxReplicas }} + metrics: + {{- if $cfg.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ $cfg.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if $cfg.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ $cfg.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end -}} + + +{{/* +============================================================================= +streaming-hub.pdb — the shared, component-parameterized PDB (policy/v1). +Input: dict { root, component }. Emitted only when that role's pdb.enabled. +maxUnavailable wins over minAvailable when both are set (mirrors the template). +============================================================================= +*/}} +{{- define "streaming-hub.pdb" -}} +{{- $ := .root -}} +{{- $component := .component -}} +{{- $cfg := index $.Values.streamingHub $component -}} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "streaming-hub.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" $ }} + labels: + {{- include "streaming-hub.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $cfg.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and (hasKey $cfg.pdb "maxUnavailable") (ne $cfg.pdb.maxUnavailable nil) }} + maxUnavailable: {{ $cfg.pdb.maxUnavailable }} + {{- else }} + minAvailable: {{ $cfg.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- include "streaming-hub.componentSelectorLabels" (dict "context" $ "component" $component) | nindent 6 }} +{{- end -}} diff --git a/charts/streaming-hub/templates/_helpers.tpl b/charts/streaming-hub/templates/_helpers.tpl new file mode 100644 index 00000000..3853bc47 --- /dev/null +++ b/charts/streaming-hub/templates/_helpers.tpl @@ -0,0 +1,111 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "streaming-hub.name" -}} +{{- default "streaming-hub" .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +Truncated at 63 chars because some Kubernetes name fields are limited to this +(by the DNS naming spec). When fullnameOverride is set it wins verbatim. +*/}} +{{- define "streaming-hub.fullname" -}} +{{- default (include "streaming-hub.name" .) .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "streaming-hub.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Resolve the image tag, falling back to the chart appVersion when image.tag is "". +*/}} +{{- define "streaming-hub.defaultTag" -}} +{{- default .Chart.AppVersion .Values.streamingHub.image.tag }} +{{- end -}} + +{{/* +Return a valid version label value (k8s label charset). +*/}} +{{- define "streaming-hub.versionLabelValue" -}} +{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "streaming-hub.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }} +{{- end -}} + +{{/* +Component fully-qualified name: -. +Input: dict { context, component }. Truncated to 63 chars. +Used by every per-role Deployment/Service/HPA/PDB so the three role variants +never collide on a name. +*/}} +{{- define "streaming-hub.componentFullname" -}} +{{- $fullname := include "streaming-hub.fullname" .context -}} +{{- printf "%s-%s" $fullname .component | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Base selector labels (no component). +Input: dict { context }. +*/}} +{{- define "streaming-hub.selectorLabels" -}} +app.kubernetes.io/name: {{ include "streaming-hub.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- end }} + +{{/* +Component-aware selector labels: base labels + app.kubernetes.io/component. +Input: dict { context, component }. The component label is the load-bearing +discriminator that keeps split-mode (ingest/delivery) Deployments from sharing +one ReplicaSet selector. +*/}} +{{- define "streaming-hub.componentSelectorLabels" -}} +{{ include "streaming-hub.selectorLabels" (dict "context" .context) }} +app.kubernetes.io/component: {{ .component }} +{{- end }} + +{{/* +Component-aware common labels (selector labels + chart/version/managed-by/part-of). +Input: dict { context, component }. +*/}} +{{- define "streaming-hub.labels" -}} +helm.sh/chart: {{ include "streaming-hub.chart" .context }} +{{ include "streaming-hub.componentSelectorLabels" (dict "context" .context "component" .component) }} +app.kubernetes.io/version: {{ include "streaming-hub.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +app.kubernetes.io/part-of: streaming-hub +{{- end }} + +{{/* +Create the name of the service account to use. +*/}} +{{- define "streaming-hub.serviceAccountName" -}} +{{- if .Values.streamingHub.serviceAccount.create }} +{{- default (include "streaming-hub.fullname" .) .Values.streamingHub.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.streamingHub.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Expand the namespace of the release. +Allows overriding it for multi-namespace deployments in combined charts. +*/}} +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* +Resolve the shared Secret name a Deployment should reference: +existingSecretName when useExistingSecret, otherwise the shared chart Secret. +Input: root context (.). +*/}} +{{- define "streaming-hub.secretName" -}} +{{- if .Values.streamingHub.useExistingSecret -}} +{{- required "streamingHub.existingSecretName is required when streamingHub.useExistingSecret=true" .Values.streamingHub.existingSecretName -}} +{{- else -}} +{{- include "streaming-hub.fullname" . -}} +{{- end -}} +{{- end -}} diff --git a/charts/streaming-hub/templates/all/deployment.yaml b/charts/streaming-hub/templates/all/deployment.yaml new file mode 100644 index 00000000..af8c835d --- /dev/null +++ b/charts/streaming-hub/templates/all/deployment.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "all" }} +{{- include "streaming-hub.deployment" (dict "root" . "component" "all") }} +{{- end }} diff --git a/charts/streaming-hub/templates/all/hpa.yaml b/charts/streaming-hub/templates/all/hpa.yaml new file mode 100644 index 00000000..c9c16ffc --- /dev/null +++ b/charts/streaming-hub/templates/all/hpa.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "all") .Values.streamingHub.all.autoscaling.enabled }} +{{- include "streaming-hub.hpa" (dict "root" . "component" "all") }} +{{- end }} diff --git a/charts/streaming-hub/templates/all/pdb.yaml b/charts/streaming-hub/templates/all/pdb.yaml new file mode 100644 index 00000000..31a5a253 --- /dev/null +++ b/charts/streaming-hub/templates/all/pdb.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "all") .Values.streamingHub.all.pdb.enabled }} +{{- include "streaming-hub.pdb" (dict "root" . "component" "all") }} +{{- end }} diff --git a/charts/streaming-hub/templates/all/service.yaml b/charts/streaming-hub/templates/all/service.yaml new file mode 100644 index 00000000..a510b3bf --- /dev/null +++ b/charts/streaming-hub/templates/all/service.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "all" }} +{{- include "streaming-hub.service" (dict "root" . "component" "all") }} +{{- end }} diff --git a/charts/streaming-hub/templates/bootstrap-postgres.yaml b/charts/streaming-hub/templates/bootstrap-postgres.yaml new file mode 100644 index 00000000..7f8fd450 --- /dev/null +++ b/charts/streaming-hub/templates/bootstrap-postgres.yaml @@ -0,0 +1,154 @@ +{{- if .Values.global.externalPostgresDefinitions.enabled }} +{{/* +Bootstrap Job for an external/shared PostgreSQL host: creates the hub's ONE +database + role and grants privileges. streaming-hub owns a SINGLE database with +a tenant_id COLUMN (NOT per-tenant DB), so exactly one DB/role is provisioned. + +Default OFF. Whether dev-st uses this Job or a pre-provisioned managed PG is a +Phase 3 decision — the chart supports both. The created DB/role name is +configurable (defaults: db "streaming-hub", role "streaming-hub") and must match +the host/dbname/user encoded in STREAMING_HUB_POSTGRES_DSN. +*/}} +{{- $defs := .Values.global.externalPostgresDefinitions -}} +{{- $dbName := $defs.database | default "streaming-hub" -}} +{{- $roleName := $defs.role | default "streaming-hub" -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "streaming-hub.fullname" . }}-bootstrap-postgres + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "bootstrap") | nindent 4 }} +spec: + ttlSecondsAfterFinished: 300 + completions: 1 + parallelism: 1 + backoffLimit: 3 + template: + spec: + restartPolicy: Never + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + env: + - name: DB_HOST + value: {{ $defs.connection.host | quote }} + - name: DB_PORT + value: {{ $defs.connection.port | quote }} + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + echo "Checking $DB_HOST:$DB_PORT..."; + while ! nc -z "$DB_HOST" "$DB_PORT"; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for $DB_HOST:$DB_PORT after ${TIMEOUT}s"; + exit 1; + fi; + echo "$DB_HOST:$DB_PORT is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "$DB_HOST:$DB_PORT is ready!"; + containers: + - name: psql + image: postgres:17 + env: + - name: DB_HOST + value: {{ $defs.connection.host | quote }} + - name: DB_PORT + value: {{ $defs.connection.port | quote }} + - name: DB_NAME + value: {{ $dbName | quote }} + - name: DB_ROLE + value: {{ $roleName | quote }} + - name: DB_USER_ADMIN + {{- if $defs.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ $defs.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_USER_ADMIN + {{- else }} + value: {{ $defs.postgresAdminLogin.username | quote }} + {{- end }} + - name: DB_ADMIN_PASSWORD + {{- if $defs.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ $defs.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_ADMIN_PASSWORD + {{- else }} + value: {{ $defs.postgresAdminLogin.password | quote }} + {{- end }} + - name: DB_PASSWORD_HUB + {{- if $defs.hubCredentials.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ $defs.hubCredentials.useExistingSecret.name | quote }} + key: DB_PASSWORD_HUB + {{- else }} + value: {{ $defs.hubCredentials.password | quote }} + {{- end }} + - name: DB_DATABASE + value: postgres + command: + - /bin/sh + - -c + - | + set -euo pipefail + # Escape single quotes so values embedded in SQL string literals can't + # break the statement (a Vault-generated password legitimately may + # contain a ' — that would otherwise abort CREATE ROLE). + sql_lit() { printf "%s" "$1" | sed "s/'/''/g"; } + DB_NAME_LIT="$(sql_lit "$DB_NAME")" + DB_ROLE_LIT="$(sql_lit "$DB_ROLE")" + DB_PASSWORD_HUB_LIT="$(sql_lit "$DB_PASSWORD_HUB")" + echo "=== streaming-hub PostgreSQL Bootstrap ===" + echo "Host: $DB_HOST:$DB_PORT Database: $DB_NAME Role: $DB_ROLE" + echo "" + + echo "Checking existing PostgreSQL objects..." + DB_EXISTS=0 + ROLE_EXISTS=0 + + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname='${DB_NAME_LIT}'" | grep -q 1; then + DB_EXISTS=1 + fi + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname='${DB_ROLE_LIT}'" | grep -q 1; then + ROLE_EXISTS=1 + fi + + if [ "$DB_EXISTS" = "1" ] && [ "$ROLE_EXISTS" = "1" ]; then + echo "PostgreSQL bootstrap already complete (database '$DB_NAME' and role '$DB_ROLE' exist). Skipping creation." + else + # Create role if not exists + if [ "$ROLE_EXISTS" = "1" ]; then + echo "Role '$DB_ROLE' already exists. Skipping creation." + else + echo "Creating role '$DB_ROLE'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE \"$DB_ROLE\" LOGIN PASSWORD '${DB_PASSWORD_HUB_LIT}'" + fi + + # Create database if not exists + if [ "$DB_EXISTS" = "1" ]; then + echo "Database '$DB_NAME' already exists. Skipping creation." + else + echo "Creating database '$DB_NAME'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE \"$DB_NAME\" OWNER \"$DB_ROLE\"" + fi + fi + + # Privileges (safe to run repeatedly) + echo "Ensuring privileges and schema permissions..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE \"$DB_NAME\" TO \"$DB_ROLE\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_NAME" -c "GRANT ALL ON SCHEMA public TO \"$DB_ROLE\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_NAME" -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \"$DB_ROLE\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_NAME" -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \"$DB_ROLE\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO \"$DB_ROLE\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_NAME" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO \"$DB_ROLE\"" + + echo "" + echo "=== streaming-hub PostgreSQL Bootstrap completed successfully ===" +{{- end }} diff --git a/charts/streaming-hub/templates/configmap.yaml b/charts/streaming-hub/templates/configmap.yaml new file mode 100644 index 00000000..20b9c86e --- /dev/null +++ b/charts/streaming-hub/templates/configmap.yaml @@ -0,0 +1,23 @@ +{{/* +ONE shared ConfigMap — role-INVARIANT, non-sensitive env. Identical across all +roles, so it is NOT duplicated per role (DRY). The role-specific vars +(STREAMING_HUB_ROLE, the Postgres pool sizes) are deliberately ABSENT here — +they are injected as explicit per-Deployment env in templates//deployment.yaml +(see templates/_deployment.tpl), which wins over this envFrom layer. + +Ranged over .Values.streamingHub.common.configmap so operators can add/override +keys without editing this template. Every key in that map MUST exist verbatim in +streaming-hub/.env.reference (the env-parity cross-check enforces this); OTEL_* +keys are the documented exception (lib-observability vars, not LoadConfig vars). +*/}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "streaming-hub.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "all") | nindent 4 }} +data: + {{- range $key, $value := .Values.streamingHub.common.configmap }} + {{ $key }}: {{ $value | quote }} + {{- end }} diff --git a/charts/streaming-hub/templates/delivery/deployment.yaml b/charts/streaming-hub/templates/delivery/deployment.yaml new file mode 100644 index 00000000..537af777 --- /dev/null +++ b/charts/streaming-hub/templates/delivery/deployment.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "split" }} +{{- include "streaming-hub.deployment" (dict "root" . "component" "delivery") }} +{{- end }} diff --git a/charts/streaming-hub/templates/delivery/hpa.yaml b/charts/streaming-hub/templates/delivery/hpa.yaml new file mode 100644 index 00000000..36465e60 --- /dev/null +++ b/charts/streaming-hub/templates/delivery/hpa.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "split") .Values.streamingHub.delivery.autoscaling.enabled }} +{{- include "streaming-hub.hpa" (dict "root" . "component" "delivery") }} +{{- end }} diff --git a/charts/streaming-hub/templates/delivery/pdb.yaml b/charts/streaming-hub/templates/delivery/pdb.yaml new file mode 100644 index 00000000..3edd4c63 --- /dev/null +++ b/charts/streaming-hub/templates/delivery/pdb.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "split") .Values.streamingHub.delivery.pdb.enabled }} +{{- include "streaming-hub.pdb" (dict "root" . "component" "delivery") }} +{{- end }} diff --git a/charts/streaming-hub/templates/delivery/service.yaml b/charts/streaming-hub/templates/delivery/service.yaml new file mode 100644 index 00000000..2e274886 --- /dev/null +++ b/charts/streaming-hub/templates/delivery/service.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "split" }} +{{- include "streaming-hub.service" (dict "root" . "component" "delivery") }} +{{- end }} diff --git a/charts/streaming-hub/templates/ingest/deployment.yaml b/charts/streaming-hub/templates/ingest/deployment.yaml new file mode 100644 index 00000000..de840b89 --- /dev/null +++ b/charts/streaming-hub/templates/ingest/deployment.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "split" }} +{{- include "streaming-hub.deployment" (dict "root" . "component" "ingest") }} +{{- end }} diff --git a/charts/streaming-hub/templates/ingest/hpa.yaml b/charts/streaming-hub/templates/ingest/hpa.yaml new file mode 100644 index 00000000..19f26aa2 --- /dev/null +++ b/charts/streaming-hub/templates/ingest/hpa.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "split") .Values.streamingHub.ingest.autoscaling.enabled }} +{{- include "streaming-hub.hpa" (dict "root" . "component" "ingest") }} +{{- end }} diff --git a/charts/streaming-hub/templates/ingest/pdb.yaml b/charts/streaming-hub/templates/ingest/pdb.yaml new file mode 100644 index 00000000..0bb740ef --- /dev/null +++ b/charts/streaming-hub/templates/ingest/pdb.yaml @@ -0,0 +1,3 @@ +{{- if and (eq .Values.streamingHub.mode "split") .Values.streamingHub.ingest.pdb.enabled }} +{{- include "streaming-hub.pdb" (dict "root" . "component" "ingest") }} +{{- end }} diff --git a/charts/streaming-hub/templates/ingest/service.yaml b/charts/streaming-hub/templates/ingest/service.yaml new file mode 100644 index 00000000..995a9346 --- /dev/null +++ b/charts/streaming-hub/templates/ingest/service.yaml @@ -0,0 +1,3 @@ +{{- if eq .Values.streamingHub.mode "split" }} +{{- include "streaming-hub.service" (dict "root" . "component" "ingest") }} +{{- end }} diff --git a/charts/streaming-hub/templates/ingress.yaml b/charts/streaming-hub/templates/ingress.yaml new file mode 100644 index 00000000..96428703 --- /dev/null +++ b/charts/streaming-hub/templates/ingress.yaml @@ -0,0 +1,52 @@ +{{- if .Values.streamingHub.ingress.enabled }} +{{/* +Control-plane API ingress (default OFF; opt-in per env in gitops). +Backend Service is the active role's component Service: + - mode=all -> the `all` Service. + - mode=split -> the `ingest` Service (the control API is served on EVERY role, + so ingest is an arbitrary-but-stable default; override the + backend by editing this template if delivery is preferred). +*/}} +{{- $component := ternary "all" "ingest" (eq .Values.streamingHub.mode "all") -}} +{{- $svcName := include "streaming-hub.componentFullname" (dict "context" . "component" $component) -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "streaming-hub.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" $component) | nindent 4 }} + {{- with .Values.streamingHub.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.streamingHub.ingress.className }} + ingressClassName: {{ .Values.streamingHub.ingress.className }} + {{- end }} + {{- if .Values.streamingHub.ingress.tls }} + tls: + {{- range .Values.streamingHub.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.streamingHub.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ $svcName }} + port: + number: {{ $.Values.streamingHub.service.port }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/streaming-hub/templates/secrets.yaml b/charts/streaming-hub/templates/secrets.yaml new file mode 100644 index 00000000..5796648c --- /dev/null +++ b/charts/streaming-hub/templates/secrets.yaml @@ -0,0 +1,28 @@ +{{/* +ONE shared Opaque Secret — role-INVARIANT sensitive env. Identical across all +roles, so it is NOT duplicated per role. + +Rendered ONLY when NOT useExistingSecret. When useExistingSecret=true (the +gitops/Vault path) this emits nothing and the Deployments reference +existingSecretName instead — that branch is exercised by the chart and MUST stay +working. + +Empty values are SKIPPED so unset SaaS/dev keys never ship as blank Secret +entries. Values are base64-encoded into `data` (b64enc). +*/}} +{{- if not .Values.streamingHub.useExistingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "streaming-hub.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "all") | nindent 4 }} +type: Opaque +data: + {{- range $key, $value := .Values.streamingHub.secrets }} + {{- if $value }} + {{ $key }}: {{ $value | toString | b64enc | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/streaming-hub/templates/serviceaccount.yaml b/charts/streaming-hub/templates/serviceaccount.yaml new file mode 100644 index 00000000..cf4b7e79 --- /dev/null +++ b/charts/streaming-hub/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.streamingHub.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "streaming-hub.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "all") | nindent 4 }} + {{- with .Values.streamingHub.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/streaming-hub/values-template.yaml b/charts/streaming-hub/values-template.yaml new file mode 100644 index 00000000..ea5a27d9 --- /dev/null +++ b/charts/streaming-hub/values-template.yaml @@ -0,0 +1,50 @@ +# streaming-hub — operator override template. +# +# Copy this file, fill the blanks per environment, and pass it with `-f`. +# It documents only the keys an operator typically sets; every other key keeps +# the default from values.yaml. See README "Chart Contract" for the full +# secret/dependency/override contract. Secrets are blank here — provide them +# inline or via `useExistingSecret` + `existingSecretName`. + +streamingHub: + # Topology: `all` (one Deployment) or `split` (ingest + delivery). Never both + # — the roles compete for one Kafka consumer group. See README. + mode: all + + image: + tag: "" # defaults to the chart appVersion + + common: + configmap: + STREAMING_HUB_ENV: production # local | staging | production + STREAMING_HUB_LOG_LEVEL: info + STREAMING_HUB_KAFKA_BROKERS: "" # e.g. redpanda.dev-st.lerian.net:9092 + STREAMING_HUB_KAFKA_SCRAM_MECHANISM: "" # e.g. SCRAM-SHA-256 (empty = no SASL) + STREAMING_HUB_ALLOW_INSECURE_KAFKA: "false" + STREAMING_HUB_KEK_SOURCE: "" # env | aws-kms | ... + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_ADDRESS: "" + STREAMING_HUB_TENANT_ID: default + STREAMING_HUB_MULTI_TENANT_ENABLED: "false" + + secrets: + STREAMING_HUB_POSTGRES_DSN: "" # full Postgres DSN, credentials embedded + STREAMING_HUB_KAFKA_SCRAM_USERNAME: "" + STREAMING_HUB_KAFKA_SCRAM_PASSWORD: "" + STREAMING_HUB_KEK_REF: "" # KEK reference (KMS key id / ARN / ...) + # STREAMING_HUB_DEV_KEK: "" # dev only + # SaaS-only — required when MULTI_TENANT_ENABLED=true: + # STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY: "" + # STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD: "" + + useExistingSecret: false + existingSecretName: "" + + # Per-role sizing. Honor Σ(replicas × poolMaxOpenConns) ≤ Postgres max_connections. + all: + replicaCount: 1 + # mode: split uses these instead: + # ingest: + # replicaCount: 2 + # delivery: + # replicaCount: 2 diff --git a/charts/streaming-hub/values.schema.json b/charts/streaming-hub/values.schema.json new file mode 100644 index 00000000..7d0c17a0 --- /dev/null +++ b/charts/streaming-hub/values.schema.json @@ -0,0 +1,43 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "additionalProperties": true, + "properties": { + "nameOverride": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "namespaceOverride": { + "type": "string" + }, + "global": { + "type": "object", + "additionalProperties": true + }, + "streamingHub": { + "type": "object", + "additionalProperties": true, + "properties": { + "mode": { + "type": "string", + "enum": ["all", "split"], + "description": "Topology switch. 'all' = one Deployment (role=all); 'split' = ingest + delivery. NEVER run both against one Kafka cluster (double-consume)." + }, + "common": { + "type": "object", + "additionalProperties": true, + "properties": { + "configmap": { + "type": "object" + } + } + }, + "secrets": { + "type": "object" + } + } + } + } +} diff --git a/charts/streaming-hub/values.yaml b/charts/streaming-hub/values.yaml new file mode 100644 index 00000000..5c3b40ce --- /dev/null +++ b/charts/streaming-hub/values.yaml @@ -0,0 +1,404 @@ +# Default values for streaming-hub. +# This is a YAML-formatted file. +# +# streaming-hub consumes lib-streaming CloudEvents from Kafka/Redpanda and fans +# them out to per-tenant subscribers. ONE image, ONE binary, RUNTIME-selected +# into a role via STREAMING_HUB_ROLE. This chart exposes that via a single +# `mode` switch (see streamingHub.mode below). +# +# External infra (provisioned OUTSIDE this chart): Kafka/Redpanda and PostgreSQL. +# There are NO database/broker/OTEL subcharts (deliberate — see Chart.yaml). + +# -- Override the chart name component of resource names. +nameOverride: "" +# -- Override the fully-qualified release name (wins verbatim). +fullnameOverride: "" +# -- Override the namespace (defaults to .Release.Namespace). +namespaceOverride: "" + +global: + # -- Bootstrap Job for an external/shared PostgreSQL: creates the hub's ONE + # database + role and grants privileges. The hub owns a SINGLE database with + # a tenant_id column (NOT per-tenant DB). Default OFF — dev-st may instead + # point STREAMING_HUB_POSTGRES_DSN at a pre-provisioned managed host. + externalPostgresDefinitions: + # -- Enable or disable the PostgreSQL bootstrap Job. + enabled: false + # -- Name of the database the Job creates (must match the DSN dbname). + database: "streaming-hub" + # -- Name of the login role the Job creates (must match the DSN user). + role: "streaming-hub" + # -- PostgreSQL connection settings for the bootstrap Job. + connection: + # -- PostgreSQL host. + host: "streaming-hub-postgresql" + # -- PostgreSQL port. + port: "5432" + # -- Admin credentials used by the Job to create the DB/role. + postgresAdminLogin: + useExistingSecret: + # -- Existing secret with DB_USER_ADMIN and DB_ADMIN_PASSWORD keys. + name: "" + # -- Admin username (ignored if useExistingSecret.name is set). + username: "postgres" + # -- Admin password (ignored if useExistingSecret.name is set). + password: "" + # -- Credentials for the hub role created by the Job. + hubCredentials: + useExistingSecret: + # -- Existing secret with DB_PASSWORD_HUB key. + name: "" + # -- Password for the hub role (ignored if useExistingSecret.name is set). + password: "" + +# ============================================================================= +# streamingHub — the single root key for everything the hub owns. +# ============================================================================= +streamingHub: + # -- Deployment topology switch. One of: all | split. + # all (default) -> ONE Deployment with STREAMING_HUB_ROLE=all (ingest + + # delivery co-resident; the dev-st target). Byte-equivalent to the + # historical single binary. + # split -> TWO Deployments: ingest (role=ingest) and delivery + # (role=delivery), each scaled independently. + # + # !!! NEVER run both an `all` Deployment AND ingest/delivery against the same + # Kafka cluster: they join ONE consumer group and DOUBLE-CONSUME every event. + # The mode switch enforces either/or — do not work around it. !!! + # The values.schema.json constrains this to the enum ["all","split"]. + mode: all + + image: + # -- Container image repository. + repository: ghcr.io/lerianstudio/streaming-hub + # -- Image pull policy. + pullPolicy: IfNotPresent + # -- Image tag. Empty falls back to Chart.appVersion via the defaultTag helper. + tag: "" + + # -- Secrets for pulling the image from a private registry. + imagePullSecrets: + - name: ghcr-credential + + # -- Number of old ReplicaSets to retain for rollback. + revisionHistoryLimit: 10 + + # -- Annotations applied to every Deployment resource. + annotations: {} + # -- Annotations applied to every pod. + podAnnotations: {} + + # -- Deployment update strategy (shared by all roles). + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + + # -- Pod-level security context. Empty by default (the hub needs no fsGroup). + podSecurityContext: {} + + # -- Container-level security context (distroless:nonroot, uid/gid 65532). + securityContext: + # -- Group ID for the process inside the container. + runAsGroup: 65532 + # -- User ID for the process inside the container. + runAsUser: 65532 + # -- Never run as root. + runAsNonRoot: true + capabilities: + drop: + - ALL + # -- Read-only root filesystem (the image carries no writable state). + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + + service: + # -- Service type. MUST be ClusterIP (Lerian convention; Ingress fronts external). + type: ClusterIP + # -- Control-plane HTTP port (the hub listens on :8080; see Dockerfile EXPOSE). + port: 8080 + # -- Annotations for every Service. + annotations: {} + + ingress: + # -- Enable or disable the control-plane Ingress (opt-in per env in gitops). + enabled: false + # -- Ingress class name. + className: "nginx" + # -- Additional ingress annotations. + annotations: {} + # -- Hosts (default empty; the control API is served on every role). + hosts: [] + # - host: "streaming-hub.lerian.net" + # paths: + # - path: / + # pathType: Prefix + # -- TLS configuration. + tls: [] + # - secretName: streaming-hub-tls + # hosts: + # - streaming-hub.lerian.net + + serviceAccount: + # -- Whether a ServiceAccount is created. + create: true + # -- Annotations for the ServiceAccount (e.g. AWS IRSA role-arn). + annotations: {} + # -- ServiceAccount name. Empty defaults to the chart fullname. + name: "" + # -- Mount the SA API token into pods. Default false — the hub makes no + # in-cluster Kubernetes API calls. (IRSA's projected token is injected by + # the EKS webhook independently of this, so it stays functional.) + automountServiceAccountToken: false + + # -- Graceful-shutdown window. Defaults to the hub's derived SIGTERM drain + # ceiling (80s) at STREAMING_HUB_SHUTDOWN_TIMEOUT=30s + + # STREAMING_HUB_PRE_STOP_DRAIN_TIMEOUT=5s: 30s HTTP + 5s consumer-commit + + # 30s dispatcher + 10s slack = 75s, + 5s pre-stop = 80s (see .env.reference). + # If you tune those knobs up, recompute and keep this AT OR ABOVE the new + # ceiling so the orchestrator never SIGKILLs a still-draining replica. NO + # preStop hook is used — the hub self-drains on SIGTERM (PID 1 receives it + # directly; exec-form ENTRYPOINT). + terminationGracePeriodSeconds: 80 + + # -- Liveness probe tuning (GET /healthz on the http port; stays 200 during drain). + livenessProbe: + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 3 + # -- Readiness probe tuning (GET /readyz; flips NotReady first on SIGTERM). + readinessProbe: + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + successThreshold: 1 + failureThreshold: 3 + + # -- Shared default scheduling (per-role blocks may override). + nodeSelector: {} + tolerations: {} + affinity: {} + + # -- Extra non-sensitive env vars injected on every Deployment (list of {name,value}). + extraEnvVars: [] + + # =========================================================================== + # telemetry — CHART-LEVEL OTEL wiring toggle (NOT an app env var; never shipped + # to the container). When enabled, each Deployment injects HOST_IP via the + # downward API and sets OTEL_EXPORTER_OTLP_ENDPOINT=$(HOST_IP):4317 (node-local + # DaemonSet collector pattern; see templates/_deployment.tpl). The hub's own + # Prometheus exposition is governed by STREAMING_HUB_METRICS_ENABLED in the + # ConfigMap above — a separate, app-read knob. + # =========================================================================== + telemetry: + # -- Inject the per-pod OTLP endpoint override (HOST_IP downward API). + enabled: false + + # =========================================================================== + # Secret sourcing. + # useExistingSecret=false -> the chart renders templates/secret.yaml (inline). + # useExistingSecret=true -> NO Secret is rendered; Deployments reference + # existingSecretName (the gitops/Vault path). + # =========================================================================== + useExistingSecret: false + existingSecretName: "" + + # =========================================================================== + # common.configmap — role-INVARIANT, NON-SENSITIVE env (one shared ConfigMap). + # Every key MUST exist verbatim in streaming-hub/.env.reference, EXCEPT the + # OTEL_* keys (lib-observability vars, not read by LoadConfig). + # + # DELIBERATELY ABSENT (injected per-Deployment, see the all/ingest/delivery + # blocks below): STREAMING_HUB_ROLE, STREAMING_HUB_POSTGRES_MAX_OPEN_CONNS, + # STREAMING_HUB_POSTGRES_MAX_IDLE_CONNS. + # =========================================================================== + common: + configmap: + # --- core --- + # Deployment environment: local | staging | production. + STREAMING_HUB_ENV: "production" + STREAMING_HUB_LOG_LEVEL: "info" + STREAMING_HUB_HTTP_LISTEN_ADDR: ":8080" + STREAMING_HUB_METRICS_ENABLED: "true" + + # --- kafka / redpanda (external) --- + STREAMING_HUB_KAFKA_BROKERS: "localhost:19092" + STREAMING_HUB_KAFKA_SCRAM_MECHANISM: "" + # Plaintext Kafka opt-in. MUST stay "false" for staging/production + # (rejected at boot when STREAMING_HUB_ENV=production). + STREAMING_HUB_ALLOW_INSECURE_KAFKA: "false" + + # --- crypto / KEK (the material itself is a Secret) --- + # env | secretsmanager. KEK material arrives via the var named by KEK_REF. + STREAMING_HUB_KEK_SOURCE: "env" + + # --- auth (lib-auth / plugin-auth JWT; PLUGIN_AUTH_ prefix, NOT STREAMING_HUB_) --- + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_ADDRESS: "http://plugin-access-manager-auth:4000" + + # --- tenancy (F4) --- + # default = BYOC single-tenant. A non-default value quarantines all + # other ce-tenantid events (zero-delivery risk) — confirm the producer. + STREAMING_HUB_TENANT_ID: "default" + # SaaS roster off by default (BYOC). When "true" the SaaS-only knobs below + # become required-when-SaaS (and several SECRET counterparts in secrets:). + STREAMING_HUB_MULTI_TENANT_ENABLED: "false" + STREAMING_HUB_TENANT_MANAGER_URL: "" + STREAMING_HUB_MULTI_TENANT_ALLOW_INSECURE_TM: "false" + STREAMING_HUB_MULTI_TENANT_TM_STALENESS_THRESHOLD: "12h" + STREAMING_HUB_MULTI_TENANT_LISTENER_STALENESS_THRESHOLD: "12h" + STREAMING_HUB_MULTI_TENANT_RECONCILE_INTERVAL: "6h" + STREAMING_HUB_MULTI_TENANT_CACHE_TTL: "12h" + STREAMING_HUB_TENANT_MANAGER_CB_THRESHOLD: "0" + STREAMING_HUB_TENANT_MANAGER_CB_TIMEOUT: "30s" + STREAMING_HUB_MULTI_TENANT_REDIS_HOST: "" + STREAMING_HUB_MULTI_TENANT_REDIS_PORT: "" + STREAMING_HUB_MULTI_TENANT_REDIS_TLS: "false" + STREAMING_HUB_MULTI_TENANT_REDIS_CA_CERT: "" + # lib-commons env name (NOT STREAMING_HUB_-prefixed). Required-in-SaaS: + # staging | production. Inert under BYOC. Leave empty unless SaaS. + ENVIRONMENT_NAME: "" + + # --- reconciler (topic-drift detection; dark-ship, defaults on) --- + STREAMING_HUB_RECONCILER_ENABLED: "true" + STREAMING_HUB_RECONCILER_INTERVAL: "300" + + # --- partition lifecycle cron --- + STREAMING_HUB_PARTITION_CRON_INTERVAL: "6h" + STREAMING_HUB_PARTITION_FUTURE_BUFFER_WEEKS: "4" + STREAMING_HUB_PARTITION_RETENTION_ENABLED: "false" + STREAMING_HUB_PARTITION_RETENTION_HORIZON: "0" + + # --- DLQ visibility --- + STREAMING_HUB_DLQ_RETENTION: "168h" + STREAMING_HUB_DLQ_PRUNE_INTERVAL: "1h" + + # --- lifecycle / drain (kept coherent with terminationGracePeriodSeconds) --- + STREAMING_HUB_SHUTDOWN_TIMEOUT: "30s" + STREAMING_HUB_PRE_STOP_DRAIN_TIMEOUT: "5s" + + # --- observability (OTEL_* are lib-observability vars, NOT in .env.reference) --- + # OTEL_EXPORTER_OTLP_ENDPOINT is overridden per-pod with $(HOST_IP):4317 via + # the downward API when streamingHub.telemetry.enabled=true (a CHART-level + # toggle, see above — not an app env var; see templates/_deployment.tpl). + OTEL_LIBRARY_NAME: "github.com/LerianStudio/streaming-hub" + OTEL_RESOURCE_SERVICE_NAME: "streaming-hub" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + + # =========================================================================== + # secrets — role-INVARIANT, SENSITIVE env (one shared Secret). All default "". + # Empty values are SKIPPED at render so unset SaaS/dev keys never ship blank. + # In gitops these come from Vault via useExistingSecret=true (this map is then + # unused). Every key exists verbatim in streaming-hub/.env.reference. + # =========================================================================== + secrets: + # Single hub-owned Postgres DSN (password embedded -> whole DSN is secret). + STREAMING_HUB_POSTGRES_DSN: "" + # SASL/SCRAM credentials (required when KAFKA_SCRAM_MECHANISM is set). + STREAMING_HUB_KAFKA_SCRAM_USERNAME: "" + STREAMING_HUB_KAFKA_SCRAM_PASSWORD: "" + # KEK reference: the NAME of the env var holding the KEK material. + STREAMING_HUB_KEK_REF: "" + # DEV-ONLY KEK material holder (local BYOC). Leave empty in real deploys. + STREAMING_HUB_DEV_KEK: "" + # SaaS tenant-manager X-API-Key (required-when-SaaS). + STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY: "" + # SaaS tenant pub/sub Redis AUTH password (optional even in SaaS). + STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD: "" + + # =========================================================================== + # Per-role blocks. Each carries replicaCount, resources, autoscaling, pdb, and + # the Postgres pool sizing injected as explicit per-Deployment env. + # + # !!! CONNECTION-BUDGET INVARIANT (the load-bearing operational rule) !!! + # Σ over all running pods of (replicas × poolMaxOpenConns) + headroom + # ≤ PostgreSQL max_connections. + # Under HPA, use maxReplicas (not replicaCount) in the sum. Every open + # connection on every pod draws from the ONE shared Postgres budget. + # NEVER run mode=all alongside split — see streamingHub.mode. + # Pool defaults (from .env.reference): all 25/12, ingest 8/4, delivery 16/10. + # =========================================================================== + all: + replicaCount: 1 + poolMaxOpenConns: 25 + poolMaxIdleConns: 12 + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + autoscaling: + # -- HPA off by default; replicaCount governs. maxReplicas × poolMaxOpenConns + # must respect the connection-budget invariant above. + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + enabled: false + minAvailable: 1 + annotations: {} + nodeSelector: {} + tolerations: {} + affinity: {} + + ingest: + replicaCount: 1 + poolMaxOpenConns: 8 + poolMaxIdleConns: 4 + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + autoscaling: + enabled: false + minReplicas: 1 + # -- maxReplicas × 8 (poolMaxOpenConns) must fit the connection budget. + maxReplicas: 4 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + enabled: false + minAvailable: 1 + annotations: {} + nodeSelector: {} + tolerations: {} + affinity: {} + + delivery: + replicaCount: 1 + poolMaxOpenConns: 16 + poolMaxIdleConns: 10 + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + autoscaling: + enabled: false + minReplicas: 1 + # -- maxReplicas × 16 (poolMaxOpenConns) must fit the connection budget. + maxReplicas: 4 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + enabled: false + minAvailable: 1 + annotations: {} + nodeSelector: {} + tolerations: {} + affinity: {} From 9fa68639cc4dc03eeb0c8d372433519b5362eb40 Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Wed, 24 Jun 2026 10:10:37 -0300 Subject: [PATCH 002/113] fix(charts): escape dynamic values in bootstrap-postgres SQL (#1570) Bootstrap Jobs embedded shell variables directly in single-quoted SQL string literals (PASSWORD '$VAR', datname='$VAR'), so a value containing a single quote would break CREATE ROLE / the existence checks. Switch to psql's native parameter quoting (-v name="$VAR" ... :'name'), matching the pattern plugin-bc-correios / plugin-br-bank-transfer already use. - go-boilerplate-ddd, matcher, midaz, tracer, underwriter: CREATE ROLE password - plugin-br-payments, plugin-br-pix-switch: WHERE-clause identifier literals plugin-bc-correios / plugin-br-bank-transfer already safe (untouched). streaming-hub fixed separately in LerianStudio/helm#1569. Claude-Session: https://claude.ai/code/session_016Bv8y35GWdpgNdhGVs28JZ --- charts/go-boilerplate-ddd/templates/bootstrap-postgres.yaml | 2 +- charts/matcher/templates/bootstrap-postgres.yaml | 2 +- charts/midaz/templates/bootstrap-postgres.yaml | 2 +- charts/plugin-br-payments/templates/bootstrap-postgres.yaml | 4 ++-- charts/plugin-br-pix-switch/templates/bootstrap-postgres.yaml | 4 ++-- charts/tracer/templates/bootstrap-postgres.yaml | 2 +- charts/underwriter/templates/bootstrap-postgres.yaml | 2 +- 7 files changed, 9 insertions(+), 9 deletions(-) diff --git a/charts/go-boilerplate-ddd/templates/bootstrap-postgres.yaml b/charts/go-boilerplate-ddd/templates/bootstrap-postgres.yaml index f097faa6..2903aa9d 100644 --- a/charts/go-boilerplate-ddd/templates/bootstrap-postgres.yaml +++ b/charts/go-boilerplate-ddd/templates/bootstrap-postgres.yaml @@ -104,7 +104,7 @@ spec: echo "Role 'go-boilerplate-ddd' already exists. Skipping creation." else echo "Creating role 'go-boilerplate-ddd'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE \"go-boilerplate-ddd\" LOGIN PASSWORD '$DB_PASSWORD_BOILERPLATE'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_BOILERPLATE" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE \"go-boilerplate-ddd\" LOGIN PASSWORD :'pw'" fi # Create database if not exists diff --git a/charts/matcher/templates/bootstrap-postgres.yaml b/charts/matcher/templates/bootstrap-postgres.yaml index 5a800c56..c5998195 100644 --- a/charts/matcher/templates/bootstrap-postgres.yaml +++ b/charts/matcher/templates/bootstrap-postgres.yaml @@ -104,7 +104,7 @@ spec: echo "Role 'matcher' already exists. Skipping creation." else echo "Creating role 'matcher'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE matcher LOGIN PASSWORD '$DB_PASSWORD_MATCHER'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_MATCHER" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE matcher LOGIN PASSWORD :'pw'" fi # Create database if not exists diff --git a/charts/midaz/templates/bootstrap-postgres.yaml b/charts/midaz/templates/bootstrap-postgres.yaml index c91de15f..a821c998 100644 --- a/charts/midaz/templates/bootstrap-postgres.yaml +++ b/charts/midaz/templates/bootstrap-postgres.yaml @@ -119,7 +119,7 @@ spec: echo "Role 'midaz' already exists. Skipping creation." else echo "Creating role 'midaz'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE midaz LOGIN PASSWORD '$DB_PASSWORD_MIDAZ'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_MIDAZ" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE midaz LOGIN PASSWORD :'pw'" fi # Privileges (safe to run repeatedly) diff --git a/charts/plugin-br-payments/templates/bootstrap-postgres.yaml b/charts/plugin-br-payments/templates/bootstrap-postgres.yaml index 0d85342e..b257903d 100644 --- a/charts/plugin-br-payments/templates/bootstrap-postgres.yaml +++ b/charts/plugin-br-payments/templates/bootstrap-postgres.yaml @@ -94,10 +94,10 @@ spec: DB_EXISTS=0 ROLE_EXISTS=0 - if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname='$APP_DB'" | grep -q 1; then + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -v db="$APP_DB" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname=:'db'" | grep -q 1; then DB_EXISTS=1 fi - if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname='$APP_ROLE'" | grep -q 1; then + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -v role="$APP_ROLE" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname=:'role'" | grep -q 1; then ROLE_EXISTS=1 fi diff --git a/charts/plugin-br-pix-switch/templates/bootstrap-postgres.yaml b/charts/plugin-br-pix-switch/templates/bootstrap-postgres.yaml index 9d22b8ad..6b534d68 100644 --- a/charts/plugin-br-pix-switch/templates/bootstrap-postgres.yaml +++ b/charts/plugin-br-pix-switch/templates/bootstrap-postgres.yaml @@ -105,10 +105,10 @@ spec: ROLE_EXISTS=0 DB_EXISTS=0 - if PGPASSWORD="${DB_ADMIN_PASSWORD}" psql -At -v ON_ERROR_STOP=1 -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER_ADMIN}" -d "${DB_DATABASE}" -c "SELECT 1 FROM pg_roles WHERE rolname='${DB_ROLE}'" | grep -q 1; then + if PGPASSWORD="${DB_ADMIN_PASSWORD}" psql -At -v ON_ERROR_STOP=1 -v role="${DB_ROLE}" -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER_ADMIN}" -d "${DB_DATABASE}" -c "SELECT 1 FROM pg_roles WHERE rolname=:'role'" | grep -q 1; then ROLE_EXISTS=1 fi - if PGPASSWORD="${DB_ADMIN_PASSWORD}" psql -At -v ON_ERROR_STOP=1 -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER_ADMIN}" -d "${DB_DATABASE}" -c "SELECT 1 FROM pg_database WHERE datname='${DB_NAME}'" | grep -q 1; then + if PGPASSWORD="${DB_ADMIN_PASSWORD}" psql -At -v ON_ERROR_STOP=1 -v db="${DB_NAME}" -h "${DB_HOST}" -p "${DB_PORT}" -U "${DB_USER_ADMIN}" -d "${DB_DATABASE}" -c "SELECT 1 FROM pg_database WHERE datname=:'db'" | grep -q 1; then DB_EXISTS=1 fi diff --git a/charts/tracer/templates/bootstrap-postgres.yaml b/charts/tracer/templates/bootstrap-postgres.yaml index e9dac46e..391f3091 100644 --- a/charts/tracer/templates/bootstrap-postgres.yaml +++ b/charts/tracer/templates/bootstrap-postgres.yaml @@ -104,7 +104,7 @@ spec: echo "Role 'tracer' already exists. Skipping creation." else echo "Creating role 'tracer'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE tracer LOGIN PASSWORD '$DB_PASSWORD_TRACER'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_TRACER" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE tracer LOGIN PASSWORD :'pw'" fi # Create database if not exists diff --git a/charts/underwriter/templates/bootstrap-postgres.yaml b/charts/underwriter/templates/bootstrap-postgres.yaml index 281925f1..0a3173ac 100644 --- a/charts/underwriter/templates/bootstrap-postgres.yaml +++ b/charts/underwriter/templates/bootstrap-postgres.yaml @@ -104,7 +104,7 @@ spec: echo "Role 'underwriter' already exists. Skipping creation." else echo "Creating role 'underwriter'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE underwriter LOGIN PASSWORD '$DB_PASSWORD_UNDERWRITER'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_UNDERWRITER" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE underwriter LOGIN PASSWORD :'pw'" fi # Create database if not exists From 19d26a560edc522017fd1f2cd2fdf5acb98b70d3 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:11:55 +0000 Subject: [PATCH 003/113] chore(release): 2.2.0-beta.2 ## (2026-06-24) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) ### Bug Fixes * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/go-boilerplate-ddd/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7ca69c98..9c33cbd5 100644 --- a/README.md +++ b/README.md @@ -249,7 +249,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `2.2.0-beta.1` | 1.0.0 | +| `2.2.0-beta.2` | 1.0.0 | ----------------- ### Notifications diff --git a/charts/go-boilerplate-ddd/Chart.yaml b/charts/go-boilerplate-ddd/Chart.yaml index 4d176f45..225de493 100644 --- a/charts/go-boilerplate-ddd/Chart.yaml +++ b/charts/go-boilerplate-ddd/Chart.yaml @@ -12,7 +12,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 2.2.0-beta.1 +version: 2.2.0-beta.2 deprecated: true appVersion: "1.0.0" keywords: From 9028a86d67093f9fb3a867631edcd7dbae5d0472 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:13:26 +0000 Subject: [PATCH 004/113] chore(release): 3.1.0-beta.1 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/matcher/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9c33cbd5..cbf0dedf 100644 --- a/README.md +++ b/README.md @@ -178,7 +178,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Matcher Version | | :---: | :---: | -| `3.0.0` | 1.0.0 | +| `3.1.0-beta.1` | 1.0.0 | ### Flowker diff --git a/charts/matcher/Chart.yaml b/charts/matcher/Chart.yaml index 74e8be5e..387682dc 100644 --- a/charts/matcher/Chart.yaml +++ b/charts/matcher/Chart.yaml @@ -16,7 +16,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.0.0 +version: 3.1.0-beta.1 appVersion: "1.0.0" From d293051006a456208a89b1de4a1a8e0237afc093 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:15:07 +0000 Subject: [PATCH 005/113] chore(release): 8.5.0-beta.1 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/midaz/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index cbf0dedf..7ae666f9 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Ledger Version | CRM Version | | :---: | :---: | :---: | -| `8.4.0` | 3.7.7 | 3.7.6 | +| `8.5.0-beta.1` | 3.7.7 | 3.7.6 | ----------------- ### Plugin Access Manager Helm Chart diff --git a/charts/midaz/Chart.yaml b/charts/midaz/Chart.yaml index a0e83408..80720b0a 100644 --- a/charts/midaz/Chart.yaml +++ b/charts/midaz/Chart.yaml @@ -14,7 +14,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to he chart and its templates, including the app version. -version: 8.4.0 +version: 8.5.0-beta.1 # This is the version number of the application being deployed. appVersion: "3.7.7" # A list of keywords about the chart. This helps others discover the chart. From ec52d39ada3fd06d572ce4bc028b380812c7ec42 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:16:35 +0000 Subject: [PATCH 006/113] chore(release): 1.1.0-beta.4 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) ### Bug Fixes * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/plugin-br-payments/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7ae666f9..922c4bc7 100644 --- a/README.md +++ b/README.md @@ -128,7 +128,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.1.0-beta.3` | 1.0.0-beta.9 | +| `1.1.0-beta.4` | 1.0.0-beta.9 | ----------------- ### Plugin BR Payments Fakebtg diff --git a/charts/plugin-br-payments/Chart.yaml b/charts/plugin-br-payments/Chart.yaml index 19fe58c6..d47cced8 100644 --- a/charts/plugin-br-payments/Chart.yaml +++ b/charts/plugin-br-payments/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.1.0-beta.3 +version: 1.1.0-beta.4 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.9" From d06f4aa6d9d10f5830b723f1b205045905200175 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:17:55 +0000 Subject: [PATCH 007/113] chore(release): 2.1.0-beta.1 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/plugin-br-pix-switch/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 922c4bc7..844f578e 100644 --- a/README.md +++ b/README.md @@ -103,7 +103,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `2.0.0` | 1.0.0-beta.1 | +| `2.1.0-beta.1` | 1.0.0-beta.1 | ----------------- ### Plugin BR Pix Indirect BTG diff --git a/charts/plugin-br-pix-switch/Chart.yaml b/charts/plugin-br-pix-switch/Chart.yaml index 956e74fc..f601e0e4 100644 --- a/charts/plugin-br-pix-switch/Chart.yaml +++ b/charts/plugin-br-pix-switch/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 2.0.0 +version: 2.1.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.101" From 2777c8a1d645e599e4df6b932164d46632c5bbc7 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:18:53 +0000 Subject: [PATCH 008/113] chore(release): 2.2.0-beta.1 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/tracer/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 844f578e..c02ba11f 100644 --- a/README.md +++ b/README.md @@ -203,7 +203,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Tracer Version | | :---: | :---: | -| `2.1.0` | 1.0.0 | +| `2.2.0-beta.1` | 1.0.0 | ----------------- ### Otel Collector Lerian diff --git a/charts/tracer/Chart.yaml b/charts/tracer/Chart.yaml index 1f04d6c9..3b5b60ec 100644 --- a/charts/tracer/Chart.yaml +++ b/charts/tracer/Chart.yaml @@ -17,7 +17,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 2.1.0 +version: 2.2.0-beta.1 appVersion: "1.0.0" From 2afadf8c0c35e4b769cdf6abd320f2b0adc625a4 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:20:24 +0000 Subject: [PATCH 009/113] chore(release): 3.1.0-beta.1 ## (2026-06-24) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) --- README.md | 2 +- charts/underwriter/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index c02ba11f..f095eb5d 100644 --- a/README.md +++ b/README.md @@ -165,7 +165,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Underwriter Version | | :---: | :---: | -| `3.0.0` | 1.0.0 | +| `3.1.0-beta.1` | 1.0.0 | ----------------- ### Matcher diff --git a/charts/underwriter/Chart.yaml b/charts/underwriter/Chart.yaml index b7cae73a..c275bc71 100644 --- a/charts/underwriter/Chart.yaml +++ b/charts/underwriter/Chart.yaml @@ -17,7 +17,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.0.0 +version: 3.1.0-beta.1 appVersion: "1.0.0" From 1f6a37519a475f6b54cf51ea6873e6ceeb553a04 Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Wed, 24 Jun 2026 10:46:36 -0300 Subject: [PATCH 010/113] fix(charts): register streaming-hub in release README + add install docs (#1571) MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The post-merge release of streaming-hub (#1569) failed: the update-chart-version-readme release step requires a per-chart section in the root README version matrix, which streaming-hub lacked, so the publish job aborted before pushing the OCI artifact. - README.md: add the "### Streaming Hub" version-matrix section. - charts/streaming-hub/README.md: add Installing/Uninstalling sections (matching sibling charts) — also the charts/streaming-hub/ change that re-triggers the release matrix, since get-changed-paths filters to charts/. Verified by running the exact failing step locally (update-chart-version-readme --chart streaming-hub --version 1.0.0-beta.1): section + table found, Chart Version updated, exit 0. Claude-Session: https://claude.ai/code/session_016Bv8y35GWdpgNdhGVs28JZ --- README.md | 11 +++++++++++ charts/streaming-hub/README.md | 22 ++++++++++++++++++++++ 2 files changed, 33 insertions(+) diff --git a/README.md b/README.md index f095eb5d..cd95cf32 100644 --- a/README.md +++ b/README.md @@ -262,3 +262,14 @@ For implementation and configuration details, see the [README](https://charts.le | :---: | :---: | | `1.0.0-beta.4` | 0.1.0 | ----------------- + +### Streaming Hub + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/streaming-hub). + +#### Application Version Mapping + +| Chart Version | App Version | +| :---: | :---: | +| `1.0.0-beta.1` | 1.0.0 | +----------------- diff --git a/charts/streaming-hub/README.md b/charts/streaming-hub/README.md index 606b3ddc..473d4bb7 100644 --- a/charts/streaming-hub/README.md +++ b/charts/streaming-hub/README.md @@ -21,6 +21,28 @@ infra, and OTEL is env-wired (see [External dependencies](#external-dependencies --- +## Installing the Chart + +```bash +helm install streaming-hub oci://registry-1.docker.io/lerianstudio/streaming-hub-helm --version -n streaming-hub --create-namespace +``` + +With a custom values file: + +```bash +helm install streaming-hub oci://registry-1.docker.io/lerianstudio/streaming-hub-helm --version -n streaming-hub -f my-values.yaml +``` + +The chart is mirrored to `oci://ghcr.io/lerianstudio/streaming-hub-helm` as well. + +## Uninstalling the Chart + +```bash +helm uninstall streaming-hub -n streaming-hub +``` + +--- + ## The `mode` switch (read this first) `streamingHub.mode` decides the topology. It is an **either/or**: From e6e54dedd4d7b66add52e11647726cb7eb6e22af Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 13:49:42 +0000 Subject: [PATCH 011/113] chore(release): 1.0.0-beta.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## (2026-06-24) ### ⚠ BREAKING CHANGES * **plugin-br-payments:** any values overlay using the previous keys (app.configmap.PROVIDER_*, app.secrets.PROVIDER_*) must be updated in the same change set that pins to 1.0.0-beta.2 or later. The follow-up gitops PR in midaz-firmino-gitops (firmino/dev/plugin-br-payments/values.yaml) is the only known consumer today. * the onboarding and transaction services have been consolidated into the ledger service. All Kubernetes resources (Deployment, Service, ConfigMap, Secret, Ingress, HPA, PDB, ServiceAccount) for both services have been removed from the chart. If you are already using the ledger service, no action is required. Migration (only if you were using onboarding or transaction services): - Remove and blocks from your values overrides - Ensure is set - All configuration is now managed under Also adds missing env vars to ledger configmap/secrets (swagger, multi-tenant, overdraft events, balance sync worker) * **plugin-access-manager:** Values path changed from 'auth.backend.migrations.image' (string) to 'auth.backend.migrations.image.repository' + '.tag' (object). Same for 'auth.initUser.image' and 'auth.initUser.imagePullPolicy'. Existing values overrides using the old string format will need updating. * **midaz:** Ledger service is now enabled by default, replacing the separate onboarding and transaction services. - ledger.enabled now defaults to true - onboarding and transaction services are automatically disabled when ledger is enabled - Existing deployments using onboarding/transaction need to explicitly set ledger.enabled=false to maintain current behavior Migration guide: docs/UPGRADE-5.0.md * **rabbitmq:** Default Rabbitmq no longer uses the bitnami chart. Persistent volume claims from the bitnami Statefulset may not be reused automatically * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **valkey:** Valkey no longer uses StatefulSet. Persistent volume claims from StatefulSet will not be reused automatically. * feat!(midaz): remove onboarding and transaction services from midaz chart ([41e88df](https://github.com/LerianStudio/helm/commit/41e88df0368450368cea9a001129d3d6d0f8bd02)) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **values:** add app new version and reference default config ([b972952](https://github.com/LerianStudio/helm/commit/b97295261b87645884b197bbbf8aeea8dd78e452)) * **values:** add app new version and reference default secret ([ef8069c](https://github.com/LerianStudio/helm/commit/ef8069c403b3e7878571ddb3b92ee6f8be2f251f)) * **plugin-fees:** add APPLICATION_NAME, MULTI_TENANT_TIMEOUT, MULTI_TENANT_CACHE_TTL_SEC ([a7b6199](https://github.com/LerianStudio/helm/commit/a7b6199c800795da1300c47fd31412dd3f3b9853)) * **chart:** add auth backend helpers functions ([7248963](https://github.com/LerianStudio/helm/commit/72489636dfd8d57191e4d61da0369d6267b277df)) * **chart:** add auth backend templates ([57fb163](https://github.com/LerianStudio/helm/commit/57fb163b2c7cca15b1006ef493e3ee43b7cc616c)) * **onboarding:** add auth config ([8a055cb](https://github.com/LerianStudio/helm/commit/8a055cb83b9f6a9d9c76ca3343ab6a61c1d1c00c)) * **transaction:** add auth config ([a7ede5b](https://github.com/LerianStudio/helm/commit/a7ede5b29f6c69752cffad6970d5d73bd21062cb)) * **plugin-br-pix-switch:** add bootstrap Jobs for postgres + mongodb ([79f12c7](https://github.com/LerianStudio/helm/commit/79f12c79a33464e64dd4c0dbfdab29ec116e3db9)) * add bootstrap-mongodb.yaml for idempotent MongoDB user/db provisioning ([c36e378](https://github.com/LerianStudio/helm/commit/c36e378b82a709e8ec50f659a19f9e654c3792b1)) * **pipe:** add branch develop to generate beta release ([2990c0e](https://github.com/LerianStudio/helm/commit/2990c0e71d5b6773321b67c986b0a5a32b970cd3)) * **ci:** add chart standard validation and render gate ([9d4ab59](https://github.com/LerianStudio/helm/commit/9d4ab5980484335942ae7827954abcc0c97f633c)) * **fetcher:** add common configmap and secrets templates for shared configuration ([7f75dd0](https://github.com/LerianStudio/helm/commit/7f75dd089489faac6e797e657ea10a34f2e876d7)) * **midaz:** add conditional deployment logic for onboarding service and update ingress routing ([f2e3c76](https://github.com/LerianStudio/helm/commit/f2e3c76aa1fe0928439bf2cfbff401bd30078714)) * **midaz:** add conditional deployment logic for transaction service ([df12827](https://github.com/LerianStudio/helm/commit/df128273a67ebc2d6572c3bd0b798d534933489b)) * **plugin-smart-templates:** add configmap annotations ([adac247](https://github.com/LerianStudio/helm/commit/adac247e5d389e8587c8e5867d19547ce98bd810)) * **reporter:** add configurable secret for KEDA TriggerAuthentication ([d84a26d](https://github.com/LerianStudio/helm/commit/d84a26d398d1df7a487e053e25cdddc8cc37df88)) * **plugins:** add CRM data source secrets and disable ingress by default ([e262736](https://github.com/LerianStudio/helm/commit/e26273677fd0d683f02d79f7cb082b43e626a377)) * **midaz:** add CRM service with MongoDB integration and complete Kubernetes manifests ([a9368d2](https://github.com/LerianStudio/helm/commit/a9368d2d9a27d7f1278e0ec06ad7a4e25124b2d5)) * add crm ui functions ([3473c00](https://github.com/LerianStudio/helm/commit/3473c0089f1e0c6efe8eb71704e12c0913d07c55)) * add crm ui templates ([8089ad7](https://github.com/LerianStudio/helm/commit/8089ad7e7056b469abf9b07d880356ace2adbc3f)) * add dependencies to midaz helm ([e1e4095](https://github.com/LerianStudio/helm/commit/e1e4095c7e9fc48c69738c0610ee7ad4bd56c12a)) * **plugin-fees:** add deployment mode and readiness timeout settings ([fa5783b](https://github.com/LerianStudio/helm/commit/fa5783bb7cb7e64d32bb4c15c0e32b637aee5bb0)) * **values:** add deployment strategy definitions ([dd93837](https://github.com/LerianStudio/helm/commit/dd9383729db20e4f88265edde5900d35c7dbbafa)) * **console:** add deployment strategy ([0000ab0](https://github.com/LerianStudio/helm/commit/0000ab0a6c088e2eca167f396bff859638b478e4)) * **onboarding:** add deployment strategy ([220274b](https://github.com/LerianStudio/helm/commit/220274beb453eb54ec6e9c3a6020016cf8a7be91)) * **transaction:** add deployment strategy ([65076f4](https://github.com/LerianStudio/helm/commit/65076f421904b98f46329ff40cb31f7cf409476b)) * add doc ([5593a96](https://github.com/LerianStudio/helm/commit/5593a96ff02c3b968c4a703a5a7ccc2afa53be04)) * add doc ([97daf1e](https://github.com/LerianStudio/helm/commit/97daf1ecb4c2a51415c58cf0bc815a36d1e52cc3)) * add doc ([2f02d2e](https://github.com/LerianStudio/helm/commit/2f02d2ef0fad7ad80fe131253a8e232b66499430)) * add doc ([6e20f92](https://github.com/LerianStudio/helm/commit/6e20f92c1c31fa26560edfa77fec348783564de2)) * **product-console:** add dynamic OTEL host injection support ([4f473e9](https://github.com/LerianStudio/helm/commit/4f473e94c54955f11383f7f439a5c8d2454b47ae)) * **midaz:** add external OTEL collector support ([f38af29](https://github.com/LerianStudio/helm/commit/f38af29a9900c118d72e07481487b146e9dab02e)) * add external secret support for RabbitMQ and Postgres definitions in Helm chart ([0994db6](https://github.com/LerianStudio/helm/commit/0994db63ae8857fc4fd5540164b9334df58b3415)) * add external secret support paramters to values file ([e35c63e](https://github.com/LerianStudio/helm/commit/e35c63efac785fb1b5fa1c31643f1a3df1b143d4)) * add external secret support to deployment ([363ee02](https://github.com/LerianStudio/helm/commit/363ee020e997e8da492cfb284b10d33c08ab780a)) * add external secret support to worker job ([58809e1](https://github.com/LerianStudio/helm/commit/58809e1efded5775234e5bdc3018d3584694a7df)) * add external secret support to worker values file ([4e62d4f](https://github.com/LerianStudio/helm/commit/4e62d4fb02c8f17009f40e6f2d04d837d404feec)) * **scripts:** add fallback to root image.tag in chart version update script ([4fdcb77](https://github.com/LerianStudio/helm/commit/4fdcb77603969e24faab5a82527abddcb2517534)) * **plugin-fees:** add fees ui env var ([c1e52e1](https://github.com/LerianStudio/helm/commit/c1e52e1e525d168adce6be38a70470facaf18590)) * **fetcher:** add fetcher helm chart with manager and worker components ([363c0cf](https://github.com/LerianStudio/helm/commit/363c0cfd5b7c0049be06358ab34e8e4619897a98)) * **doc:** add general readme and moving midaz readme ([41f11fe](https://github.com/LerianStudio/helm/commit/41f11fe167c213be99413d4b0b82a9becbe482f6)) * add gpg key and clean file ([81630ce](https://github.com/LerianStudio/helm/commit/81630ce857b0e00600b63d602c3dec4df45eab61)) * add gRPC port configuration for transaction service ([1f9f761](https://github.com/LerianStudio/helm/commit/1f9f7612cf82f8dd2803c00d665f461fc13c2e12)) * add gRPC port to transaction service ([30351b9](https://github.com/LerianStudio/helm/commit/30351b9dc6622ed4ab3ac1010c777d518537c999)) * **plugins:** add Helm chart for BC Correios plugin ([81bc419](https://github.com/LerianStudio/helm/commit/81bc41948bc410bf1952ab23081e2d205bf1f51f)) * add helm chart for BR PIX direct JD plugin with PostgreSQL dependency ([0adcba2](https://github.com/LerianStudio/helm/commit/0adcba27ed3fd6158b4632d3223f4a2f211545fb)) * add Helm chart for plugin-br-bank-transfer-jd ([2ee97b9](https://github.com/LerianStudio/helm/commit/2ee97b9986a7fc2821c3c3935e34eb183f02daf8)) * **plugin-br-payments:** add helm chart ([85cfe2a](https://github.com/LerianStudio/helm/commit/85cfe2a00eb299bc252b6fe6c496c4166d5cd390)) * **plugin-br-pix-switch:** add helm chart ([8977d4b](https://github.com/LerianStudio/helm/commit/8977d4b73d6f9d3df64153b89f976279e7a3a43d)) * add helm hook weights and delete policies for postgres and rabbitmq resources ([1bb5bf8](https://github.com/LerianStudio/helm/commit/1bb5bf8e3a02b547123d9e0a395163adca958729)) * add Helm hooks to onboarding and transaction ConfigMaps for pre-install/upgrade ordering ([a163833](https://github.com/LerianStudio/helm/commit/a163833ccd5c476f2a624252cea0169780fd55fd)) * add helm-compose config and karpenter node ([9a52467](https://github.com/LerianStudio/helm/commit/9a52467339718fd820e76355e97113cb6104fc2c)) * **plugin-br-pix-indirect-btg:** add HMAC validation and mTLS BTG config envs ([d1563c4](https://github.com/LerianStudio/helm/commit/d1563c48a40a1ef1dc9e8fd387203dc91c188261)) * add IAM Roles Anywhere sidecar support for fetcher and matcher ([a67b756](https://github.com/LerianStudio/helm/commit/a67b756fed6c39b62dfacda1f2ae34fecbd2b12e)) * **plugin-fees:** add IAM Roles Anywhere sidecar support ([d9621a1](https://github.com/LerianStudio/helm/commit/d9621a1da9d48355713f8d53ee881e01f8350143)) * **reporter:** add IAM Roles Anywhere sidecar support ([2b76810](https://github.com/LerianStudio/helm/commit/2b7681083e0bd731d3fc2e8605b1c0a02a3cc975)) * add imagePullSecrets and resource limits to nginx deployment ([73edcda](https://github.com/LerianStudio/helm/commit/73edcda18eb3f27c3c62ade6db7f353e8fdaa78c)) * **plugin-br-pix-switch:** add in-cluster sibling URL defaults ([c1f7b8f](https://github.com/LerianStudio/helm/commit/c1f7b8fdc42bae4bb588987df29a5e32a3969712)) * add index to semantic-release versioning ([4c98cf1](https://github.com/LerianStudio/helm/commit/4c98cf120e280bcdb252fed83aab285f1fa0f5e8)) * add index to semantic-release versioning ([af4c306](https://github.com/LerianStudio/helm/commit/af4c306d8e6ece405b451407c941eb1bf4eff5bd)) * add ingress template ([44b73b2](https://github.com/LerianStudio/helm/commit/44b73b2e3d2330af536435194930132e65d2ecc2)) * **ingress:** add ingress templates ([020369a](https://github.com/LerianStudio/helm/commit/020369a13b9696eb2e6e12c389ed211d2feb95f1)) * **ingress:** add ingress templates ([816fcee](https://github.com/LerianStudio/helm/commit/816fcee9d905744bcd47003fb16b974104c2d2d3)) * add init container in casdoor to check if the database is ready ([#48](https://github.com/LerianStudio/helm/issues/48)) ([8337771](https://github.com/LerianStudio/helm/commit/833777165ff6ed1d4183cc48757acd2d8b7ddd83)) * add initial helm chart for BR Pix Direct JD plugin ([2f097d0](https://github.com/LerianStudio/helm/commit/2f097d0f713783cf599888c880fc82fa6eec0ea3)) * **underwriter:** add initial Helm chart for Underwriter service ([7bbba1a](https://github.com/LerianStudio/helm/commit/7bbba1afcb883a261ef121710a9f5d0a854326ff)) * **plugin-br-pix-indirect-btg:** add INTERNAL_WEBHOOK_SECRET and bump to 1.0.0-rc.26 ([e5ef789](https://github.com/LerianStudio/helm/commit/e5ef7890094698e5bd5faceacc1e56746e0f2305)) * **dependencies:** add job to apply default definitions to external rabbitmq host ([c91db90](https://github.com/LerianStudio/helm/commit/c91db90f8311960f818d7f0b0046bc9eda1a4e6b)) * add Kubernetes manifests for PIX QR code service deployment ([8b1881f](https://github.com/LerianStudio/helm/commit/8b1881f157b140d02bed50cd6d7e70e67b074cb1)) * add Kubernetes manifests for plugin-br-pix-direct-jd job deployment ([9b67a67](https://github.com/LerianStudio/helm/commit/9b67a67fd073657a1c1dd7751288275fe24619d0)) * **midaz:** add ledger service configuration and restructure values files ([d4332f9](https://github.com/LerianStudio/helm/commit/d4332f9a122f4cf9045f76c8ce1e76dd080beda6)) * **midaz:** add ledger service with unified API and migration helpers ([0ee6e83](https://github.com/LerianStudio/helm/commit/0ee6e83a4a04e185585e7391f9ff7271ef8546b1)) * **doc:** add lerian banner ([35b904a](https://github.com/LerianStudio/helm/commit/35b904afb9d910e51b1508693aa7c3ce06ea9a75)) * add logical replication slot and improve SQL formatting ([ec2cfee](https://github.com/LerianStudio/helm/commit/ec2cfee6dab3fc571fb74e7e662c08000836a893)) * **plugin-fees:** add M2M and AWS_REGION env vars to chart ([f026d18](https://github.com/LerianStudio/helm/commit/f026d18e6b053f778b26d24dc1932a91f8c689d5)) * **fetcher:** add manager component Kubernetes manifests with full deployment configuration ([12ec0dd](https://github.com/LerianStudio/helm/commit/12ec0ddca52e9046324204ec7b717b87296e434b)) * **matcher:** add matcher helm chart ([6a235c1](https://github.com/LerianStudio/helm/commit/6a235c1fde13dc7ae70b3e719ed9b7dab4e3bb28)) * **matcher:** add missing env vars for matcher v1.0.0+ ([0bf1e7f](https://github.com/LerianStudio/helm/commit/0bf1e7f71c9dbb9ffea852f369def1d61ebfffac)) * **plugin-br-pix-indirect-btg:** add missing inbound webhook entity envs and security tier config ([ca62f49](https://github.com/LerianStudio/helm/commit/ca62f49564f7bf5c543028ec639870a762410605)) * **charts:** add missing NEU app env vars to reporter and fetcher ([8d4db13](https://github.com/LerianStudio/helm/commit/8d4db13cd6f1c1ebda31797c799b6d2ecebc7e5c)) * **product-console:** add MONGO_PARAMETERS env var for TLS/auth options ([164468c](https://github.com/LerianStudio/helm/commit/164468c7bbe92e069a3d4d25bd05eef17f8827c6)) * **plugin-br-pix-switch:** add mongodb + rabbitmq subchart dependencies ([0e9b3d4](https://github.com/LerianStudio/helm/commit/0e9b3d42d6cadd7e93d1ebd7e3d353d58c57f2cf)) * **console:** add mongodb environments ([256757e](https://github.com/LerianStudio/helm/commit/256757eb38cff41510d114572f4d18d92569fd6f)) * **console:** add mongodb environments ([88db3ba](https://github.com/LerianStudio/helm/commit/88db3bad7e8f2ec4fe5056980cbb7e41cdd02c38)) * **console:** add mongodb environments ([7c86ca0](https://github.com/LerianStudio/helm/commit/7c86ca00a65680a99b642d976ac36578c39c31f9)) * **console:** add mongodb port ([73ec8e2](https://github.com/LerianStudio/helm/commit/73ec8e27a619c333a6f2cfe60fcc0c8d49fd8295)) * **plugin-fees:** add MULTI_TENANT_ALLOW_INSECURE_HTTP to configmap template ([48cf209](https://github.com/LerianStudio/helm/commit/48cf20922c92bf3ece54122be84251913497c9a4)) * **plugin-fees:** add multi-tenant support and fix AVP secret rendering ([#1229](https://github.com/LerianStudio/helm/issues/1229)) ([04e12ac](https://github.com/LerianStudio/helm/commit/04e12acc2a1f0188fe78b227896880aa8f60bd28)) * **flowker:** add multi-tenant support and missing env vars ([9892b7d](https://github.com/LerianStudio/helm/commit/9892b7d9635f3b29d1159eccc60e5fd891d2badc)) * **tracer:** add multi-tenant support to chart (2.1.0-beta.1) ([a4c4a7e](https://github.com/LerianStudio/helm/commit/a4c4a7e62e71016696b0fc166eee66df2c76d61e)) * **console:** add new console env vars ([cf974b8](https://github.com/LerianStudio/helm/commit/cf974b8d696f9eb89e951fd144632d0e5817291f)) * **plugin-fees:** add new env vars for v3.1.0 ([f824431](https://github.com/LerianStudio/helm/commit/f8244314c78d1bfc76a3a83dce58e5e29d330b17)), closes [#1195](https://github.com/LerianStudio/helm/issues/1195) * **console:** add new env vars ([a228e39](https://github.com/LerianStudio/helm/commit/a228e39c856f9f4b561d55949edcaa051d5b9af9)) * **console:** add new env vars ([8b8d76f](https://github.com/LerianStudio/helm/commit/8b8d76f525a96f36c1d694c65db51ed7280a68a5)) * **dependencies:** add new parameters to chart file ([#44](https://github.com/LerianStudio/helm/issues/44)) ([4796070](https://github.com/LerianStudio/helm/commit/4796070cb5ad4c32d28bbb7ffc085b5fb3aeb495)) * **doc:** add new version ([39c0a71](https://github.com/LerianStudio/helm/commit/39c0a71dacbe9c80aa095a580c5d42d153b0947b)) * **doc:** add new version ([f864ad2](https://github.com/LerianStudio/helm/commit/f864ad20353a26f7dbe525332ef3b54f6af6fb74)) * add nginx configuration templates ([5755baa](https://github.com/LerianStudio/helm/commit/5755baaef5a346db79dfb78c7638b74c928c442f)) * add nginx dependence for midaz-console ([baa0cd4](https://github.com/LerianStudio/helm/commit/baa0cd4e4a209c520a2cb8e7de67c154f8a39e24)) * **midaz:** add nginx paramters to midaz-console ([84ff310](https://github.com/LerianStudio/helm/commit/84ff3103d5cd01da01c64c15eec4a83c5df66f17)) * **fetcher:** add OpenTelemetry HOST_IP injection support ([0ea3d75](https://github.com/LerianStudio/helm/commit/0ea3d7570288ab2e6e99a8f81564b031e11af626)) * add option to use existing secrets in helm chart ([f810082](https://github.com/LerianStudio/helm/commit/f810082fe8ce19eb69823f12b92345e418bb68d8)) * add plugin crm ui values ([493e4eb](https://github.com/LerianStudio/helm/commit/493e4eba4bf4457bbd75cf21334d33f16267b833)) * add plugin crm ui values ([c31de8d](https://github.com/LerianStudio/helm/commit/c31de8d30aedca6c9b4cc91b096c1e76a92a1a35)) * add plugin fees ui templates ([3451909](https://github.com/LerianStudio/helm/commit/345190944d3648c0ebae6e47890967cfefcc7e49)) * add plugin to semantic-release ([4ec01d8](https://github.com/LerianStudio/helm/commit/4ec01d8aceef35145239ae5b513977531798b329)) * add plugin to semantic-release ([d102c52](https://github.com/LerianStudio/helm/commit/d102c52039f5c1262f9dc00eb07728d226e656ef)) * add plugin to semantic-release ([a26017e](https://github.com/LerianStudio/helm/commit/a26017e363c87530e30e96e9b5fdc2581c19bb49)) * add plugin to semantic-release ([b001de0](https://github.com/LerianStudio/helm/commit/b001de0f2fad2b2b1cf05b5c0db9f48aa1af5265)) * add plugin to semantic-release ([f786586](https://github.com/LerianStudio/helm/commit/f7865866e41aad38bdf343e45fce351fa2af2a9b)) * add plugin to semantic-release ([13f0af3](https://github.com/LerianStudio/helm/commit/13f0af38e59cf9fb7a3596293a83dd3e6b9757a0)) * add postgres definitions and update security settings for console deployment ([6371b55](https://github.com/LerianStudio/helm/commit/6371b5568b94bc8f6fe57817132dee4644870ef3)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](https://github.com/LerianStudio/helm/commit/f6e469519784f6f301929066c55a152698e16d77)) * add pre-install and pre-upgrade hooks to onboarding and transaction secrets ([8199e92](https://github.com/LerianStudio/helm/commit/8199e92a9904adfc89adc6acf65a367d6c42b7e7)) * **product-console:** add product-console helm chart ([c956078](https://github.com/LerianStudio/helm/commit/c956078bd0959c13f42a018aa52b80862781b11d)) * **fetcher:** add RabbitMQ bootstrap job with definitions for external RabbitMQ instances ([90c5edc](https://github.com/LerianStudio/helm/commit/90c5edc90b4798ed0d31e56ca9479095889a521e)) * add RabbitMQ consumer credentials configuration in values-template ([da5c625](https://github.com/LerianStudio/helm/commit/da5c6255dfc8a2a671f9dfb88bb511d0536ddd6e)) * add rate limit configuration to midaz, fetcher, and reporter charts ([db2ec46](https://github.com/LerianStudio/helm/commit/db2ec461f6df0cc003cfe05fe4dd33df08d27d4e)) * add RBAC and nginx restart capability to service discovery job ([236e62f](https://github.com/LerianStudio/helm/commit/236e62f776e356b716fbd3059c37377cdbd154b6)) * **pipe:** add release step for ghcr ([f0e4f3f](https://github.com/LerianStudio/helm/commit/f0e4f3f5221b392bb68b2a5f87aa85facc5cfbee)) * **plugin-br-pix-indirect-btg:** add required validation for INTERNAL_WEBHOOK_SECRET ([df410e2](https://github.com/LerianStudio/helm/commit/df410e2d27b21a724447b44d50f9faaed7796be6)) * **plugin-fees:** Add SA template Fees ([14af5bd](https://github.com/LerianStudio/helm/commit/14af5bdd8e0cb45747c5d23797ed10ac6f4a96a3)) * **console:** add secrets ([ad89e3b](https://github.com/LerianStudio/helm/commit/ad89e3ba7bd1713686bc0546be1e6b11341b10da)) * add security context and service account to nginx deployment ([3eaa99e](https://github.com/LerianStudio/helm/commit/3eaa99e8ecf17e3992e0c952699c2c111cf3aac3)) * **chart:** add security context to plugin identity ([47b48fc](https://github.com/LerianStudio/helm/commit/47b48fc9ec49f706519fceb4a7007c0179f62317)) * **pipe:** Add semantic changelog ([8c65e59](https://github.com/LerianStudio/helm/commit/8c65e5970101edc9ac621ec30b783bbc4fc3225c)) * **pipe:** Add semantic changelog ([452b6e7](https://github.com/LerianStudio/helm/commit/452b6e78b97a10aa4cd94daf5c95cd1545dc8222)) * **pipe:** Add semantic changelog ([c54115e](https://github.com/LerianStudio/helm/commit/c54115ebf8bd43a0dc8d41233d1100ac136ba8c3)) * **pipe:** Add semantic changelog ([d9befbb](https://github.com/LerianStudio/helm/commit/d9befbb65561716987a9825587f5ac0c9b63be3b)) * **ci:** Add Semantic Release changelog ([6537310](https://github.com/LerianStudio/helm/commit/6537310682b459b7f9fd48ed3c18dd739a816b0f)) * add service discovery job to plugins ui ([2bdaf78](https://github.com/LerianStudio/helm/commit/2bdaf789279b7cbefef51dbc4ad4db219325df73)) * **reporter:** add ServiceAccount annotations support for IRSA ([3685103](https://github.com/LerianStudio/helm/commit/3685103f9547e595667f85a9267272e337f3b077)) * **fetcher:** add ServiceAccount support for worker ([aa616c7](https://github.com/LerianStudio/helm/commit/aa616c7e00827621e525f75e3eb23c44fa2c9993)) * add step to update gh-pages ([bd762c7](https://github.com/LerianStudio/helm/commit/bd762c72ead853758a349d52913a63b45ed40a5c)) * add step to update gh-pages ([ddffd1b](https://github.com/LerianStudio/helm/commit/ddffd1b3dfbd179e26958361965f93a62273af07)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **midaz:** add support to external screts ([ab13b87](https://github.com/LerianStudio/helm/commit/ab13b878fdf8c280dc9e95cf015a459ce8b1edc6)) * **tracer:** add tracer helm chart ([275c30e](https://github.com/LerianStudio/helm/commit/275c30e44dcc66052cfc459e997dd0618e5ca766)) * add transaction gRPC configuration and update service versions ([cb48384](https://github.com/LerianStudio/helm/commit/cb4838437068d4e616c864c7cd37340399c0f504)) * **midaz:** add user consumer config to rabbitmq ([fb28359](https://github.com/LerianStudio/helm/commit/fb28359f8a4634317aeebd56e40af1a9083eb857)) * **plugin-br-pix-indirect-btg:** add validation to ensure INTERNAL_WEBHOOK_SECRET matches ([0f485b2](https://github.com/LerianStudio/helm/commit/0f485b225b9b5cd23e01e6154770550df8a69043)) * **plugin-smart-templates:** add valkey to smart templates chart ([709876b](https://github.com/LerianStudio/helm/commit/709876bb3b4d9c61a301d554f2f093615ad91084)) * add values template file ([7252f36](https://github.com/LerianStudio/helm/commit/7252f36fe7070fe18675073c21bb9269443270e8)) * **matcher:** add values-template and rabbitmq definitions ([3063245](https://github.com/LerianStudio/helm/commit/30632451da1ae248b1eeaf1dce680411b075f334)) * **matcher:** add VERSION env var and OTEL support ([cee8f96](https://github.com/LerianStudio/helm/commit/cee8f9682f769b77f6d2a5d52964b53dc92f9253)) * **plugin-br-pix-switch:** add wait-for-dependencies init container ([281226e](https://github.com/LerianStudio/helm/commit/281226e570ce08ce0ba412525986cb0766df77a2)) * **fetcher:** add worker component Kubernetes manifests with deployment, configmap and secrets ([fd8d8f3](https://github.com/LerianStudio/helm/commit/fd8d8f325262e945ed1e738efea2558e5ce9e2c6)) * add worker reconciliation config ([596c5a9](https://github.com/LerianStudio/helm/commit/596c5a91ed1fd498a7efc964f65cad94cc6b47c8)) * **console:** adds new env vars ([473cf5a](https://github.com/LerianStudio/helm/commit/473cf5a8d681e42c9ad8318b42b08dbea1e3e045)) * ajuste utilização recursos console ([44c7e64](https://github.com/LerianStudio/helm/commit/44c7e641170ad5e9b0a3629971c2cdc731059928)) * allow custom nginx configmap names and update plugins.conf path to snippets directory ([fe69b7b](https://github.com/LerianStudio/helm/commit/fe69b7b26b86c85a8d916afae4c9c9b009d8ba0d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **plugin-br-pix-switch:** auto-derive OTEL service version + node-IP OTLP endpoint ([15e6196](https://github.com/LerianStudio/helm/commit/15e6196cf549401084b7c6a1d7afd55c13f194b5)) * **reporter,fetcher:** auto-set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image tag ([bcc28f1](https://github.com/LerianStudio/helm/commit/bcc28f1bdc02b51347e677a8d26ac5ab7d7c40b6)) * **plugin-br-pix-switch:** auto-wire URLs to in-cluster subcharts ([561b398](https://github.com/LerianStudio/helm/commit/561b39871e2a17028eb56b9f3c0490ee74c5df43)) * **plugin-access-manager:** bump auth version ([12d5453](https://github.com/LerianStudio/helm/commit/12d54531235c76ccb25de1e976336505a0c51c91)) * **plugin-access-manager:** bump auth version ([10b5e4c](https://github.com/LerianStudio/helm/commit/10b5e4c9d7cc99ed93ff254b3e5c2632df25b9c6)) * **plugin-access-manager:** bump auth version ([90c6906](https://github.com/LerianStudio/helm/commit/90c6906ac94512dc14308f871aa4ed82717de49d)) * **midaz:** bump chart version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable ([bb157a4](https://github.com/LerianStudio/helm/commit/bb157a4472446033b94ab96837433e4df160555f)) * casdoor bump version ([bf5e28c](https://github.com/LerianStudio/helm/commit/bf5e28c0d3a259c192e94023fe1701bcca3d4fe4)) * **midaz:** config internal collector in midaz ([07d310e](https://github.com/LerianStudio/helm/commit/07d310ef840b1b95f86b6bdf1f75eba1a7e5b64a)) * **midaz:** config internal collector in midaz ([fb7d829](https://github.com/LerianStudio/helm/commit/fb7d8290ad20cb4e92ccd7eea19c07bb46b46bc7)) * **chart:** configure pdb to auth backend ([112bc47](https://github.com/LerianStudio/helm/commit/112bc47d72db94b57e81138297d973cb31d4ddf6)) * **helm:** create chart file to plugin crm ([69b01c8](https://github.com/LerianStudio/helm/commit/69b01c868752eb91973e2d292eb2e7ffaa57c1e0)) * **helm:** create chart file to plugin-fees ([38a0e81](https://github.com/LerianStudio/helm/commit/38a0e81c29d53bb81bb1895869b058942bc1d116)) * create chart midaz opensource ([afeadcf](https://github.com/LerianStudio/helm/commit/afeadcf46aef60af8b74055695a55fc00131f029)) * **helm:** create chart templates to plugin crm ([777ea2f](https://github.com/LerianStudio/helm/commit/777ea2fa1582d1530fbc4946c4ef184ae90598e9)) * **chart:** create chart templates to plugin-fees ([adabbaa](https://github.com/LerianStudio/helm/commit/adabbaaf405b471b111abe208408fce9c0772e99)) * **chart:** create chart templates to plugin-fees ([303caf0](https://github.com/LerianStudio/helm/commit/303caf06a48ff63e20fcdd13fd2c5d0629aae33c)) * **helm:** create doc to plugin crm ([4cbaa9d](https://github.com/LerianStudio/helm/commit/4cbaa9d4e8377260508c5687f292cfec8dbeee36)) * **plugin-smart-templates:** create functions to plugin-smart-templates ui ([d660619](https://github.com/LerianStudio/helm/commit/d6606192c1c6f0c0bd404e3b44c660079ce653b9)) * **plugin-smart-templates:** create helm templates to plugin-smart-templates ui ([a06f9c0](https://github.com/LerianStudio/helm/commit/a06f9c06c2d89de0a7f8ce6ba845057a8af3c268)) * **dependencies:** create init config file ([bddd6f0](https://github.com/LerianStudio/helm/commit/bddd6f025782740e3fc021ae4d7e64c0e78fd580)) * **dependencies:** create init sql file ([dcca103](https://github.com/LerianStudio/helm/commit/dcca103dcf229a307833685ad04711f662099219)) * **midaz:** create internal collector helm chart ([d17a5a4](https://github.com/LerianStudio/helm/commit/d17a5a45388428c30fa2133a58e275d445b634c7)) * **dependencies:** create job to apply migrations in casdoor db ([5a74bcc](https://github.com/LerianStudio/helm/commit/5a74bcc6ca8691159c4a3d11826a5afb34909e49)) * **values:** create pdb definitions ([fe34974](https://github.com/LerianStudio/helm/commit/fe34974aaa497979e0d13b610b77b4d1d7895f2f)) * **console:** create pdb template ([102c56a](https://github.com/LerianStudio/helm/commit/102c56a6e697623317585b8808f09f3cb7458882)) * **onboarding:** create pdb template ([8bc0d48](https://github.com/LerianStudio/helm/commit/8bc0d489407c8c5181a20f2c731e5abc7946b8b6)) * **transaction:** create pdb template ([738f5d3](https://github.com/LerianStudio/helm/commit/738f5d3ff33cc62f155186af1514340fa3133503)) * **chart:** create plugin access manager auth templates ([2fdd9ac](https://github.com/LerianStudio/helm/commit/2fdd9ac466966c5557757afae07a52f9894240fd)) * **chart:** create plugin access manager chart file ([094eecc](https://github.com/LerianStudio/helm/commit/094eeccff09029260104c7428a254c25260d20d6)) * **chart:** create plugin access manager identity templates ([c52068d](https://github.com/LerianStudio/helm/commit/c52068d228e3a79bbf4904e9823fb29407694add)) * **chart:** create plugin access manager templates ([c4221ad](https://github.com/LerianStudio/helm/commit/c4221adf91b52acc3c590d9d7b1f8db314f01d88)) * **values:** create plugin access manager values file ([b1727d0](https://github.com/LerianStudio/helm/commit/b1727d0f162fb1c464b35559f5684740a5af819e)) * create plugin fees ui functions ([0d2c127](https://github.com/LerianStudio/helm/commit/0d2c127d3d4f1aed530a864937e4e0e5fe7c8332)) * **plugin-smart-templates:** create secret to plugin-smart-templates ui ([552d061](https://github.com/LerianStudio/helm/commit/552d06115d589ceb41ac5d201fe972e82fc4c588)) * **plugin-smart-templates:** create values defintions to plugin-smart-templates ui ([48a25ca](https://github.com/LerianStudio/helm/commit/48a25ca3f4d889ba827a3674a284a563dbcbb105)) * **helm:** create values file to plugin crm ([de6b154](https://github.com/LerianStudio/helm/commit/de6b1547947f91d580a9ff5f7fb14c1e5efa4d0d)) * **values:** create values file to plugin-fees ([304f228](https://github.com/LerianStudio/helm/commit/304f22871b76180f4b299daa3ecaac06571ffd92)) * **values:** create values file to plugin-fees ([f383281](https://github.com/LerianStudio/helm/commit/f383281421b709744823d9de1bc053288ab6d747)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-br-pix-switch:** default DEPLOYMENT_MODE to byoc (1.1.0-beta.3) ([aa12385](https://github.com/LerianStudio/helm/commit/aa12385a12d159121c021f53350ebac3f90b3668)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](https://github.com/LerianStudio/helm/commit/4946cb505bb4ee121910113c4ca78a74e8a97269)) * dependency update ([18bd991](https://github.com/LerianStudio/helm/commit/18bd9910348f05785a975b38d8b11068f1069407)) * dependency update ([b56d142](https://github.com/LerianStudio/helm/commit/b56d1421e7251dc932d4b025cc6be4be31ee3c42)) * dependency update ([55eb548](https://github.com/LerianStudio/helm/commit/55eb5489f192d16508b7ecfd93bddcf71aa42feb)) * **grafana:** disable grafana ([423a6f5](https://github.com/LerianStudio/helm/commit/423a6f5495c50c4ccae86c5391cb52841af300e8)) * **plugni-fees:** Disable SA create ([4074905](https://github.com/LerianStudio/helm/commit/4074905ddec1dec2c62eab214fdbff1b548ef329)) * **plugin-fees:** enable extra env vars to configmap template ([5f60cea](https://github.com/LerianStudio/helm/commit/5f60ceac653f34a021d0db1a10447113fb693005)) * **plugin-fees:** enable extra env vars to values yaml ([dc626a7](https://github.com/LerianStudio/helm/commit/dc626a7a5825e0afbd1d44c1f56594f3a97f14fe)) * **plugin-crm:** enable extra env vars ([5ea9e2f](https://github.com/LerianStudio/helm/commit/5ea9e2fc7cda9500fe728d4bf2cd877844b666a4)) * **plugin-smart-templates:** enable extra env vars ([c03007b](https://github.com/LerianStudio/helm/commit/c03007bf50902abd45c54d5bee3296450a13d50b)) * enable karpenter node ([02b029d](https://github.com/LerianStudio/helm/commit/02b029d1a18e462be5c5c11c5d0c5f0cceee6122)) * **midaz:** enable ledger service by default ([1abf1f1](https://github.com/LerianStudio/helm/commit/1abf1f1b1944583717002bd23d2fb72fae71a676)) * enable telemetry for onboarding and transaction services ([2497433](https://github.com/LerianStudio/helm/commit/2497433be24d42829985604f47cf983705c05f6e)) * **console:** enforce absolute DNS resolution ([8e519fe](https://github.com/LerianStudio/helm/commit/8e519fe25255119d50ecfef91ca8ab5a01df5f78)) * **onboarding:** enforce absolute DNS resolution ([c471521](https://github.com/LerianStudio/helm/commit/c471521eb53ce2e100f080247c2ff25bc1255650)) * **transaction:** enforce absolute DNS resolution ([1759a5b](https://github.com/LerianStudio/helm/commit/1759a5b1ce44339302482bd5ccabed5056c33a2f)) * **ci:** enforce single-source infra secrets ([3b787d5](https://github.com/LerianStudio/helm/commit/3b787d508ba556c21b036b41ff990245e7258427)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](https://github.com/LerianStudio/helm/commit/756a1f9c85d570a539866b54f070192d40cb2f59)) * **midaz:** extend RBAC permissions for discovery service to access replicasets and list/watch deployments ([9285689](https://github.com/LerianStudio/helm/commit/9285689f5bbb1ae361741668834473809cb7c86b)) * **matcher:** finalize matcher helm chart for v1.0.0 ([2be45e9](https://github.com/LerianStudio/helm/commit/2be45e958cbc4fc001831c1f87b11a1aea472d15)) * **ci:** harden validator with collapse gate ([cc324ee](https://github.com/LerianStudio/helm/commit/cc324ee94663baa3228d6b4ed754cc09d0ac4fbf)) * helm doc ([#26](https://github.com/LerianStudio/helm/issues/26)) ([ccb3021](https://github.com/LerianStudio/helm/commit/ccb30211fbd9ab5b1ff5e3151f1f9361d25e3cff)) * improve Helm setup reliability in release workflow ([eb49cc3](https://github.com/LerianStudio/helm/commit/eb49cc348065b87027112371b4496080b25dd4e4)) * **midaz:** improve RabbitMQ bootstrap script with smart URL handling and enhanced logging ([8d99add](https://github.com/LerianStudio/helm/commit/8d99addbd1dec7b570ccdb9fc7f6add52564172d)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](https://github.com/LerianStudio/helm/commit/e67d89c3fffa8154989f6d71f65582331fba98d9)), closes [#138](https://github.com/LerianStudio/helm/issues/138) * **lerian-notification:** initial chart ([2a001d4](https://github.com/LerianStudio/helm/commit/2a001d4ba433a61cd3317929cc96045c42561bfd)) * **bootstrap-mongodb:** make app user and roles configurable via values ([5a37252](https://github.com/LerianStudio/helm/commit/5a37252bc760b70a50ad1814d5fb7955065f7400)) * **plugin-access-manager:** make createDatabase configurable ([1574601](https://github.com/LerianStudio/helm/commit/1574601cb8d8a8d2a8cdf9f360dc695f5f102bfb)) * midaz helm chart ([8768a8e](https://github.com/LerianStudio/helm/commit/8768a8e1f97dbe82d0cb96b899c3865e7b9c95c3)) * midaz helm chart ([94b2a6e](https://github.com/LerianStudio/helm/commit/94b2a6eab897bb6c1cd6f336fc9cf12f642ad697)) * **rabbitmq:** migrate from Bitnami chart to groundhog2k chart ([454c850](https://github.com/LerianStudio/helm/commit/454c850bb9bce3b24f62bea34cf65997a55fcf2b)) * **valkey:** migrate from StatefulSet to Deployment ([3854dfe](https://github.com/LerianStudio/helm/commit/3854dfe3430eaf7f4d99e39d032103eca4ff10fd)) * **plugin-br-bank-transfer:** move CLIENT_IDs to secrets ([d3e36c0](https://github.com/LerianStudio/helm/commit/d3e36c03dce5f43305daf1c6da2da4f65a142f76)) * **pipe:** new pipe to deploy all charts ([20629f5](https://github.com/LerianStudio/helm/commit/20629f50ce386463a83ac0ebc0fce367430f04a0)) * **pipe:** new releaserc template ([24dc653](https://github.com/LerianStudio/helm/commit/24dc653adae4f036f7d5b9da044f42c43e9acd09)) * onboarding bump version ([4fc43e7](https://github.com/LerianStudio/helm/commit/4fc43e748f50fc4afd34e475a1c7d7360efaf3bc)) * onboarding rabbitmq protocol variable ([add46ac](https://github.com/LerianStudio/helm/commit/add46ac46bdcf1e629db5f92d4e129f550e93cfb)) * onboarding rabbitmq protocol variable ([01b91e6](https://github.com/LerianStudio/helm/commit/01b91e690ca469e58800047c055c872b90ab00d8)) * onboarding rabbitmq protocol variable ([9980d0c](https://github.com/LerianStudio/helm/commit/9980d0cd82b658b34d9244cc524630222f0cf61e)) * onboarding rabbitmq protocol variable ([3d44fa1](https://github.com/LerianStudio/helm/commit/3d44fa1c77b8442600f272497fd4fe79351aadf9)) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](https://github.com/LerianStudio/helm/commit/82dbb81fda6cb8611844cabdaff52b9cc65758b1)) * **charts:** parametrize probe path and timing for all charts using /readyz ([c4d15a2](https://github.com/LerianStudio/helm/commit/c4d15a20995b4edbcf11ce8576c1b80b5a05287d)) * **ci:** per-chart values.schema.json generator ([d295433](https://github.com/LerianStudio/helm/commit/d2954334953f15a1db0ee47064d5885bcec89f6b)) * **plugin-br-pix-switch:** per-component command/args for single-image multi-binary support ([d607978](https://github.com/LerianStudio/helm/commit/d607978e45aedec2137b0ecf5505529a08a254cd)) * **plugin-br-pix-switch:** per-component image repository defaults (1.1.0-beta.6) ([48b9d17](https://github.com/LerianStudio/helm/commit/48b9d17c3930e97c3d84355f6c56c39f739913b8)), closes [#137](https://github.com/LerianStudio/helm/issues/137) * plugin auth bump version ([f99a6fb](https://github.com/LerianStudio/helm/commit/f99a6fb0ad500f482703e87bb47ff5a87be857ff)) * plugin identity bump version ([d98f1b5](https://github.com/LerianStudio/helm/commit/d98f1b57ca9d5445651721904a16587d7689241d)) * **midaz:** plugins ui support to console ([17f2376](https://github.com/LerianStudio/helm/commit/17f23766c70f1e1784f7cb83fccff7f54fcd5333)) * **midaz:** plugins ui support to console ([7eced23](https://github.com/LerianStudio/helm/commit/7eced23afd42a256af0f28f308e814058b046f17)) * **midaz:** plugins ui support to console ([495afa4](https://github.com/LerianStudio/helm/commit/495afa420d2395027082a7b8b14fc7402512ede2)) * **midaz:** plugins ui support to console ([3b8ad93](https://github.com/LerianStudio/helm/commit/3b8ad93dfac6f20ab87a23f3c7e1e0eca853c252)) * **midaz:** plugins ui support to console ([3af6680](https://github.com/LerianStudio/helm/commit/3af668074fe67d2c6abf5a9a15dacb906d9200db)) * **midaz:** plugins ui support to console ([8303bad](https://github.com/LerianStudio/helm/commit/8303badc38db540dbbbb60ad0cf6384a3642ca50)) * **midaz:** plugins ui support to console ([d902801](https://github.com/LerianStudio/helm/commit/d90280110322bed7b0b54fd781320c361582ad36)) * postgres replication ([fa57f99](https://github.com/LerianStudio/helm/commit/fa57f99ed9d8dc8a157b776c65a02beb6f3453b4)) * **plugin-br-pix-switch:** providersIngress for outbound-provider adapters (1.1.0-beta.8) ([061f8b9](https://github.com/LerianStudio/helm/commit/061f8b9ed0bc9ac7d94629980121a32022edc020)) * **plugin-br-pix-switch:** refactor chart to multi-component (1.1.0-beta.2) ([ea1ff08](https://github.com/LerianStudio/helm/commit/ea1ff08c41a4c3f6d94715977f9792d307d9ee1d)) * refactor plugin fees templates folder ([af27cba](https://github.com/LerianStudio/helm/commit/af27cbaaf3255ca7b4bb62acd7cbdc221b3ab2bb)) * **midaz:** remove console service and nginx components ([68be4ac](https://github.com/LerianStudio/helm/commit/68be4aca05f97e0a3bcdf35058dfccf8ee8e192a)) * **doc:** remove old components ([954dd09](https://github.com/LerianStudio/helm/commit/954dd097b1be74841efa6022a94d807e228c6ec4)) * **github:** remove pgbouncer reference ([49924e8](https://github.com/LerianStudio/helm/commit/49924e811d918e8ed136e878bb480da51096d98a)) * **pipe:** remove step commit history ([b0fd599](https://github.com/LerianStudio/helm/commit/b0fd5993ef1eecb84d34759552871d9f1447b7a3)) * **pipe:** remove step commit history ([e42b665](https://github.com/LerianStudio/helm/commit/e42b665d1bda4e9461e08b855e120fcb596c6521)) * **pipe:** remove step commit history ([ed1ec98](https://github.com/LerianStudio/helm/commit/ed1ec98c8132bd84ee4c344cd70ac9da355bf9af)) * **pipe:** remove step commit history ([b8b256d](https://github.com/LerianStudio/helm/commit/b8b256d997e838caea71ced0ed190e24aa73896a)) * **pipe:** remove step commit history ([a56f7c6](https://github.com/LerianStudio/helm/commit/a56f7c6027fe4e5c90f08231b2cab83e1dc4cc30)) * **pipe:** remove step commit history ([323b43a](https://github.com/LerianStudio/helm/commit/323b43aa1b8b73d103cdaba3b692d2bde73ff772)) * rename Smart Templates to Reporter and enhance RabbitMQ config ([1b1c269](https://github.com/LerianStudio/helm/commit/1b1c269a3e43625c48535e7d759dff9fb5b159f8)) * **plugins:** restructur plugins with frontend add support for external secrets and create guide to upgrade ([ea4a669](https://github.com/LerianStudio/helm/commit/ea4a66964a13c4331f7cdd4ade710fe29177a23f)) * **plugin-br-pix-switch:** schema migration Jobs (1.1.0-beta.9) ([8e88410](https://github.com/LerianStudio/helm/commit/8e884103cf1e251711f442cec4055d703626d561)), closes [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) * **plugin-br-pix-switch:** shared multi-path ingresses (1.2.0-beta.1) ([78c74f4](https://github.com/LerianStudio/helm/commit/78c74f4ef0129663ce13ae4e2155927b02140468)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **reporter:** support external KEDA operator ([0f19cbe](https://github.com/LerianStudio/helm/commit/0f19cbecb1208201f6413921a6726e89616a09b1)) * support external secrets for RabbitMQ admin credentials in Helm chart ([76fa832](https://github.com/LerianStudio/helm/commit/76fa832de626e9ad6c8d44fb366c75cdd900f55d)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](https://github.com/LerianStudio/helm/commit/86eb65124a2e4c5a5590908fe5b6365c825215e8)) * **tracer:** template ENV_NAME in configmap ([50a6f50](https://github.com/LerianStudio/helm/commit/50a6f501b24164485475f64529514293e1e83211)) * transaction bump version ([84028fb](https://github.com/LerianStudio/helm/commit/84028fb3c2be79e976ac9bea48707696db4f40c4)) * transaction rabbitmq protocol variable ([27e075c](https://github.com/LerianStudio/helm/commit/27e075c1b2762d6648ed26c666491c6c039dd0ae)) * transaction rabbitmq protocol variable ([f0f8334](https://github.com/LerianStudio/helm/commit/f0f8334ff61cbcdad9b434e08547dab328fbf2fa)) * transaction rabbitmq protocol variable ([60ff71f](https://github.com/LerianStudio/helm/commit/60ff71f7b07e90ecfdb8c55895225682b25c2694)) * transaction rabbitmq protocol variable ([7fdc26c](https://github.com/LerianStudio/helm/commit/7fdc26c4bcdf7a7ebffe8bc5aaa662964c9a7605)) * **chart:** update app version ([348b0cc](https://github.com/LerianStudio/helm/commit/348b0ccb5fea5042fe08da2af81cbd0b323a7aca)) * **chart:** update app version ([6f40285](https://github.com/LerianStudio/helm/commit/6f402851add6d9898c04e263d5706644645cacb2)) * **helm:** update app version ([fb2f841](https://github.com/LerianStudio/helm/commit/fb2f84162e5951495e2ab12296f6855edb09fce7)) * **midaz:** update app version ([e18a30b](https://github.com/LerianStudio/helm/commit/e18a30b59c5f33cb462d6ac4bdd8c675097f2d9d)) * **values:** update app version ([598ed6d](https://github.com/LerianStudio/helm/commit/598ed6d478240d26ee9baa9560d73db1912ba05d)) * **values:** update apps version and add backend config ([7cb17c2](https://github.com/LerianStudio/helm/commit/7cb17c2225d0863ee655b6ea5fc5532421ffa93d)) * **dependencies:** update auth backend init file ([be72215](https://github.com/LerianStudio/helm/commit/be72215937655d4adb136ae9802d68ade6a279b9)) * **chart:** update auth backend templates ([8659b67](https://github.com/LerianStudio/helm/commit/8659b6758e533c9a0922d481107ba59656d3f0a5)) * **chart:** update auth templates ([a6221e4](https://github.com/LerianStudio/helm/commit/a6221e4b89edec63f40b80bd31574588d9204a5b)) * **chart:** update auth templates ([c5bcb23](https://github.com/LerianStudio/helm/commit/c5bcb23959466580106b98f7e3312195f7f42f35)) * **values:** update auth version ([b549735](https://github.com/LerianStudio/helm/commit/b54973599235c3f52058e68dcd499c8c21c8dac7)) * **doc:** update charts documentation ([422e771](https://github.com/LerianStudio/helm/commit/422e7717a8f7c79d96f4cdd110421f0c68857d82)) * **doc:** update charts documentation ([b9618c4](https://github.com/LerianStudio/helm/commit/b9618c462cf3f0ad6b3f237347ffae01fc23cb09)) * **midaz:** update console configmap ([bf616a3](https://github.com/LerianStudio/helm/commit/bf616a3ee69f10ab2ffa21fce05ed92a21d10c6e)) * **console:** update console image ([0cf1135](https://github.com/LerianStudio/helm/commit/0cf11350d345410c751d99cf8c5347793219b469)) * **console:** update console image ([4da311d](https://github.com/LerianStudio/helm/commit/4da311d8968411a29d129ef02e133b3ddd0bb25e)) * **console:** update console version ([d789c7d](https://github.com/LerianStudio/helm/commit/d789c7dc7596e65c90c0e18072687b2ea828b295)) * **values:** update console version ([778eea0](https://github.com/LerianStudio/helm/commit/778eea0d86f62b9257f4f94892ef2b340df945da)) * **values:** update extra env vars for postgres ([9852143](https://github.com/LerianStudio/helm/commit/9852143eff1ca1bbc3e6c33660d80ec4bb337d6d)) * **fetcher:** update fetcher-manager@1.1.0, fetcher-worker@1.1.0 - new env vars ([345798a](https://github.com/LerianStudio/helm/commit/345798aca7179ec1b36958b22b4f702fe772ce9a)) * **fetcher:** update fetcher-manager@1.2.0, fetcher-worker@1.2.0 - new env vars ([47785ab](https://github.com/LerianStudio/helm/commit/47785abc7269481a7b2365b49589b5bd614d0f41)) * **fetcher:** update fetcher-manager@1.3.0, fetcher-worker@1.3.0 - new env vars ([679fd73](https://github.com/LerianStudio/helm/commit/679fd73b41b0019aa0c75c782adae169826f1053)) * **pipe:** update gitignore ([6ae09d6](https://github.com/LerianStudio/helm/commit/6ae09d68f21e21e5b93834017c0525511baaf94a)) * **chart:** update identity templates ([f8def52](https://github.com/LerianStudio/helm/commit/f8def529a453cf4c2db448df07ba167ff14d6c83)) * **values:** update identity version ([f8ee875](https://github.com/LerianStudio/helm/commit/f8ee875bb51ac52300d683e366f976aa903077b2)) * **product-console:** update image tag to 1.5.0 and add upgrade guide ([a289f8c](https://github.com/LerianStudio/helm/commit/a289f8c27b440f30174dac68339fe50d83d27679)) * **values:** update midaz version ([#36](https://github.com/LerianStudio/helm/issues/36)) ([af4b898](https://github.com/LerianStudio/helm/commit/af4b898e7ed4e431ab853320a3275b9d219630f7)) * **migrations:** update migration logic and enable migrations job ([643f703](https://github.com/LerianStudio/helm/commit/643f703aed35990cb8997a2df90f1fe2bacf9494)) * **midaz:** update onboarding configmap ([7a28f50](https://github.com/LerianStudio/helm/commit/7a28f50d694f2b527d51d201205d486ce8b2d3d5)) * **midaz:** update otel env var ([769a770](https://github.com/LerianStudio/helm/commit/769a77004aebb612aed5d81b9dec30624a003734)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.10, job@1.2.1-beta.10 - new env vars ([63ae72c](https://github.com/LerianStudio/helm/commit/63ae72c6add50c9e0fbeff1567bb018afe3ef553)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.11, job@1.2.1-beta.11 - new env vars ([3b07e6b](https://github.com/LerianStudio/helm/commit/3b07e6bd9b5c07c865599da7749bff593f593da8)) * **chart:** update plugin access manager values ([e4221eb](https://github.com/LerianStudio/helm/commit/e4221ebc5da46a51c5d71ef0755bba35e3313584)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.0, plugin-br-pix-indirect-btg-worker-inbound@1.5.0, plugin-br-pix-indirect-btg-worker-outbound@1.5.0 - new env vars ([80fe4fc](https://github.com/LerianStudio/helm/commit/80fe4fc55014cf24844c1e1626b213475d5419a3)) * **plugin-fees:** update plugin-fees@3.1.0 - new env vars ([0111ef7](https://github.com/LerianStudio/helm/commit/0111ef72746c78f97321c78b110ffb0e2ac68e61)) * **docs:** update rabbitmq documentation ([cae5467](https://github.com/LerianStudio/helm/commit/cae54677bcf8a2a26949ed341df9caea50cea762)) * **docs:** update readme file ([314da0e](https://github.com/LerianStudio/helm/commit/314da0e538e7534a79cbea9423d2d6b5c08c3a8e)) * **reporter:** update reporter-manager@1.2.0, reporter-worker@1.2.0 - new env vars ([624ec97](https://github.com/LerianStudio/helm/commit/624ec978ef73810b568c9a8a578d4f8635f998d2)) * **values:** update resources limits ([04ccb18](https://github.com/LerianStudio/helm/commit/04ccb184cd7393e5c1f60fa5945fd89d0b5289d2)) * **midaz:** update transaction configmap ([be52752](https://github.com/LerianStudio/helm/commit/be5275243af5315dc64026f436460f345eb41e78)) * **midaz:** update transaction otel env var ([79717c5](https://github.com/LerianStudio/helm/commit/79717c5815e8c1f5a9e859cea47ef3553fe821df)) * **midaz:** update transaction otel env var ([927f39e](https://github.com/LerianStudio/helm/commit/927f39e5ab03e15460d28769bacb9fe1ac43d0ed)) * **plugin-crm:** update ui env vars ([9fab16d](https://github.com/LerianStudio/helm/commit/9fab16dbcbc80ccc55c0bc2c32e2d099facb6110)) * **midaz:** update values file ([98e396c](https://github.com/LerianStudio/helm/commit/98e396cb1a366691c8b0a3f32f697086583c99bf)) * **midaz:** update values file ([c0cbef1](https://github.com/LerianStudio/helm/commit/c0cbef16e5225e218a60d25d71496c2085250820)) * **values:** update values file ([db9b3db](https://github.com/LerianStudio/helm/commit/db9b3db3961bea039663a7dba0f548601e3c146b)) * **values:** update values file ([cc698a0](https://github.com/LerianStudio/helm/commit/cc698a0a76b24e97b4ff890605535e9ad128e886)) * **midaz:** update values template ([90f3133](https://github.com/LerianStudio/helm/commit/90f31338d4158ddaeca92ab47417b9ca8e7cf20b)) * **chart:** update version ([40d723d](https://github.com/LerianStudio/helm/commit/40d723d6159d78f2a198cdfa9c7c969d07219289)) * **chart:** update version ([22e2930](https://github.com/LerianStudio/helm/commit/22e2930ce80b8e33926bb6db7a5f70ca6faa4fa5)) * **chart:** update version ([8031ceb](https://github.com/LerianStudio/helm/commit/8031cebf57f599fda19f74224cd17a746bfe1e21)) * **chart:** update version ([a8af389](https://github.com/LerianStudio/helm/commit/a8af389aa9135313e2e534e4fd0af358a3b8fcf2)) * **chart:** update version ([412e782](https://github.com/LerianStudio/helm/commit/412e782cff316594cb5b6ea0410a7c5d66ebf6a1)) * **chart:** update version ([4a42b13](https://github.com/LerianStudio/helm/commit/4a42b1367e2ac41654210610641c44fcb7f8b463)) * upgrade app version to 3.3.0 and add SSL mode configs for database connections ([c9d334f](https://github.com/LerianStudio/helm/commit/c9d334f2354705719d3469d614317d6524fd9987)) * **lerian-notification:** use /migrate binary in migrations Job ([1696dd7](https://github.com/LerianStudio/helm/commit/1696dd7f1af6292d634a1e2a428eb2a69aeb6d86)), closes [LerianStudio/lerian-notification#40](https://github.com/LerianStudio/lerian-notification/issues/40) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) * values template file ([2f7c796](https://github.com/LerianStudio/helm/commit/2f7c79606290492be77d34dfbd6ec76e89334cbb)) * values template file ([54ba721](https://github.com/LerianStudio/helm/commit/54ba721da0981d80e2df95a008d22d0fb0b03fd8)) ### Bug Fixes * **release:** add branch check to release notification job to only run on main branch ([f2f8e02](https://github.com/LerianStudio/helm/commit/f2f8e02c5eacdc9ea06d1b5af6df99a73df589db)) * **values:** add comments in values ([#43](https://github.com/LerianStudio/helm/issues/43)) ([03a5842](https://github.com/LerianStudio/helm/commit/03a5842787db8dc1b4d954038b36a343ad7180c1)) * **plugin-access-manager:** add configurable DB_SSLMODE for auth PostgreSQL connections ([dd1d626](https://github.com/LerianStudio/helm/commit/dd1d626766129b1459e768732e2f826d3ad96eac)) * **new:** add DEFAULT_MIDAZ_ORGANIZATION_ID to configmap for enhanced multi-tenancy support ([d7b66a0](https://github.com/LerianStudio/helm/commit/d7b66a052d47394096ecdc18809e7c2d4fffeed3)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([33adde3](https://github.com/LerianStudio/helm/commit/33adde3650e26f65c09643ba8b2fd669bd504adc)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([5f8ca7b](https://github.com/LerianStudio/helm/commit/5f8ca7b5abc6ca7c895af8c3ae1055907689c1d3)) * **product-console:** add image annotation for product-console 1.6.0 ([03c927c](https://github.com/LerianStudio/helm/commit/03c927c3029714c435534a4c72ca450bcdccbd08)) * add kindIs guard for backward compat with string image values ([313d9f6](https://github.com/LerianStudio/helm/commit/313d9f6b646cf3b3bb26cc2644063b16806c1847)) * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](https://github.com/LerianStudio/helm/commit/79ef8f5ea3d7bc2626972fcd4621b1e327c08aed)) * **matcher:** add missing env vars for systemplane and multi-tenant ([965da94](https://github.com/LerianStudio/helm/commit/965da94cdddb8c11654625e071e28c7a83193938)) * add missing MONGO_HOST/MONGO_PORT and align MONGODB_DB_NAME ([0725fa2](https://github.com/LerianStudio/helm/commit/0725fa2b26ed516c15ff1b5292b35581ff437de2)) * **midaz:** add missing MONGO_PARAMETERS to CRM configmap ([2bfecc2](https://github.com/LerianStudio/helm/commit/2bfecc220b7646c57b5e47f141cfb6e79469baec)) * add missing space in MIDAZ_CONSOLE_BASE_PATH template expression ([7b9bb67](https://github.com/LerianStudio/helm/commit/7b9bb677785cd1d381d1b8d497ee0a8bdc921c83)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](https://github.com/LerianStudio/helm/commit/d7765b455710ba5009a931493d351f88f735a1ce)) * **product-console:** add MongoDB connection info to NOTES.txt ([b4d6557](https://github.com/LerianStudio/helm/commit/b4d6557b5ccf5a93a70104bc5d5533171bc0147f)) * **product-console:** add mongodb.enabled flag to values-template ([7024d9d](https://github.com/LerianStudio/helm/commit/7024d9d0d47422b362b400b9494cfd440378122a)) * **configmap:** add new configuration options for deployment mode, private upstreams, and reconciliation settings ([f1a475e](https://github.com/LerianStudio/helm/commit/f1a475ea82bed1d9174193e58e271a5a730a5cc1)) * **plugin-access-manager:** add new configuration options for logging, rate limiting, and MFA in configmap.yaml ([d1e83b2](https://github.com/LerianStudio/helm/commit/d1e83b286a91b144bc44788a4fb457c4273b052f)) * **chart:** add new env var to enable auth plugin ([53b8ffb](https://github.com/LerianStudio/helm/commit/53b8ffb5ef5beaf77756b45e815b946b106c9320)) * add newline at end of values.yaml file ([044905f](https://github.com/LerianStudio/helm/commit/044905f48ff2d9fe8bd7f84770f34bebd700baf9)) * add plugin-br-bank-transfer-jd section to README version matrix ([ccd19ac](https://github.com/LerianStudio/helm/commit/ccd19acf8352c2e4a1390af297c61f0d63d7ae1e)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](https://github.com/LerianStudio/helm/commit/7ba4f9d8fede36092d0a7a60f08620f5ca3fd777)), closes [#1404](https://github.com/LerianStudio/helm/issues/1404) * **fetcher:** add RabbitMQ and storage configuration options, remove unused secret template ([865613d](https://github.com/LerianStudio/helm/commit/865613d1cf6264ee5b97e5e85d342e5f36043415)) * **plugin-br-pix-switch:** add RABBITMQ_URI to dict-hub-vsync configmap ([75074ae](https://github.com/LerianStudio/helm/commit/75074ae94521b346e0a0c167a166988d65084497)) * add required validation for Roles Anywhere ARNs and README migration note ([50e4718](https://github.com/LerianStudio/helm/commit/50e47186dee052e541566d65d2362c8fe175e5a5)), closes [#1](https://github.com/LerianStudio/helm/issues/1) [#3](https://github.com/LerianStudio/helm/issues/3) [#1113](https://github.com/LerianStudio/helm/issues/1113) * add trailing slash to default MIDAZ_ONBOARDING_URL in fees configmap ([fe394c5](https://github.com/LerianStudio/helm/commit/fe394c5e4fde1fb3cca5a5c7cc9a3019ac92cd5f)) * **plugin-br-pix-indirect-btg:** add WEBHOOK_DEFAULT_URL to outbound configmap ([0dd6d81](https://github.com/LerianStudio/helm/commit/0dd6d81592f19d983e0ddfa75dbaf5e00b8fbd85)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * address CodeRabbit CLI review findings ([974bbb8](https://github.com/LerianStudio/helm/commit/974bbb85bee5549825b25a379042eeeaf3f79ba7)) * **plugin-br-pix-switch:** address CodeRabbit feedback on NOTES, README, configmap, and labeler ([78e4615](https://github.com/LerianStudio/helm/commit/78e4615949c5e9b7dabcc2f497d687deae7ccfe4)) * **plugin-br-pix-indirect-btg:** address coderabbit review feedback ([bb664a9](https://github.com/LerianStudio/helm/commit/bb664a9eb52c4e2636397955b7bde365643e34db)) * **lerian-notification:** address CodeRabbit review on initial chart ([36c326f](https://github.com/LerianStudio/helm/commit/36c326fe1bbabd80112ef82cab3bb862fa0a18b1)), closes [#1332](https://github.com/LerianStudio/helm/issues/1332) * **product-console:** address CodeRabbit review on NOTES.txt ([e8cf8d7](https://github.com/LerianStudio/helm/commit/e8cf8d7157aedb39c4d58be3d88e6ac4a044391f)) * **charts:** address CodeRabbit review on revamp PR [#1470](https://github.com/LerianStudio/helm/issues/1470) ([98288a5](https://github.com/LerianStudio/helm/commit/98288a5c6b09efe520675e9c4d605ddb4e8d71f0)), closes [#1](https://github.com/LerianStudio/helm/issues/1) * address CodeRabbit security and quality issues ([eb80852](https://github.com/LerianStudio/helm/commit/eb80852c7012443feebb00cb5d3cb1e6a2a80c2c)) * address remaining CodeRabbit review comments ([6f26a8b](https://github.com/LerianStudio/helm/commit/6f26a8b44643d9eaaa3957d1892f0f763d9da3c3)) * **pix-btg:** adjust default url ([51c4753](https://github.com/LerianStudio/helm/commit/51c4753e916e653ae44829792c8b47a9fc625efd)) * **midaz:** adjust ledger component port from 3000 to 3002 ([8e01518](https://github.com/LerianStudio/helm/commit/8e015184256566ca18c2973067fb8d48e8332fb5)) * **midaz:** adjust ledger component port from 3000 to 3002 ([bb58334](https://github.com/LerianStudio/helm/commit/bb583344a4ba4b59f114355eef6c4339b6d4b102)) * **midaz:** adjust midaz-crm repository image ([5f9fdcb](https://github.com/LerianStudio/helm/commit/5f9fdcb9733aa2b6d620a8d5b61ca7fc54036265)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **tracer:** align chart default port with source convention (2.0.0-beta.6) ([0f8683d](https://github.com/LerianStudio/helm/commit/0f8683dfacda22346b632511a0bfa92b4119f550)), closes [#193](https://github.com/LerianStudio/helm/issues/193) * **flowker:** align chart default port with source convention (2.1.0-beta.6) ([662ad6e](https://github.com/LerianStudio/helm/commit/662ad6e4a39aef852901dd2e1c861018e89fdfaa)), closes [#1308](https://github.com/LerianStudio/helm/issues/1308) * **underwriter:** align chart with app config + standardize VERSION ([9d9a875](https://github.com/LerianStudio/helm/commit/9d9a875ce000cd6136c36fd22967c24c743dbd3a)) * align comment with actual template keys per CodeRabbit review ([338e19c](https://github.com/LerianStudio/helm/commit/338e19ccf967d764ef4165818b585b4698d8e8a5)) * **matcher:** align default securityContext with distroless nonroot UID ([87f0c59](https://github.com/LerianStudio/helm/commit/87f0c59675607d596145d2caa99f96dfd09f1e35)) * **flowker:** align Mongo env vars with app source code ([fdeb22c](https://github.com/LerianStudio/helm/commit/fdeb22c6d2b98425b2c9fae436d4eb81d871eec3)) * align NextAuth URLs with reporter UI base URL ([8d5f4f7](https://github.com/LerianStudio/helm/commit/8d5f4f7e6a671872f6d8e3b95f60b119f89416e0)) * **matcher:** align OTEL env vars with app and bump to v1.0.0-beta.3 ([d1616fb](https://github.com/LerianStudio/helm/commit/d1616fb09bd3e80cce2bbd3e91930771f985ff75)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](https://github.com/LerianStudio/helm/commit/75ad0d4a418787d0d3e85ef8311ee822202e1a2e)) * always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image.tag ([56bfc66](https://github.com/LerianStudio/helm/commit/56bfc666dd2c8d8d83802f026f4ec6436bda8dc4)) * **plugin-br-pix-switch:** apply container securityContext, fix tolerations type, add NOTES defaults ([86b7f17](https://github.com/LerianStudio/helm/commit/86b7f1789c06a09a46d32f9cc2fddcbd560fa25d)) * **onboarding:** auth endpoint and remove old env var ([de370da](https://github.com/LerianStudio/helm/commit/de370daa57563a194d5273888587f0aa95262a0b)) * **transaction:** auth endpoint ([12d8f6d](https://github.com/LerianStudio/helm/commit/12d8f6d3c9d52bff108f220f297d0d4f1db6ca78)) * **values:** auth env vars ([23b34a1](https://github.com/LerianStudio/helm/commit/23b34a13ea547a1587d71689b30adfe02f580dc0)) * **plugin-br-pix-switch:** bootstrap Job fixes surfaced by live install test ([fc9e125](https://github.com/LerianStudio/helm/commit/fc9e12530d40da9dfc6cec51ba2afbd0e66bf9f0)) * bump chart and console versions to 4.4.3 and 3.4.3 ([1cb77cc](https://github.com/LerianStudio/helm/commit/1cb77cc00932d6302e3a71f9bd08253d85f2c3d0)) * **console:** bump image tag to 2.2.1 ([9dfde6e](https://github.com/LerianStudio/helm/commit/9dfde6ee7deb61ef67376dd84d3396845f88fe9f)) * bump plugin-fees chart to version 3.4.4 ([8aaed46](https://github.com/LerianStudio/helm/commit/8aaed46539f10d3879eb7563c1cfa63841d6ddb2)) * change Helm hooks from post-install to pre-install for Postgres and RabbitMQ initialization ([374ccbb](https://github.com/LerianStudio/helm/commit/374ccbb36160f5a614271f65c0a55cf79be568f1)) * chart ([81f1126](https://github.com/LerianStudio/helm/commit/81f112612a3327fffc69da8720b2222122df44a4)) * chart ([f6e6446](https://github.com/LerianStudio/helm/commit/f6e644662db2f641b0e71e3cccd518fa4fe715dc)) * chart app version ([4ae59b0](https://github.com/LerianStudio/helm/commit/4ae59b08085f19e6a20617782e5a3b28044c01f6)) * **tracer:** chart cleanup for 2.0.0-beta.5 ([b8767d5](https://github.com/LerianStudio/helm/commit/b8767d5853b9108a751590468dea17400815f906)) * chart name ([78ae357](https://github.com/LerianStudio/helm/commit/78ae357d208a2835174345b9179c596cf50a401b)) * chart name ([6db8350](https://github.com/LerianStudio/helm/commit/6db83502f0f75b59a5345c27eeade292b31078a9)) * chart name ([1f78da5](https://github.com/LerianStudio/helm/commit/1f78da504538d1a518f503e69b21b1696a893313)) * clean dead OTEL defaults and fix SWAGGER_HOST service names ([76909b8](https://github.com/LerianStudio/helm/commit/76909b801a697be8c28fb345d1f9de611be88bee)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](https://github.com/LerianStudio/helm/commit/5ff9c1d027c1079a972ea550e63d1417b8e3c34d)) * codeowners groups ([#23](https://github.com/LerianStudio/helm/issues/23)) ([b51ff0c](https://github.com/LerianStudio/helm/commit/b51ff0ce5f7d838c2f01565340d91a79cd9c772f)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](https://github.com/LerianStudio/helm/commit/fcaa3b46bf7c06be7c94b7d21bf61b728265bd9d)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](https://github.com/LerianStudio/helm/commit/14924af14cbb6299471ff1d52c0e3591892f13a6)), closes [#1470](https://github.com/LerianStudio/helm/issues/1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](https://github.com/LerianStudio/helm/commit/a3946586aa847615a7082a2c4583646926d53792)) * complete standardization of VERSION across all remaining charts ([63adbb9](https://github.com/LerianStudio/helm/commit/63adbb959f5ea18a22219d7f78d6422f4e9ffb38)) * **plugin-access-manager:** construct dataSourceName at runtime with environment variables ([ac4fd9f](https://github.com/LerianStudio/helm/commit/ac4fd9f94212fed2adbc7d5c6b17e9ad10e3b9cd)) * **plugin-br-pix-switch:** correct appVersion to 1.0.0-beta.1 and add to compatibility matrix ([85bd001](https://github.com/LerianStudio/helm/commit/85bd0015bd9aa7e1def72ed14f981e3a8d080c19)) * **bank-transfer:** correct encryption key env var names ([fb79deb](https://github.com/LerianStudio/helm/commit/fb79deb833c798f68b75e075f8cf6aa2146ad523)) * **flowker:** correct livenessProbe default path from /health/live to /health ([f588107](https://github.com/LerianStudio/helm/commit/f588107a6a543361ceb00d798c9479d1ad37cec3)) * **midaz:** correct RabbitMQ bootstrap secret key reference from RABBITMQ_TRANSACTION_PASS to RABBITMQ_DEFAULT_PASS ([f86aa98](https://github.com/LerianStudio/helm/commit/f86aa9826b425861d1614f01ffacb8f68726975f)) * correct RabbitMQ configuration path in transaction service ([eab6df2](https://github.com/LerianStudio/helm/commit/eab6df2eb2793166f7dc2a3455e562a399dcb096)) * **plugin-access-manager:** correct REDIS_PASSWORD reference in identity secrets ([2c6c323](https://github.com/LerianStudio/helm/commit/2c6c323da55401c0323e3023eb9f6958089bbe5e)) * **plugin-access-manager:** correct REDIS_PORT reference from au to identity in configmap ([aafd65a](https://github.com/LerianStudio/helm/commit/aafd65aebbe2b4d27724a02e969701a3a408621a)) * **fetcher:** correct repository URL in Chart.yaml home field ([378a458](https://github.com/LerianStudio/helm/commit/378a458596b151f37393f4292ef8badf88fc57b5)) * crm ui port ([35f387b](https://github.com/LerianStudio/helm/commit/35f387b6037c85963dc793229e6975ca5addc65c)) * **lerian-notification:** declare kubeVersion compatibility ([fd3067e](https://github.com/LerianStudio/helm/commit/fd3067e0a78ac2d207dc1c64f19f7fad5cdca8cc)) * **product-console:** derive MongoDB service name dynamically in NOTES.txt ([4bbf749](https://github.com/LerianStudio/helm/commit/4bbf749465bf0cbf6112ed3cc32653a0d3972480)) * **auth:** disable auth ingress ([4e08d7a](https://github.com/LerianStudio/helm/commit/4e08d7af33f67b9500b459a40ad93473cf82007f)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](https://github.com/LerianStudio/helm/commit/a38dca3beda61b5ad6a4b56c4712dc63ea3e1555)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](https://github.com/LerianStudio/helm/commit/734a38a07fdb6d694b373b52097502dd0aaae440)) * **midaz:** enable external service bootstrap jobs by default for RabbitMQ and PostgreSQL ([f65f8ff](https://github.com/LerianStudio/helm/commit/f65f8ff4f669f99d0eb55f32826dfb7e2891695d)) * **plugin-access-manager:** enable extra env vars to auth configmap template ([1be8107](https://github.com/LerianStudio/helm/commit/1be8107a59d8f0c5e9a12ceb4b70829dbc90b858)) * **plugin-access-manager:** enable extra env vars to auth ([a085323](https://github.com/LerianStudio/helm/commit/a085323623b5df8283e7583b9f03fefeb3202260)) * **plugin-access-manager:** enable extra env vars to identity configmap template ([01f1efe](https://github.com/LerianStudio/helm/commit/01f1efe5c64a1c8237722d1da80ee322e8e27067)) * **plugin-access-manager:** enable extra env vars to identity ([356b815](https://github.com/LerianStudio/helm/commit/356b8157cdcc1a503aa514f077142283e8ea9b21)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** fail loud on missing infra creds ([5bfc010](https://github.com/LerianStudio/helm/commit/5bfc01046118dc1df300b9c4640186c99a304bf8)) * fix ([8e3d5ad](https://github.com/LerianStudio/helm/commit/8e3d5ad6deff4dc6a84d7f0c343d5e605428686f)) * fix ([3ff9f64](https://github.com/LerianStudio/helm/commit/3ff9f645ed8119d28a4dc256848d27206a4d80ce)) * **audit:** fix audit configmap ([#41](https://github.com/LerianStudio/helm/issues/41)) ([429fdef](https://github.com/LerianStudio/helm/commit/429fdef691c87dc5b4a7e44c236b2550f548c20d)) * **values:** fix autoscaling parameters ([69585b6](https://github.com/LerianStudio/helm/commit/69585b6743736edad8d393c5e50eddc9e4ff114d)) * **matcher:** fix configmap archival condition and S3 endpoint for IAM Roles Anywhere ([53232ae](https://github.com/LerianStudio/helm/commit/53232ae6aec2f6fd8b1a4dba74edad8bf261056f)) * **transaction:** fix default value of rabbitmq secret ([71afd7a](https://github.com/LerianStudio/helm/commit/71afd7a7067ee4b1cf429669e4a44c58479af037)) * **doc:** fix midaz transaction container port ([bab48e6](https://github.com/LerianStudio/helm/commit/bab48e600b179abf07bbc207982803102ea1d704)) * **pipe:** fix pr title workflow ([#34](https://github.com/LerianStudio/helm/issues/34)) ([5134118](https://github.com/LerianStudio/helm/commit/51341186dfd7f643e3be1d598c51d3909748a3dd)) * **midaz:** fix rabbitmq job to apply default definition ([a1349ff](https://github.com/LerianStudio/helm/commit/a1349ff2891e3368d21d9b077fab46c448685356)) * **chart:** fix set secret ref to console deployment ([34b4885](https://github.com/LerianStudio/helm/commit/34b488597985e744a4108eda086a9e14eddac702)) * **transaction:** fix transaction container port ([cb4ec59](https://github.com/LerianStudio/helm/commit/cb4ec592c2c47036bee2b519d795ca08336904dc)) * **midaz:** fix transaction deployment template ([c269284](https://github.com/LerianStudio/helm/commit/c2692846f8f3a30f73c41da792ebf47595e067b1)) * **chart:** fix typo in environment variable name ([2f57d53](https://github.com/LerianStudio/helm/commit/2f57d53b1b47b8ef0829729a37d819949efd03c4)) * **plugin-br-pix-indirect-btg:** fix useExistingSecrets typo in all deployments ([fa2dc49](https://github.com/LerianStudio/helm/commit/fa2dc4964c8080f0825471be4a1a2a3889fa7833)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](https://github.com/LerianStudio/helm/commit/9ae56b40a5b127510b82256975682648e06bbaea)) * generate multiples CHANGELOG's ([3f60787](https://github.com/LerianStudio/helm/commit/3f607875b618db474e4055c44a2cffd8216f4261)) * **lerian-notification:** handle explicit maxUnavailable: null in PDB ([03ee596](https://github.com/LerianStudio/helm/commit/03ee596ecdba8da4e6727236b2785c2d14c0c1c5)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](https://github.com/LerianStudio/helm/issues/1467)) ([7c62a98](https://github.com/LerianStudio/helm/commit/7c62a98cabe072e32a717169317018a2af334e5c)) * helm chart ([9b6552f](https://github.com/LerianStudio/helm/commit/9b6552f37d039bb5187c92319bcc3787d1c4ddcc)) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **plugin-br-pix-indirect-btg:** improve reconciliation config and remove vault annotations ([ad64484](https://github.com/LerianStudio/helm/commit/ad64484db87788071ff7ade533a04754eed58347)) * **components:** init file for auth app ([4939e82](https://github.com/LerianStudio/helm/commit/4939e823f60cdbc0965281f496b058178bf70a00)) * job to apply rabbitmq definitions ([b959644](https://github.com/LerianStudio/helm/commit/b959644941d2f137fd6d766ff3cb6c022ac3354d)) * **plugin-br-pix-switch:** leave adapter-btg-mock ingress untouched ([7a1c827](https://github.com/LerianStudio/helm/commit/7a1c827984df9e31a819f18e05cb5de77aa32457)) * **plugin-br-pix-switch:** liveness probe path /live -> /health ([030af5f](https://github.com/LerianStudio/helm/commit/030af5fd92687e5980a6f2e3357493f037e56496)) * **components:** load definitions for rabbitmq ([167c80a](https://github.com/LerianStudio/helm/commit/167c80a8e156fb653e2e365f155c4c35e2785fca)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](https://github.com/LerianStudio/helm/issues/1465)) ([a39f2c6](https://github.com/LerianStudio/helm/commit/a39f2c652365001992fa259b8d7932f45d65ed8a)) * **plugin-br-pix-switch:** match probe template fallbacks to per-component routePrefix ([ee914d7](https://github.com/LerianStudio/helm/commit/ee914d78ef23df3d368a4465eef80f8641c21730)) * **midaz:** midaz console configmap ([5d8428c](https://github.com/LerianStudio/helm/commit/5d8428ce7fa7fd2678b18b1146bcadbb2fc4ced7)) * midaz nginx proxy config ([46d3af2](https://github.com/LerianStudio/helm/commit/46d3af2330ae02cf7298efc8275cf6e4ee309685)) * move MONGO_URI to secrets and support JD sandbox mode ([6d41468](https://github.com/LerianStudio/helm/commit/6d41468e7e14de2a61f99b90769b7b7643208d0d)) * **plugin-br-pix-switch:** namespace handling + global image tag override ([0fd1ef6](https://github.com/LerianStudio/helm/commit/0fd1ef681a03fabd2937ed48477ad9469ab95c70)) * **midaz:** nginx server definition ([b63b23a](https://github.com/LerianStudio/helm/commit/b63b23a5bf3292d2a36e8872bd3e3a3c257152c5)) * **midaz:** nginx server definition ([d4f18da](https://github.com/LerianStudio/helm/commit/d4f18dadfda3b4446df5cc5f094784decc247f9d)) * **midaz:** nginx server definitions ([9863437](https://github.com/LerianStudio/helm/commit/9863437a6a3d925edcf547ae801389cb9954c145)) * onboarding adjust default value of env var ([d274067](https://github.com/LerianStudio/helm/commit/d274067915c39400b9f920ef6af93f02bbc7d9d9)) * onboarding init container ([46284e5](https://github.com/LerianStudio/helm/commit/46284e5bee1bf07269aeac457c7f7dad74b848b6)) * **lerian-notification:** order SA/ConfigMap/Secret before migrations Job ([23069fc](https://github.com/LerianStudio/helm/commit/23069fcc638795bdc02bc093c770f9cafb0ea135)) * **product-console:** parametrize probes that were missed in initial commit ([5be4277](https://github.com/LerianStudio/helm/commit/5be4277d671dd74af3fbe64dc7bd95295272d50a)) * **reporter:** prevent null env in manager and worker deployments ([51a72c6](https://github.com/LerianStudio/helm/commit/51a72c640b78716a69f2ddee05e5a5be3e1125cd)) * **reporter:** prevent null env in ScaledJob when no env vars are configured ([7fa29b4](https://github.com/LerianStudio/helm/commit/7fa29b47d0859aaae3097af6b33b4585412b230c)) * **plugin-br-pix-switch:** probe paths follow per-component routePrefix ([d6e5264](https://github.com/LerianStudio/helm/commit/d6e5264d2fca1a64ac207978e90ab1a1b2cbde75)), closes [#135](https://github.com/LerianStudio/helm/issues/135) * **plugin-br-pix-switch:** providers ingress default path /mock-btg -> /btg-mock ([b6df396](https://github.com/LerianStudio/helm/commit/b6df396a0984f06c6c3774c0d89bf48bdfd20ac3)) * **docs:** rabbitmq mispelling name ([cefee91](https://github.com/LerianStudio/helm/commit/cefee916b39020938945ce97f442dbdbf3ba6d63)) * **onboarding:** rabbitmq mispelling name ([bf8de0c](https://github.com/LerianStudio/helm/commit/bf8de0cf79e4a40a3fa0bb7581a7f11b9458de76)) * **transaction:** rabbitmq mispelling name ([8e05032](https://github.com/LerianStudio/helm/commit/8e050329da399b563d2ce6f5fa70edcf2291cccd)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** remove common secret to match reporter pattern ([37050a0](https://github.com/LerianStudio/helm/commit/37050a0834a3fc70676e00e3b5dd4018f9e0ec02)) * remove duplicate reporter-manager/secret.yaml with incorrect template references ([e8cc8b6](https://github.com/LerianStudio/helm/commit/e8cc8b6e63e587a9c5fc7c45284c1482ec766564)) * remove empty variable ([48052b2](https://github.com/LerianStudio/helm/commit/48052b2c411e6d882c5c7067f19b4364cdb363e6)) * **release:** remove generate_changelog dependency from back-merge step ([40dfa39](https://github.com/LerianStudio/helm/commit/40dfa390347ce04d88ae8bf22dde9dcc824f93b2)) * **onboarding:** remove grpc port from container ([3bd9621](https://github.com/LerianStudio/helm/commit/3bd96218a95decae1c58cc29078c8bbfd71736a9)) * **midaz:** remove hardcoded localhost URLs from console configmap ([75ab6e8](https://github.com/LerianStudio/helm/commit/75ab6e87a0271f08e48f496b8b753b0f1721d843)) * remove hardcoded namespaceOverride to use release namespace ([f650315](https://github.com/LerianStudio/helm/commit/f650315e2ca1849da559dffb51fd0f01f5669167)) * remove hook ([aa92d78](https://github.com/LerianStudio/helm/commit/aa92d78f74000f6f4f2c7fc22db35cc0010916ca)) * remove hotfix branch from release config ([11d0188](https://github.com/LerianStudio/helm/commit/11d018800fe55cbfc1cc840974248b8c85b5fb0b)) * **plugin-access-manager:** remove imagePullSecrets from values.yaml for identity and auth sections ([238ca51](https://github.com/LerianStudio/helm/commit/238ca519ce930eb2b4431abfd6a0fd69f1efda27)) * **product-console:** remove inconsistent artifacthub image annotation ([77e46c4](https://github.com/LerianStudio/helm/commit/77e46c4b36f2ebf51e7da2d6d6864b3b0d244733)) * **plugin-fees:** remove MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC from configmap ([f3e7f9b](https://github.com/LerianStudio/helm/commit/f3e7f9bae9113bba8d11602afcbd4048778b892a)) * **onboarding:** remove old secrets ([0c7966f](https://github.com/LerianStudio/helm/commit/0c7966f91207c688b0e014bab463dac40846f56e)) * **trasaction:** remove old secrets ([1a2a10c](https://github.com/LerianStudio/helm/commit/1a2a10c9a165c0767f45b7909276c287d5c4d3a3)) * remove RabbitMQ health check from onboarding deployment ([181179e](https://github.com/LerianStudio/helm/commit/181179e4dea9faea9717eb0eafc946f86d6a1192)) * **plugin-br-pix-indirect-btg:** remove trailing newline from values.yaml ([938bf17](https://github.com/LerianStudio/helm/commit/938bf17d10d468c257d83fa4e2a46778deb071aa)) * **plugin-br-bank-transfer:** rename chart to include -helm suffix ([f393e35](https://github.com/LerianStudio/helm/commit/f393e35ec6b5ad070ccc24214771b3c2cfd81fb0)) * **audit:** rename env vars and update container port ([9796046](https://github.com/LerianStudio/helm/commit/979604649c30ce6b8788acb3c1f67dff1a765f63)) * **transaction:** rename env vars and update container port ([4052bc5](https://github.com/LerianStudio/helm/commit/4052bc51634b989fba34c2245319db767aa02275)) * **chart:** rename ledger component to onboarding ([47dd9d0](https://github.com/LerianStudio/helm/commit/47dd9d01c491f30669c3f4ec6271bae1c8d0de75)) * **chart:** rename ledger component to onboarding ([e04404b](https://github.com/LerianStudio/helm/commit/e04404b79c78396a6cb1227cafa5bad10b51d3ee)) * **doc:** rename ledger component to onboarding ([0aa6e34](https://github.com/LerianStudio/helm/commit/0aa6e34ed38d68308cec31b5280b17c017c3d277)) * **components:** rename ledger db for onboarding ([40e49b8](https://github.com/LerianStudio/helm/commit/40e49b8cb2dcf6b169ea4a9c32b5c516f0d06b57)) * **pipe:** rename ledger to onboarding ([448ce90](https://github.com/LerianStudio/helm/commit/448ce9015baee8d553a81f6253d77d76bb96c3ba)) * **bank-transfer:** rename MULTI_TENANT_INFRA_ENABLED to MULTI_TENANT_ENABLED for consistency ([0fb14a6](https://github.com/LerianStudio/helm/commit/0fb14a62d9644d039931afe1c5a6f7291bbaafa8)) * **dependencies:** rename otel to grafana ([#57](https://github.com/LerianStudio/helm/issues/57)) ([974c47f](https://github.com/LerianStudio/helm/commit/974c47f6974d42804e5210d530829efa0394d734)) * **tracer:** rename PLUGIN_AUTH_HOST to PLUGIN_AUTH_ADDRESS (2.0.0-beta.4) ([4be1526](https://github.com/LerianStudio/helm/commit/4be1526c4e9f1415e4ef8dec74533ff1a4ac98fa)) * rename PRIVATE_KEY to KEY in qr-code secrets template ([8736d13](https://github.com/LerianStudio/helm/commit/8736d1343048542d33331c97ded6b3aff1cce369)) * **chart:** resources limits in onboarding and transaction values ([9d788f5](https://github.com/LerianStudio/helm/commit/9d788f5dc9639cb97bf285332c31033fedb0545a)) * **plugin-fees:** revert MIDAZ_TRANSACTION_URL to midaz-transaction default ([0871187](https://github.com/LerianStudio/helm/commit/0871187b0197c5af9439f0cd9f6f1813b68ae4c4)) * rollback midaz version ([e458c1c](https://github.com/LerianStudio/helm/commit/e458c1ccfa01a5f67fb221a3cf33b8cb8054d4b7)) * rollback plugin-access-manager version ([ce2b088](https://github.com/LerianStudio/helm/commit/ce2b08841977784e729d7efeb635c64780072b54)) * **lerian-notification:** self-contain migrations Job; drop hook annotations from SA/ConfigMap/Secret ([068b1e3](https://github.com/LerianStudio/helm/commit/068b1e3fe5ef93f274bf4f219031fc867f43ffc6)) * **plugins:** separate RABBITMQ_HOST from RABBITMQ_URL in bc-correios chart ([#1268](https://github.com/LerianStudio/helm/issues/1268)) ([780aff8](https://github.com/LerianStudio/helm/commit/780aff85155d47316160f60a596dfc7e70b0c6be)) * **plugin-br-pix-indirect-btg:** set DB_SSL_MODE default to disable ([29f2348](https://github.com/LerianStudio/helm/commit/29f2348e7c55bb7eafcb6cfddbc013d2ceeae3f7)) * **plugin-br-pix-switch:** set default PLUGIN_AUTH_URL on auth-using components ([f689afc](https://github.com/LerianStudio/helm/commit/f689afcc5173a3a15fd105fd7a4fbb2605b26f71)) * **product-console:** set image tag to 1.3.0 in values.yaml ([a535b88](https://github.com/LerianStudio/helm/commit/a535b885158731c4ef859e5197f3283dcd2c1b60)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](https://github.com/LerianStudio/helm/issues/1405)) ([e0d9084](https://github.com/LerianStudio/helm/commit/e0d908413cf66830d4afa6a53bac3ce8573a10af)) * **plugin-br-pix-indirect-btg:** set REDIS_TLS default to false in reconciliation configmap ([b8dc4d1](https://github.com/LerianStudio/helm/commit/b8dc4d1af0462ae2f12ba9b1542711d0ebdce300)) * setup otel in template ([#24](https://github.com/LerianStudio/helm/issues/24)) ([837fd03](https://github.com/LerianStudio/helm/commit/837fd03c642b14387299b9b4a50fe00dc22e2f29)) * simplify hotfix branch prerelease configuration ([8f61d2d](https://github.com/LerianStudio/helm/commit/8f61d2d31b87a6f4273beab1f73fe64b3fb78cf0)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](https://github.com/LerianStudio/helm/commit/582ea9751785df979371f64e367c4ceb8a2731de)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](https://github.com/LerianStudio/helm/commit/45d152ab94251e5d08eeeba666d0908c2d90c287)) * **plugin-access-manager:** split migrations and initUser image into repository/tag fields ([5be206a](https://github.com/LerianStudio/helm/commit/5be206ad28843d9de908efb7c329e9305070415f)) * **components:** sql init for auth app ([9824943](https://github.com/LerianStudio/helm/commit/9824943ab8a6d2e038cd55448259c27149c50546)) * **midaz:** standardize base URL configuration using MIDAZ_CONSOLE_BASE_PATH as source of truth ([bc4705a](https://github.com/LerianStudio/helm/commit/bc4705aafe9ab36a3c56264099400543202d7412)) * **plugins:** standardize MIDAZ console URL configuration ([b89bb83](https://github.com/LerianStudio/helm/commit/b89bb837974a805cc9b238684e7d8ab7e752eef6)) * standardize VERSION/OTEL_RESOURCE_SERVICE_VERSION in remaining charts ([4172495](https://github.com/LerianStudio/helm/commit/4172495136f2d17d0897c6b4bdbcc081634a372a)) * **plugin-br-pix-switch:** swap envFrom order so Secret overrides ConfigMap (1.1.0-beta.4) ([c1241c0](https://github.com/LerianStudio/helm/commit/c1241c0f9b2839cbf22ef2ecd73a738a54fa9920)) * **new:** sync migrations job and app versions ([d90d1d7](https://github.com/LerianStudio/helm/commit/d90d1d7042bd1b82a4638dd993274539d9aeed42)) * templates ([bc18fc3](https://github.com/LerianStudio/helm/commit/bc18fc3fddd8736d8694f3be401d1a85fc781039)) * transaction adjust default value of env var ([6e807a9](https://github.com/LerianStudio/helm/commit/6e807a9da365d88d023746233992b316ef1696df)) * transaction init container ([3d3492c](https://github.com/LerianStudio/helm/commit/3d3492c9e0c017d7e904fc26e9aeadfdfbe76c8e)) * **midaz:** update app image tag from 2.2.0 to 2.2.1 ([3103f2d](https://github.com/LerianStudio/helm/commit/3103f2d2f97fdc4021e3702efc7e0f5494fd6fe0)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](https://github.com/LerianStudio/helm/commit/944e1ce9b6af49dfcbd3bce0851093cefc4989eb)) * **configmap:** update APPLICATION_NAME default value to crm ([53b65c3](https://github.com/LerianStudio/helm/commit/53b65c3ecc9a07f901832e99efc45fec3bd1d65f)) * **plugin-access-manager:** update appVersion and image tags to 2.6.2 ([ed831fb](https://github.com/LerianStudio/helm/commit/ed831fb2dca1a1f65988b03edc9d4d14bc14e6bf)) * **plugin-access-manager:** update appVersion and image tags to 2.6.3 ([f4d26c0](https://github.com/LerianStudio/helm/commit/f4d26c0378bfb41d6f0be5de46e7be614463529d)) * **product-console:** update appVersion to 1.3.0 ([c708e76](https://github.com/LerianStudio/helm/commit/c708e76df0e532850dd8d5e2472a4b34c72a249c)) * **plugin-access-manager:** update appVersion to 2.6.5 ([db5045a](https://github.com/LerianStudio/helm/commit/db5045a532276e6bd34b4b30682f58e7f2bca567)) * **plugin-bc-correios:** update br-spb-bc-correios@1.2.0 ([f5d8eca](https://github.com/LerianStudio/helm/commit/f5d8eca7c779bf8b941f7a5bfa94fa6db2bba394)) * update casdoor backend images ([ea9e82b](https://github.com/LerianStudio/helm/commit/ea9e82bfce3259bf88fb13b0b39b0a2f6280c7a1)) * update casdoor backend images ([8c1741d](https://github.com/LerianStudio/helm/commit/8c1741dcd6e3c7df86ed6f5f59d07309792754ba)) * **plugin-fees:** update chart version to 5.4.0 and app version to 3.2.0 ([303911d](https://github.com/LerianStudio/helm/commit/303911d1c080482ac5df1440cf50ad58ea26a581)) * **midaz:** update console@3.4.8, onboarding@3.4.8, transaction@3.4.8 and add back-merge workflow ([2400460](https://github.com/LerianStudio/helm/commit/2400460545b915829faf6f5871c4551f6cc51445)) * update default NGINX_BASE_PATH to use correct service name midaz-console-nginx ([ed89e32](https://github.com/LerianStudio/helm/commit/ed89e324691ebe09e742abb5d9d4e56216efdce5)) * update default value to swagger hot env var ([a691862](https://github.com/LerianStudio/helm/commit/a6918621eee89815ab6e074dbd841f5d7d520b3d)) * update default value to swagger hot env var ([25fe35e](https://github.com/LerianStudio/helm/commit/25fe35e5cba187cdebd9a711f6ceee31e6687936)) * **bank-transfer:** update DEFAULT_TENANT_ID to allow empty default value in configmap ([10ea45e](https://github.com/LerianStudio/helm/commit/10ea45e0ff6d8b0023efc0a293db31390566300c)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](https://github.com/LerianStudio/helm/commit/f7aa25b6756bf756a3d7cc3e0f90fba1b85f31df)) * **ci:** update Helm setup action to v3.5 in release workflow ([6736085](https://github.com/LerianStudio/helm/commit/673608587a310dece3aeb5fda8fd0d408584c4ad)) * **plugin-access-manager:** update identity@2.1.1, auth@2.4.0 and use image.tag for version fields ([e260dee](https://github.com/LerianStudio/helm/commit/e260deef9bc8bafe34a85755c1532a400aac416a)) * update image repository ([4d9116f](https://github.com/LerianStudio/helm/commit/4d9116fd515d1628be6159dbd0c4512de0720a8c)) * update image repository ([43d0cc0](https://github.com/LerianStudio/helm/commit/43d0cc0cc1559589afae24aa9b568206a9902649)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](https://github.com/LerianStudio/helm/commit/68bcd0ba0581b73f7e41b9edcdfe6aff4d9a56fc)) * **plugin-access-manager:** update image tags and add CORS, rate limiting, multi-tenancy, and circuit breaker configurations ([628ad1d](https://github.com/LerianStudio/helm/commit/628ad1d77b88e3bfde9bcf07d14ae64f0f234603)) * **plugin-access-manager:** update image tags for identity and auth components to latest versions ([08f9a6a](https://github.com/LerianStudio/helm/commit/08f9a6a9216b2db51fe0cbd9a35f97eba037a762)) * **midaz:** update ledger service default port from 3000 to 3002 ([2878908](https://github.com/LerianStudio/helm/commit/28789085b331fe28430cfce77a6a2e7f9bb65b97)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **midaz:** update midaz-crm@3.6.2, midaz-ledger@3.6.2 ([960a392](https://github.com/LerianStudio/helm/commit/960a392f9d63e4576dabcc3ed1008be42063c4b5)) * **midaz:** update midaz-crm@3.6.3, midaz-ledger@3.6.3 ([1cce7ba](https://github.com/LerianStudio/helm/commit/1cce7ba9f7494151eb9f62361d6b07915063210a)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](https://github.com/LerianStudio/helm/commit/3c9bea0fedc48926df8151fa421d4c0a27f07ccb)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](https://github.com/LerianStudio/helm/commit/5ee7f4531e5fe78d61e63142f528f98d220bf131)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](https://github.com/LerianStudio/helm/commit/67021d410f8bd95628dc2e1fda00029e587a6408)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](https://github.com/LerianStudio/helm/commit/4852190a64cc81e28e78f9a27d7978187cd1ac72)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](https://github.com/LerianStudio/helm/commit/5c2edb0ebd628ad373269f290736c0ee56899f3b)) * update mongodb ([858c934](https://github.com/LerianStudio/helm/commit/858c93496a5e45fcb84389614536d63ca6b84a02)) * **console:** update mongodb default port ([fd58b09](https://github.com/LerianStudio/helm/commit/fd58b09788b9f7ccc03937ac5e950060110cedf3)) * update nginx deployment config with correct service account and simplified configmap names ([b1119fd](https://github.com/LerianStudio/helm/commit/b1119fdad81d1d4bbcb2c3aecbe74d56cd0a3136)) * **doc:** update nginx ingress config ([#35](https://github.com/LerianStudio/helm/issues/35)) ([d9763ea](https://github.com/LerianStudio/helm/commit/d9763ea4c2139c7d5f020d71422a634f37e15172)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.7, job@1.2.1-beta.7 ([4010717](https://github.com/LerianStudio/helm/commit/4010717e52a535803550f84faf3092439cb063b7)) * update plugin registration URL to use midaz-console-nginx hostname ([0eaca46](https://github.com/LerianStudio/helm/commit/0eaca4642ff0d7907302ecc7e95c1426378a56a8)) * **plugin-access-manager:** update plugin-auth@2.6.0 ([6b5b3d8](https://github.com/LerianStudio/helm/commit/6b5b3d85f0f2312dd0104b79ab3efb7fa707ec80)) * **plugin-access-manager:** update plugin-auth@2.6.1 ([253b5e8](https://github.com/LerianStudio/helm/commit/253b5e8c6dc6940884d28b3d3064b941e7936742)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](https://github.com/LerianStudio/helm/commit/b5892a37b4b8b67cbcf3bee1bb8557b807e637ce)) * **plugin-br-bank-transfer-jd:** update plugin-br-bank-transfer-jd@1.0.0 ([afcdded](https://github.com/LerianStudio/helm/commit/afcdded551872f8fea45bd5811129d967862fc48)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@2.1.0 ([3e29c6c](https://github.com/LerianStudio/helm/commit/3e29c6cbcda36b88db0140e18d1995e41d711ada)) * update plugin-br-pix-indirect-btg pix OTEL_RESOURCE_SERVICE_VERSION ([4fa8d3f](https://github.com/LerianStudio/helm/commit/4fa8d3fa16f4c4db14a353fee4132f3734177229)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.1 ([4397bc6](https://github.com/LerianStudio/helm/commit/4397bc641c2009520ddfa74db5b07ce560682137)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.3 ([b9a4b68](https://github.com/LerianStudio/helm/commit/b9a4b68daddf3bc7f34ece779be416e297372c46)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.2.0 ([5e4b893](https://github.com/LerianStudio/helm/commit/5e4b89388355b6970ad8a7d381b36c66ab7ef7e4)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.0 ([df6de7b](https://github.com/LerianStudio/helm/commit/df6de7b0c40b062351913790901f48423e5f664a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.2 ([ffb414d](https://github.com/LerianStudio/helm/commit/ffb414d8b71c60108afc8d8ca997616610c88a05)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.1 ([adbe456](https://github.com/LerianStudio/helm/commit/adbe456f10361ac91c79e72b81bd171d9d1a28da)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.2 ([2c2b639](https://github.com/LerianStudio/helm/commit/2c2b639e67f749a6e98452ecb09aab79a327e468)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.3 ([e08d78a](https://github.com/LerianStudio/helm/commit/e08d78a8e4220c78695d51a6764417241f8ff8ea)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.4 ([a42a959](https://github.com/LerianStudio/helm/commit/a42a959fd56639a0805eef3dca75d117cdcb407e)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.6 ([fe3749c](https://github.com/LerianStudio/helm/commit/fe3749cd1cd6dae57a2d156181cab624db53aa76)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.7 ([793be45](https://github.com/LerianStudio/helm/commit/793be450b2ee8fdb9042dca0b275845d4461fff8)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.8 ([55681de](https://github.com/LerianStudio/helm/commit/55681def27a6eaf2655b0cdd03ba1d90956db54a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.3.0 ([35c27d1](https://github.com/LerianStudio/helm/commit/35c27d157a06baf08d0c35587b0ba42fa83e003f)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.4.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.4.1, plugin-br-pix-indirect-btg-worker-inbound@1.4.1, plugin-br-pix-indirect-btg-worker-outbound@1.4.1 ([3c6970f](https://github.com/LerianStudio/helm/commit/3c6970fa684f810608c93c9b5a14762913fa0642)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.1, plugin-br-pix-indirect-btg-worker-inbound@1.5.1, plugin-br-pix-indirect-btg-worker-outbound@1.5.1 ([226f506](https://github.com/LerianStudio/helm/commit/226f506964e0b271d4f61ec451a52121371096a3)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.2, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.2, plugin-br-pix-indirect-btg-worker-inbound@1.5.2, plugin-br-pix-indirect-btg-worker-outbound@1.5.2 ([6dbb46c](https://github.com/LerianStudio/helm/commit/6dbb46cfa97ec25e3a96a7c296452ed5a2a93f38)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](https://github.com/LerianStudio/helm/commit/a3c2b6d91208d9a2def2fffe15f9065d6d12e0c0)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-fees:** update plugin-fees@3.0.7 ([844537d](https://github.com/LerianStudio/helm/commit/844537d1ff6d902a454b6f49bd70e431a1b9055f)) * **plugin-fees:** update plugin-fees@3.0.8 ([8c5579c](https://github.com/LerianStudio/helm/commit/8c5579c72b31b43e4a5389112a9849092e645617)) * **plugin-access-manager:** update plugin-identity@2.4.2 ([8b01a14](https://github.com/LerianStudio/helm/commit/8b01a14b077f8fdbc0dd642c1f09b695f27d8623)) * update rabbitmq authentication format to use value field in helm chart ([9ef3305](https://github.com/LerianStudio/helm/commit/9ef33051275a99abd848ef6b1717a8e613e49f94)) * update rabbitmq authentication username field to user ([07a183a](https://github.com/LerianStudio/helm/commit/07a183a8be746cdef266d09dbfe011b04b5da468)) * **product-console:** update readiness probe path to default to root ([2996200](https://github.com/LerianStudio/helm/commit/29962007e8b4428251289da18ac13c97c46fac02)) * **midaz:** update README with ledger service documentation and remove console/nginx references ([e472f4f](https://github.com/LerianStudio/helm/commit/e472f4f192b3ab73f75e17f0968150dca1394e26)) * update reporter cm ([fcdd63c](https://github.com/LerianStudio/helm/commit/fcdd63c752b873d83618c75093f9709aaaebf353)) * **reporter:** update reporter-manager@1.0.0, reporter-worker@1.0.0 ([d586bf1](https://github.com/LerianStudio/helm/commit/d586bf17c2427509b5bdc6a33797b15d4fd126b5)) * **reporter:** update reporter-manager@1.1.1 ([4f98acf](https://github.com/LerianStudio/helm/commit/4f98acfb798423cf6e82b27b2b9dbe97b44d4351)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **matcher:** update securityContext to run as root ([8de4a13](https://github.com/LerianStudio/helm/commit/8de4a13461263bfdac56c72f5521fa4bb228f5b4)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](https://github.com/LerianStudio/helm/commit/4492c3d629bbe1048e250967572a7b6599a15a68)) * **plugin-br-bank-transfer:** update service port and server address to 4027 in configuration files ([dd4e2a0](https://github.com/LerianStudio/helm/commit/dd4e2a05f1c62f619f3cd45bd4f8a9b01a596546)) * update transaction service DNS name in onboarding config ([b98a488](https://github.com/LerianStudio/helm/commit/b98a488e3b27c077eebd65e3bbffcddac2a313e1)) * **reporter:** update worker default image tag to match latest stable release ([147ed4c](https://github.com/LerianStudio/helm/commit/147ed4c20cb81a955402d3d4361852966a11516e)) * **bootstrap-mongodb:** use /bin/bash instead of /bin/sh for mongosh container ([b956943](https://github.com/LerianStudio/helm/commit/b956943f69f1ecee7e90f3db5f75b37c2827d179)) * use /bin/sh instead of /bin/bash in alpine kubectl container ([24c9fc0](https://github.com/LerianStudio/helm/commit/24c9fc0702fd5252105c7ec2774413647a0b7009)) * **matcher:** use configmap value for OBJECT_STORAGE_ENDPOINT with IAM Roles Anywhere ([c0f19a4](https://github.com/LerianStudio/helm/commit/c0f19a4648595b8784d0d5e7ce3f9991074978ac)) * **midaz:** use dig function for safer nested value access in ledger init container timeout ([86ee67d](https://github.com/LerianStudio/helm/commit/86ee67d4f3bfe9281f5336a68a59cb8175e4e2d4)) * use dynamic service names based on release name ([cc9e734](https://github.com/LerianStudio/helm/commit/cc9e7345d452a7ba32263269c8e974a7856c5544)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](https://github.com/LerianStudio/helm/commit/ac4c1e82a13017aa3d2c7d031f449c86ad63bc23)) * **plugin-fees:** use midaz-ledger service for MIDAZ_TRANSACTION_URL default ([9515b35](https://github.com/LerianStudio/helm/commit/9515b3520d4e36ec74eb0279ff30933c0955499e)) * **bootstrap-mongodb:** use name helpers instead of hardcoded names ([d932f48](https://github.com/LerianStudio/helm/commit/d932f48eec2054013278151769001633b0c94091)) * **reporter:** use RABBITMQ_URI for KEDA scaler host ([60809c9](https://github.com/LerianStudio/helm/commit/60809c9273e1f1af8a177038e6c922d3a672b057)) * **plugin-access-manager:** use separate repository and tag for auth backend image ([01b9a5c](https://github.com/LerianStudio/helm/commit/01b9a5c85abd3d26e56ce698b5b0661a227d6c77)) * **reporter:** use unique names for cluster-scoped resources ([5cdaa80](https://github.com/LerianStudio/helm/commit/5cdaa8066d13a312d84a138d81609226f492a745)) * **bootstrap-mongodb:** use updateUser + process.env for safer reconciliation ([13ee1dc](https://github.com/LerianStudio/helm/commit/13ee1dc99078c5581a659ed33b361e7191229200)), closes [#1187](https://github.com/LerianStudio/helm/issues/1187) * **charts:** value key typo and stale README notes ([91ce16f](https://github.com/LerianStudio/helm/commit/91ce16fd0abb82f251f6151bdf34cfd7029edf80)) * values ([b1dc8f7](https://github.com/LerianStudio/helm/commit/b1dc8f7105ab3aa0bbed2549525f013875087b7d)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](https://github.com/LerianStudio/helm/issues/1430)) ([f38d6d9](https://github.com/LerianStudio/helm/commit/f38d6d91fec753cada642103ae242bb388e67669)) ### Performance Improvements * Update resources ([b5f07f0](https://github.com/LerianStudio/helm/commit/b5f07f0fd2319f2bbe3155fd075c1ae7874cf59c)) * Update resources ([9ffc743](https://github.com/LerianStudio/helm/commit/9ffc7430951db115934fb10223f0d9287adfcf60)) ### Reverts * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET from global to component-level secrets ([653594c](https://github.com/LerianStudio/helm/commit/653594ccc07a2fdde1e3f7b09ff627089278a668)) * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET validation from global to pix.secrets ([f95be82](https://github.com/LerianStudio/helm/commit/f95be8266c5b88c92c839060063a69b581a41edf)) ### Miscellaneous Chores * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([28de7ce](https://github.com/LerianStudio/helm/commit/28de7ceb2dd9b39d87ae64d0f64573530a03be9b)) * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([e2113c0](https://github.com/LerianStudio/helm/commit/e2113c0bd99fe8f04e3c4ede5766f3fb99497ec0)) ### Code Refactoring * **plugin-br-payments:** rename PROVIDER_* values to BTG_* ([6454fc3](https://github.com/LerianStudio/helm/commit/6454fc3ff1395821bb4b7d21f3f0bd5915964cc6)) --- charts/streaming-hub/Chart.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index 0cb23156..9452f2e7 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -7,7 +7,7 @@ description: >- type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. -version: 0.1.0 +version: 1.0.0-beta.1 appVersion: "1.0.0" annotations: lerian.studio/chart-type: multi-component @@ -26,6 +26,7 @@ keywords: - fan-out - lerian icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 + # NO dependencies block by deliberate design (deviation from reporter/midaz): # OTEL is env-wired via the OTEL_EXPORTER_OTLP_ENDPOINT downward-API override, # not bundled as an otel-collector-lerian subchart. Declaring it would force an From 5df8bab769de86b41d22cc579abbc1d846dddc86 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Wed, 24 Jun 2026 15:02:56 -0300 Subject: [PATCH 012/113] feat(plugin-br-pix-switch): expose all multi-tenant knobs across MT-aware components The 2.1.0-beta.1 chart shipped partial multi-tenant exposure - three of the MT-aware components were missing the circuit-breaker tunables and the systemplane components could not seed MULTI_TENANT_ENABLED into their store. Enabling MULTI_TENANT_ENABLED=true required hand-patching the rendered ConfigMaps. This change brings the chart's MT surface area in line with what the binaries actually read (verified against plugin-br-pix-switch source, lib-commons v5.8.0): spi + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" spiSystemplane + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_URL: "" + MULTI_TENANT_API_KEY: "" (Secret) dictHub + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" dictHubVsync + MULTI_TENANT_ENABLED: "false" dictSystemplane + MULTI_TENANT_ENABLED: "false" cobHub + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" cobSystemplane + MULTI_TENANT_ENABLED: "false" Defaults match pkg/config (DefaultMultiTenantCBThreshold=5, DefaultMultiTenantCBTimeoutSec=30) so single-tenant deployments (MULTI_TENANT_ENABLED=false) see zero behavioural change. Verified: - helm lint clean - helm template renders the new keys correctly with MT off (defaults) and MT on (overrides flow through) - Cross-checked every added key against the corresponding component's .env.example in the plugin-br-pix-switch source tree --- charts/plugin-br-pix-switch/Chart.yaml | 2 +- charts/plugin-br-pix-switch/values.yaml | 41 ++++++++++++++++++++++++- 2 files changed, 41 insertions(+), 2 deletions(-) diff --git a/charts/plugin-br-pix-switch/Chart.yaml b/charts/plugin-br-pix-switch/Chart.yaml index f601e0e4..ad31b20b 100644 --- a/charts/plugin-br-pix-switch/Chart.yaml +++ b/charts/plugin-br-pix-switch/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 2.1.0-beta.1 +version: 2.1.0-beta.2 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.101" diff --git a/charts/plugin-br-pix-switch/values.yaml b/charts/plugin-br-pix-switch/values.yaml index b8423bf7..ddafcb69 100644 --- a/charts/plugin-br-pix-switch/values.yaml +++ b/charts/plugin-br-pix-switch/values.yaml @@ -241,9 +241,15 @@ spi: MIDAZ_CLIENT_ID: "" MIDAZ_LEDGER_ID: "" MIDAZ_ORGANIZATION_ID: "" - # Multi-tenant + # -- Multi-tenant (consumed when MULTI_TENANT_ENABLED=true). MULTI_TENANT_URL + # and MULTI_TENANT_API_KEY are seeds for the spi-systemplane store; once + # persisted there, env values become optional (a re-deploy without them is + # a supported rollback path). Circuit breaker defaults match the binary + # (pkg/config: DefaultMultiTenantCBThreshold=5, ...CBTimeoutSec=30). MULTI_TENANT_ENABLED: "false" MULTI_TENANT_URL: "" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" secrets: DATABASE_URL: "" @@ -361,12 +367,21 @@ spiSystemplane: OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" OTEL_EXPORTER_OTLP_ENDPOINT: "" + # -- Multi-tenant seeds. When MULTI_TENANT_ENABLED=true, MULTI_TENANT_URL + # and MULTI_TENANT_API_KEY (masked) are seeded into the systemplane store + # at tenant.manager_url / tenant.manager_api_key on first boot. After + # the systemplane row exists, env values can be removed. + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_URL: "" secrets: DATABASE_URL: "" SYSTEMPLANE_POSTGRES_DSN: "" LICENSE_KEY: "" SYSTEMPLANE_SECRET_MASTER_KEY: "" + # -- Tenant Manager API key (consumed when MULTI_TENANT_ENABLED=true on + # spi-systemplane). Seeded into the systemplane store on first boot. + MULTI_TENANT_API_KEY: "" useExistingSecret: false existingSecretName: "" @@ -576,8 +591,14 @@ dictHub: CRM_ORGANIZATION_ID: "" KEY_CACHE_TTL_SEC: "60" MONGO_DB_NAME: "pix-dict" + # -- Multi-tenant (consumed when MULTI_TENANT_ENABLED=true). MULTI_TENANT_URL + # and MULTI_TENANT_API_KEY are seeds for the dict-systemplane store; the CB + # tunables size the tenant-manager client circuit breaker (defaults from + # pkg/config: threshold=5, timeoutSec=30). MULTI_TENANT_ENABLED: "false" MULTI_TENANT_URL: "" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" secrets: DATABASE_URL: "" @@ -698,6 +719,10 @@ dictHubVsync: CRM_BASE_URL: "" CRM_CLIENT_ID: "" CRM_ORGANIZATION_ID: "" + # -- Multi-tenant (vsync uses the per-tenant DSN resolver only; no + # API key here, no CB tunables — the resolver shares the dict-hub + # tenant-manager client config). + MULTI_TENANT_ENABLED: "false" MULTI_TENANT_URL: "" # VSync tunables VSYNC_ENABLED: "true" @@ -910,6 +935,10 @@ dictSystemplane: OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" OTEL_EXPORTER_OTLP_ENDPOINT: "" + # -- Multi-tenant flag. dict-systemplane reads only the boolean (URL + + # API key live on spi-systemplane). When enabled, the systemplane store + # is bootstrapped in MT mode. + MULTI_TENANT_ENABLED: "false" secrets: DATABASE_URL: "" @@ -1011,8 +1040,14 @@ cobHub: PLUGIN_AUTH_URL: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" LICENSE_ORGANIZATION_IDS: "global" ORGANIZATION_ID: "" + # -- Multi-tenant (consumed when MULTI_TENANT_ENABLED=true). MULTI_TENANT_URL + # and MULTI_TENANT_API_KEY are seeds for the cob-systemplane store; the CB + # tunables size the tenant-manager client circuit breaker (defaults from + # pkg/config: threshold=5, timeoutSec=30). MULTI_TENANT_ENABLED: "false" MULTI_TENANT_URL: "" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" secrets: DATABASE_URL: "" @@ -1221,6 +1256,10 @@ cobSystemplane: OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" OTEL_EXPORTER_OTLP_ENDPOINT: "" + # -- Multi-tenant flag. cob-systemplane reads only the boolean (URL + + # API key live on spi-systemplane). When enabled, the systemplane store + # is bootstrapped in MT mode. + MULTI_TENANT_ENABLED: "false" secrets: DATABASE_URL: "" From 1049b05c4bff8e27a13d4b4ef34384032032ee3a Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 18:10:39 +0000 Subject: [PATCH 013/113] chore(release): 2.1.0-beta.2 ## (2026-06-24) ### Features * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) ### Bug Fixes * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index 80bfa9db..b1c12f4f 100644 --- a/README.md +++ b/README.md @@ -103,7 +103,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `2.1.0-beta.1` | 1.0.0-beta.1 | +| `2.1.0-beta.2` | 1.0.0-beta.1 | ----------------- ### Plugin BR Pix Indirect BTG From 8f279f4abb834de38ef176958a65874878187619 Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Wed, 24 Jun 2026 17:14:22 -0300 Subject: [PATCH 014/113] feat(charts): add streaming-hub out-of-band DB migration support Adds the chart's out-of-band DB migration support: a PreSync migrations Job (weight -1) running the streaming-hub-migrations image, a minimal DSN-only PreSync Secret (-5), and bootstrap-postgres promoted to a PreSync hook (-10). Full ordering: bootstrap-postgres (-10) -> migration-secret (-5) -> migrations Job (-1) -> app (main Sync). Default OFF (migrations.enabled=false). CodeRabbit review addressed: reserved hook/wave keys filtered out of custom migrations.annotations; README documents the existingSecretName pre-existence requirement. The lingering-DSN-Secret finding is intentionally declined and documented in-template (hook-succeeded would delete the DSN before the Job at wave -1 reads it; the Secret only duplicates the DSN already in the app Secret). https://claude.ai/code/session_016Bv8y35GWdpgNdhGVs28JZ --- charts/streaming-hub/README.md | 12 +- charts/streaming-hub/templates/_helpers.tpl | 13 ++ .../templates/bootstrap-postgres.yaml | 11 ++ .../templates/migration-secret.yaml | 48 +++++++ .../streaming-hub/templates/migrations.yaml | 124 ++++++++++++++++++ charts/streaming-hub/values.yaml | 62 +++++++++ 6 files changed, 269 insertions(+), 1 deletion(-) create mode 100644 charts/streaming-hub/templates/migration-secret.yaml create mode 100644 charts/streaming-hub/templates/migrations.yaml diff --git a/charts/streaming-hub/README.md b/charts/streaming-hub/README.md index 473d4bb7..2c3fb1a9 100644 --- a/charts/streaming-hub/README.md +++ b/charts/streaming-hub/README.md @@ -16,6 +16,7 @@ infra, and OTEL is env-wired (see [External dependencies](#external-dependencies - Chart type: `multi-component` - Required secrets: `secrets.STREAMING_HUB_POSTGRES_DSN` (the DSN carries the DB password); `secrets.STREAMING_HUB_KAFKA_SCRAM_USERNAME` + `secrets.STREAMING_HUB_KAFKA_SCRAM_PASSWORD` (when the broker requires SASL/SCRAM); `secrets.STREAMING_HUB_KEK_REF` (KEK reference for the F10 envelope crypto — `secrets.STREAMING_HUB_DEV_KEK` for dev only). SaaS-only, required when `STREAMING_HUB_MULTI_TENANT_ENABLED=true`: `secrets.STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY` and `secrets.STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD`. All blank by default — provide inline or set `streamingHub.useExistingSecret` + `streamingHub.existingSecretName` (the path GitOps uses, with a Vault-injected Secret). - Dependency notes: **No bundled subcharts.** Kafka/Redpanda and PostgreSQL are shared external infra — supply `common.configmap.STREAMING_HUB_KAFKA_BROKERS` and `secrets.STREAMING_HUB_POSTGRES_DSN`. OTEL is env-wired to a node-local collector (`HOST_IP:4317`, gated on `streamingHub.telemetry.enabled`) — there is no OTEL collector subchart. The optional `bootstrap-postgres` Job provisions the hub's single database when `global.externalPostgresDefinitions.enabled=true`. +- Migrations: the hub applies its schema **out of band** (the app never migrates itself). Enable the migration Job with `streamingHub.migrations.enabled=true` (default off). It is a PreSync hook that runs the stock `migrate/migrate` toolchain (image `ghcr.io/lerianstudio/streaming-hub-migrations`) BEFORE the app rolls out. The hook chain is **`bootstrap-postgres` (sync-wave -10, role+db) → `migration-secret` (-5, the DSN) → `migrations` Job (-1, the schema) → app Deployment (main Sync)**. The Job's only env is `STREAMING_HUB_POSTGRES_DSN` (from the migration-secret, or `migrations.existingSecretName` when `migrations.useExistingSecret=true`). Without it, ingest/dispatcher/partition workers crash on `relation "event_inbox"/"delivery_jobs" does not exist (42P01)`. **When `migrations.useExistingSecret=true`, the named secret must already exist in the namespace before the PreSync phase runs** — do not point it at the chart-managed application Secret (`streamingHub.existingSecretName` / inline `secrets.*`), which is created later in the main Sync phase and is therefore absent when the hook fires; the chart provisions its own PreSync `migration-secret` precisely to close that ordering gap. - Production overrides: choose `streamingHub.mode` (`all` vs `split`); size per-role `replicaCount` / `autoscaling` / `resources` and the Postgres pool (`poolMaxOpenConns` / `poolMaxIdleConns`) honoring **Σ(replicas × poolMaxOpenConns) ≤ Postgres `max_connections`**; set `image.tag`, `ingress`, and the secrets (inline or `useExistingSecret`). - Source/license: Source is in `github.com/LerianStudio/helm`; license is Apache-2.0. @@ -202,7 +203,16 @@ This chart provisions **none** of the following — they live outside it: | `streamingHub..poolMaxIdleConns` | all `12` / ingest `4` / delivery `10` | | | `streamingHub..autoscaling.enabled` | `false` | HPA per role (`autoscaling/v2`, CPU+memory). | | `streamingHub..pdb.enabled` | `false` | PodDisruptionBudget per role (`policy/v1`). | -| `global.externalPostgresDefinitions.enabled` | `false` | Bootstrap Job for the hub's one DB/role. | +| `global.externalPostgresDefinitions.enabled` | `false` | Bootstrap Job for the hub's one DB/role (PreSync, sync-wave -10). | +| `streamingHub.migrations.enabled` | `false` | Out-of-band schema migration Job (PreSync, sync-wave -1). | +| `streamingHub.migrations.image.repository` | `ghcr.io/lerianstudio/streaming-hub-migrations` | Migrations image (`FROM migrate/migrate` + the hub's `migrations/`). | +| `streamingHub.migrations.image.tag` | `""` | Empty falls back to `streamingHub.image.tag`, then `Chart.appVersion`. | +| `streamingHub.migrations.image.digest` | `""` | Pin by digest; wins over tag. | +| `streamingHub.migrations.useExistingSecret` | `false` | `true` = Job reads `STREAMING_HUB_POSTGRES_DSN` from `existingSecretName`. | +| `streamingHub.migrations.existingSecretName` | `""` | Required when `migrations.useExistingSecret`. Must already exist before the PreSync phase — not the main-Sync app Secret. | +| `streamingHub.migrations.backoffLimit` | `3` | Job retry cap. | +| `streamingHub.migrations.activeDeadlineSeconds` | `600` | Job wall-clock cap. | +| `streamingHub.migrations.ttlSecondsAfterFinished` | `600` | Finished-Job GC TTL. | For the full env contract (defaults, required-in-SaaS markers, the F4 tenant caution, KEK source vars), see `streaming-hub/.env.reference`. diff --git a/charts/streaming-hub/templates/_helpers.tpl b/charts/streaming-hub/templates/_helpers.tpl index 3853bc47..6d497d8c 100644 --- a/charts/streaming-hub/templates/_helpers.tpl +++ b/charts/streaming-hub/templates/_helpers.tpl @@ -109,3 +109,16 @@ Input: root context (.). {{- include "streaming-hub.fullname" . -}} {{- end -}} {{- end -}} + +{{/* +streaming-hub.migrationDSN — STREAMING_HUB_POSTGRES_DSN for the migration-only +Secret hook. migration-secret.yaml renders only on the chart-managed credential +path (NOT migrations.useExistingSecret), and runs as a PreSync hook BEFORE the +normal app Secret exists, so the operator MUST supply the DSN here. Kept as a +named gate helper (not an inline `required`) to mirror the bank-transfer pattern. +Input: root context (.). +*/}} +{{- define "streaming-hub.migrationDSN" -}} +{{- $secrets := get (.Values.streamingHub | default dict) "secrets" | default dict -}} +{{- required "streamingHub.secrets.STREAMING_HUB_POSTGRES_DSN is required when migrations run with a chart-managed Secret (migrations.useExistingSecret=false)" (get $secrets "STREAMING_HUB_POSTGRES_DSN") -}} +{{- end -}} diff --git a/charts/streaming-hub/templates/bootstrap-postgres.yaml b/charts/streaming-hub/templates/bootstrap-postgres.yaml index 7f8fd450..fb906f6b 100644 --- a/charts/streaming-hub/templates/bootstrap-postgres.yaml +++ b/charts/streaming-hub/templates/bootstrap-postgres.yaml @@ -19,6 +19,17 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "streaming-hub.labels" (dict "context" . "component" "bootstrap") | nindent 4 }} + annotations: + # PreSync hook at the FRONT of the chain (weight -10 / sync-wave -10): creates + # the hub's role+db BEFORE the migration-secret (-5), the migrations Job (-1), + # and the app Deployment (main Sync). Idempotent — it creates the role/db only + # when absent (see the script), so re-running on every sync is safe. + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-weight": "-10" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "argocd.argoproj.io/hook": PreSync + "argocd.argoproj.io/sync-wave": "-10" + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation,HookSucceeded spec: ttlSecondsAfterFinished: 300 completions: 1 diff --git a/charts/streaming-hub/templates/migration-secret.yaml b/charts/streaming-hub/templates/migration-secret.yaml new file mode 100644 index 00000000..d6a78ae7 --- /dev/null +++ b/charts/streaming-hub/templates/migration-secret.yaml @@ -0,0 +1,48 @@ +{{- $streamingHub := .Values.streamingHub | default dict }} +{{- $migrations := get $streamingHub "migrations" | default dict }} +{{- $migrationsEnabled := eq (lower (toString (get $migrations "enabled" | default false))) "true" }} +{{- $migUseExisting := eq (lower (toString (get $migrations "useExistingSecret" | default false))) "true" }} +{{- /* +Minimal, migration-only Secret carrying ONLY STREAMING_HUB_POSTGRES_DSN. + +Rendered ONLY when migrations are enabled AND a chart-managed credential is used +(migrations.useExistingSecret=false). In that case the migration Job runs as a +pre-install/pre-upgrade hook (weight -1) BEFORE the normal application Secret +(secrets.yaml, a normal main-sync resource) exists, so it needs its own credential +available early. This Secret is a PreSync hook at weight -5 / sync-wave -5 — after +bootstrap-postgres (-10), before the migration Job (-1). + +It holds ONLY the DSN; the full application Secret stays a NORMAL (non-hook) +resource so its sensitive runtime keys are never left behind as orphaned hooks on +uninstall. +*/}} +{{- if and $migrationsEnabled (not $migUseExisting) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-migrations" (include "streaming-hub.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "migrations") | nindent 4 }} + annotations: + # PreSync hook (weight -5 / sync-wave -5) so it exists before the migration Job + # (weight -1) and after bootstrap-postgres (weight -10). Holds ONLY the DSN; see + # the comment above for why the full application Secret is intentionally NOT a hook. + # + # Delete policy is before-hook-creation ONLY — deliberately NOT hook-succeeded. + # This Secret is consumed by a LATER hook (the migrations Job at weight -1); both + # Helm and ArgoCD treat a Secret as "succeeded" the moment it applies, so a + # hook-succeeded policy would delete the DSN at the end of wave -5, BEFORE the + # Job at wave -1 can read it — reintroducing the migration failure this exists to + # fix. The trade-off: the Secret lingers post-run, but it only duplicates the DSN + # already held permanently by the app's main Secret, so it adds no new exposure. + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": before-hook-creation + "argocd.argoproj.io/hook": PreSync + "argocd.argoproj.io/sync-wave": "-5" + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation +type: Opaque +stringData: + STREAMING_HUB_POSTGRES_DSN: {{ include "streaming-hub.migrationDSN" . | quote }} +{{- end }} diff --git a/charts/streaming-hub/templates/migrations.yaml b/charts/streaming-hub/templates/migrations.yaml new file mode 100644 index 00000000..2efe5e23 --- /dev/null +++ b/charts/streaming-hub/templates/migrations.yaml @@ -0,0 +1,124 @@ +{{- $streamingHub := .Values.streamingHub | default dict }} +{{- $migrations := get $streamingHub "migrations" | default dict }} +{{- $migrationImage := get $migrations "image" | default dict }} +{{- $defaultMigrationResources := dict "requests" (dict "cpu" "50m" "memory" "64Mi") "limits" (dict "cpu" "250m" "memory" "256Mi") }} +{{- $migrationsEnabled := eq (lower (toString (get $migrations "enabled" | default false))) "true" }} +{{- if $migrationsEnabled }} +{{- /* +OUT-OF-BAND schema migration Job. The hub never migrates itself; this Job applies +the SQL migrations BEFORE the app rolls out. PreSync hook at weight -1 — after +bootstrap-postgres (-10, creates role+db) and migration-secret (-5, carries the +DSN), before the app Deployment (main Sync). Runs ONCE regardless of +streamingHub.mode (all | split) — it is not per-role. + +The runner is the stock migrate/migrate toolchain baked with the hub's migrations/ +dir; its entrypoint runs `migrate -path=/migrations -database="$STREAMING_HUB_POSTGRES_DSN" up`, +so the ONLY required env is STREAMING_HUB_POSTGRES_DSN (secretKeyRef). +*/}} +{{- /* Secret resolution — STREAMING_HUB_POSTGRES_DSN source. */}} +{{- $migUseExisting := eq (lower (toString (get $migrations "useExistingSecret" | default false))) "true" }} +{{- $dsnSecretName := "" }} +{{- if $migUseExisting }} +{{- $dsnSecretName = required "streamingHub.migrations.existingSecretName is required when streamingHub.migrations.useExistingSecret=true" (get $migrations "existingSecretName") }} +{{- else }} +{{- $dsnSecretName = printf "%s-migrations" (include "streaming-hub.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- $namespace := include "global.namespace" . }} +{{- /* Image resolution — explicit digest > explicit tag > app tag (streamingHub.image.tag) > chart appVersion. */}} +{{- $migrationTag := get $migrationImage "tag" | default "" }} +{{- $migrationDigest := get $migrationImage "digest" | default "" }} +{{- if and (empty $migrationTag) (empty $migrationDigest) }} +{{- $migrationTag = $streamingHub.image.tag | default .Chart.AppVersion }} +{{- end }} +{{- $migrationRepository := get $migrationImage "repository" | default "ghcr.io/lerianstudio/streaming-hub-migrations" }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ printf "%s-migrations" (include "streaming-hub.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $namespace }} + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "migrations") | nindent 4 }} + annotations: + # External Postgres host (bootstrap-postgres provisions the role+db at PreSync + # weight -10) — run BEFORE the app rolls out (schema-first). + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-weight": "-1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "argocd.argoproj.io/hook": PreSync + "argocd.argoproj.io/sync-wave": "-1" + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation,HookSucceeded + {{- /* + Custom annotations are merged AFTER the fixed set, but the hook/wave keys are + filtered out so a user annotation can NEVER knock this Job out of PreSync or + shift its wave — that would reintroduce the empty-schema rollout this Job + exists to prevent. The fixed hook chain always wins. + */}} + {{- range $k, $v := (get $migrations "annotations") }} + {{- if or (hasPrefix "helm.sh/hook" $k) (hasPrefix "argocd.argoproj.io/hook" $k) (eq $k "argocd.argoproj.io/sync-wave") }} + {{- /* reserved hook/wave key — ignored to preserve the schema-first ordering */}} + {{- else }} + {{ $k | quote }}: {{ $v | quote }} + {{- end }} + {{- end }} +spec: + backoffLimit: {{ get $migrations "backoffLimit" | default 3 }} + activeDeadlineSeconds: {{ get $migrations "activeDeadlineSeconds" | default 600 }} + ttlSecondsAfterFinished: {{ get $migrations "ttlSecondsAfterFinished" | default 600 }} + template: + metadata: + labels: + {{- include "streaming-hub.labels" (dict "context" . "component" "migrations") | nindent 8 }} + {{- with (get $migrations "podAnnotations") }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with (get $streamingHub "imagePullSecrets") }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: migrations + {{- if $migrationDigest }} + image: "{{ $migrationRepository }}@{{ $migrationDigest }}" + {{- else }} + image: "{{ $migrationRepository }}:{{ $migrationTag }}" + {{- end }} + imagePullPolicy: {{ get $migrationImage "pullPolicy" | default "IfNotPresent" }} + env: + # The baked migrate/migrate entrypoint runs: + # migrate -path=/migrations -database="$STREAMING_HUB_POSTGRES_DSN" up + - name: STREAMING_HUB_POSTGRES_DSN + valueFrom: + secretKeyRef: + name: {{ $dsnSecretName }} + key: STREAMING_HUB_POSTGRES_DSN + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + {{- toYaml (get $migrations "resources" | default $defaultMigrationResources) | nindent 12 }} + {{- with (get $streamingHub "nodeSelector") }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $streamingHub "affinity") }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $streamingHub "tolerations") }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/streaming-hub/values.yaml b/charts/streaming-hub/values.yaml index 5c3b40ce..84f3d97c 100644 --- a/charts/streaming-hub/values.yaml +++ b/charts/streaming-hub/values.yaml @@ -312,6 +312,68 @@ streamingHub: # SaaS tenant pub/sub Redis AUTH password (optional even in SaaS). STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD: "" + # =========================================================================== + # migrations — OUT-OF-BAND schema migration Job (Helm + ArgoCD PreSync hook). + # + # The hub NEVER migrates itself (the app refuses to). Without this Job, ingest / + # dispatcher / partition workers spin on `relation "event_inbox"/"delivery_jobs" + # does not exist (42P01)`. This Job applies the SQL migrations BEFORE the app + # rolls out. + # + # ORDERING (the load-bearing design): the chain is + # bootstrap-postgres (PreSync weight -10, creates role+db) + # -> migration-secret (PreSync weight -5, carries the DSN) + # -> migrations Job (PreSync weight -1, creates the schema) + # -> app Deployment (main Sync) + # + # The runner is the stock `migrate/migrate` toolchain baked with the hub's + # `migrations/` dir; its entrypoint runs + # migrate -path=/migrations -database="$STREAMING_HUB_POSTGRES_DSN" up + # so the Job's ONLY required env is STREAMING_HUB_POSTGRES_DSN (secretKeyRef). + # It runs ONCE regardless of streamingHub.mode (all | split) — it is not per-role. + # =========================================================================== + migrations: + # -- Enable or disable the migrations Job. Default false — opt-in per env + # (consistent with the chart's other optional features). + enabled: false + # -- Optional. When true, the Job reads STREAMING_HUB_POSTGRES_DSN from a + # pre-existing Secret (existingSecretName) instead of the chart-managed + # migration-secret hook. Independent of streamingHub.useExistingSecret; + # set this to point migrations at the app's existing (e.g. Vault) Secret. + useExistingSecret: false + # -- Name of the pre-existing Secret holding STREAMING_HUB_POSTGRES_DSN + # (only used when migrations.useExistingSecret=true). + existingSecretName: "" + image: + # -- Migrations image (FROM migrate/migrate + COPY migrations/ /migrations/). + repository: ghcr.io/lerianstudio/streaming-hub-migrations + # -- Tag for the migrations image. Empty falls back to the app image tag + # (streamingHub.image.tag, or the chart appVersion). An explicit tag + # or digest overrides this. + tag: "" + # -- Pin by digest (sha256:...) instead of tag. Wins over tag when set. + digest: "" + # -- Image pull policy. + pullPolicy: IfNotPresent + # -- Maximum retries before the Job is considered failed. + backoffLimit: 3 + # -- Hard wall-clock cap on the Job (seconds). + activeDeadlineSeconds: 600 + # -- TTL after which a finished Job is garbage-collected (seconds). + ttlSecondsAfterFinished: 600 + # -- Extra annotations on the Job (merged after the hook annotations). + annotations: {} + # -- Extra annotations on the migration pod. + podAnnotations: {} + # -- Resource requests/limits for the migration container. + resources: + limits: + cpu: 250m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi + # =========================================================================== # Per-role blocks. Each carries replicaCount, resources, autoscaling, pdb, and # the Postgres pool sizing injected as explicit per-Deployment env. From 236c2ee8784d69a96afdd51e3cb647cc4e05a747 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 24 Jun 2026 20:15:22 +0000 Subject: [PATCH 015/113] chore(release): 1.0.0-beta.2 ## (2026-06-24) ### Features * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) ### Bug Fixes * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) --- README.md | 2 +- charts/streaming-hub/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a72db276..0f24c778 100644 --- a/README.md +++ b/README.md @@ -271,5 +271,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.1` | 1.0.0 | +| `1.0.0-beta.2` | 1.0.0 | ----------------- diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index 9452f2e7..11ea72c6 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -7,7 +7,7 @@ description: >- type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. -version: 1.0.0-beta.1 +version: 1.0.0-beta.2 appVersion: "1.0.0" annotations: lerian.studio/chart-type: multi-component From 7d719d1dc72de12f0b8bd33b3c487651ea26c558 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Thu, 25 Jun 2026 13:12:49 +0000 Subject: [PATCH 016/113] feat(streaming-hub): update streaming-hub@1.0.0 - new env vars --- charts/streaming-hub/Chart.yaml | 5 +-- .../templates/streaming-hub/secret.yaml | 14 ++++++++ charts/streaming-hub/values.yaml | 36 ++----------------- 3 files changed, 18 insertions(+), 37 deletions(-) create mode 100644 charts/streaming-hub/templates/streaming-hub/secret.yaml diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index 11ea72c6..8c5657e8 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -1,9 +1,7 @@ apiVersion: v2 name: streaming-hub-helm description: >- - Lerian streaming-hub — consumes lib-streaming CloudEvents from Kafka/Redpanda - and fans them out to per-tenant SaaS/BYOC subscribers. Multi-component chart - with a runtime STREAMING_HUB_ROLE model (mode: all | split). + Lerian streaming-hub — consumes lib-streaming CloudEvents from Kafka/Redpanda and fans them out to per-tenant SaaS/BYOC subscribers. Multi-component chart with a runtime STREAMING_HUB_ROLE model (mode: all | split). type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. @@ -26,7 +24,6 @@ keywords: - fan-out - lerian icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 - # NO dependencies block by deliberate design (deviation from reporter/midaz): # OTEL is env-wired via the OTEL_EXPORTER_OTLP_ENDPOINT downward-API override, # not bundled as an otel-collector-lerian subchart. Declaring it would force an diff --git a/charts/streaming-hub/templates/streaming-hub/secret.yaml b/charts/streaming-hub/templates/streaming-hub/secret.yaml new file mode 100644 index 00000000..991a0785 --- /dev/null +++ b/charts/streaming-hub/templates/streaming-hub/secret.yaml @@ -0,0 +1,14 @@ +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "streaming-hub-helm.fullname" . }}-streaming-hub + labels: + {{- include "streaming-hub-helm.labels" . | nindent 4 }} + app.kubernetes.io/component: streaming-hub +type: Opaque +data: + POSTGRES_PASSWORD: {{ .Values.streaming-hub.secrets.POSTGRES_PASSWORD | default "streaming_hub" | b64enc | quote }} + # Extra Secret Vars + {{- if .Values.streaming-hub.extraSecretVars }} + {{- toYaml .Values.streaming-hub.extraSecretVars | nindent 2 }} + {{- end }} diff --git a/charts/streaming-hub/values.yaml b/charts/streaming-hub/values.yaml index 84f3d97c..0438ac83 100644 --- a/charts/streaming-hub/values.yaml +++ b/charts/streaming-hub/values.yaml @@ -15,7 +15,6 @@ nameOverride: "" fullnameOverride: "" # -- Override the namespace (defaults to .Release.Namespace). namespaceOverride: "" - global: # -- Bootstrap Job for an external/shared PostgreSQL: creates the hub's ONE # database + role and grants privileges. The hub owns a SINGLE database with @@ -50,7 +49,6 @@ global: name: "" # -- Password for the hub role (ignored if useExistingSecret.name is set). password: "" - # ============================================================================= # streamingHub — the single root key for everything the hub owns. # ============================================================================= @@ -67,7 +65,6 @@ streamingHub: # The mode switch enforces either/or — do not work around it. !!! # The values.schema.json constrains this to the enum ["all","split"]. mode: all - image: # -- Container image repository. repository: ghcr.io/lerianstudio/streaming-hub @@ -75,29 +72,23 @@ streamingHub: pullPolicy: IfNotPresent # -- Image tag. Empty falls back to Chart.appVersion via the defaultTag helper. tag: "" - # -- Secrets for pulling the image from a private registry. imagePullSecrets: - name: ghcr-credential - # -- Number of old ReplicaSets to retain for rollback. revisionHistoryLimit: 10 - # -- Annotations applied to every Deployment resource. annotations: {} # -- Annotations applied to every pod. podAnnotations: {} - # -- Deployment update strategy (shared by all roles). deploymentStrategy: type: RollingUpdate rollingUpdate: maxSurge: 1 maxUnavailable: 0 - # -- Pod-level security context. Empty by default (the hub needs no fsGroup). podSecurityContext: {} - # -- Container-level security context (distroless:nonroot, uid/gid 65532). securityContext: # -- Group ID for the process inside the container. @@ -114,7 +105,6 @@ streamingHub: allowPrivilegeEscalation: false seccompProfile: type: RuntimeDefault - service: # -- Service type. MUST be ClusterIP (Lerian convention; Ingress fronts external). type: ClusterIP @@ -122,7 +112,6 @@ streamingHub: port: 8080 # -- Annotations for every Service. annotations: {} - ingress: # -- Enable or disable the control-plane Ingress (opt-in per env in gitops). enabled: false @@ -141,7 +130,6 @@ streamingHub: # - secretName: streaming-hub-tls # hosts: # - streaming-hub.lerian.net - serviceAccount: # -- Whether a ServiceAccount is created. create: true @@ -153,7 +141,6 @@ streamingHub: # in-cluster Kubernetes API calls. (IRSA's projected token is injected by # the EKS webhook independently of this, so it stays functional.) automountServiceAccountToken: false - # -- Graceful-shutdown window. Defaults to the hub's derived SIGTERM drain # ceiling (80s) at STREAMING_HUB_SHUTDOWN_TIMEOUT=30s + # STREAMING_HUB_PRE_STOP_DRAIN_TIMEOUT=5s: 30s HTTP + 5s consumer-commit + @@ -163,7 +150,6 @@ streamingHub: # preStop hook is used — the hub self-drains on SIGTERM (PID 1 receives it # directly; exec-form ENTRYPOINT). terminationGracePeriodSeconds: 80 - # -- Liveness probe tuning (GET /healthz on the http port; stays 200 during drain). livenessProbe: initialDelaySeconds: 15 @@ -178,15 +164,12 @@ streamingHub: timeoutSeconds: 5 successThreshold: 1 failureThreshold: 3 - # -- Shared default scheduling (per-role blocks may override). nodeSelector: {} tolerations: {} affinity: {} - # -- Extra non-sensitive env vars injected on every Deployment (list of {name,value}). extraEnvVars: [] - # =========================================================================== # telemetry — CHART-LEVEL OTEL wiring toggle (NOT an app env var; never shipped # to the container). When enabled, each Deployment injects HOST_IP via the @@ -198,7 +181,6 @@ streamingHub: telemetry: # -- Inject the per-pod OTLP endpoint override (HOST_IP downward API). enabled: false - # =========================================================================== # Secret sourcing. # useExistingSecret=false -> the chart renders templates/secret.yaml (inline). @@ -207,7 +189,6 @@ streamingHub: # =========================================================================== useExistingSecret: false existingSecretName: "" - # =========================================================================== # common.configmap — role-INVARIANT, NON-SENSITIVE env (one shared ConfigMap). # Every key MUST exist verbatim in streaming-hub/.env.reference, EXCEPT the @@ -225,22 +206,18 @@ streamingHub: STREAMING_HUB_LOG_LEVEL: "info" STREAMING_HUB_HTTP_LISTEN_ADDR: ":8080" STREAMING_HUB_METRICS_ENABLED: "true" - # --- kafka / redpanda (external) --- STREAMING_HUB_KAFKA_BROKERS: "localhost:19092" STREAMING_HUB_KAFKA_SCRAM_MECHANISM: "" # Plaintext Kafka opt-in. MUST stay "false" for staging/production # (rejected at boot when STREAMING_HUB_ENV=production). STREAMING_HUB_ALLOW_INSECURE_KAFKA: "false" - # --- crypto / KEK (the material itself is a Secret) --- # env | secretsmanager. KEK material arrives via the var named by KEK_REF. STREAMING_HUB_KEK_SOURCE: "env" - # --- auth (lib-auth / plugin-auth JWT; PLUGIN_AUTH_ prefix, NOT STREAMING_HUB_) --- PLUGIN_AUTH_ENABLED: "true" PLUGIN_AUTH_ADDRESS: "http://plugin-access-manager-auth:4000" - # --- tenancy (F4) --- # default = BYOC single-tenant. A non-default value quarantines all # other ce-tenantid events (zero-delivery risk) — confirm the producer. @@ -263,25 +240,20 @@ streamingHub: # lib-commons env name (NOT STREAMING_HUB_-prefixed). Required-in-SaaS: # staging | production. Inert under BYOC. Leave empty unless SaaS. ENVIRONMENT_NAME: "" - # --- reconciler (topic-drift detection; dark-ship, defaults on) --- STREAMING_HUB_RECONCILER_ENABLED: "true" STREAMING_HUB_RECONCILER_INTERVAL: "300" - # --- partition lifecycle cron --- STREAMING_HUB_PARTITION_CRON_INTERVAL: "6h" STREAMING_HUB_PARTITION_FUTURE_BUFFER_WEEKS: "4" STREAMING_HUB_PARTITION_RETENTION_ENABLED: "false" STREAMING_HUB_PARTITION_RETENTION_HORIZON: "0" - # --- DLQ visibility --- STREAMING_HUB_DLQ_RETENTION: "168h" STREAMING_HUB_DLQ_PRUNE_INTERVAL: "1h" - # --- lifecycle / drain (kept coherent with terminationGracePeriodSeconds) --- STREAMING_HUB_SHUTDOWN_TIMEOUT: "30s" STREAMING_HUB_PRE_STOP_DRAIN_TIMEOUT: "5s" - # --- observability (OTEL_* are lib-observability vars, NOT in .env.reference) --- # OTEL_EXPORTER_OTLP_ENDPOINT is overridden per-pod with $(HOST_IP):4317 via # the downward API when streamingHub.telemetry.enabled=true (a CHART-level @@ -290,7 +262,6 @@ streamingHub: OTEL_RESOURCE_SERVICE_NAME: "streaming-hub" OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" OTEL_EXPORTER_OTLP_ENDPOINT: "" - # =========================================================================== # secrets — role-INVARIANT, SENSITIVE env (one shared Secret). All default "". # Empty values are SKIPPED at render so unset SaaS/dev keys never ship blank. @@ -311,7 +282,6 @@ streamingHub: STREAMING_HUB_TENANT_MANAGER_SERVICE_API_KEY: "" # SaaS tenant pub/sub Redis AUTH password (optional even in SaaS). STREAMING_HUB_MULTI_TENANT_REDIS_PASSWORD: "" - # =========================================================================== # migrations — OUT-OF-BAND schema migration Job (Helm + ArgoCD PreSync hook). # @@ -373,7 +343,6 @@ streamingHub: requests: cpu: 50m memory: 64Mi - # =========================================================================== # Per-role blocks. Each carries replicaCount, resources, autoscaling, pdb, and # the Postgres pool sizing injected as explicit per-Deployment env. @@ -412,7 +381,6 @@ streamingHub: nodeSelector: {} tolerations: {} affinity: {} - ingest: replicaCount: 1 poolMaxOpenConns: 8 @@ -438,7 +406,6 @@ streamingHub: nodeSelector: {} tolerations: {} affinity: {} - delivery: replicaCount: 1 poolMaxOpenConns: 16 @@ -464,3 +431,6 @@ streamingHub: nodeSelector: {} tolerations: {} affinity: {} +streaming-hub: + image: + tag: 1.0.0 From bbedef9032777c1019f1af85ce82e91bb4996297 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Thu, 25 Jun 2026 22:33:56 +0000 Subject: [PATCH 017/113] fix(plugin-br-bank-transfer): update plugin-br-bank-transfer@1.1.7 --- charts/plugin-br-bank-transfer/Chart.yaml | 5 +---- charts/plugin-br-bank-transfer/values.yaml | 14 +------------- 2 files changed, 2 insertions(+), 17 deletions(-) diff --git a/charts/plugin-br-bank-transfer/Chart.yaml b/charts/plugin-br-bank-transfer/Chart.yaml index c71de409..8dcb5d53 100644 --- a/charts/plugin-br-bank-transfer/Chart.yaml +++ b/charts/plugin-br-bank-transfer/Chart.yaml @@ -11,11 +11,8 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" - version: 1.2.1 - -appVersion: "1.1.0" - +appVersion: "1.1.7" keywords: - bank-transfer - ted diff --git a/charts/plugin-br-bank-transfer/values.yaml b/charts/plugin-br-bank-transfer/values.yaml index f378bc11..538992a6 100644 --- a/charts/plugin-br-bank-transfer/values.yaml +++ b/charts/plugin-br-bank-transfer/values.yaml @@ -82,7 +82,7 @@ bankTransfer: # -- Image pull policy pullPolicy: IfNotPresent # -- Image tag used for deployment - tag: "1.1.0" + tag: "1.1.7" # -- PostgreSQL migrations job (Helm hook pre-install,pre-upgrade; ArgoCD PreSync). # The chart-managed Secret is rendered as an earlier hook (weight -5 / sync-wave -5), # so it exists before this migration hook (weight -1) — migrations run against the @@ -226,12 +226,10 @@ bankTransfer: APPLICATION_NAME: "plugin-br-bank-transfer" SERVER_ADDRESS: ":4027" HTTP_BODY_LIMIT_BYTES: "1048576" - # ================================================================= # TLS / proxy # ================================================================= TLS_TERMINATED_UPSTREAM: "true" - # ================================================================= # CORS policy # In production the plugin's validator rejects wildcard "*" and any @@ -245,7 +243,6 @@ bankTransfer: CORS_ALLOWED_ORIGINS: "" CORS_ALLOWED_METHODS: "" CORS_ALLOWED_HEADERS: "" - # ================================================================= # Multi-tenancy # Only the toggle, the DEFAULT_TENANT_* identifiers, and the @@ -301,7 +298,6 @@ bankTransfer: REDIS_WRITE_TIMEOUT_MS: "3000" REDIS_DIAL_TIMEOUT_MS: "5000" REDIS_TLS: "false" - # ================================================================= # MongoDB (audit/event persistence) # MONGO_URI is in templates/secrets.yaml. @@ -311,7 +307,6 @@ bankTransfer: MONGO_MAX_POOL_SIZE: "25" MONGO_SERVER_SELECTION_TIMEOUT_MS: "3000" MONGO_HEARTBEAT_INTERVAL_MS: "10000" - # ================================================================= # RabbitMQ (event bus, optional) # RABBITMQ_URL is rendered from chart defaults when empty. @@ -319,13 +314,11 @@ bankTransfer: # ================================================================= RABBITMQ_ENABLED: "false" RABBITMQ_EXCHANGE: "bank_transfer.lifecycle" - # ================================================================= # Authentication (inbound — plugin-access-manager) # ================================================================= PLUGIN_AUTH_ENABLED: "true" PLUGIN_AUTH_ADDRESS: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" - # ================================================================= # License gateway override (optional — defaults to lib-license-go's # hard-coded endpoint when LICENSE_SERVICE_ADDRESS is unset) @@ -341,7 +334,6 @@ bankTransfer: OTEL_RESOURCE_SERVICE_NAME: "plugin-br-bank-transfer" OTEL_EXPORTER_OTLP_ENDPOINT: "" OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" - # ================================================================= # Outbound adapters — endpoints + auth toggles only. # Timeouts, retries, circuit breakers, cache TTLs, and lookup @@ -375,14 +367,12 @@ bankTransfer: # JD_LEGACY_CODE: "" JD_SIGNING_MODE: "local_pem" # local_pem | external_provided | disabled JD_POLLING_ENABLED: "false" - # ================================================================= # Single-tenant defaults # ================================================================= ORGANIZATION_ID: "" ORGANIZATION_IDS: "" IS_DEVELOPMENT: "false" - # ================================================================= # Feature flags # ================================================================= @@ -391,7 +381,6 @@ bankTransfer: RATE_LIMIT_ENABLED: "false" ALLOW_INSECURE_TLS: "true" OTEL_SDK_DISABLED: "false" - # -- Secrets for storing sensitive data # @default -- templates/secrets.yaml secrets: @@ -614,4 +603,3 @@ rabbitmq: mountPath: /etc/rabbitmq/definitions customConfig: | management.load_definitions = /etc/rabbitmq/definitions/load_definition.json - \ No newline at end of file From 34148606c1821be4859a99e1b8eb75341ef4b32f Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 26 Jun 2026 00:57:25 +0000 Subject: [PATCH 018/113] chore(release): 1.3.0-beta.1 ## (2026-06-26) ### Features * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) ### Bug Fixes * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) --- README.md | 2 +- charts/plugin-br-bank-transfer/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2b9ae196..7e147a05 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | bankTransfer Version | | :---: | :---: | -| `1.2.1` | 1.0.0 | +| `1.3.0-beta.1` | 1.0.0 | ----------------- diff --git a/charts/plugin-br-bank-transfer/Chart.yaml b/charts/plugin-br-bank-transfer/Chart.yaml index 8dcb5d53..76a72ae3 100644 --- a/charts/plugin-br-bank-transfer/Chart.yaml +++ b/charts/plugin-br-bank-transfer/Chart.yaml @@ -11,7 +11,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.2.1 +version: 1.3.0-beta.1 appVersion: "1.1.7" keywords: - bank-transfer From 88686caa6279e4df49206666240e34943a8637ef Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Wed, 1 Jul 2026 15:56:01 -0700 Subject: [PATCH 019/113] feat(matcher): promote UI, MCP and detached migrations to multi-component chart Convert matcher-helm from single-service to multi-component (fetcher layout, component subdirectories under templates/). New components default to disabled, so existing single-service installs are unaffected. - UI, MCP and detached migrations promoted to first-class components, each gated by .enabled (default false). UI ingress preserves the same-origin proxy: /v1 and /system route to the API Service, / to the UI Service. - migrations: ArgoCD PreSync Secret(-2) + Job(-1) running the dedicated up-only matcher-migrations image; useExistingSecret-aware; refuses multi-tenant. - APP_ENC_KEY and ACTOR_PII_ENCRYPTION_KEY are first-class (opt-in) in matcher.secrets; APP_ENC_KEY is required in production by the app. - Remove dead AUTH_JWT_SECRET (no-op in app v4; validation delegated to plugin-auth). Rename AUTH_ENABLED / AUTH_SERVICE_ADDRESS -> PLUGIN_AUTH_ENABLED / PLUGIN_AUTH_ADDRESS in the ConfigMap, with a legacy fallback so an upgrade never silently disables auth on envs still setting the old keys. - Chart-standard compliance: UI runs a read-only rootfs (emptyDir-backed /usr/share/nginx/html seeded by an initContainer so config.js renders at start, plus /tmp and /var/cache/nginx; fsGroup 101); migrations Secret template named secrets.yaml; README Chart Contract declares multi-component. - version 3.2.0-beta.1; chart-type -> multi-component. Rendering is byte-identical for existing consumers EXCEPT the deliberate, documented auth changes above (values and runtime behavior preserved; the app honors both AUTH_* and PLUGIN_AUTH_* aliases). The new components only render when enabled. helm lint passes and the repo chart-standard validator reports zero matcher violations. See docs/UPGRADE-3.2.md. Claude-Session: https://claude.ai/code/session_012y7cAy9sBT6JDE8FkMqXSE --- charts/matcher/CHANGELOG.md | 34 +++ charts/matcher/Chart.yaml | 6 +- charts/matcher/README.md | 71 ++++- charts/matcher/docs/UPGRADE-3.2.md | 93 +++++++ charts/matcher/templates/_helpers.tpl | 67 +++++ .../templates/{ => matcher}/configmap.yaml | 14 +- .../templates/{ => matcher}/deployment.yaml | 0 .../matcher/templates/{ => matcher}/hpa.yaml | 0 .../templates/{ => matcher}/ingress.yaml | 0 .../matcher/templates/{ => matcher}/pdb.yaml | 0 .../templates/{ => matcher}/secrets.yaml | 14 +- .../templates/{ => matcher}/service.yaml | 0 .../{ => matcher}/serviceaccount.yaml | 0 charts/matcher/templates/mcp/deployment.yaml | 83 ++++++ charts/matcher/templates/mcp/ingress.yaml | 34 +++ charts/matcher/templates/mcp/service.yaml | 22 ++ charts/matcher/templates/migrations/job.yaml | 98 +++++++ .../matcher/templates/migrations/secrets.yaml | 24 ++ charts/matcher/templates/ui/deployment.yaml | 112 ++++++++ charts/matcher/templates/ui/ingress.yaml | 50 ++++ charts/matcher/templates/ui/service.yaml | 22 ++ charts/matcher/values.schema.json | 12 + charts/matcher/values.yaml | 259 +++++++++++++++++- 23 files changed, 1000 insertions(+), 15 deletions(-) create mode 100644 charts/matcher/docs/UPGRADE-3.2.md rename charts/matcher/templates/{ => matcher}/configmap.yaml (92%) rename charts/matcher/templates/{ => matcher}/deployment.yaml (100%) rename charts/matcher/templates/{ => matcher}/hpa.yaml (100%) rename charts/matcher/templates/{ => matcher}/ingress.yaml (100%) rename charts/matcher/templates/{ => matcher}/pdb.yaml (100%) rename charts/matcher/templates/{ => matcher}/secrets.yaml (84%) rename charts/matcher/templates/{ => matcher}/service.yaml (100%) rename charts/matcher/templates/{ => matcher}/serviceaccount.yaml (100%) create mode 100644 charts/matcher/templates/mcp/deployment.yaml create mode 100644 charts/matcher/templates/mcp/ingress.yaml create mode 100644 charts/matcher/templates/mcp/service.yaml create mode 100644 charts/matcher/templates/migrations/job.yaml create mode 100644 charts/matcher/templates/migrations/secrets.yaml create mode 100644 charts/matcher/templates/ui/deployment.yaml create mode 100644 charts/matcher/templates/ui/ingress.yaml create mode 100644 charts/matcher/templates/ui/service.yaml diff --git a/charts/matcher/CHANGELOG.md b/charts/matcher/CHANGELOG.md index 524334d6..84afb6cf 100644 --- a/charts/matcher/CHANGELOG.md +++ b/charts/matcher/CHANGELOG.md @@ -2,6 +2,40 @@ All notable changes to this project will be documented in this file. +## [3.2.0-beta.1] + +### Added + +- Promote UI, MCP, and detached migrations into the chart as first-class, + optional multi-component parts (chart-type `multi-component`). All default to + `enabled: false`: + - `ui.*` — Vite SPA (nginx-unprivileged). UI ingress implements the same-origin + proxy (`/v1` and `/system` → matcher API Service; `/` → UI Service). + - `mcp.*` — Streamable-HTTP MCP relay (stateless, no credentials); independent + version line from the app tag. + - `migrations.*` — ArgoCD PreSync Secret + Job (up-only, single-tenant) applied + before the app Deployment; TCP-wait initContainer; `useExistingSecret`-aware. +- `matcher.secrets.APP_ENC_KEY` (engine credential master key; required in + production) and `matcher.secrets.ACTOR_PII_ENCRYPTION_KEY` (optional). Both are + emitted only when set, keeping the default render byte-identical. +- `matcher.configmap.GOMEMLIMIT` opt-in knob (Go 1.26 soft memory limit). + +### Changed + +- App templates moved into `templates/matcher/` component subdirectory. Rendered + Kubernetes objects are unchanged for existing API consumers, modulo the chart + version string, `# Source:` provenance, and the auth-key changes below. +- ConfigMap now emits `PLUGIN_AUTH_ENABLED` / `PLUGIN_AUTH_ADDRESS` (the app's + canonical v4 names) instead of `AUTH_ENABLED` / `AUTH_SERVICE_ADDRESS`. The + template still reads the legacy `matcher.configmap.AUTH_ENABLED` / + `AUTH_SERVICE_ADDRESS` as a fallback, so an upgrade never silently disables auth. + +### Removed + +- `matcher.secrets.AUTH_JWT_SECRET` — no-op in app v4 (validation delegated to + plugin-auth); no longer emitted into the Secret. Setting it is now ignored + (harmless). See `docs/UPGRADE-3.2.md`. + ## [1.2.0] - 2026-02-25 ### Added diff --git a/charts/matcher/Chart.yaml b/charts/matcher/Chart.yaml index 387682dc..abd4d9dc 100644 --- a/charts/matcher/Chart.yaml +++ b/charts/matcher/Chart.yaml @@ -4,7 +4,7 @@ description: A Helm chart for the Matcher reconciliation service type: application annotations: - lerian.studio/chart-type: single-service + lerian.studio/chart-type: multi-component home: https://github.com/LerianStudio/helm @@ -16,8 +16,10 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.1.0-beta.1 +version: 3.2.0-beta.1 +# NOTE: appVersion is a stale placeholder. The real app image tag is set via +# matcher.image.tag (and per-component ui.image.tag / mcp.image.tag / migrations.image.tag). appVersion: "1.0.0" keywords: diff --git a/charts/matcher/README.md b/charts/matcher/README.md index 80edc33d..a73922d5 100644 --- a/charts/matcher/README.md +++ b/charts/matcher/README.md @@ -2,7 +2,7 @@ ## Chart Contract -- Chart type: `single-service` +- Chart type: `multi-component` - Required secrets: `matcher.secrets.RABBITMQ_PASSWORD` (install fails loud if unset, unless `matcher.useExistingSecret` is enabled). The PostgreSQL primary/replica and Valkey passwords are **single-sourced from their Bitnami subchart Secrets** — `matcher` reads them at runtime from `-postgresql` (keys `password`, `replication-password`) and `-valkey` (key `valkey-password`), so they are not stored in the app Secret. Only set `matcher.secrets.POSTGRES_PASSWORD`, `POSTGRES_REPLICA_PASSWORD`, and `REDIS_PASSWORD` when pointing at **external** infra without an `existingSecret`. `RABBITMQ_PASSWORD` remains operator-provided (see Known limitations). Production database and messaging credentials must not be committed in values files. - Dependency notes: Uses local PostgreSQL, Valkey, and RabbitMQ dependency charts unless external services are configured. - Production overrides: Provide production credentials through chart secrets or existing dependency Secrets where supported; override image tags, ingress, resources, and persistence. @@ -117,6 +117,69 @@ matcher: | `matcher.serviceAccount.annotations` | Annotations for the ServiceAccount. | `{}` | | `matcher.serviceAccount.name` | Name of the service account. | `""` | +### UI (`matcher-ui`) + +Optional web UI (Vite SPA served by nginx-unprivileged). Disabled by default. When enabled, the UI ingress implements a **same-origin proxy** (decision 2026-06-27): the UI image hardcodes a CSP with `connect-src 'self'`, so the API must be served from the **same host** as the UI. On the UI host, `/v1` and `/system` route to the matcher API Service, and `/` routes to the UI Service (single ingress, two backends). This keeps the browser same-origin — no CORS, no CSP violation. Set `ui.env.API_BASE_URL: ""` so the SPA calls `/v1` and `/system` relative. + +| Parameter | Description | Default Value | +|---|---|---| +| `ui.enabled` | Enable the UI component. | `false` | +| `ui.replicaCount` | Number of UI replicas. | `1` | +| `ui.image.repository` | UI image repository. | `"ghcr.io/lerianstudio/matcher-ui"` | +| `ui.image.tag` | UI image tag (**required** when `ui.enabled=true`). | `""` | +| `ui.image.pullPolicy` | Image pull policy. | `"IfNotPresent"` | +| `ui.imagePullSecrets` | Pull secrets for the UI image. | `[]` | +| `ui.securityContext.*` | Container security context. `runAsUser/Group 101`, `readOnlyRootFilesystem: false` (nginx-unprivileged renders `/config.js` at start). | See `values.yaml` | +| `ui.service.type` / `ui.service.port` | Service type / port (also containerPort). | `ClusterIP` / `8080` | +| `ui.env.*` | UI runtime env (rendered verbatim; empty values are emitted). `API_BASE_URL: ""` (same-origin), `TRUSTED_API_ORIGINS`, `AUTH_DISABLED`, optional `WORKOS_CLIENT_ID`. | See `values.yaml` | +| `ui.livenessProbe.path` / `ui.readinessProbe.path` | Probe path. Defaults to `/` (nginx SPA index). Set to `/healthz` only if the deployed UI image exposes it. | `"/"` | +| `ui.ingress.enabled` | Enable the UI ingress (same-origin proxy). | `false` | +| `ui.ingress.className` | Ingress class name. | `"nginx"` | +| `ui.ingress.annotations` | Ingress annotations (e.g. `cert-manager.io/cluster-issuer`). | `{}` | +| `ui.ingress.host` | UI host (**required** when `ui.ingress.enabled=true`). | `""` | +| `ui.ingress.apiPaths` | API prefixes routed to the matcher API Service. | `[/v1, /system]` | +| `ui.ingress.tls.enabled` / `ui.ingress.tls.secretName` | Enable TLS / TLS secret name. | `true` / `"matcher-ui-tls"` | + +### MCP (`matcher-mcp`) + +Optional Model Context Protocol server (Node, Streamable HTTP). Stateless bearer-token relay that holds **no credentials** and forwards to the in-cluster matcher API Service. Independent version line from the app. Disabled by default. + +| Parameter | Description | Default Value | +|---|---|---| +| `mcp.enabled` | Enable the MCP component. | `false` | +| `mcp.replicaCount` | Number of MCP replicas. | `1` | +| `mcp.image.repository` | MCP image repository. | `"ghcr.io/lerianstudio/matcher-mcp"` | +| `mcp.image.tag` | MCP image tag (**required** when `mcp.enabled=true`; independent of the app tag). | `""` | +| `mcp.image.pullPolicy` | Image pull policy. | `"IfNotPresent"` | +| `mcp.imagePullSecrets` | Pull secrets for the MCP image. | `[]` | +| `mcp.securityContext.*` | Container security context. `runAsUser/Group 65532`, `readOnlyRootFilesystem: true`. | See `values.yaml` | +| `mcp.service.type` / `mcp.service.port` | Service type / port (also containerPort). | `ClusterIP` / `4019` | +| `mcp.env.MATCHER_API_URL` | In-cluster matcher API URL. Empty → derived `http://..svc.cluster.local:`. | `""` (derived) | +| `mcp.env.*` | Other MCP env: `MCP_PORT`, `ENABLE_TELEMETRY`, `MCP_UPLOAD_ALLOWED_HOSTS` (SSRF allowlist, off), `MCP_UPLOAD_MAX_FETCH_BYTES`, `MATCHER_TIMEOUT_MS`, `MAX_BODY_BYTES`; add `OTEL_*` as needed. | See `values.yaml` | +| `mcp.livenessProbe.path` / `mcp.readinessProbe.path` | Probe path. | `"/healthz"` | +| `mcp.ingress.enabled` | Enable the MCP ingress. | `false` | +| `mcp.ingress.className` | Ingress class name. | `"nginx"` | +| `mcp.ingress.annotations` | Streaming defaults: `proxy-buffering: "off"`, `proxy-read-timeout: "3600"`. Add issuer as needed. | See `values.yaml` | +| `mcp.ingress.host` | MCP host (**required** when `mcp.ingress.enabled=true`). | `""` | +| `mcp.ingress.tls.enabled` / `mcp.ingress.tls.secretName` | Enable TLS / TLS secret name. | `true` / `"matcher-mcp-tls"` | + +### Detached migrations (`matcher-migrations`) + +Optional ArgoCD **PreSync** Secret + Job that applies the schema (up-only, single-tenant) **before** the app Deployment. matcher v3+ is detached: it refuses to boot against an unmigrated DB, and the app image ships no migration binary. Disabled by default. Requires an operator-provided Postgres password (external PG) or `matcher.useExistingSecret` pointing at a pre-created Secret. **Do not** run this with `MULTI_TENANT_ENABLED=true` (the runner refuses it; the Tenant Manager owns tenant DB migrations). + +| Parameter | Description | Default Value | +|---|---|---| +| `migrations.enabled` | Enable the detached migration PreSync Job. | `false` | +| `migrations.image.repository` | Migration runner image. | `"ghcr.io/lerianstudio/matcher-migrations"` | +| `migrations.image.tag` | Migration image tag. Empty → falls back to `matcher.image.tag`. | `""` | +| `migrations.image.pullPolicy` | Image pull policy. | `"IfNotPresent"` | +| `migrations.imagePullSecrets` | Pull secrets for the migration image. | `[]` | +| `migrations.waitImage` | Image for the TCP-wait initContainer. | `busybox` | +| `migrations.postgres.{host,port,user,database,sslMode}` | Postgres connection. Empty fields fall back to `matcher.configmap.POSTGRES_*` (host derives from the postgresql subchart). | `""` | +| `migrations.postgres.password` | Password for the PreSync Secret. Empty → `matcher.secrets.POSTGRES_PASSWORD`. Ignored when `matcher.useExistingSecret=true` (Job reads the existing Secret). | `""` | +| `migrations.backoffLimit` / `migrations.activeDeadlineSeconds` / `migrations.ttlSecondsAfterFinished` | Job retry / deadline / TTL. | `3` / `600` / `600` | +| `migrations.resources.*` | CPU/Memory requests/limits. | See `values.yaml` | + --- ## Dependencies @@ -171,7 +234,7 @@ The following environment variables can be configured via the `matcher.configmap | `REDIS_HOST` | Redis/Valkey host. Derived collapse-aware from the subchart name; shown for release `matcher`. | `"matcher-valkey-primary.matcher.svc.cluster.local.:6379"` | | `RABBITMQ_HOST` | RabbitMQ host. | `"matcher-rabbitmq.matcher.svc.cluster.local."` | | `RABBITMQ_PORT` | RabbitMQ port. | `"5672"` | -| `AUTH_ENABLED` | Enable authentication. | `"false"` | +| `PLUGIN_AUTH_ENABLED` | Enable authentication (delegated to plugin-auth). Legacy `AUTH_ENABLED` still honored as a fallback. | `"false"` | | `ENABLE_TELEMETRY` | Enable OpenTelemetry. | `"false"` | | `OBJECT_STORAGE_ENDPOINT` | Object storage endpoint. | `"http://matcher-seaweedfs.matcher.svc.cluster.local.:8333"` | | `EXPORT_WORKER_ENABLED` | Enable export worker. | `"true"` | @@ -192,7 +255,9 @@ The following secrets can be configured via the `matcher.secrets` section: | `RABBITMQ_PASSWORD` | RabbitMQ password. Operator-provided (not single-sourced — see Known limitations). | `""` | | `OBJECT_STORAGE_ACCESS_KEY_ID` | Object storage access key. | `""` | | `OBJECT_STORAGE_SECRET_ACCESS_KEY` | Object storage secret key. | `""` | -| `AUTH_JWT_SECRET` | JWT secret for authentication. | `""` | +| `APP_ENC_KEY` | Engine credential master key (base64 32-byte). **Required in production.** Emitted only when set (opt-in). Generate: `openssl rand -base64 32 \| tr -d '\n'`. | `""` | +| `ACTOR_PII_ENCRYPTION_KEY` | Actor PII encryption key (optional, base64 32-byte). Emitted only when set. | `""` | +| `SYSTEMPLANE_SECRET_MASTER_KEY` | AES-256-GCM master key for encrypting secret config values. | `""` | --- diff --git a/charts/matcher/docs/UPGRADE-3.2.md b/charts/matcher/docs/UPGRADE-3.2.md new file mode 100644 index 00000000..58747e61 --- /dev/null +++ b/charts/matcher/docs/UPGRADE-3.2.md @@ -0,0 +1,93 @@ +# Helm Upgrade from v3.1.x to v3.2.x + +## Overview + +`matcher-helm` 3.2.0 promotes the **UI**, **MCP**, and **detached migrations** into +this chart as first-class, optional components, following the Lerian multi-component +house pattern. The chart annotation changes from `single-service` to `multi-component`. + +**This is a backward-compatible (additive) release.** The existing `matcher.*` (API) +values block is unchanged, and all new components default to `enabled: false`. A default +render (no new components enabled) matches 3.1.x except for: + +- the chart version string (`helm.sh/chart: matcher-helm-3.2.0-beta.1`); +- moved-file provenance: the API templates now live under `templates/matcher/`, which + changes the `# Source:` comments and the emit order of two `Secret` documents (the + rendered Kubernetes objects are otherwise unchanged); and +- the deliberate auth changes below — the ConfigMap emits `PLUGIN_AUTH_ENABLED` / + `PLUGIN_AUTH_ADDRESS` in place of `AUTH_ENABLED` / `AUTH_SERVICE_ADDRESS`, and the + `AUTH_JWT_SECRET` Secret key is removed. Values and runtime behavior are preserved + (the app honors both aliases; legacy values still resolve via a fallback). + +No action is required for existing API-only consumers. + +## What changed + +### 1. Template layout (no output change for the API) + +The flat `templates/*.yaml` app manifests moved into component subdirectories: + +- `templates/matcher/` — API (deployment, service, ingress, hpa, pdb, configmap, secrets, serviceaccount) +- `templates/ui/` — UI (deployment, service, ingress) +- `templates/mcp/` — MCP (deployment, service, ingress) +- `templates/migrations/` — PreSync Secret + Job + +`bootstrap-postgres.yaml`, `bootstrap-rabbitmq.yaml`, `rabbitmq_load_definitions.yaml` +and `_helpers.tpl` remain at the `templates/` root. + +### 2. New optional components (default off) + +See `README.md` for the full parameter tables. + +- **`ui.*`** — Vite SPA served by nginx-unprivileged. When `ui.ingress.enabled=true`, + the ingress implements the **same-origin proxy**: `/v1` and `/system` route to the + matcher API Service; `/` routes to the UI Service (single ingress, two backends). The + UI image hardcodes a CSP with `connect-src 'self'`, so the API must be same-origin. +- **`mcp.*`** — Streamable-HTTP MCP relay. Holds no credentials; forwards to the + in-cluster API. Independent version line from the app tag. +- **`migrations.*`** — ArgoCD PreSync Secret (hook-weight `-2`) + Job (hook-weight `-1`) + that applies the schema up-only before the app Deployment. **Never** set + `MULTI_TENANT_ENABLED=true` for the runner. When `matcher.useExistingSecret=true`, + the Job reads `POSTGRES_PASSWORD` from the existing Secret and no PreSync Secret is minted. + +### 3. Secret allowlist + +- **Added `APP_ENC_KEY`** (base64 32-byte engine-credential master key). **Required in + production** per the app. It is now first-class in `matcher.secrets` and is emitted into + the Secret **only when set** (opt-in), so a default render stays byte-identical. Previously + operators had to inject it via an external secret. + Generate: `openssl rand -base64 32 | tr -d '\n'`. +- **Added `ACTOR_PII_ENCRYPTION_KEY`** (optional, base64 32-byte). Emitted only when set. +- **`AUTH_JWT_SECRET` removed** (no-op in app v4 — token validation is delegated to + plugin-auth). It is no longer emitted into the Secret. If you still set + `matcher.secrets.AUTH_JWT_SECRET`, the value is simply ignored (harmless). No action needed. +- **`AUTH_ENABLED` / `AUTH_SERVICE_ADDRESS` renamed to `PLUGIN_AUTH_ENABLED` / + `PLUGIN_AUTH_ADDRESS`** in the ConfigMap (the app's canonical v4 names). The template still + reads the legacy `matcher.configmap.AUTH_ENABLED` / `AUTH_SERVICE_ADDRESS` as a fallback, so + existing values keep working without a lockstep change — migrate to the new keys when + convenient. The rendered ConfigMap now carries the `PLUGIN_AUTH_*` keys instead of `AUTH_*`. + (Security note: because the legacy values are still honored, an upgrade will NOT silently + disable auth on environments that set `AUTH_ENABLED: "true"`.) + +### 4. App env knob + +- **`matcher.configmap.GOMEMLIMIT`** — new opt-in knob for the Go soft memory limit + (Go 1.26 does not auto-detect cgroup limits). Set to ~85% of the pod memory limit + (e.g. `"435MiB"`). Emitted only when non-empty; default render unchanged. + +## Migration steps + +1. **API-only consumers:** none. `helm upgrade` is a no-op change to workloads. +2. **To enable the UI:** set `ui.enabled=true`, `ui.image.tag`, and — for external access — + `ui.ingress.enabled=true` with `ui.ingress.host` and a cert-manager issuer annotation. +3. **To enable the MCP:** set `mcp.enabled=true` and `mcp.image.tag`. +4. **To enable detached migrations:** set `migrations.enabled=true` and provide the + Postgres password via `migrations.postgres.password` (or set `matcher.useExistingSecret`). +5. **Production:** set `matcher.secrets.APP_ENC_KEY` (or provide it via your existing secret). + +## Preview changes before upgrading + +```bash +helm template charts/matcher --set ui.enabled=true --set ui.image.tag= \ + --set mcp.enabled=true --set mcp.image.tag= --set migrations.enabled=true +``` diff --git a/charts/matcher/templates/_helpers.tpl b/charts/matcher/templates/_helpers.tpl index 29c3e165..4f9e79a8 100644 --- a/charts/matcher/templates/_helpers.tpl +++ b/charts/matcher/templates/_helpers.tpl @@ -124,6 +124,73 @@ false {{- end -}} {{- end -}} +{{/* +============================================================================== +Component helpers (multi-component: ui / mcp / migrations) +Names are derived from matcher.fullname so cross-references stay deterministic +and release-aware (e.g. the UI ingress routes /v1 to the API Service by name, +and the migration Job reads its PreSync Secret by name). +============================================================================== +*/}} + +{{/* UI fullname (e.g. matcher-ui) */}} +{{- define "matcher-ui.fullname" -}} +{{- printf "%s-ui" (include "matcher.fullname" . | trunc 60 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* UI selector labels */}} +{{- define "matcher-ui.selectorLabels" -}} +app.kubernetes.io/name: {{ include "matcher-ui.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: ui +{{- end -}} + +{{/* UI labels */}} +{{- define "matcher-ui.labels" -}} +helm.sh/chart: {{ include "matcher.chart" . }} +{{ include "matcher-ui.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Values.ui.image.tag }} +app.kubernetes.io/version: {{ . | quote }} +{{- end }} +{{- end -}} + +{{/* MCP fullname (e.g. matcher-mcp) */}} +{{- define "matcher-mcp.fullname" -}} +{{- printf "%s-mcp" (include "matcher.fullname" . | trunc 59 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* MCP selector labels */}} +{{- define "matcher-mcp.selectorLabels" -}} +app.kubernetes.io/name: {{ include "matcher-mcp.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/component: mcp +{{- end -}} + +{{/* MCP labels */}} +{{- define "matcher-mcp.labels" -}} +helm.sh/chart: {{ include "matcher.chart" . }} +{{ include "matcher-mcp.selectorLabels" . }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- with .Values.mcp.image.tag }} +app.kubernetes.io/version: {{ . | quote }} +{{- end }} +{{- end -}} + +{{/* Migrations fullname (e.g. matcher-migrations) — Job and PreSync Secret reference this */}} +{{- define "matcher-migrations.fullname" -}} +{{- printf "%s-migrations" (include "matcher.fullname" . | trunc 52 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* Migrations labels */}} +{{- define "matcher-migrations.labels" -}} +helm.sh/chart: {{ include "matcher.chart" . }} +app.kubernetes.io/name: {{ include "matcher-migrations.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/component: migrations +{{- end -}} + {{/* Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra Secret/Service names render even when all bundled subcharts are disabled diff --git a/charts/matcher/templates/configmap.yaml b/charts/matcher/templates/matcher/configmap.yaml similarity index 92% rename from charts/matcher/templates/configmap.yaml rename to charts/matcher/templates/matcher/configmap.yaml index b5771463..4858fdb6 100644 --- a/charts/matcher/templates/configmap.yaml +++ b/charts/matcher/templates/matcher/configmap.yaml @@ -12,6 +12,11 @@ data: LOG_LEVEL: {{ .Values.matcher.configmap.LOG_LEVEL | default "info" | quote }} SERVER_ADDRESS: {{ .Values.matcher.configmap.SERVER_ADDRESS | default ":8080" | quote }} HTTP_BODY_LIMIT_BYTES: {{ .Values.matcher.configmap.HTTP_BODY_LIMIT_BYTES | default "104857600" | quote }} + {{- if .Values.matcher.configmap.GOMEMLIMIT }} + # Go soft memory limit. Set explicitly (~85% of pod memory limit): Go 1.26 does + # not auto-detect cgroup memory limits. Only emitted when set (opt-in knob). + GOMEMLIMIT: {{ .Values.matcher.configmap.GOMEMLIMIT | quote }} + {{- end }} # CORS Configuration CORS_ALLOWED_ORIGINS: {{ .Values.matcher.configmap.CORS_ALLOWED_ORIGINS | default "*" | quote }} @@ -83,9 +88,12 @@ data: RABBITMQ_VHOST: {{ .Values.matcher.configmap.RABBITMQ_VHOST | default "/" | quote }} RABBITMQ_HEALTH_URL: {{ .Values.matcher.configmap.RABBITMQ_HEALTH_URL | default (printf "http://matcher-rabbitmq.%s.svc.cluster.local.:15672" .Release.Namespace) | quote }} - # Authentication - AUTH_ENABLED: {{ .Values.matcher.configmap.AUTH_ENABLED | default "false" | quote }} - AUTH_SERVICE_ADDRESS: {{ .Values.matcher.configmap.AUTH_SERVICE_ADDRESS | default "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local.:4000" | quote }} + # Authentication (delegated to plugin-auth in app v4). Canonical names are + # PLUGIN_AUTH_*; the legacy AUTH_ENABLED / AUTH_SERVICE_ADDRESS values are still + # honored as a fallback so consumers can migrate their values without a lockstep + # break. The app also accepts both aliases at runtime. + PLUGIN_AUTH_ENABLED: {{ .Values.matcher.configmap.PLUGIN_AUTH_ENABLED | default .Values.matcher.configmap.AUTH_ENABLED | default "false" | quote }} + PLUGIN_AUTH_ADDRESS: {{ .Values.matcher.configmap.PLUGIN_AUTH_ADDRESS | default .Values.matcher.configmap.AUTH_SERVICE_ADDRESS | default "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local.:4000" | quote }} # Swagger Documentation SWAGGER_ENABLED: {{ .Values.matcher.configmap.SWAGGER_ENABLED | default "false" | quote }} diff --git a/charts/matcher/templates/deployment.yaml b/charts/matcher/templates/matcher/deployment.yaml similarity index 100% rename from charts/matcher/templates/deployment.yaml rename to charts/matcher/templates/matcher/deployment.yaml diff --git a/charts/matcher/templates/hpa.yaml b/charts/matcher/templates/matcher/hpa.yaml similarity index 100% rename from charts/matcher/templates/hpa.yaml rename to charts/matcher/templates/matcher/hpa.yaml diff --git a/charts/matcher/templates/ingress.yaml b/charts/matcher/templates/matcher/ingress.yaml similarity index 100% rename from charts/matcher/templates/ingress.yaml rename to charts/matcher/templates/matcher/ingress.yaml diff --git a/charts/matcher/templates/pdb.yaml b/charts/matcher/templates/matcher/pdb.yaml similarity index 100% rename from charts/matcher/templates/pdb.yaml rename to charts/matcher/templates/matcher/pdb.yaml diff --git a/charts/matcher/templates/secrets.yaml b/charts/matcher/templates/matcher/secrets.yaml similarity index 84% rename from charts/matcher/templates/secrets.yaml rename to charts/matcher/templates/matcher/secrets.yaml index 7d11c15a..542910fe 100644 --- a/charts/matcher/templates/secrets.yaml +++ b/charts/matcher/templates/matcher/secrets.yaml @@ -43,8 +43,18 @@ data: OBJECT_STORAGE_ACCESS_KEY_ID: {{ .Values.matcher.secrets.OBJECT_STORAGE_ACCESS_KEY_ID | default "" | b64enc | quote }} OBJECT_STORAGE_SECRET_ACCESS_KEY: {{ .Values.matcher.secrets.OBJECT_STORAGE_SECRET_ACCESS_KEY | default "" | b64enc | quote }} - # Authentication Secrets - AUTH_JWT_SECRET: {{ .Values.matcher.secrets.AUTH_JWT_SECRET | default "" | b64enc | quote }} + {{- /* + APP_ENC_KEY: engine credential master key (base64 32-byte). REQUIRED in + production per app init_engine.go. First-class as of 3.2.0 — emitted only when + set (opt-in), so a default render stays byte-identical. Provide via values or + an existing Secret. ACTOR_PII_ENCRYPTION_KEY (base64 32-byte) is optional. + */}} + {{- if .Values.matcher.secrets.APP_ENC_KEY }} + APP_ENC_KEY: {{ .Values.matcher.secrets.APP_ENC_KEY | b64enc | quote }} + {{- end }} + {{- if .Values.matcher.secrets.ACTOR_PII_ENCRYPTION_KEY }} + ACTOR_PII_ENCRYPTION_KEY: {{ .Values.matcher.secrets.ACTOR_PII_ENCRYPTION_KEY | b64enc | quote }} + {{- end }} # Systemplane Secrets # REQUIRED: AES-256-GCM master key for encrypting secret config values. diff --git a/charts/matcher/templates/service.yaml b/charts/matcher/templates/matcher/service.yaml similarity index 100% rename from charts/matcher/templates/service.yaml rename to charts/matcher/templates/matcher/service.yaml diff --git a/charts/matcher/templates/serviceaccount.yaml b/charts/matcher/templates/matcher/serviceaccount.yaml similarity index 100% rename from charts/matcher/templates/serviceaccount.yaml rename to charts/matcher/templates/matcher/serviceaccount.yaml diff --git a/charts/matcher/templates/mcp/deployment.yaml b/charts/matcher/templates/mcp/deployment.yaml new file mode 100644 index 00000000..8f3f87b8 --- /dev/null +++ b/charts/matcher/templates/mcp/deployment.yaml @@ -0,0 +1,83 @@ +{{- if .Values.mcp.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "matcher-mcp.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-mcp.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.mcp.replicaCount | default 1 }} + revisionHistoryLimit: {{ .Values.mcp.revisionHistoryLimit | default 10 }} + selector: + matchLabels: + {{- include "matcher-mcp.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.mcp.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "matcher-mcp.labels" . | nindent 8 }} + spec: + {{- with .Values.mcp.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.mcp.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: {{ include "matcher-mcp.fullname" . }} + image: "{{ .Values.mcp.image.repository }}:{{ required "mcp.image.tag is required when mcp.enabled=true" .Values.mcp.image.tag }}" + imagePullPolicy: {{ .Values.mcp.image.pullPolicy | default "IfNotPresent" }} + securityContext: + {{- toYaml .Values.mcp.securityContext | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.mcp.service.port }} + protocol: TCP + env: + # Stateless bearer-token relay: MCP holds no credentials. It only + # forwards to the in-cluster matcher API Service (no hairpin). + - name: MATCHER_API_URL + value: {{ .Values.mcp.env.MATCHER_API_URL | default (printf "http://%s.%s.svc.cluster.local:%v" (include "matcher.fullname" .) (include "global.namespace" .) .Values.matcher.service.port) | quote }} + {{- range $key, $value := omit .Values.mcp.env "MATCHER_API_URL" }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + livenessProbe: + httpGet: + path: {{ .Values.mcp.livenessProbe.path | default "/healthz" }} + port: http + initialDelaySeconds: {{ .Values.mcp.livenessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ .Values.mcp.livenessProbe.periodSeconds | default 30 }} + timeoutSeconds: {{ .Values.mcp.livenessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.mcp.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.mcp.livenessProbe.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: {{ .Values.mcp.readinessProbe.path | default "/healthz" }} + port: http + initialDelaySeconds: {{ .Values.mcp.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ .Values.mcp.readinessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ .Values.mcp.readinessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.mcp.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.mcp.readinessProbe.failureThreshold | default 3 }} + resources: + {{- toYaml .Values.mcp.resources | nindent 12 }} + {{- with .Values.mcp.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.mcp.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.mcp.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/matcher/templates/mcp/ingress.yaml b/charts/matcher/templates/mcp/ingress.yaml new file mode 100644 index 00000000..437d735e --- /dev/null +++ b/charts/matcher/templates/mcp/ingress.yaml @@ -0,0 +1,34 @@ +{{- if and .Values.mcp.enabled .Values.mcp.ingress.enabled -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "matcher-mcp.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-mcp.labels" . | nindent 4 }} + {{- with .Values.mcp.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.mcp.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- if .Values.mcp.ingress.tls.enabled }} + tls: + - hosts: + - {{ required "mcp.ingress.host is required when mcp.ingress.enabled=true" .Values.mcp.ingress.host | quote }} + secretName: {{ .Values.mcp.ingress.tls.secretName }} + {{- end }} + rules: + - host: {{ required "mcp.ingress.host is required when mcp.ingress.enabled=true" .Values.mcp.ingress.host | quote }} + http: + paths: + - path: / + pathType: Prefix + backend: + service: + name: {{ include "matcher-mcp.fullname" . }} + port: + number: {{ .Values.mcp.service.port }} +{{- end }} diff --git a/charts/matcher/templates/mcp/service.yaml b/charts/matcher/templates/mcp/service.yaml new file mode 100644 index 00000000..6bbbcc20 --- /dev/null +++ b/charts/matcher/templates/mcp/service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.mcp.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "matcher-mcp.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-mcp.labels" . | nindent 4 }} + {{- with .Values.mcp.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.mcp.service.type | default "ClusterIP" }} + ports: + - port: {{ .Values.mcp.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "matcher-mcp.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/matcher/templates/migrations/job.yaml b/charts/matcher/templates/migrations/job.yaml new file mode 100644 index 00000000..95b9ce65 --- /dev/null +++ b/charts/matcher/templates/migrations/job.yaml @@ -0,0 +1,98 @@ +{{- if .Values.migrations.enabled }} +# PreSync migration Job. Runs the dedicated, up-only matcher-migrations image +# (entrypoint /postgres-migrations from Dockerfile.migrations) which applies the +# embedded schema and exits. matcher v3+ is DETACHED: it checks migration compat +# on boot and refuses to start against an unmigrated DB, and the app image ships +# no migration binary. hook-weight -1 puts this after the PreSync Secret (-2) and +# before the main-sync matcher Deployment, so the app never boots unmigrated. +# Single-tenant: MULTI_TENANT_ENABLED is left UNSET (the runner refuses MT=true; +# the Tenant Manager owns tenant DB migrations). +{{- $pgHost := .Values.migrations.postgres.host | default .Values.matcher.configmap.POSTGRES_HOST | default (printf "%s-%s.%s.svc.cluster.local." (include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" .)) (.Values.postgresql.primary.name | default "primary") (include "global.namespace" .)) }} +{{- $pgPort := .Values.migrations.postgres.port | default .Values.matcher.configmap.POSTGRES_PORT | default "5432" }} +{{- $pgUser := .Values.migrations.postgres.user | default .Values.matcher.configmap.POSTGRES_USER | default "matcher" }} +{{- $pgDb := .Values.migrations.postgres.database | default .Values.matcher.configmap.POSTGRES_DB | default "matcher" }} +{{- $pgSslMode := .Values.migrations.postgres.sslMode | default .Values.matcher.configmap.POSTGRES_SSLMODE | default "disable" }} +{{- $secretName := ternary .Values.matcher.existingSecretName (include "matcher-migrations.fullname" .) .Values.matcher.useExistingSecret }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "matcher-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-1" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded +spec: + backoffLimit: {{ .Values.migrations.backoffLimit | default 3 }} + activeDeadlineSeconds: {{ .Values.migrations.activeDeadlineSeconds | default 600 }} + ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished | default 600 }} + template: + metadata: + labels: + {{- include "matcher-migrations.labels" . | nindent 8 }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with .Values.migrations.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + initContainers: + - name: wait-for-postgres + image: {{ .Values.migrations.waitImage | default "busybox" }} + command: + - /bin/sh + - -c + - > + echo "Waiting for {{ $pgHost }}:{{ $pgPort }}..."; + until nc -z {{ $pgHost }} {{ $pgPort }}; do + echo "{{ $pgHost }}:{{ $pgPort }} not ready, waiting..."; + sleep 5; + done; + echo "{{ $pgHost }}:{{ $pgPort }} is ready!"; + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + containers: + - name: migrations + image: "{{ .Values.migrations.image.repository }}:{{ .Values.migrations.image.tag | default .Values.matcher.image.tag }}" + imagePullPolicy: {{ .Values.migrations.image.pullPolicy | default "IfNotPresent" }} + env: + - name: POSTGRES_HOST + value: {{ $pgHost | quote }} + - name: POSTGRES_PORT + value: {{ $pgPort | quote }} + - name: POSTGRES_USER + value: {{ $pgUser | quote }} + - name: POSTGRES_DB + value: {{ $pgDb | quote }} + - name: POSTGRES_SSLMODE + value: {{ $pgSslMode | quote }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + {{- toYaml .Values.migrations.resources | nindent 12 }} +{{- end }} diff --git a/charts/matcher/templates/migrations/secrets.yaml b/charts/matcher/templates/migrations/secrets.yaml new file mode 100644 index 00000000..dd5eaeac --- /dev/null +++ b/charts/matcher/templates/migrations/secrets.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.migrations.enabled (not .Values.matcher.useExistingSecret) }} +# Dedicated PreSync Secret carrying the Postgres password for the migration Job. +# PreSync hooks run BEFORE the main sync wave, so on a first install the chart's +# own app Secret does not exist yet. This hook Secret (weight -2) is created +# before the migration Job (weight -1). hook-delete-policy is BeforeHookCreation +# only (NOT HookSucceeded) so it survives the whole PreSync phase for the Job to +# read; it is cleaned up at the next sync. Same password as the app Secret, so no +# new exposure. When matcher.useExistingSecret=true this Secret is NOT minted and +# the Job reads POSTGRES_PASSWORD from the operator-provided existing Secret. +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "matcher-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-2" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +type: Opaque +stringData: + POSTGRES_PASSWORD: {{ .Values.migrations.postgres.password | default .Values.matcher.secrets.POSTGRES_PASSWORD | quote }} +{{- end }} diff --git a/charts/matcher/templates/ui/deployment.yaml b/charts/matcher/templates/ui/deployment.yaml new file mode 100644 index 00000000..d992de29 --- /dev/null +++ b/charts/matcher/templates/ui/deployment.yaml @@ -0,0 +1,112 @@ +{{- if .Values.ui.enabled }} +{{- $image := printf "%s:%s" .Values.ui.image.repository (required "ui.image.tag is required when ui.enabled=true" .Values.ui.image.tag) -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "matcher-ui.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-ui.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.ui.replicaCount | default 1 }} + revisionHistoryLimit: {{ .Values.ui.revisionHistoryLimit | default 10 }} + selector: + matchLabels: + {{- include "matcher-ui.selectorLabels" . | nindent 6 }} + template: + metadata: + {{- with .Values.ui.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "matcher-ui.labels" . | nindent 8 }} + spec: + {{- with .Values.ui.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.ui.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + initContainers: + # Seed the read-only rootfs: copy the image's built static assets into the + # html emptyDir so the entrypoint can render config.js there at start. + - name: copy-html + image: {{ $image | quote }} + imagePullPolicy: {{ .Values.ui.image.pullPolicy | default "IfNotPresent" }} + command: ['sh', '-c', 'cp -a /usr/share/nginx/html/. /html-writable/'] + securityContext: + {{- toYaml .Values.ui.securityContext | nindent 12 }} + volumeMounts: + - name: html + mountPath: /html-writable + containers: + - name: {{ include "matcher-ui.fullname" . }} + image: {{ $image | quote }} + imagePullPolicy: {{ .Values.ui.image.pullPolicy | default "IfNotPresent" }} + securityContext: + {{- toYaml .Values.ui.securityContext | nindent 12 }} + ports: + - name: http + containerPort: {{ .Values.ui.service.port }} + protocol: TCP + env: + # The UI image is env-agnostic: the entrypoint renders /config.js at + # start from these vars into the html emptyDir (rootfs stays read-only). + # API_BASE_URL="" -> SPA calls /v1 and /system RELATIVE (same-origin); + # the UI ingress proxies those prefixes to the matcher API Service. + {{- range $key, $value := .Values.ui.env }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + livenessProbe: + httpGet: + # Default "/" (nginx SPA index): the beleriand-proven path. Set to + # /healthz only if the deployed UI image exposes it. + path: {{ .Values.ui.livenessProbe.path | default "/" }} + port: http + initialDelaySeconds: {{ .Values.ui.livenessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ .Values.ui.livenessProbe.periodSeconds | default 20 }} + timeoutSeconds: {{ .Values.ui.livenessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.ui.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.ui.livenessProbe.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: {{ .Values.ui.readinessProbe.path | default "/" }} + port: http + initialDelaySeconds: {{ .Values.ui.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ .Values.ui.readinessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ .Values.ui.readinessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.ui.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.ui.readinessProbe.failureThreshold | default 3 }} + resources: + {{- toYaml .Values.ui.resources | nindent 12 }} + volumeMounts: + - name: html + mountPath: /usr/share/nginx/html + - name: tmp + mountPath: /tmp + - name: nginx-cache + mountPath: /var/cache/nginx + volumes: + - name: html + emptyDir: {} + - name: tmp + emptyDir: {} + - name: nginx-cache + emptyDir: {} + {{- with .Values.ui.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.ui.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.ui.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/matcher/templates/ui/ingress.yaml b/charts/matcher/templates/ui/ingress.yaml new file mode 100644 index 00000000..2d3aa75d --- /dev/null +++ b/charts/matcher/templates/ui/ingress.yaml @@ -0,0 +1,50 @@ +{{- if and .Values.ui.enabled .Values.ui.ingress.enabled -}} +{{- $apiSvc := include "matcher.fullname" . -}} +{{- $apiPort := .Values.matcher.service.port -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "matcher-ui.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-ui.labels" . | nindent 4 }} + {{- with .Values.ui.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with .Values.ui.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- if .Values.ui.ingress.tls.enabled }} + tls: + - hosts: + - {{ required "ui.ingress.host is required when ui.ingress.enabled=true" .Values.ui.ingress.host | quote }} + secretName: {{ .Values.ui.ingress.tls.secretName }} + {{- end }} + rules: + - host: {{ required "ui.ingress.host is required when ui.ingress.enabled=true" .Values.ui.ingress.host | quote }} + http: + paths: + # SAME-ORIGIN PROXY (decision Fred 2026-06-27): the UI image hardcodes a + # CSP with connect-src 'self', so the API MUST be served from the SAME + # host as the UI (no cross-origin). These prefixes route to the matcher + # API Service; "/" routes to the UI Service. nginx uses longest-prefix + # matching, so /v1 and /system win over /. + {{- range .Values.ui.ingress.apiPaths }} + - path: {{ . }} + pathType: Prefix + backend: + service: + name: {{ $apiSvc }} + port: + number: {{ $apiPort }} + {{- end }} + - path: / + pathType: Prefix + backend: + service: + name: {{ include "matcher-ui.fullname" . }} + port: + number: {{ .Values.ui.service.port }} +{{- end }} diff --git a/charts/matcher/templates/ui/service.yaml b/charts/matcher/templates/ui/service.yaml new file mode 100644 index 00000000..dfa98c94 --- /dev/null +++ b/charts/matcher/templates/ui/service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.ui.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "matcher-ui.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "matcher-ui.labels" . | nindent 4 }} + {{- with .Values.ui.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.ui.service.type | default "ClusterIP" }} + ports: + - port: {{ .Values.ui.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "matcher-ui.selectorLabels" . | nindent 4 }} +{{- end }} diff --git a/charts/matcher/values.schema.json b/charts/matcher/values.schema.json index 3dbc6b92..cbf3022a 100644 --- a/charts/matcher/values.schema.json +++ b/charts/matcher/values.schema.json @@ -28,6 +28,18 @@ }, "additionalProperties": true }, + "ui": { + "type": "object", + "additionalProperties": true + }, + "mcp": { + "type": "object", + "additionalProperties": true + }, + "migrations": { + "type": "object", + "additionalProperties": true + }, "valkey": { "type": "object", "additionalProperties": true diff --git a/charts/matcher/values.yaml b/charts/matcher/values.yaml index a4ce7a85..e92c138c 100644 --- a/charts/matcher/values.yaml +++ b/charts/matcher/values.yaml @@ -203,6 +203,9 @@ matcher: LOG_LEVEL: "info" SERVER_ADDRESS: ":8080" HTTP_BODY_LIMIT_BYTES: "104857600" + # -- Go soft memory limit (opt-in). Set ~85% of the pod memory limit; Go 1.26 + # does not auto-detect cgroup limits. Only emitted when non-empty. e.g. "435MiB" + GOMEMLIMIT: "" # CORS Configuration CORS_ALLOWED_ORIGINS: "*" @@ -276,9 +279,14 @@ matcher: RABBITMQ_VHOST: "/" RABBITMQ_HEALTH_URL: "http://matcher-rabbitmq.matcher.svc.cluster.local.:15672" - # Authentication - AUTH_ENABLED: "false" - AUTH_SERVICE_ADDRESS: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local.:4000" + # Authentication (delegated to plugin-auth in app v4). Canonical knobs: + # PLUGIN_AUTH_ENABLED (effective default "false") and PLUGIN_AUTH_ADDRESS + # (effective default the in-cluster plugin-access-manager URL). Leave EMPTY to + # take the default: the configmap template resolves empty -> legacy AUTH_ENABLED / + # AUTH_SERVICE_ADDRESS (fallback for migration) -> hard default. Setting a + # non-empty value here overrides the legacy fallback. + PLUGIN_AUTH_ENABLED: "" + PLUGIN_AUTH_ADDRESS: "" # Swagger Documentation SWAGGER_ENABLED: "false" @@ -375,8 +383,11 @@ matcher: OBJECT_STORAGE_ACCESS_KEY_ID: "" # -- Object Storage secret key OBJECT_STORAGE_SECRET_ACCESS_KEY: "" - # -- JWT secret for authentication - AUTH_JWT_SECRET: "" + # -- Engine credential master key (base64 32-byte). REQUIRED in production. + # Generate with: openssl rand -base64 32 | tr -d '\n'. Emitted only when set. + APP_ENC_KEY: "" + # -- Actor PII encryption key (optional, base64 32-byte). Emitted only when set. + ACTOR_PII_ENCRYPTION_KEY: "" # -- Systemplane AES-256-GCM master key for encrypting secret config values # REQUIRED: Generate with: openssl rand -base64 32 | tr -d '\n' # WARNING: Use a unique value per environment. Never use the default in production. @@ -402,6 +413,244 @@ matcher: # @default -- `matcher.fullname` name: "" +# ============================================================================= +# UI component (matcher-ui) — Vite SPA served by nginx-unprivileged. +# Disabled by default. When enabled, the ingress implements the same-origin +# proxy: /v1 and /system route to the matcher API Service, / routes to the UI. +# ============================================================================= +ui: + # -- Enable the matcher UI component + enabled: false + # -- Number of UI replicas + replicaCount: 1 + # -- Number of old ReplicaSets to retain + revisionHistoryLimit: 10 + image: + # -- UI image repository + repository: ghcr.io/lerianstudio/matcher-ui + # -- UI image tag (REQUIRED when ui.enabled=true) + tag: "" + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Secrets for pulling the UI image from a private registry + imagePullSecrets: [] + # -- Pod annotations + podAnnotations: {} + # -- Pod-level security context. fsGroup 101 makes the emptyDir volumes + # (html / tmp / cache) group-writable by the non-root nginx user. + podSecurityContext: + fsGroup: 101 + # -- Container security context. nginx-unprivileged runs as uid 101 with a + # read-only rootfs; emptyDir volumes back /usr/share/nginx/html (seeded by an + # initContainer so config.js can be rendered at start), /tmp and /var/cache/nginx. + securityContext: + runAsUser: 101 + runAsGroup: 101 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + service: + # -- Service type + type: ClusterIP + # -- Service port (also the containerPort) + port: 8080 + annotations: {} + # -- UI runtime env. Rendered verbatim into the container. Empty values are + # emitted (API_BASE_URL="" means same-origin). + env: + # -- Empty -> SPA calls /v1 and /system RELATIVE (same-origin proxy) + API_BASE_URL: "" + # -- Trusted API origins (set to the UI host, e.g. https://matcher-ui.example.com) + TRUSTED_API_ORIGINS: "" + # -- Disable UI auth (set "false" when wiring plugin-auth) + AUTH_DISABLED: "true" + # -- Optional: WORKOS_CLIENT_ID (uncomment to set) + # WORKOS_CLIENT_ID: "" + # -- Liveness probe (path defaults to "/", the nginx SPA index) + livenessProbe: + path: "/" + # -- Readiness probe (path defaults to "/") + readinessProbe: + path: "/" + resources: + limits: + cpu: 200m + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + ingress: + # -- Enable the UI ingress (same-origin proxy) + enabled: false + # -- Ingress class name + className: "nginx" + # -- Ingress annotations (e.g. cert-manager.io/cluster-issuer) + annotations: {} + # -- UI host (REQUIRED when ui.ingress.enabled=true) + host: "" + # -- API prefixes routed to the matcher API Service (same-origin). nginx + # longest-prefix matching ensures these win over "/". + apiPaths: + - /v1 + - /system + tls: + # -- Enable TLS + enabled: true + # -- TLS secret name + secretName: "matcher-ui-tls" + # -- Node selector + nodeSelector: {} + # -- Tolerations + tolerations: {} + # -- Affinity + affinity: {} + +# ============================================================================= +# MCP component (matcher-mcp) — Node, Streamable HTTP. Stateless bearer-token +# relay (holds NO credentials). Independent version line from the app. +# Disabled by default. +# ============================================================================= +mcp: + # -- Enable the matcher MCP component + enabled: false + # -- Number of MCP replicas + replicaCount: 1 + # -- Number of old ReplicaSets to retain + revisionHistoryLimit: 10 + image: + # -- MCP image repository + repository: ghcr.io/lerianstudio/matcher-mcp + # -- MCP image tag (REQUIRED when mcp.enabled=true; INDEPENDENT of the app tag) + tag: "" + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Secrets for pulling the MCP image from a private registry + imagePullSecrets: [] + # -- Pod annotations + podAnnotations: {} + # -- Pod-level security context (optional) + podSecurityContext: {} + # -- Container security context. Distroless nonroot (uid 65532), read-only rootfs. + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + service: + # -- Service type + type: ClusterIP + # -- Service port (also the containerPort) + port: 4019 + annotations: {} + # -- MCP runtime env. MATCHER_API_URL is derived from the release when empty. + env: + # -- In-cluster matcher API URL (empty -> derived: http://..svc.cluster.local:) + MATCHER_API_URL: "" + # -- MCP listen port (keep in sync with mcp.service.port) + MCP_PORT: "4019" + # -- Enable telemetry + ENABLE_TELEMETRY: "false" + # -- SSRF allowlist for upload fetch (empty = off) + MCP_UPLOAD_ALLOWED_HOSTS: "" + # -- Max bytes fetched for uploads + MCP_UPLOAD_MAX_FETCH_BYTES: "10485760" + # -- Upstream matcher API request timeout (ms) + MATCHER_TIMEOUT_MS: "30000" + # -- Max request body bytes + MAX_BODY_BYTES: "1048576" + # -- Liveness probe (path defaults to /healthz) + livenessProbe: + path: "/healthz" + # -- Readiness probe (path defaults to /healthz) + readinessProbe: + path: "/healthz" + resources: + limits: + cpu: 500m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi + ingress: + # -- Enable the MCP ingress + enabled: false + # -- Ingress class name + className: "nginx" + # -- Ingress annotations. Streaming HTTP defaults: proxy-buffering off, + # long read-timeout. Add cert-manager.io/cluster-issuer as needed. + annotations: + nginx.ingress.kubernetes.io/proxy-buffering: "off" + nginx.ingress.kubernetes.io/proxy-read-timeout: "3600" + # -- MCP host (REQUIRED when mcp.ingress.enabled=true) + host: "" + tls: + # -- Enable TLS + enabled: true + # -- TLS secret name + secretName: "matcher-mcp-tls" + # -- Node selector + nodeSelector: {} + # -- Tolerations + tolerations: {} + # -- Affinity + affinity: {} + +# ============================================================================= +# Detached migrations (matcher-migrations) — ArgoCD PreSync Secret + Job that +# applies the schema (up-only, single-tenant) before the app Deployment. +# Disabled by default. Requires an operator-provided Postgres password (external +# PG) or matcher.useExistingSecret pointing at a pre-created Secret. +# ============================================================================= +migrations: + # -- Enable the detached migration PreSync Job + enabled: false + image: + # -- Migration runner image repository + repository: ghcr.io/lerianstudio/matcher-migrations + # -- Migration image tag (empty -> falls back to matcher.image.tag) + tag: "" + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Secrets for pulling the migration image from a private registry + imagePullSecrets: [] + # -- Image used by the TCP-wait initContainer + waitImage: busybox + # -- Postgres connection for the migration Job. Empty fields fall back to + # matcher.configmap.POSTGRES_* (host derives from the postgresql subchart). + postgres: + host: "" + port: "" + user: "" + database: "" + sslMode: "" + # -- Password for the PreSync Secret (empty -> matcher.secrets.POSTGRES_PASSWORD). + # Ignored when matcher.useExistingSecret=true (Job reads the existing Secret). + password: "" + # -- Job backoff limit + backoffLimit: 3 + # -- Job active deadline (seconds) + activeDeadlineSeconds: 600 + # -- TTL after the Job finishes (seconds) + ttlSecondsAfterFinished: 600 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 256Mi + # Valkey (Redis-compatible) configuration valkey: enabled: true From b33b067454eb04c33f6cd4a31f127140978c5a6b Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 1 Jul 2026 23:45:58 +0000 Subject: [PATCH 020/113] chore(release): 3.1.0-beta.2 ## (2026-07-01) ### Features * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) ### Bug Fixes * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) --- README.md | 2 +- charts/matcher/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7e147a05..d4d65bfc 100644 --- a/README.md +++ b/README.md @@ -180,7 +180,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Matcher Version | | :---: | :---: | -| `3.1.0-beta.1` | 1.0.0 | +| `3.1.0-beta.2` | 1.0.0 | ### Flowker diff --git a/charts/matcher/Chart.yaml b/charts/matcher/Chart.yaml index abd4d9dc..f27fc899 100644 --- a/charts/matcher/Chart.yaml +++ b/charts/matcher/Chart.yaml @@ -16,7 +16,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.2.0-beta.1 +version: 3.1.0-beta.2 # NOTE: appVersion is a stale placeholder. The real app image tag is set via # matcher.image.tag (and per-component ui.image.tag / mcp.image.tag / migrations.image.tag). From 66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Thu, 2 Jul 2026 22:09:16 +0000 Subject: [PATCH 021/113] fix(streaming-hub): update streaming-hub@1.0.1 --- charts/streaming-hub/Chart.yaml | 2 +- charts/streaming-hub/values.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index 8c5657e8..757dc40e 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -6,7 +6,7 @@ type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. version: 1.0.0-beta.2 -appVersion: "1.0.0" +appVersion: "1.0.1" annotations: lerian.studio/chart-type: multi-component home: https://github.com/LerianStudio/streaming-hub diff --git a/charts/streaming-hub/values.yaml b/charts/streaming-hub/values.yaml index 0438ac83..6921ebd0 100644 --- a/charts/streaming-hub/values.yaml +++ b/charts/streaming-hub/values.yaml @@ -433,4 +433,4 @@ streamingHub: affinity: {} streaming-hub: image: - tag: 1.0.0 + tag: 1.0.1 From de702edc6490f6cc1b9734c61849cc674610b254 Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Thu, 2 Jul 2026 20:36:06 -0300 Subject: [PATCH 022/113] feat(plugin-br-payments): use single MIDAZ_LEDGER_URL Replace the required MIDAZ_ONBOARDING_URL + MIDAZ_TRANSACTION_URL pair with a single MIDAZ_LEDGER_URL, matching the app refactor to one Ledger plane URL. The old pair is kept as a deprecated validation fallback so environments that have not migrated yet (e.g. stg-mt) are not silently broken. - _helpers.tpl: single MIDAZ_LEDGER_URL gate, old pair accepted as fallback - NOTES.txt / README.md: document MIDAZ_LEDGER_URL - values.yaml / values-template.yaml: MIDAZ_LEDGER_URL default - Chart.yaml: bump 1.1.0-beta.4 -> 1.1.0-beta.5 - CHANGELOG.md: entry under 1.1.0-beta.5 --- charts/plugin-br-payments/CHANGELOG.md | 17 +++++++++++++++++ charts/plugin-br-payments/Chart.yaml | 2 +- charts/plugin-br-payments/README.md | 3 +-- charts/plugin-br-payments/templates/NOTES.txt | 3 +-- .../plugin-br-payments/templates/_helpers.tpl | 16 ++++++++++------ charts/plugin-br-payments/values-template.yaml | 6 +++--- charts/plugin-br-payments/values.yaml | 7 ++++--- 7 files changed, 37 insertions(+), 17 deletions(-) diff --git a/charts/plugin-br-payments/CHANGELOG.md b/charts/plugin-br-payments/CHANGELOG.md index f70a3eb6..d89386e3 100644 --- a/charts/plugin-br-payments/CHANGELOG.md +++ b/charts/plugin-br-payments/CHANGELOG.md @@ -5,6 +5,23 @@ All notable changes to this chart will be documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/), and this chart adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [1.1.0-beta.5] — Unreleased + +### Changed + +- Renamed the Midaz Ledger configmap key to a single `app.configmap.MIDAZ_LEDGER_URL`, + matching the app refactor that reads one Ledger plane URL instead of the former + `MIDAZ_ONBOARDING_URL` + `MIDAZ_TRANSACTION_URL` pair. Updated the required-value + validation (`_helpers.tpl`), `NOTES.txt`, `values.yaml`, `values-template.yaml`, + and `README.md`. + +### Deprecated + +- `app.configmap.MIDAZ_ONBOARDING_URL` and `app.configmap.MIDAZ_TRANSACTION_URL` + are deprecated. They are still accepted as a fallback (validation passes when + both are set) for environments that have not yet migrated to `MIDAZ_LEDGER_URL`. + Remove once all overlays use the single key. + ## [1.0.0-beta.2] — Unreleased ### Changed diff --git a/charts/plugin-br-payments/Chart.yaml b/charts/plugin-br-payments/Chart.yaml index d47cced8..e294feb7 100644 --- a/charts/plugin-br-payments/Chart.yaml +++ b/charts/plugin-br-payments/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.1.0-beta.4 +version: 1.1.0-beta.5 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.9" diff --git a/charts/plugin-br-payments/README.md b/charts/plugin-br-payments/README.md index 1b9e359b..ae1ce527 100644 --- a/charts/plugin-br-payments/README.md +++ b/charts/plugin-br-payments/README.md @@ -56,8 +56,7 @@ The chart **fails fast** on `helm install` if any of the following are missing: | `app.configmap.OUTBOX_ENABLED` | Must be `"true"`. The plugin only registers HTTP routes when the outbox is enabled. | | `app.configmap.BTG_API_BASE_URL` | BTG API base URL. | | `app.configmap.BTG_AUTH_URL` | BTG OAuth2 token URL. | -| `app.configmap.MIDAZ_ONBOARDING_URL` | Midaz onboarding service URL. | -| `app.configmap.MIDAZ_TRANSACTION_URL` | Midaz transaction service URL. | +| `app.configmap.MIDAZ_LEDGER_URL` | Midaz Ledger service URL (single plane). The deprecated `MIDAZ_ONBOARDING_URL` + `MIDAZ_TRANSACTION_URL` pair is still accepted as a fallback. | | `app.secrets.BTG_CLIENT_ID` | BTG OAuth2 client ID. | | `app.secrets.BTG_CLIENT_SECRET` | BTG OAuth2 client secret. | | `app.secrets.BTG_WEBHOOK_SECRET` | Bearer token for incoming BTG webhooks. | diff --git a/charts/plugin-br-payments/templates/NOTES.txt b/charts/plugin-br-payments/templates/NOTES.txt index 3f43eb57..906e89e5 100644 --- a/charts/plugin-br-payments/templates/NOTES.txt +++ b/charts/plugin-br-payments/templates/NOTES.txt @@ -46,8 +46,7 @@ The following values MUST be set for the deployment to start successfully: - app.configmap.OUTBOX_ENABLED (must be "true" — HTTP routes only register when the outbox is enabled) - app.configmap.BTG_API_BASE_URL (BTG API base URL) - app.configmap.BTG_AUTH_URL (BTG OAuth2 token URL) - - app.configmap.MIDAZ_ONBOARDING_URL (Midaz onboarding service URL) - - app.configmap.MIDAZ_TRANSACTION_URL (Midaz transaction service URL) + - app.configmap.MIDAZ_LEDGER_URL (Midaz Ledger service URL; deprecated MIDAZ_ONBOARDING_URL + MIDAZ_TRANSACTION_URL pair still accepted as a fallback) - app.secrets.BTG_CLIENT_ID (BTG OAuth2 client ID) - app.secrets.BTG_CLIENT_SECRET (BTG OAuth2 client secret) - app.secrets.BTG_WEBHOOK_SECRET (BTG webhook bearer token) diff --git a/charts/plugin-br-payments/templates/_helpers.tpl b/charts/plugin-br-payments/templates/_helpers.tpl index f44e058c..1a616af3 100644 --- a/charts/plugin-br-payments/templates/_helpers.tpl +++ b/charts/plugin-br-payments/templates/_helpers.tpl @@ -181,13 +181,17 @@ plugin-br-payments README. {{- fail "\n\nERROR: app.secrets.BTG_WEBHOOK_SECRET is REQUIRED.\n Set the BTG webhook bearer token in the secrets section.\n" }} {{- end }} -{{/* Midaz Ledger URLs — required for production */}} -{{- if not .Values.app.configmap.MIDAZ_ONBOARDING_URL }} -{{- fail "\n\nERROR: app.configmap.MIDAZ_ONBOARDING_URL is REQUIRED.\n Set the Midaz onboarding service URL.\n" }} +{{/* Midaz Ledger URL — required for production. + Preferred: app.configmap.MIDAZ_LEDGER_URL (single Ledger plane URL; the + app now serves onboarding + transaction from one plane). + DEPRECATED fallback: MIDAZ_ONBOARDING_URL + MIDAZ_TRANSACTION_URL (the + former split pair). Still accepted for backward compatibility with + environments that have not migrated yet; remove once all overlays use + MIDAZ_LEDGER_URL. */}} +{{- if not .Values.app.configmap.MIDAZ_LEDGER_URL }} +{{- if not (and .Values.app.configmap.MIDAZ_ONBOARDING_URL .Values.app.configmap.MIDAZ_TRANSACTION_URL) }} +{{- fail "\n\nERROR: app.configmap.MIDAZ_LEDGER_URL is REQUIRED.\n Set the Midaz Ledger service URL.\n (Deprecated: the former MIDAZ_ONBOARDING_URL + MIDAZ_TRANSACTION_URL pair is still accepted as a fallback.)\n" }} {{- end }} - -{{- if not .Values.app.configmap.MIDAZ_TRANSACTION_URL }} -{{- fail "\n\nERROR: app.configmap.MIDAZ_TRANSACTION_URL is REQUIRED.\n Set the Midaz transaction service URL.\n" }} {{- end }} {{/* PostgreSQL password is single-sourced from the postgresql subchart Secret diff --git a/charts/plugin-br-payments/values-template.yaml b/charts/plugin-br-payments/values-template.yaml index 141d5798..9423ec5d 100644 --- a/charts/plugin-br-payments/values-template.yaml +++ b/charts/plugin-br-payments/values-template.yaml @@ -35,9 +35,9 @@ app: # BTG Provider integration (REQUIRED) BTG_API_BASE_URL: "" BTG_AUTH_URL: "" - # Midaz Ledger (REQUIRED) - MIDAZ_ONBOARDING_URL: "" - MIDAZ_TRANSACTION_URL: "" + # Midaz Ledger (REQUIRED) — single Ledger plane URL. The deprecated + # MIDAZ_ONBOARDING_URL + MIDAZ_TRANSACTION_URL pair is still accepted. + MIDAZ_LEDGER_URL: "" # Auth PLUGIN_AUTH_ENABLED: "true" PLUGIN_AUTH_ADDRESS: "" diff --git a/charts/plugin-br-payments/values.yaml b/charts/plugin-br-payments/values.yaml index 3e81c831..925ccc49 100644 --- a/charts/plugin-br-payments/values.yaml +++ b/charts/plugin-br-payments/values.yaml @@ -238,9 +238,10 @@ app: BTG_API_BASE_URL: "" BTG_AUTH_URL: "" BTG_TOKEN_REFRESH_INTERVAL: "1h" - # Midaz Ledger URLs (REQUIRED for production - validated by helper) - MIDAZ_ONBOARDING_URL: "" - MIDAZ_TRANSACTION_URL: "" + # Midaz Ledger URL (REQUIRED for production - validated by helper). + # Single Ledger plane URL; the deprecated MIDAZ_ONBOARDING_URL + + # MIDAZ_TRANSACTION_URL pair is still accepted as a fallback. + MIDAZ_LEDGER_URL: "" # Reconciliation worker (in-process) RECONCILIATION_INTERVAL: "5m" RECONCILIATION_LOOKBACK_HOURS: "24" From 5d6bf6a3d210db1f257a2f7e116f47a886eb754f Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Thu, 2 Jul 2026 19:40:43 -0700 Subject: [PATCH 023/113] feat(charts): add br-spi-helm chart for the SPI rail Backfills develop with the br-spi-helm chart, which landed on main via #1607 (direct-to-main) and was therefore absent from the develop prerelease channel. Scope is limited to charts/br-spi + its render fixture; the pre-existing main/develop drift in other charts is untouched. Claude-Session: https://claude.ai/code/session_012fNphWnucMKd84KskVFgvz Signed-off-by: Fred Amaral --- .../configs/helm-render-values/br-spi.yaml | 38 ++ charts/br-spi/Chart.lock | 9 + charts/br-spi/Chart.yaml | 49 ++ charts/br-spi/README.md | 73 +++ charts/br-spi/templates/_component.tpl | 422 +++++++++++++++++ charts/br-spi/templates/_helpers.tpl | 132 ++++++ charts/br-spi/templates/brcode/configmap.yaml | 1 + .../br-spi/templates/brcode/deployment.yaml | 1 + charts/br-spi/templates/brcode/hpa.yaml | 1 + charts/br-spi/templates/brcode/ingress.yaml | 1 + charts/br-spi/templates/brcode/pdb.yaml | 1 + charts/br-spi/templates/brcode/secrets.yaml | 1 + charts/br-spi/templates/brcode/service.yaml | 1 + charts/br-spi/templates/common/NOTES.txt | 31 ++ .../templates/common/serviceaccount.yaml | 18 + charts/br-spi/templates/core/configmap.yaml | 1 + charts/br-spi/templates/core/deployment.yaml | 1 + charts/br-spi/templates/core/hpa.yaml | 1 + charts/br-spi/templates/core/ingress.yaml | 1 + charts/br-spi/templates/core/pdb.yaml | 1 + charts/br-spi/templates/core/secrets.yaml | 1 + charts/br-spi/templates/core/service.yaml | 1 + charts/br-spi/templates/dict/configmap.yaml | 1 + charts/br-spi/templates/dict/deployment.yaml | 1 + charts/br-spi/templates/dict/hpa.yaml | 1 + charts/br-spi/templates/dict/ingress.yaml | 1 + charts/br-spi/templates/dict/pdb.yaml | 1 + charts/br-spi/templates/dict/secrets.yaml | 1 + charts/br-spi/templates/dict/service.yaml | 1 + charts/br-spi/templates/migrations/job.yaml | 105 +++++ .../br-spi/templates/migrations/secrets.yaml | 24 + charts/br-spi/templates/spi/configmap.yaml | 1 + charts/br-spi/templates/spi/deployment.yaml | 1 + charts/br-spi/templates/spi/hpa.yaml | 1 + charts/br-spi/templates/spi/ingress.yaml | 1 + charts/br-spi/templates/spi/pdb.yaml | 1 + charts/br-spi/templates/spi/secrets.yaml | 1 + charts/br-spi/templates/spi/service.yaml | 1 + charts/br-spi/values-template.yaml | 61 +++ charts/br-spi/values.schema.json | 95 ++++ charts/br-spi/values.yaml | 443 ++++++++++++++++++ 41 files changed, 1528 insertions(+) create mode 100644 .github/configs/helm-render-values/br-spi.yaml create mode 100644 charts/br-spi/Chart.lock create mode 100644 charts/br-spi/Chart.yaml create mode 100644 charts/br-spi/README.md create mode 100644 charts/br-spi/templates/_component.tpl create mode 100644 charts/br-spi/templates/_helpers.tpl create mode 100644 charts/br-spi/templates/brcode/configmap.yaml create mode 100644 charts/br-spi/templates/brcode/deployment.yaml create mode 100644 charts/br-spi/templates/brcode/hpa.yaml create mode 100644 charts/br-spi/templates/brcode/ingress.yaml create mode 100644 charts/br-spi/templates/brcode/pdb.yaml create mode 100644 charts/br-spi/templates/brcode/secrets.yaml create mode 100644 charts/br-spi/templates/brcode/service.yaml create mode 100644 charts/br-spi/templates/common/NOTES.txt create mode 100644 charts/br-spi/templates/common/serviceaccount.yaml create mode 100644 charts/br-spi/templates/core/configmap.yaml create mode 100644 charts/br-spi/templates/core/deployment.yaml create mode 100644 charts/br-spi/templates/core/hpa.yaml create mode 100644 charts/br-spi/templates/core/ingress.yaml create mode 100644 charts/br-spi/templates/core/pdb.yaml create mode 100644 charts/br-spi/templates/core/secrets.yaml create mode 100644 charts/br-spi/templates/core/service.yaml create mode 100644 charts/br-spi/templates/dict/configmap.yaml create mode 100644 charts/br-spi/templates/dict/deployment.yaml create mode 100644 charts/br-spi/templates/dict/hpa.yaml create mode 100644 charts/br-spi/templates/dict/ingress.yaml create mode 100644 charts/br-spi/templates/dict/pdb.yaml create mode 100644 charts/br-spi/templates/dict/secrets.yaml create mode 100644 charts/br-spi/templates/dict/service.yaml create mode 100644 charts/br-spi/templates/migrations/job.yaml create mode 100644 charts/br-spi/templates/migrations/secrets.yaml create mode 100644 charts/br-spi/templates/spi/configmap.yaml create mode 100644 charts/br-spi/templates/spi/deployment.yaml create mode 100644 charts/br-spi/templates/spi/hpa.yaml create mode 100644 charts/br-spi/templates/spi/ingress.yaml create mode 100644 charts/br-spi/templates/spi/pdb.yaml create mode 100644 charts/br-spi/templates/spi/secrets.yaml create mode 100644 charts/br-spi/templates/spi/service.yaml create mode 100644 charts/br-spi/values-template.yaml create mode 100644 charts/br-spi/values.schema.json create mode 100644 charts/br-spi/values.yaml diff --git a/.github/configs/helm-render-values/br-spi.yaml b/.github/configs/helm-render-values/br-spi.yaml new file mode 100644 index 00000000..0aca4bab --- /dev/null +++ b/.github/configs/helm-render-values/br-spi.yaml @@ -0,0 +1,38 @@ +# CI-only render fixture for br-spi. Dummy values, NOT a production example and +# NOT real credentials. Exercises the external-infra path (the target-environment +# reality): all four components + the migration Job enabled, Postgres/Redis +# external. The declared Bitnami subcharts stay disabled; the render gate still +# runs the release-name collapse renders against them. +core: + configmap: + POSTGRES_HOST: "pg.example.svc" + STREAMING_BROKERS: "kafka-dummy:9092" + secrets: + POSTGRES_PASSWORD: "dummy-ci-password" + +spi: + configmap: + POSTGRES_HOST: "pg.example.svc" + STREAMING_BROKERS: "kafka-dummy:9092" + BACEN_SPI_ENDPOINT: "http://mock-bacen.example.svc:8080" + secrets: + POSTGRES_PASSWORD: "dummy-ci-password" + +brcode: + configmap: + POSTGRES_HOST: "pg.example.svc" + secrets: + POSTGRES_PASSWORD: "dummy-ci-password" + +dict: + configmap: + POSTGRES_HOST: "pg.example.svc" + REDIS_HOST: "redis.example.svc:6379" + secrets: + POSTGRES_PASSWORD: "dummy-ci-password" + REDIS_PASSWORD: "dummy-ci-redis" + +migrations: + enabled: true + postgres: + host: "pg.example.svc" diff --git a/charts/br-spi/Chart.lock b/charts/br-spi/Chart.lock new file mode 100644 index 00000000..51ae192c --- /dev/null +++ b/charts/br-spi/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 16.3.5 +- name: valkey + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.4.7 +digest: sha256:52ff7322d903f193a03cdb12e017ea953e3f7c06cd6019216410086fef3bcd6b +generated: "2026-07-02T18:30:40.65224-07:00" diff --git a/charts/br-spi/Chart.yaml b/charts/br-spi/Chart.yaml new file mode 100644 index 00000000..a0532300 --- /dev/null +++ b/charts/br-spi/Chart.yaml @@ -0,0 +1,49 @@ +apiVersion: v2 +name: br-spi-helm +description: A Helm chart for the br-sfn SPI (Pix) rail — the four Go binaries (core, spi, brcode, dict) that connect an FI to BACEN SPI/DICT/Pix and emit settlement CloudEvents onto a Redpanda bus + +type: application +annotations: + lerian.studio/chart-type: multi-component + +home: https://github.com/LerianStudio/helm + +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/br-spi + - https://github.com/LerianStudio/br-spi + +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" + +version: 0.1.0-beta.1 + +# NOTE: appVersion is the default image tag for every component and the +# migration Job. Override per component via .image.tag when a +# component needs to pin a different build. +appVersion: "0.1.0" + +keywords: + - br-spi + - spi + - pix + - bacen + - dict + - lerian + - settlement + +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 + +# Bitnami subcharts are DECLARED (exact pins, condition-gated) so the chart can +# optionally bundle infra, but they default to disabled: on the target +# environments Postgres and Redis are EXTERNAL and pre-provisioned. Chart.lock is +# committed; re-verify Secret name/key against `helm template` on any pin bump. +dependencies: + - name: postgresql + version: "16.3.5" + repository: "https://charts.bitnami.com/bitnami" + condition: postgresql.enabled + - name: valkey + version: "2.4.7" + repository: "oci://registry-1.docker.io/bitnamicharts" + condition: valkey.enabled diff --git a/charts/br-spi/README.md b/charts/br-spi/README.md new file mode 100644 index 00000000..5209c1f6 --- /dev/null +++ b/charts/br-spi/README.md @@ -0,0 +1,73 @@ +# br-spi Helm Chart + +Deploys the **br-sfn SPI (Pix) rail** — the four Go binaries (`core`, `spi`, `brcode`, `dict`) that connect a financial institution to BACEN SPI / DICT / Pix — into Kubernetes. When streaming is enabled, `core` becomes a CloudEvents **producer**, emitting `studio.lerian.settlement.*` onto the `br-spi.settlement` topic of a Redpanda/Kafka bus. + +## Chart Contract + +- Chart type: `multi-component` +- Required secrets: **None for a default render.** For external Postgres (the default), provide each component's `POSTGRES_PASSWORD` (all four share the single `brspi` database) via `.secrets.POSTGRES_PASSWORD` or `.useExistingSecret`; on the target environments this is sourced from GitOps/Vault. `dict` additionally needs `REDIS_PASSWORD` when its external Redis requires auth. When the bundled `postgresql`/`valkey` subcharts are enabled instead, those passwords are **single-sourced** from the subchart Secrets (read at runtime via `secretKeyRef`) and are not stored in the app Secrets. No credential is ever placed in a ConfigMap. Optional at-rest / PII keys added under `.secrets` are emitted only when set. +- Dependency notes: Bundled `postgresql` (16.3.5) and `valkey` (2.4.7) Bitnami subcharts are **declared but disabled by default** — Postgres and Redis are external and pre-provisioned on the target environments. Kafka/Redpanda is external and referenced only by `STREAMING_BROKERS` (plaintext; no SASL/TLS knobs). Enable the subcharts only for a self-contained install. +- Production overrides: Set `.image.tag` (defaults to `Chart.appVersion`); `POSTGRES_HOST` and `POSTGRES_PASSWORD` for every enabled component; `STREAMING_BROKERS` for `core` and `spi` (a producer with `STREAMING_ENABLED=true` and empty `STREAMING_BROKERS`/`STREAMING_CLOUDEVENTS_SOURCE` **fails closed at boot** by design); `REDIS_HOST` for `dict`; and per-component `ingress`, `autoscaling`, and `resources` as needed. `useExistingSecret`/`existingSecretName` are supported per component and for the migration Job. +- Source/license: Source is in `github.com/LerianStudio/helm`; chart license is Apache-2.0. The `br-spi` service source is `github.com/LerianStudio/br-spi`. + +## Components + +All four components are the same Go binary family (identical deployment shape). The chart renders them from one shared template library, so env — especially `STREAMING_*` — is emitted uniformly and a component can never silently drop a producer knob. + +| Component | Image (default) | Listens | Streams | Role | +|-----------|-----------------|---------|---------|------| +| `core` | `ghcr.io/lerianstudio/br-sfn-core` | `:8080` | **yes** | Settlement engine; sole producer of `studio.lerian.settlement.*` | +| `spi` | `ghcr.io/lerianstudio/br-sfn-spi` | `:8080` | **yes** | ISO 20022 / BACEN SPI; writes the `spi->core` seam | +| `brcode` | `ghcr.io/lerianstudio/br-sfn-brcode` | `:8080` | no | Pix BR Code (QR) REST | +| `dict` | `ghcr.io/lerianstudio/br-sfn-dict` | `:8080` | no | DICT (Pix directory) REST; **requires `REDIS_HOST`** | + +Each component exposes: `.enabled`, `image.{repository,tag,pullPolicy}`, `replicaCount`, `service`, `ingress`, `autoscaling`, `pdb`, `resources`, `configmap` (map, emitted verbatim), `secrets`, `useExistingSecret`/`existingSecretName`, `extraEnvVars` (raw env list escape). Probes are `/health` (liveness) and `/readyz` (readiness) on the `http` port (containerPort `8080`). + +### Settlement producer coupling + +`core` produces `settlement.*` only by **consuming** the `spi->core` seam topics that `spi` writes. Therefore **both** `core` and `spi` must have `STREAMING_ENABLED=true`, the **same** `STREAMING_BROKERS`, and the **same** Postgres, or no settlement event is emitted at all. `brcode` and `dict` are REST-only and stream `false`. + +## Configuration knobs (ConfigMap passthrough) + +`.configmap` is emitted verbatim into the component ConfigMap — it is **not** a fixed allowlist. Any additional env (BACEN endpoints, Postgres pool tuning, signer/JOSE knobs) can be added under `.configmap` without editing the chart. `STREAMING_ENABLED`, `STREAMING_BROKERS`, `STREAMING_CLOUDEVENTS_SOURCE`, `POSTGRES_HOST`, and `REDIS_HOST` are handled first-class by the template (the hosts derive from the bundled subchart when enabled). Secrets must go under `.secrets`, never `configmap`. + +| Key | Default | Notes | +|-----|---------|-------| +| `ENV_NAME` | `development` | SPI env; `development` relaxes BACEN mTLS + accepts `http://`/mock endpoints | +| `SERVER_ADDRESS` | `:8080` | host:port form (container port is 8080) | +| `POSTGRES_{HOST,PORT,USER,DB,SSLMODE}` | see values | All four share the `brspi` database | +| `REDIS_HOST` | `""` | host:port; **required for `dict`** | +| `OUTBOX_ENABLED` | `true` | keep on for the producer | +| `IDEMPOTENCY_RETRY_WINDOW_SEC` | `300` | `core` only; must be `> 0` | +| `STREAMING_ENABLED` | `true` (core/spi), `false` (brcode/dict) | fail-closed when brokers/source empty | +| `STREAMING_BROKERS` | `""` | CSV; **required when streaming enabled** | +| `STREAMING_CLOUDEVENTS_SOURCE` | `studio.lerian.core` / `studio.lerian.spi` | required when streaming enabled | +| `ENABLE_TELEMETRY` | `false` | when `true`, `OTEL_EXPORTER_OTLP_ENDPOINT` is set to `$(HOST_IP):4317` (gRPC) | +| `OTEL_RESOURCE_SERVICE_NAME` | `br-spi-` | distinct per binary so dashboards don't collapse | + +## Detached migrations + +`migrations.enabled` (default `true`) ships an ArgoCD **PreSync** Secret (`hook-weight: -2`) + Job (`hook-weight: -1`) that runs `ghcr.io/lerianstudio/br-sfn-spi-migrations`. That image's entrypoint applies the 6-module `golang-migrate` loop in manifest order (`global events spi dict brcode core`) to the single `brspi` database, using the per-module `x-migrations-table=schema_migrations_` naming that `/readyz` reads back. `systemplane` is **not** applied by `golang-migrate` — it is managed by lib-systemplane at runtime. br-sfn runtime binaries are detached — they verify the schema on boot and refuse to start unmigrated — so the PreSync Job runs before every component Deployment. The Job pod is hardened (non-root, read-only rootfs, drop ALL, no service-account token) and waits for Postgres via a `busybox` initContainer. Supports `migrations.useExistingSecret`/`existingSecretName`. + +Source code: +* https://github.com/LerianStudio/helm/tree/main/charts/br-spi +* https://github.com/LerianStudio/br-spi + +## Install + +```console +$ helm install br-spi oci://ghcr.io/lerianstudio/br-spi-helm --version 0.1.0 -n br-spi --create-namespace \ + --set core.configmap.POSTGRES_HOST=pg-dev,core.secrets.POSTGRES_PASSWORD=... \ + --set core.configmap.STREAMING_BROKERS=kafka-dev:9092 +``` + +## External vs bundled infrastructure + +Default (external): leave `postgresql.enabled=false` and `valkey.enabled=false`, set `POSTGRES_HOST`/`REDIS_HOST` per component, and provide `POSTGRES_PASSWORD` (and `REDIS_PASSWORD` if the Redis needs auth). + +Bundled (self-contained): set `postgresql.enabled=true` (and `valkey.enabled=true`); the app reads the subchart-generated passwords via `secretKeyRef` (single-sourced), and `POSTGRES_HOST`/`REDIS_HOST` derive from the subchart Service names collapse-aware via `common.names.dependency.fullname`. + +## Support & Community + +- **GitHub Issues**: https://github.com/LerianStudio/br-spi/issues +- **Email**: contact@lerian.studio diff --git a/charts/br-spi/templates/_component.tpl b/charts/br-spi/templates/_component.tpl new file mode 100644 index 00000000..2c505fdf --- /dev/null +++ b/charts/br-spi/templates/_component.tpl @@ -0,0 +1,422 @@ +{{/* +============================================================================== +Shared workload library for the four SPI binaries (core / spi / brcode / dict). +All four are the same Go binary family with an identical deployment shape, so +the logic lives here once and each templates//*.yaml is a thin +include. This is deliberate: emitting env uniformly (especially STREAMING_*) +from ONE place removes the "one component silently drops a key" drift hazard. + +Every template takes (dict "context" $ "component" ""). +============================================================================== +*/}} + +{{/* +componentConfigMap — the component's ConfigMap. +STREAMING_* and the derived hosts are emitted first-class; everything else in +.configmap is ranged verbatim (NOT a fixed allowlist — a fixed +allowlist is exactly what makes a producer boot as a silent NoopEmitter). +*/}} +{{- define "br-spi.componentConfigMap" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if $cv.enabled -}} +{{- $reserved := list "POSTGRES_HOST" "REDIS_HOST" "STREAMING_ENABLED" "STREAMING_BROKERS" "STREAMING_CLOUDEVENTS_SOURCE" -}} +{{- $pgHost := $cv.configmap.POSTGRES_HOST -}} +{{- if and (not $pgHost) (ne (toString $ctx.Values.postgresql.enabled) "false") -}} +{{- $pgHost = printf "%s.%s.svc.cluster.local." (include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" $ctx.Values.postgresql "context" $ctx)) (include "global.namespace" $ctx) -}} +{{- end -}} +{{- $redisHost := $cv.configmap.REDIS_HOST -}} +{{- if and (not $redisHost) (ne (toString $ctx.Values.valkey.enabled) "false") -}} +{{- $redisHost = printf "%s-primary.%s.svc.cluster.local.:6379" (include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" $ctx.Values.valkey "context" $ctx)) (include "global.namespace" $ctx) -}} +{{- end -}} +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} +data: + # Streaming (CloudEvents producer knobs). First-class + always emitted: a + # producer with STREAMING_ENABLED=true but empty STREAMING_BROKERS/SOURCE + # fails closed at boot by design — it must never silently degrade to a + # NoopEmitter because the chart dropped these keys. + STREAMING_ENABLED: {{ $cv.configmap.STREAMING_ENABLED | default "false" | quote }} + STREAMING_BROKERS: {{ $cv.configmap.STREAMING_BROKERS | default "" | quote }} + STREAMING_CLOUDEVENTS_SOURCE: {{ $cv.configmap.STREAMING_CLOUDEVENTS_SOURCE | default "" | quote }} + # Datastore hosts (derived from the bundled subchart when enabled, else the + # operator-supplied value; on external infra these come from values/GitOps). + POSTGRES_HOST: {{ $pgHost | default "" | quote }} + REDIS_HOST: {{ $redisHost | default "" | quote }} + {{- range $k, $v := $cv.configmap }} + {{- if not (has $k $reserved) }} + {{ $k }}: {{ $v | quote }} + {{- end }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +componentSecret — the component's Opaque Secret. Minted only when the component +is enabled and not using an existingSecret. Infra passwords are single-sourced +from the Bitnami subchart when bundled (read via secretKeyRef in the Deployment), +so they are emitted here ONLY on the external path (subchart disabled, no +existingSecret). Optional at-rest / PII keys are emitted only when set. +*/}} +{{- define "br-spi.componentSecret" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if and $cv.enabled (not $cv.useExistingSecret) -}} +{{- $pg := $ctx.Values.postgresql | default dict -}} +{{- $pgAuth := $pg.auth | default dict -}} +{{- $pgInternal := and (ne (toString $pg.enabled) "false") (not $pg.external) -}} +{{- $vk := $ctx.Values.valkey | default dict -}} +{{- $vkAuth := $vk.auth | default dict -}} +{{- $vkInternal := and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled -}} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} +type: Opaque +data: + # PostgreSQL password — single-sourced from the postgresql subchart Secret when + # bundled; emitted here only for external Postgres without an existingSecret. + {{- if and (not $pgInternal) (not $pgAuth.existingSecret) $cv.secrets.POSTGRES_PASSWORD }} + POSTGRES_PASSWORD: {{ $cv.secrets.POSTGRES_PASSWORD | b64enc | quote }} + {{- end }} + # Redis/Valkey password — single-sourced from the valkey subchart Secret when + # bundled; emitted here only for external Redis without an existingSecret. + {{- if and (not $vkInternal) (not $vkAuth.existingSecret) $cv.secrets.REDIS_PASSWORD }} + REDIS_PASSWORD: {{ $cv.secrets.REDIS_PASSWORD | b64enc | quote }} + {{- end }} + {{- range $k, $v := $cv.secrets }} + {{- if and (not (has $k (list "POSTGRES_PASSWORD" "REDIS_PASSWORD"))) $v }} + {{ $k }}: {{ $v | b64enc | quote }} + {{- end }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +componentDeployment — the component's Deployment. +*/}} +{{- define "br-spi.componentDeployment" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if $cv.enabled -}} +{{- $fullname := include "br-spi.componentFullname" (dict "context" $ctx "component" $c) -}} +{{- if and $cv.useExistingSecret (not $cv.existingSecretName) -}} +{{- fail (printf "br-spi: %s.existingSecretName must be set when %s.useExistingSecret is true" $c $c) -}} +{{- end -}} +{{- $secretName := ternary $cv.existingSecretName $fullname $cv.useExistingSecret -}} +{{- $pullSecrets := $cv.imagePullSecrets | default $ctx.Values.imagePullSecrets -}} +{{- $telemetry := eq (toString $cv.configmap.ENABLE_TELEMETRY) "true" -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ $fullname }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} +spec: + revisionHistoryLimit: {{ $cv.revisionHistoryLimit | default 10 }} + {{- if not $cv.autoscaling.enabled }} + replicas: {{ $cv.replicaCount | default 1 }} + {{- end }} + strategy: + type: {{ $cv.deploymentUpdate.type | default "RollingUpdate" }} + {{- if eq ($cv.deploymentUpdate.type | default "RollingUpdate") "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ $cv.deploymentUpdate.maxSurge | default "100%" }} + maxUnavailable: {{ $cv.deploymentUpdate.maxUnavailable | default 0 }} + {{- end }} + selector: + matchLabels: + {{- include "br-spi.componentSelectorLabels" (dict "context" $ctx "component" $c) | nindent 6 }} + template: + metadata: + {{- with $cv.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 8 }} + spec: + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "br-spi.serviceAccountName" $ctx }} + securityContext: + {{- toYaml $ctx.Values.podSecurityContext | nindent 8 }} + initContainers: + - name: wait-for-dependencies + image: {{ $cv.waitImage | default "busybox" }} + envFrom: + - configMapRef: + name: {{ $fullname }} + command: + - /bin/sh + - -c + - > + if [ -n "$POSTGRES_HOST" ]; then + echo "waiting for postgres $POSTGRES_HOST:${POSTGRES_PORT:-5432}..."; + until nc -z "$POSTGRES_HOST" "${POSTGRES_PORT:-5432}"; do + echo "postgres not ready, waiting..."; sleep 5; + done; + echo "postgres is ready"; + fi; + if [ -n "$REDIS_HOST" ]; then + RH=$(echo "$REDIS_HOST" | cut -d: -f1); + RP=$(echo "$REDIS_HOST" | cut -d: -f2); + [ -z "$RP" ] && RP=6379; + echo "waiting for redis $RH:$RP..."; + until nc -z "$RH" "$RP"; do + echo "redis not ready, waiting..."; sleep 5; + done; + echo "redis is ready"; + fi; + echo "dependencies ready" + securityContext: + {{- toYaml $ctx.Values.securityContext | nindent 12 }} + containers: + - name: {{ $fullname }} + securityContext: + {{- toYaml $ctx.Values.securityContext | nindent 12 }} + image: "{{ $cv.image.repository }}:{{ $cv.image.tag | default $ctx.Chart.AppVersion }}" + imagePullPolicy: {{ $cv.image.pullPolicy | default "IfNotPresent" }} + envFrom: + - secretRef: + name: {{ $secretName }} + - configMapRef: + name: {{ $fullname }} + env: + {{- $pg := $ctx.Values.postgresql | default dict }} + {{- $pgAuth := $pg.auth | default dict }} + {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} + {{- include "br-spi.infraSecretRef" (dict "context" $ctx "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} + {{- else if $cv.secrets.POSTGRES_PASSWORD }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + {{- end }} + {{- $vk := $ctx.Values.valkey | default dict }} + {{- $vkAuth := $vk.auth | default dict }} + {{- if or (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled) $vkAuth.existingSecret }} + {{- include "br-spi.infraSecretRef" (dict "context" $ctx "subchart" "valkey" "key" "valkey-password" "envName" "REDIS_PASSWORD") | nindent 12 }} + {{- else if $cv.secrets.REDIS_PASSWORD }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: REDIS_PASSWORD + {{- end }} + {{- if $telemetry }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + # SPI exports OTLP over gRPC on 4317 (no scheme), to the node-local collector. + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + {{- with $cv.extraEnvVars }} + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: 8080 + protocol: TCP + livenessProbe: + httpGet: + path: {{ $cv.livenessProbe.path | default "/health" }} + port: http + initialDelaySeconds: {{ $cv.livenessProbe.initialDelaySeconds | default 15 }} + periodSeconds: {{ $cv.livenessProbe.periodSeconds | default 20 }} + timeoutSeconds: {{ $cv.livenessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ $cv.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $cv.livenessProbe.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: {{ $cv.readinessProbe.path | default "/readyz" }} + port: http + initialDelaySeconds: {{ $cv.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ $cv.readinessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $cv.readinessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ $cv.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $cv.readinessProbe.failureThreshold | default 3 }} + resources: + {{- toYaml $cv.resources | nindent 12 }} + {{- with $cv.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $cv.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $cv.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +componentService — the component's ClusterIP Service. +*/}} +{{- define "br-spi.componentService" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if $cv.enabled -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} + {{- with $cv.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ $cv.service.type | default "ClusterIP" }} + ports: + - port: {{ $cv.service.port | default 8080 }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "br-spi.componentSelectorLabels" (dict "context" $ctx "component" $c) | nindent 4 }} +{{- end -}} +{{- end -}} + +{{/* +componentIngress — optional per-component Ingress (disabled by default). +*/}} +{{- define "br-spi.componentIngress" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if and $cv.enabled $cv.ingress.enabled -}} +{{- $svcName := include "br-spi.componentFullname" (dict "context" $ctx "component" $c) -}} +{{- $svcPort := $cv.service.port | default 8080 -}} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $svcName }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} + {{- with $cv.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $cv.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- with $cv.ingress.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + {{- range $cv.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType | default "Prefix" }} + backend: + service: + name: {{ $svcName }} + port: + number: {{ $svcPort }} + {{- end }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +componentHPA — optional per-component HorizontalPodAutoscaler. +*/}} +{{- define "br-spi.componentHPA" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if and $cv.enabled $cv.autoscaling.enabled -}} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + minReplicas: {{ $cv.autoscaling.minReplicas | default 1 }} + maxReplicas: {{ $cv.autoscaling.maxReplicas | default 3 }} + metrics: + {{- with $cv.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} + {{- with $cv.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ . }} + {{- end }} +{{- end -}} +{{- end -}} + +{{/* +componentPDB — optional per-component PodDisruptionBudget. +*/}} +{{- define "br-spi.componentPDB" -}} +{{- $ctx := .context -}} +{{- $c := .component -}} +{{- $cv := index $ctx.Values $c -}} +{{- if and $cv.enabled $cv.pdb.enabled -}} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "br-spi.componentFullname" (dict "context" $ctx "component" $c) }} + namespace: {{ include "global.namespace" $ctx }} + labels: + {{- include "br-spi.componentLabels" (dict "context" $ctx "component" $c) | nindent 4 }} + {{- with $cv.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if $cv.pdb.maxUnavailable }} + maxUnavailable: {{ $cv.pdb.maxUnavailable }} + {{- else }} + minAvailable: {{ $cv.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- include "br-spi.componentSelectorLabels" (dict "context" $ctx "component" $c) | nindent 6 }} +{{- end -}} +{{- end -}} diff --git a/charts/br-spi/templates/_helpers.tpl b/charts/br-spi/templates/_helpers.tpl new file mode 100644 index 00000000..ff1c90cf --- /dev/null +++ b/charts/br-spi/templates/_helpers.tpl @@ -0,0 +1,132 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "br-spi.name" -}} +{{- default "br-spi" .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name. +Truncated at 63 chars because some Kubernetes name fields are limited by the DNS spec. +*/}} +{{- define "br-spi.fullname" -}} +{{- default (include "br-spi.name" .) .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "br-spi.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Expand the namespace of the release. Overridable for multi-namespace layouts. +*/}} +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* +Name of the service account to use (single, shared across all components). +*/}} +{{- define "br-spi.serviceAccountName" -}} +{{- if .Values.serviceAccount.create }} +{{- default (include "br-spi.fullname" .) .Values.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +============================================================================== +Component helpers (multi-component: core / spi / brcode / dict). +Names derive from br-spi.fullname so cross-references stay deterministic and +release-aware (e.g. the migration Job and MCP-style refs resolve by name). +Inputs (dict): context (root .), component ("core"|"spi"|"brcode"|"dict"). +============================================================================== +*/}} + +{{/* Component fullname, e.g. br-spi-core */}} +{{- define "br-spi.componentFullname" -}} +{{- $base := include "br-spi.fullname" .context | trunc 57 | trimSuffix "-" -}} +{{- printf "%s-%s" $base .component | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* Component version label — the component's image tag, falling back to AppVersion */}} +{{- define "br-spi.componentVersion" -}} +{{- $cv := index .context.Values .component -}} +{{- default .context.Chart.AppVersion $cv.image.tag -}} +{{- end -}} + +{{/* Component selector labels (stable across image bumps) */}} +{{- define "br-spi.componentSelectorLabels" -}} +app.kubernetes.io/name: {{ include "br-spi.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +app.kubernetes.io/component: {{ .component }} +{{- end -}} + +{{/* Component labels */}} +{{- define "br-spi.componentLabels" -}} +helm.sh/chart: {{ include "br-spi.chart" .context }} +{{ include "br-spi.componentSelectorLabels" (dict "context" .context "component" .component) }} +app.kubernetes.io/version: {{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "br-spi.componentVersion" .) "-" | trunc 63 | trimAll "-" | quote }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +{{- end -}} + +{{/* Migrations fullname, e.g. br-spi-migrations — Job and PreSync Secret reference this */}} +{{- define "br-spi-migrations.fullname" -}} +{{- printf "%s-migrations" (include "br-spi.fullname" . | trunc 52 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* Migrations labels */}} +{{- define "br-spi-migrations.labels" -}} +helm.sh/chart: {{ include "br-spi.chart" . }} +app.kubernetes.io/name: {{ include "br-spi-migrations.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/component: migrations +{{- end -}} + +{{/* +infraSecretRef — emit a `- name: valueFrom: secretKeyRef: {name,key}` +env entry pointing at a Bitnami subchart's generated Secret (or the operator's +existingSecret override). Only used on the bundled-subchart path; the external +path reads the app's own Secret. See docs/helm-chart-standard.md +"Single-Source Infra Secrets". +Inputs (dict): context (root .), subchart, key, envName. +*/}} +{{- define "br-spi.infraSecretRef" -}} +{{- $ctx := .context -}} +{{- $sub := .subchart -}} +{{- $auth := default dict (index $ctx.Values $sub "auth") -}} +{{- $secretName := "" -}} +{{- if $auth.existingSecret -}} +{{- $secretName = $auth.existingSecret -}} +{{- else -}} +{{- $secretName = include "common.names.dependency.fullname" (dict "chartName" $sub "chartValues" (index $ctx.Values $sub) "context" $ctx) -}} +{{- end -}} +- name: {{ .envName }} + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: {{ .key }} +{{- end }} + +{{/* +Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra +Secret/Service names render even when all bundled subcharts are disabled +(external-infra path). Self-contained: no other common.* helpers required. +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/br-spi/templates/brcode/configmap.yaml b/charts/br-spi/templates/brcode/configmap.yaml new file mode 100644 index 00000000..19a7f877 --- /dev/null +++ b/charts/br-spi/templates/brcode/configmap.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentConfigMap" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/deployment.yaml b/charts/br-spi/templates/brcode/deployment.yaml new file mode 100644 index 00000000..3aa46a2e --- /dev/null +++ b/charts/br-spi/templates/brcode/deployment.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentDeployment" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/hpa.yaml b/charts/br-spi/templates/brcode/hpa.yaml new file mode 100644 index 00000000..d1a7ef3c --- /dev/null +++ b/charts/br-spi/templates/brcode/hpa.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentHPA" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/ingress.yaml b/charts/br-spi/templates/brcode/ingress.yaml new file mode 100644 index 00000000..048c73b6 --- /dev/null +++ b/charts/br-spi/templates/brcode/ingress.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentIngress" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/pdb.yaml b/charts/br-spi/templates/brcode/pdb.yaml new file mode 100644 index 00000000..e304445b --- /dev/null +++ b/charts/br-spi/templates/brcode/pdb.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentPDB" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/secrets.yaml b/charts/br-spi/templates/brcode/secrets.yaml new file mode 100644 index 00000000..58632682 --- /dev/null +++ b/charts/br-spi/templates/brcode/secrets.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentSecret" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/brcode/service.yaml b/charts/br-spi/templates/brcode/service.yaml new file mode 100644 index 00000000..75d72d79 --- /dev/null +++ b/charts/br-spi/templates/brcode/service.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentService" (dict "context" . "component" "brcode") -}} diff --git a/charts/br-spi/templates/common/NOTES.txt b/charts/br-spi/templates/common/NOTES.txt new file mode 100644 index 00000000..cb823a26 --- /dev/null +++ b/charts/br-spi/templates/common/NOTES.txt @@ -0,0 +1,31 @@ +br-spi (SPI / Pix rail) has been deployed to namespace {{ include "global.namespace" . }}. + +Components: +{{- range $c := list "core" "spi" "brcode" "dict" }} +{{- $cv := index $.Values $c }} + - {{ include "br-spi.componentFullname" (dict "context" $ "component" $c) }}: {{ if $cv.enabled }}enabled{{ else }}disabled{{ end }}{{ if $cv.enabled }} (streaming: {{ $cv.configmap.STREAMING_ENABLED | default "false" }}){{ end }} +{{- end }} + +Settlement CloudEvents producers: + - core emits studio.lerian.settlement.* on topic br-spi.settlement + (it produces them by consuming the spi->core seam topics, so BOTH core and + spi must have STREAMING_ENABLED=true, the same STREAMING_BROKERS, and the + same Postgres — else no settlement event is emitted at all). + +Verify: + kubectl -n {{ include "global.namespace" . }} get pods -l app.kubernetes.io/instance={{ .Release.Name }} + kubectl -n {{ include "global.namespace" . }} get cm,secret -l app.kubernetes.io/instance={{ .Release.Name }} + +{{- if or (eq (toString .Values.core.configmap.STREAMING_ENABLED) "true") (eq (toString .Values.spi.configmap.STREAMING_ENABLED) "true") }} + +Streaming reminder: a component with STREAMING_ENABLED=true fails closed at boot +if STREAMING_BROKERS or STREAMING_CLOUDEVENTS_SOURCE is empty. Confirm both are +set for core and spi. +{{- end }} + +{{- if .Values.migrations.enabled }} + +Migrations: an ArgoCD PreSync Job ({{ include "br-spi-migrations.fullname" . }}) +applies the 6-module schema to the `brspi` database before the app boots. Under +plain `helm install` (no ArgoCD) the PreSync hook Job still runs as a normal Job. +{{- end }} diff --git a/charts/br-spi/templates/common/serviceaccount.yaml b/charts/br-spi/templates/common/serviceaccount.yaml new file mode 100644 index 00000000..762b4a34 --- /dev/null +++ b/charts/br-spi/templates/common/serviceaccount.yaml @@ -0,0 +1,18 @@ +{{- if .Values.serviceAccount.create -}} +# One ServiceAccount shared by all four component Deployments — they run the same +# workload identity and need no per-component RBAC differentiation. +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "br-spi.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + helm.sh/chart: {{ include "br-spi.chart" . }} + app.kubernetes.io/name: {{ include "br-spi.name" . }} + app.kubernetes.io/instance: {{ .Release.Name }} + app.kubernetes.io/managed-by: {{ .Release.Service }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/br-spi/templates/core/configmap.yaml b/charts/br-spi/templates/core/configmap.yaml new file mode 100644 index 00000000..8aecfd80 --- /dev/null +++ b/charts/br-spi/templates/core/configmap.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentConfigMap" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/deployment.yaml b/charts/br-spi/templates/core/deployment.yaml new file mode 100644 index 00000000..5dc3b39d --- /dev/null +++ b/charts/br-spi/templates/core/deployment.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentDeployment" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/hpa.yaml b/charts/br-spi/templates/core/hpa.yaml new file mode 100644 index 00000000..106dce05 --- /dev/null +++ b/charts/br-spi/templates/core/hpa.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentHPA" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/ingress.yaml b/charts/br-spi/templates/core/ingress.yaml new file mode 100644 index 00000000..78440603 --- /dev/null +++ b/charts/br-spi/templates/core/ingress.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentIngress" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/pdb.yaml b/charts/br-spi/templates/core/pdb.yaml new file mode 100644 index 00000000..28040f58 --- /dev/null +++ b/charts/br-spi/templates/core/pdb.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentPDB" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/secrets.yaml b/charts/br-spi/templates/core/secrets.yaml new file mode 100644 index 00000000..e59e79bc --- /dev/null +++ b/charts/br-spi/templates/core/secrets.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentSecret" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/core/service.yaml b/charts/br-spi/templates/core/service.yaml new file mode 100644 index 00000000..62ee27ef --- /dev/null +++ b/charts/br-spi/templates/core/service.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentService" (dict "context" . "component" "core") -}} diff --git a/charts/br-spi/templates/dict/configmap.yaml b/charts/br-spi/templates/dict/configmap.yaml new file mode 100644 index 00000000..5774087c --- /dev/null +++ b/charts/br-spi/templates/dict/configmap.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentConfigMap" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/deployment.yaml b/charts/br-spi/templates/dict/deployment.yaml new file mode 100644 index 00000000..e0a93918 --- /dev/null +++ b/charts/br-spi/templates/dict/deployment.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentDeployment" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/hpa.yaml b/charts/br-spi/templates/dict/hpa.yaml new file mode 100644 index 00000000..82e3047c --- /dev/null +++ b/charts/br-spi/templates/dict/hpa.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentHPA" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/ingress.yaml b/charts/br-spi/templates/dict/ingress.yaml new file mode 100644 index 00000000..cf901857 --- /dev/null +++ b/charts/br-spi/templates/dict/ingress.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentIngress" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/pdb.yaml b/charts/br-spi/templates/dict/pdb.yaml new file mode 100644 index 00000000..b243a416 --- /dev/null +++ b/charts/br-spi/templates/dict/pdb.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentPDB" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/secrets.yaml b/charts/br-spi/templates/dict/secrets.yaml new file mode 100644 index 00000000..5104e4b2 --- /dev/null +++ b/charts/br-spi/templates/dict/secrets.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentSecret" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/dict/service.yaml b/charts/br-spi/templates/dict/service.yaml new file mode 100644 index 00000000..0703eb74 --- /dev/null +++ b/charts/br-spi/templates/dict/service.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentService" (dict "context" . "component" "dict") -}} diff --git a/charts/br-spi/templates/migrations/job.yaml b/charts/br-spi/templates/migrations/job.yaml new file mode 100644 index 00000000..2e606aad --- /dev/null +++ b/charts/br-spi/templates/migrations/job.yaml @@ -0,0 +1,105 @@ +{{- if .Values.migrations.enabled }} +# PreSync migration Job. Runs the dedicated br-sfn-spi-migrations image, whose +# entrypoint already applies the 6-module golang-migrate loop in manifest order +# (global events spi dict brcode core) against the single `brspi` database, using +# the per-module `x-migrations-table=schema_migrations_` naming that +# /readyz reads back. systemplane is NOT applied by golang-migrate — it is +# lib-systemplane-managed at runtime. The chart's Job only provides the DB +# connection + runs the image; it does NOT build the loop. +# +# br-sfn runtime binaries are detached: they verify schema version on boot and +# refuse to start against an unmigrated DB, and the app images ship no migrator. +# hook-weight -1 puts this after the PreSync Secret (-2) and before the main-sync +# Deployments, so no binary ever boots unmigrated. +{{- $pgHost := .Values.migrations.postgres.host | default .Values.core.configmap.POSTGRES_HOST -}} +{{- if and (not $pgHost) (ne (toString .Values.postgresql.enabled) "false") -}} +{{- $pgHost = printf "%s.%s.svc.cluster.local." (include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" .Values.postgresql "context" .)) (include "global.namespace" .) -}} +{{- end }} +{{- $pgPort := .Values.migrations.postgres.port | default .Values.core.configmap.POSTGRES_PORT | default "5432" }} +{{- $pgUser := .Values.migrations.postgres.user | default .Values.core.configmap.POSTGRES_USER | default "brspi" }} +{{- $pgDb := .Values.migrations.postgres.database | default .Values.core.configmap.POSTGRES_DB | default "brspi" }} +{{- $pgSslMode := .Values.migrations.postgres.sslMode | default .Values.core.configmap.POSTGRES_SSLMODE | default "disable" }} +{{- $secretName := ternary .Values.migrations.existingSecretName (include "br-spi-migrations.fullname" .) .Values.migrations.useExistingSecret }} +{{- $pullSecrets := .Values.migrations.imagePullSecrets | default .Values.imagePullSecrets }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "br-spi-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-spi-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-1" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded +spec: + backoffLimit: {{ .Values.migrations.backoffLimit | default 3 }} + activeDeadlineSeconds: {{ .Values.migrations.activeDeadlineSeconds | default 600 }} + ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished | default 600 }} + template: + metadata: + labels: + {{- include "br-spi-migrations.labels" . | nindent 8 }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + initContainers: + - name: wait-for-postgres + image: {{ .Values.migrations.waitImage | default "busybox" }} + command: + - /bin/sh + - -c + - > + echo "waiting for {{ $pgHost }}:{{ $pgPort }}..."; + until nc -z {{ $pgHost }} {{ $pgPort }}; do + echo "{{ $pgHost }}:{{ $pgPort }} not ready, waiting..."; sleep 5; + done; + echo "{{ $pgHost }}:{{ $pgPort }} is ready" + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + containers: + - name: migrations + image: "{{ .Values.migrations.image.repository }}:{{ .Values.migrations.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.migrations.image.pullPolicy | default "IfNotPresent" }} + env: + - name: POSTGRES_HOST + value: {{ $pgHost | quote }} + - name: POSTGRES_PORT + value: {{ $pgPort | quote }} + - name: POSTGRES_USER + value: {{ $pgUser | quote }} + - name: POSTGRES_DB + value: {{ $pgDb | quote }} + - name: POSTGRES_SSLMODE + value: {{ $pgSslMode | quote }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + {{- toYaml .Values.migrations.resources | nindent 12 }} +{{- end }} diff --git a/charts/br-spi/templates/migrations/secrets.yaml b/charts/br-spi/templates/migrations/secrets.yaml new file mode 100644 index 00000000..54f104dd --- /dev/null +++ b/charts/br-spi/templates/migrations/secrets.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.migrations.enabled (not .Values.migrations.useExistingSecret) }} +# Dedicated PreSync Secret carrying only the Postgres password for the migration +# Job. PreSync hooks run BEFORE the main sync wave, so on a first install the +# component app Secrets do not exist yet. This hook Secret (weight -2) is created +# before the migration Job (weight -1). hook-delete-policy is BeforeHookCreation +# ONLY (not HookSucceeded) so it survives the whole PreSync phase for the Job to +# read; it is replaced at the next sync. When migrations.useExistingSecret=true +# this Secret is NOT minted and the Job reads POSTGRES_PASSWORD from the +# operator-provided existing Secret. +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-spi-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-spi-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-2" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +type: Opaque +stringData: + POSTGRES_PASSWORD: {{ .Values.migrations.postgres.password | default .Values.core.secrets.POSTGRES_PASSWORD | quote }} +{{- end }} diff --git a/charts/br-spi/templates/spi/configmap.yaml b/charts/br-spi/templates/spi/configmap.yaml new file mode 100644 index 00000000..3b095acf --- /dev/null +++ b/charts/br-spi/templates/spi/configmap.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentConfigMap" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/deployment.yaml b/charts/br-spi/templates/spi/deployment.yaml new file mode 100644 index 00000000..b461220f --- /dev/null +++ b/charts/br-spi/templates/spi/deployment.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentDeployment" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/hpa.yaml b/charts/br-spi/templates/spi/hpa.yaml new file mode 100644 index 00000000..87e55ae0 --- /dev/null +++ b/charts/br-spi/templates/spi/hpa.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentHPA" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/ingress.yaml b/charts/br-spi/templates/spi/ingress.yaml new file mode 100644 index 00000000..e6243a87 --- /dev/null +++ b/charts/br-spi/templates/spi/ingress.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentIngress" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/pdb.yaml b/charts/br-spi/templates/spi/pdb.yaml new file mode 100644 index 00000000..42407e5e --- /dev/null +++ b/charts/br-spi/templates/spi/pdb.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentPDB" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/secrets.yaml b/charts/br-spi/templates/spi/secrets.yaml new file mode 100644 index 00000000..8e8eb33e --- /dev/null +++ b/charts/br-spi/templates/spi/secrets.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentSecret" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/templates/spi/service.yaml b/charts/br-spi/templates/spi/service.yaml new file mode 100644 index 00000000..1ca2b91b --- /dev/null +++ b/charts/br-spi/templates/spi/service.yaml @@ -0,0 +1 @@ +{{- include "br-spi.componentService" (dict "context" . "component" "spi") -}} diff --git a/charts/br-spi/values-template.yaml b/charts/br-spi/values-template.yaml new file mode 100644 index 00000000..f13e5336 --- /dev/null +++ b/charts/br-spi/values-template.yaml @@ -0,0 +1,61 @@ +# Template values for the br-spi (SPI / Pix rail) chart. +# Copy this file and fill in the values for your environment. Postgres and Redis +# are external on the target environments — point every component at the shared +# `brspi` database and set STREAMING_BROKERS for the producers (core + spi). + +imagePullSecrets: + - name: ghcr-credential + +core: + image: + tag: "" # optional — defaults to Chart.appVersion + configmap: + ENV_NAME: "development" + POSTGRES_HOST: "" # REQUIRED — shared brspi Postgres host + POSTGRES_USER: "brspi" + POSTGRES_DB: "brspi" + STREAMING_BROKERS: "" # REQUIRED when STREAMING_ENABLED=true (fails closed otherwise) + STREAMING_CLOUDEVENTS_SOURCE: "studio.lerian.core" + secrets: + POSTGRES_PASSWORD: "" # REQUIRED for external Postgres (or use useExistingSecret) + +spi: + configmap: + ENV_NAME: "development" + POSTGRES_HOST: "" # REQUIRED — same host as core + STREAMING_BROKERS: "" # REQUIRED — same brokers as core + STREAMING_CLOUDEVENTS_SOURCE: "studio.lerian.spi" + BACEN_SPI_ENDPOINT: "" # dev: http:// / mock accepted; set the real endpoint for homolog/prod + secrets: + POSTGRES_PASSWORD: "" + +brcode: + configmap: + ENV_NAME: "development" + POSTGRES_HOST: "" # REQUIRED + secrets: + POSTGRES_PASSWORD: "" + +dict: + configmap: + ENV_NAME: "development" + POSTGRES_HOST: "" # REQUIRED + REDIS_HOST: "" # REQUIRED for dict — Redis host:port + secrets: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" # set if the external Redis requires auth + +migrations: + enabled: true + postgres: + host: "" # defaults to core.configmap.POSTGRES_HOST + password: "" # defaults to core.secrets.POSTGRES_PASSWORD + +# External infra (default). Enable only for a self-contained install. +postgresql: + enabled: false + external: true + +valkey: + enabled: false + external: true diff --git a/charts/br-spi/values.schema.json b/charts/br-spi/values.schema.json new file mode 100644 index 00000000..79574fdb --- /dev/null +++ b/charts/br-spi/values.schema.json @@ -0,0 +1,95 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "additionalProperties": false, + "properties": { + "nameOverride": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "namespaceOverride": { + "type": "string" + }, + "global": { + "type": "object", + "additionalProperties": true + }, + "imagePullSecrets": { + "type": "array" + }, + "serviceAccount": { + "type": "object", + "additionalProperties": true + }, + "podSecurityContext": { + "type": "object", + "additionalProperties": true + }, + "securityContext": { + "type": "object", + "additionalProperties": true + }, + "core": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "spi": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "brcode": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "dict": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "migrations": { + "type": "object", + "additionalProperties": true + }, + "postgresql": { + "type": "object", + "additionalProperties": true + }, + "valkey": { + "type": "object", + "additionalProperties": true + } + } +} diff --git a/charts/br-spi/values.yaml b/charts/br-spi/values.yaml new file mode 100644 index 00000000..03a473b7 --- /dev/null +++ b/charts/br-spi/values.yaml @@ -0,0 +1,443 @@ +# Default values for the br-spi (SPI / Pix rail) chart. +# Four component blocks (core / spi / brcode / dict) share the same workload +# shape; they differ by image, OTEL resource name, streaming toggle, and a few +# per-binary env keys. Each component's `configmap` map is emitted VERBATIM into +# its ConfigMap (not a fixed allowlist), so any extra env — BACEN endpoints, +# Postgres pool tuning — can be added under `.configmap` without a +# chart change. STREAMING_* keys are always emitted first-class. +nameOverride: "br-spi" +fullnameOverride: "" +namespaceOverride: "" + +global: + imageRegistry: "" + imagePullSecrets: [] + +# -- Default pull secret for every component + the migration Job (single GHCR +# credential). Override per component via .imagePullSecrets. +imagePullSecrets: + - name: ghcr-credential + +serviceAccount: + # -- Create one ServiceAccount shared by all components + create: true + # -- Annotations for the ServiceAccount + annotations: {} + # -- Name of the service account (defaults to the release fullname) + name: "" + +# -- Pod-level security context (shared by all components) +podSecurityContext: {} + +# -- Container security context (shared by all components + the wait initContainer) +securityContext: + runAsNonRoot: true + runAsUser: 1000 + runAsGroup: 1000 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + +# ============================================================================= +# core — settlement engine + sole producer of studio.lerian.settlement.* on the +# br-spi.settlement topic. It emits by CONSUMING the spi->core seam topics, so +# core AND spi must both stream (same brokers, same Postgres) or no settlement +# event is emitted at all. +# ============================================================================= +core: + enabled: true + replicaCount: 1 + revisionHistoryLimit: 10 + image: + repository: ghcr.io/lerianstudio/br-sfn-core + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + podAnnotations: {} + waitImage: busybox + deploymentUpdate: + type: RollingUpdate + maxSurge: 100% + maxUnavailable: 0 + service: + type: ClusterIP + port: 8080 + annotations: {} + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + tls: [] + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + # Off by default: with replicaCount 1, a PDB (minAvailable 1) blocks all + # voluntary evictions and stalls node drains. Enable it once scaled >1. + enabled: false + minAvailable: 1 + annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + memory: 512Mi + # -- Readiness/liveness probe overrides (path defaults /readyz and /health) + readinessProbe: {} + livenessProbe: {} + # -- Use an operator-provided Secret instead of the chart-managed one + useExistingSecret: false + existingSecretName: "" + # -- Raw container env entries appended verbatim (can include valueFrom). + # Range-free escape for anything the ConfigMap map cannot carry. + extraEnvVars: [] + # -- ConfigMap env. Emitted verbatim; STREAMING_*/POSTGRES_HOST/REDIS_HOST are + # handled first-class by the template. + configmap: + ENV_NAME: "development" + LOG_LEVEL: "info" + SERVER_ADDRESS: ":8080" + HTTP_BODY_LIMIT_BYTES: "104857600" + # PostgreSQL (all four binaries share ONE database: brspi) + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "brspi" + POSTGRES_DB: "brspi" + POSTGRES_SSLMODE: "disable" + # Redis/Valkey (host:port in one var; optional for core) + REDIS_HOST: "" + # Outbox relay (must stay on for the producer) + OUTBOX_ENABLED: "true" + # core requires a positive idempotency retry window to boot + IDEMPOTENCY_RETRY_WINDOW_SEC: "300" + # Streaming — core is a producer + STREAMING_ENABLED: "true" + STREAMING_BROKERS: "" + STREAMING_CLOUDEVENTS_SOURCE: "studio.lerian.core" + # OpenTelemetry (gRPC/4317; endpoint overridden to $(HOST_IP):4317 when ENABLE_TELEMETRY=true) + ENABLE_TELEMETRY: "false" + OTEL_RESOURCE_SERVICE_NAME: "br-spi-core" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + secrets: + # -- External-Postgres password. Single-sourced from the postgresql subchart + # Secret when it is bundled; set here only for external Postgres without an + # existingSecret. On the target environments this comes from GitOps/Vault. + POSTGRES_PASSWORD: "" + # -- External-Redis password (optional; single-sourced from the valkey subchart when bundled) + REDIS_PASSWORD: "" + +# ============================================================================= +# spi — the ISO 20022 / BACEN SPI binary. Producer of the spi->core seam topics, +# so it must stream alongside core. Talks to BACEN SPI (relaxed under ENV_NAME=development). +# ============================================================================= +spi: + enabled: true + replicaCount: 1 + revisionHistoryLimit: 10 + image: + repository: ghcr.io/lerianstudio/br-sfn-spi + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + podAnnotations: {} + waitImage: busybox + deploymentUpdate: + type: RollingUpdate + maxSurge: 100% + maxUnavailable: 0 + service: + type: ClusterIP + port: 8080 + annotations: {} + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + tls: [] + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + # Off by default: with replicaCount 1, a PDB (minAvailable 1) blocks all + # voluntary evictions and stalls node drains. Enable it once scaled >1. + enabled: false + minAvailable: 1 + annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + memory: 512Mi + readinessProbe: {} + livenessProbe: {} + useExistingSecret: false + existingSecretName: "" + extraEnvVars: [] + configmap: + ENV_NAME: "development" + LOG_LEVEL: "info" + SERVER_ADDRESS: ":8080" + HTTP_BODY_LIMIT_BYTES: "104857600" + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "brspi" + POSTGRES_DB: "brspi" + POSTGRES_SSLMODE: "disable" + REDIS_HOST: "" + OUTBOX_ENABLED: "true" + # BACEN SPI endpoint. Under ENV_NAME=development a http:// / mock endpoint is + # accepted and BACEN mTLS validation is bypassed (not required to boot). + # Other BACEN_* / signer knobs can be added here verbatim. + BACEN_SPI_ENDPOINT: "" + # Streaming — spi writes the spi->core seam that core turns into settlement.* + STREAMING_ENABLED: "true" + STREAMING_BROKERS: "" + STREAMING_CLOUDEVENTS_SOURCE: "studio.lerian.spi" + ENABLE_TELEMETRY: "false" + OTEL_RESOURCE_SERVICE_NAME: "br-spi-spi" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + secrets: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" + +# ============================================================================= +# brcode — Pix BR Code (QR) REST binary. NOT a settlement producer; streaming off. +# ============================================================================= +brcode: + enabled: true + replicaCount: 1 + revisionHistoryLimit: 10 + image: + repository: ghcr.io/lerianstudio/br-sfn-brcode + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + podAnnotations: {} + waitImage: busybox + deploymentUpdate: + type: RollingUpdate + maxSurge: 100% + maxUnavailable: 0 + service: + type: ClusterIP + port: 8080 + annotations: {} + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + tls: [] + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + # Off by default: with replicaCount 1, a PDB (minAvailable 1) blocks all + # voluntary evictions and stalls node drains. Enable it once scaled >1. + enabled: false + minAvailable: 1 + annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + memory: 512Mi + readinessProbe: {} + livenessProbe: {} + useExistingSecret: false + existingSecretName: "" + extraEnvVars: [] + configmap: + ENV_NAME: "development" + LOG_LEVEL: "info" + SERVER_ADDRESS: ":8080" + HTTP_BODY_LIMIT_BYTES: "104857600" + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "brspi" + POSTGRES_DB: "brspi" + POSTGRES_SSLMODE: "disable" + REDIS_HOST: "" + OUTBOX_ENABLED: "true" + # Not a producer + STREAMING_ENABLED: "false" + STREAMING_BROKERS: "" + STREAMING_CLOUDEVENTS_SOURCE: "" + ENABLE_TELEMETRY: "false" + OTEL_RESOURCE_SERVICE_NAME: "br-spi-brcode" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + secrets: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" + +# ============================================================================= +# dict — DICT (Pix directory) REST binary. NOT a settlement producer; streaming +# off. REQUIRES REDIS_HOST (scheduler / caches). +# ============================================================================= +dict: + enabled: true + replicaCount: 1 + revisionHistoryLimit: 10 + image: + repository: ghcr.io/lerianstudio/br-sfn-dict + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + podAnnotations: {} + waitImage: busybox + deploymentUpdate: + type: RollingUpdate + maxSurge: 100% + maxUnavailable: 0 + service: + type: ClusterIP + port: 8080 + annotations: {} + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + tls: [] + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 3 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + pdb: + # Off by default: with replicaCount 1, a PDB (minAvailable 1) blocks all + # voluntary evictions and stalls node drains. Enable it once scaled >1. + enabled: false + minAvailable: 1 + annotations: {} + resources: + requests: + cpu: 100m + memory: 128Mi + limits: + memory: 512Mi + readinessProbe: {} + livenessProbe: {} + useExistingSecret: false + existingSecretName: "" + extraEnvVars: [] + configmap: + ENV_NAME: "development" + LOG_LEVEL: "info" + SERVER_ADDRESS: ":8080" + HTTP_BODY_LIMIT_BYTES: "104857600" + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "brspi" + POSTGRES_DB: "brspi" + POSTGRES_SSLMODE: "disable" + # REQUIRED for dict — set to the Redis host:port (e.g. valkey-dev:6379). + REDIS_HOST: "" + OUTBOX_ENABLED: "true" + STREAMING_ENABLED: "false" + STREAMING_BROKERS: "" + STREAMING_CLOUDEVENTS_SOURCE: "" + ENABLE_TELEMETRY: "false" + OTEL_RESOURCE_SERVICE_NAME: "br-spi-dict" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + secrets: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" + +# ============================================================================= +# Detached migrations — ArgoCD PreSync Secret + Job that applies the 6-module +# schema to the single `brspi` database before the app boots. The +# br-sfn-spi-migrations image's entrypoint runs the golang-migrate loop in +# manifest order (global events spi dict brcode core) with the per-module +# x-migrations-table naming; systemplane is lib-systemplane-managed at runtime, +# not golang-migrate. The chart only supplies the DB connection and runs it. +# ============================================================================= +migrations: + enabled: true + image: + repository: ghcr.io/lerianstudio/br-sfn-spi-migrations + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + waitImage: busybox + # -- Use an operator-provided Secret (must carry POSTGRES_PASSWORD) instead of + # the chart-managed PreSync Secret. + useExistingSecret: false + existingSecretName: "" + # -- Postgres connection for the migration Job. Empty fields fall back to + # core.configmap.POSTGRES_* (all four binaries share the brspi database). + postgres: + host: "" + port: "" + user: "" + database: "" + sslMode: "" + # -- Password for the PreSync Secret (empty -> core.secrets.POSTGRES_PASSWORD). + # Ignored when migrations.useExistingSecret=true. NOTE: for a self-contained + # install (postgresql.enabled=true) this MUST be set explicitly (or use + # useExistingSecret) — the bundled Postgres Secret does not exist yet at + # PreSync time, so the fallback cannot read it. External Postgres (the + # default) has no such constraint. + password: "" + backoffLimit: 3 + activeDeadlineSeconds: 600 + ttlSecondsAfterFinished: 600 + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + memory: 256Mi + +# ============================================================================= +# Bundled infra subcharts — DISABLED by default. On the target environments +# Postgres and Redis are external and pre-provisioned; wire hosts via +# .configmap.POSTGRES_HOST / REDIS_HOST. Enable these only for a +# self-contained install (then passwords are single-sourced from their Secrets). +# ============================================================================= +postgresql: + enabled: false + external: true + +valkey: + enabled: false + external: true From 3a942b2b3d9227cf76907676294f0bd7e2d72208 Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Thu, 2 Jul 2026 19:59:52 -0700 Subject: [PATCH 024/113] fix(charts): remove dead unrenderable streaming-hub secret boilerplate MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit templates/streaming-hub/secret.yaml never rendered: line 10 uses .Values.streaming-hub.secrets.POSTGRES_PASSWORD, whose hyphenated key is a Go-template parse error ('bad character U+002D'), so the whole chart failed 'helm template'. It is stale boilerplate — it uses the old streaming-hub-helm.* helpers and a POSTGRES_PASSWORD key that is not part of the chart's real secret model (the live Postgres credential is STREAMING_HUB_POSTGRES_DSN in templates/secrets.yaml, gated on streamingHub.useExistingSecret). Deleting it removes both helm-chart-standard violations (nonstandard-secret-template-name + template-default-secret), fixes the parse error, and loses nothing — the real Secret in templates/secrets.yaml is untouched. Verified: strict validate 0 violations; render-gate streaming-hub ok; 'helm template' now emits exactly one Secret (streaming-hub). Claude-Session: https://claude.ai/code/session_012fNphWnucMKd84KskVFgvz Signed-off-by: Fred Amaral --- .../templates/streaming-hub/secret.yaml | 14 -------------- 1 file changed, 14 deletions(-) delete mode 100644 charts/streaming-hub/templates/streaming-hub/secret.yaml diff --git a/charts/streaming-hub/templates/streaming-hub/secret.yaml b/charts/streaming-hub/templates/streaming-hub/secret.yaml deleted file mode 100644 index 991a0785..00000000 --- a/charts/streaming-hub/templates/streaming-hub/secret.yaml +++ /dev/null @@ -1,14 +0,0 @@ -apiVersion: v1 -kind: Secret -metadata: - name: {{ include "streaming-hub-helm.fullname" . }}-streaming-hub - labels: - {{- include "streaming-hub-helm.labels" . | nindent 4 }} - app.kubernetes.io/component: streaming-hub -type: Opaque -data: - POSTGRES_PASSWORD: {{ .Values.streaming-hub.secrets.POSTGRES_PASSWORD | default "streaming_hub" | b64enc | quote }} - # Extra Secret Vars - {{- if .Values.streaming-hub.extraSecretVars }} - {{- toYaml .Values.streaming-hub.extraSecretVars | nindent 2 }} - {{- end }} From be46b00a3586a5c8ea946889c2dd05d4c14de9a8 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 3 Jul 2026 03:02:33 +0000 Subject: [PATCH 025/113] chore(release): 1.0.0-beta.3 ## (2026-07-03) ### Features * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) ### Bug Fixes * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) --- README.md | 2 +- charts/streaming-hub/Chart.yaml | 7 +++++-- 2 files changed, 6 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index d4d65bfc..e31c5599 100644 --- a/README.md +++ b/README.md @@ -273,5 +273,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.2` | 1.0.0 | +| `1.0.0-beta.3` | 1.0.0 | ----------------- diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index 8c5657e8..2ce9a7b5 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -1,11 +1,13 @@ apiVersion: v2 name: streaming-hub-helm description: >- - Lerian streaming-hub — consumes lib-streaming CloudEvents from Kafka/Redpanda and fans them out to per-tenant SaaS/BYOC subscribers. Multi-component chart with a runtime STREAMING_HUB_ROLE model (mode: all | split). + Lerian streaming-hub — consumes lib-streaming CloudEvents from Kafka/Redpanda + and fans them out to per-tenant SaaS/BYOC subscribers. Multi-component chart + with a runtime STREAMING_HUB_ROLE model (mode: all | split). type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. -version: 1.0.0-beta.2 +version: 1.0.0-beta.3 appVersion: "1.0.0" annotations: lerian.studio/chart-type: multi-component @@ -24,6 +26,7 @@ keywords: - fan-out - lerian icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 + # NO dependencies block by deliberate design (deviation from reporter/midaz): # OTEL is env-wired via the OTEL_EXPORTER_OTLP_ENDPOINT downward-API override, # not bundled as an otel-collector-lerian subchart. Declaring it would force an From c69325187517c7398c3b91736effeeae560a9a6a Mon Sep 17 00:00:00 2001 From: Fred Amaral Date: Thu, 2 Jul 2026 20:14:05 -0700 Subject: [PATCH 026/113] docs(charts): add br-spi version-matrix section to README MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release pipeline's prepareCmd (update-chart-version-readme --chart br-spi) requires a '### ...br spi...' section with a Chart Version matrix table in the root README.md. It was missing, so the br-spi release job failed on BOTH channels (#1607 main, #1608 develop) with 'Could not find section for chart br-spi' — the chart never published to OCI. Adds the section so future br-spi releases succeed. Verified locally: the prepareCmd binary now finds the section and updates the Chart Version cell (exit 0). README-only, so this merge itself triggers no release (paths-ignore); the first publish rides the next charts/br-spi change. Claude-Session: https://claude.ai/code/session_012fNphWnucMKd84KskVFgvz Signed-off-by: Fred Amaral --- README.md | 13 +++++++++++++ 1 file changed, 13 insertions(+) diff --git a/README.md b/README.md index e31c5599..b1b7c2b1 100644 --- a/README.md +++ b/README.md @@ -54,6 +54,19 @@ For implementation and configuration details, see the [README](https://charts.le ----------------- +### BR SPI Helm Chart + +Brazilian SFN — SPI / Pix rail (components: core, spi, brcode, dict, plus a dedicated schema-migration Job). + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/br-spi). + +#### Application Version Mapping + +| Chart Version | App Version | +| :---: | :---: | +| `0.1.0-beta.1` | `0.1.0` | +----------------- + ### Reporter See the [official documentation](https://docs.lerian.studio/en/reporter) for details. From 09a3caaabceee772b24a7fa3150ddba65162511c Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 3 Jul 2026 14:10:36 +0000 Subject: [PATCH 027/113] chore(release): 1.1.0-beta.5 ## (2026-07-03) ### Features * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) --- README.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/README.md b/README.md index b1b7c2b1..1fdea578 100644 --- a/README.md +++ b/README.md @@ -141,7 +141,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.1.0-beta.4` | 1.0.0-beta.9 | +| `1.1.0-beta.5` | 1.0.0-beta.9 | ----------------- ### Plugin BR Payments Fakebtg [DEPRECATED → helm-internal] From b082ddad46f232749d3efd0babd24f49f0eec76f Mon Sep 17 00:00:00 2001 From: Guilherme Moreira Rodrigues Date: Mon, 6 Jul 2026 12:31:19 -0300 Subject: [PATCH 028/113] feat(br-sta): add br-sta-helm chart --- charts/br-sta/Chart.lock | 12 + charts/br-sta/Chart.yaml | 50 ++ charts/br-sta/README.md | 149 ++++++ charts/br-sta/templates/NOTES.txt | 85 +++ charts/br-sta/templates/_helpers.tpl | 233 +++++++++ .../br-sta/templates/bootstrap-postgres.yaml | 133 +++++ charts/br-sta/templates/configmap.yaml | 66 +++ charts/br-sta/templates/deployment.yaml | 159 ++++++ charts/br-sta/templates/hpa.yaml | 36 ++ charts/br-sta/templates/ingress.yaml | 62 +++ charts/br-sta/templates/pdb.yaml | 24 + charts/br-sta/templates/secrets.yaml | 24 + charts/br-sta/templates/service.yaml | 22 + charts/br-sta/templates/serviceaccount.yaml | 13 + charts/br-sta/values-template.yaml | 74 +++ charts/br-sta/values.schema.json | 52 ++ charts/br-sta/values.yaml | 491 ++++++++++++++++++ 17 files changed, 1685 insertions(+) create mode 100644 charts/br-sta/Chart.lock create mode 100644 charts/br-sta/Chart.yaml create mode 100644 charts/br-sta/README.md create mode 100644 charts/br-sta/templates/NOTES.txt create mode 100644 charts/br-sta/templates/_helpers.tpl create mode 100644 charts/br-sta/templates/bootstrap-postgres.yaml create mode 100644 charts/br-sta/templates/configmap.yaml create mode 100644 charts/br-sta/templates/deployment.yaml create mode 100644 charts/br-sta/templates/hpa.yaml create mode 100644 charts/br-sta/templates/ingress.yaml create mode 100644 charts/br-sta/templates/pdb.yaml create mode 100644 charts/br-sta/templates/secrets.yaml create mode 100644 charts/br-sta/templates/service.yaml create mode 100644 charts/br-sta/templates/serviceaccount.yaml create mode 100644 charts/br-sta/values-template.yaml create mode 100644 charts/br-sta/values.schema.json create mode 100644 charts/br-sta/values.yaml diff --git a/charts/br-sta/Chart.lock b/charts/br-sta/Chart.lock new file mode 100644 index 00000000..0a7b7cf9 --- /dev/null +++ b/charts/br-sta/Chart.lock @@ -0,0 +1,12 @@ +dependencies: +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 16.3.5 +- name: valkey + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.4.7 +- name: rabbitmq + repository: https://groundhog2k.github.io/helm-charts + version: 2.1.11 +digest: sha256:930a2d793fd5205d6a265b344f6785f4727059476f40bc0dac54350d02ba601a +generated: "2026-07-01T19:53:22.540418-03:00" diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml new file mode 100644 index 00000000..8455727b --- /dev/null +++ b/charts/br-sta/Chart.yaml @@ -0,0 +1,50 @@ +apiVersion: v2 +name: br-sta-helm +description: A Helm chart for br-sta, a Lerian Studio Go/Fiber HTTP service + backed by PostgreSQL and Redis/Valkey. +type: application +annotations: + lerian.studio/chart-type: single-service +home: https://github.com/LerianStudio/br-sta +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/br-sta + - https://github.com/LerianStudio/br-sta +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +version: 1.0.0 + +# This is the version number of the application being deployed. +appVersion: "1.0.0-beta.5" + +# A list of keywords about the chart. This helps others discover the chart. +keywords: + - br-sta + - lerian + - go + - fiber + - service + +# The URL to an icon file for this chart. +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 + +# Dependencies — br-sta requires PostgreSQL (SQL migrations) and Redis/Valkey +# (caching + rate limiting). RabbitMQ is OPTIONAL and bundled only when +# rabbitmq.enabled=true (disabled by default). All subcharts are gated by +# their `.enabled` condition. +dependencies: + - name: postgresql + version: "16.3.5" + repository: "https://charts.bitnami.com/bitnami" + condition: postgresql.enabled + - name: valkey + version: "2.4.7" + repository: "oci://registry-1.docker.io/bitnamicharts" + condition: valkey.enabled + - name: rabbitmq + version: "2.1.11" + repository: "https://groundhog2k.github.io/helm-charts" + condition: rabbitmq.enabled diff --git a/charts/br-sta/README.md b/charts/br-sta/README.md new file mode 100644 index 00000000..be4554e9 --- /dev/null +++ b/charts/br-sta/README.md @@ -0,0 +1,149 @@ +# br-sta-helm + +## Chart Contract + +- Chart type: `single-service` +- Required secrets: `None for default render`. With the bundled PostgreSQL and Valkey subcharts the database and Redis passwords are auto-generated and read via `secretKeyRef`. Only supply `app.secrets.POSTGRES_PASSWORD` / `app.secrets.REDIS_PASSWORD` for external infra without `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. `app.secrets.MULTI_TENANT_SERVICE_API_KEY` is required only when `MULTI_TENANT_ENABLED=true`. +- Dependency notes: Bundles two local subcharts — Bitnami `postgresql` (`postgresql.enabled`, default `true`) and Bitnami `valkey` (`valkey.enabled`, default `true`). RabbitMQ is optional, config-only, and NOT bundled (`RABBITMQ_ENABLED=false`). All can be pointed at external services. +- Production overrides: Disable the bundled subcharts and point `POSTGRES_HOST` / `REDIS_HOST` at managed services; supply credentials via chart secrets or an existing Secret; override image tag, ingress, resources, and persistence. +- Source/license: Source is in `github.com/LerianStudio/br-sta`; chart license is Apache-2.0. + +A Helm chart for [br-sta](https://github.com/LerianStudio/br-sta) — a Lerian Studio Go/Fiber HTTP service. It ships a single Deployment running the `/service` binary, backed by PostgreSQL (SQL migrations applied at startup) and Redis/Valkey (caching + rate limiting). + +## TL;DR + +```bash +helm repo add lerian https://lerianstudio.github.io/helm +helm install my-br-sta lerian/br-sta-helm \ + --namespace br-sta --create-namespace +``` + +The default render brings up br-sta plus an in-cluster PostgreSQL and Valkey, with no operator-provided secrets required. + +## Prerequisites + +- Kubernetes 1.23+ +- Helm 3.10+ +- Either the bundled PostgreSQL/Valkey subcharts (default) or externally managed PostgreSQL 16+ and Redis/Valkey. + +## Architecture + +The chart deploys **one Deployment, one process** (`/service`, a Go/Fiber HTTP server): + +- HTTP API served on port `8080` (`/health`, `/api/v1/...`). +- PostgreSQL is the primary datastore; SQL migrations are applied at startup from `MIGRATIONS_PATH` (`migrations`). +- Redis/Valkey provides caching and rate limiting (`REDIS_*`). + +### Optional integrations (disabled by default) + +| Toggle | Default | Purpose | +|--------|---------|---------| +| `RABBITMQ_ENABLED` | `"false"` | Event-driven starter (config-only; broker not bundled). | +| `OUTBOX_ENABLED` | `"false"` | Transactional outbox dispatcher. | +| `PLUGIN_AUTH_ENABLED` | `"false"` | lib-auth / plugin-auth integration. | +| `MULTI_TENANT_ENABLED` | `"false"` | Multi-tenant mode via tenant-manager. | +| `ENABLE_TELEMETRY` | `"false"` | OpenTelemetry OTLP export. | + +## Storage + +- **PostgreSQL** — application data + SQL migrations. +- **Redis/Valkey** — cache + rate-limiting counters. + +## Single-source infra credentials + +Following [`docs/helm-chart-standard.md`](../../docs/helm-chart-standard.md): + +- With the bundled **PostgreSQL** subchart (default), the password is auto-generated into the subchart's own Secret and read by the app via `secretKeyRef` (key `password`) — leave `app.secrets.POSTGRES_PASSWORD` empty. +- With the bundled **Valkey** subchart (default), the password is auto-generated into the subchart's own Secret and read via `secretKeyRef` (key `valkey-password`) — leave `app.secrets.REDIS_PASSWORD` empty. +- For external infra (subchart disabled), supply `app.secrets.POSTGRES_PASSWORD` / `app.secrets.REDIS_PASSWORD`, or set `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. + +## Required configuration + +The chart **fails fast** on `helm install` only when an enabled optional integration is missing its inputs: + +| Field | When required | +|-------|---------------| +| `app.configmap.MULTI_TENANT_URL` | `MULTI_TENANT_ENABLED=true` | +| `app.secrets.MULTI_TENANT_SERVICE_API_KEY` | `MULTI_TENANT_ENABLED=true` | + +## Probes + +| Probe | Path | Notes | +|-------|------|-------| +| Liveness | `/health` | HTTP self-probe. | +| Readiness | `/health` | br-sta exposes a single `/health` endpoint. | + +## Common values + +| Key | Default | Description | +|-----|---------|-------------| +| `app.replicaCount` | `2` | Number of replicas. | +| `app.image.repository` | `ghcr.io/lerianstudio/br-sta` | Container image. | +| `app.image.tag` | `""` (Chart `appVersion`) | Image tag. | +| `app.service.port` | `8080` | Service port. | +| `app.ingress.enabled` | `false` | Expose via Ingress. | +| `app.autoscaling.enabled` | `true` | Enable HPA. | +| `postgresql.enabled` | `true` | Deploy the in-cluster PostgreSQL subchart. | +| `postgresql.architecture` | `replication` | Primary + read replica. | +| `valkey.enabled` | `true` | Deploy the in-cluster Valkey subchart. | +| `valkey.architecture` | `standalone` | Single Valkey primary. | +| `global.externalPostgresDefinitions.enabled` | `false` | Run a bootstrap Job against an external PostgreSQL. | +| `otel-collector-lerian.enabled` | `false` | Inject host-level OTLP endpoint env vars. | + +See [`values.yaml`](./values.yaml) for the full list, and [`values-template.yaml`](./values-template.yaml) for a production overlay starter. + +## Production layout + +1. **Disable the bundled infra** and point at managed services: + ```yaml + postgresql: + enabled: false + valkey: + enabled: false + app: + configmap: + POSTGRES_HOST: my-rds-instance.example.com + POSTGRES_SSLMODE: require + REDIS_HOST: my-redis.example.com:6379 + secrets: + POSTGRES_PASSWORD: + REDIS_PASSWORD: + ``` + +2. **Use an existing Secret** instead of inline values: + ```yaml + app: + useExistingSecret: true + existingSecretName: br-sta-secrets + ``` + +3. **Optional bootstrap** for a fresh external Postgres (creates DB + role + grants, idempotent): + ```yaml + global: + externalPostgresDefinitions: + enabled: true + connection: + host: my-rds-instance.example.com + port: "5432" + postgresAdminLogin: + username: postgres + password: + appCredentials: + password: + ``` + +## Uninstall + +```bash +helm uninstall my-br-sta -n br-sta +``` + +If the bundled PostgreSQL was used, its PVCs are NOT deleted automatically: + +```bash +kubectl delete pvc -n br-sta -l app.kubernetes.io/instance=my-br-sta +``` + +## License + +[Apache 2.0](../../LICENSE) (chart). diff --git a/charts/br-sta/templates/NOTES.txt b/charts/br-sta/templates/NOTES.txt new file mode 100644 index 00000000..c1851e8d --- /dev/null +++ b/charts/br-sta/templates/NOTES.txt @@ -0,0 +1,85 @@ +# br-sta + +Thank you for installing {{ .Chart.Name }} v{{ .Chart.Version }}! + +## Deployment Status + +{{ if .Release.IsUpgrade }} +The chart has been UPGRADED to version {{ .Chart.Version }} (appVersion {{ .Chart.AppVersion }}). +{{ else }} +The chart has been INSTALLED at version {{ .Chart.Version }} (appVersion {{ .Chart.AppVersion }}). +{{ end }} + +## Component Deployed + +Single Deployment ({{ .Values.app.replicaCount }} replica(s)) running the /service binary +(Go/Fiber HTTP server). + + Service: {{ include "br-sta.fullname" . }}.{{ include "global.namespace" . }}.svc.cluster.local:{{ .Values.app.service.port }} + Health: /health + API: /api/v1/... + +## Dependencies + +{{- if eq (include "postgresql.enabled" .) "true" }} +1. PostgreSQL (in-cluster, Bitnami subchart) + - Primary: {{ include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" (index .Values "postgresql") "context" .) }}-primary.{{ include "global.namespace" . }}.svc.cluster.local:5432 + - Database: {{ .Values.postgresql.auth.database }} + - User: {{ .Values.postgresql.auth.username }} +{{- else if .Values.global.externalPostgresDefinitions.enabled }} +1. PostgreSQL (external, bootstrapped by Helm) + - Host: {{ .Values.global.externalPostgresDefinitions.connection.host }}:{{ .Values.global.externalPostgresDefinitions.connection.port }} + - Database/Role: br_sta +{{- else }} +1. PostgreSQL (external, expected to be pre-provisioned) + - Configure POSTGRES_HOST/POSTGRES_PORT/POSTGRES_USER/POSTGRES_NAME/POSTGRES_PASSWORD before installing. +{{- end }} + +{{- if eq (include "valkey.enabled" .) "true" }} +2. Redis/Valkey (in-cluster, Bitnami subchart) + - Host: {{ include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" (index .Values "valkey") "context" .) }}-primary.{{ include "global.namespace" . }}.svc.cluster.local:6379 +{{- else }} +2. Redis/Valkey (external, expected to be pre-provisioned) + - Configure REDIS_HOST (host:port) and REDIS_PASSWORD before installing. +{{- end }} + +## Optional Integrations (disabled by default) + + - RabbitMQ (RABBITMQ_ENABLED) — event-driven starter (config-only; not bundled) + - Outbox (OUTBOX_ENABLED) — transactional outbox dispatcher + - plugin-auth (PLUGIN_AUTH_ENABLED) — lib-auth integration + - Multi-tenant (MULTI_TENANT_ENABLED) — tenant-manager (requires MULTI_TENANT_URL + MULTI_TENANT_SERVICE_API_KEY) + - Telemetry (ENABLE_TELEMETRY) — OpenTelemetry OTLP export + +## Required Configuration + +The default render (bundled PostgreSQL + Valkey) requires no operator secrets — +the infra passwords are auto-generated by the subcharts and read via secretKeyRef. + +When MULTI_TENANT_ENABLED=true, the following become required: + - app.configmap.MULTI_TENANT_URL + - app.secrets.MULTI_TENANT_SERVICE_API_KEY + +For an EXTERNAL PostgreSQL / Redis (subchart disabled), supply the passwords via +app.secrets.POSTGRES_PASSWORD / app.secrets.REDIS_PASSWORD (or existingSecret). + +## Accessing the API + +{{- if contains "ClusterIP" .Values.app.service.type }} + +Port-forward locally: + + kubectl port-forward -n {{ include "global.namespace" . }} svc/{{ include "br-sta.fullname" . }} {{ .Values.app.service.port }}:{{ .Values.app.service.port }} + +Then access: http://localhost:{{ .Values.app.service.port }}/health +{{- end }} + +## Useful Commands + + kubectl get pods -n {{ include "global.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }} + kubectl logs -n {{ include "global.namespace" . }} -l app.kubernetes.io/instance={{ .Release.Name }} --tail=200 + +## Source + + - Service source: https://github.com/LerianStudio/br-sta + - Chart source: https://github.com/LerianStudio/helm/tree/main/charts/br-sta diff --git a/charts/br-sta/templates/_helpers.tpl b/charts/br-sta/templates/_helpers.tpl new file mode 100644 index 00000000..5718c69a --- /dev/null +++ b/charts/br-sta/templates/_helpers.tpl @@ -0,0 +1,233 @@ +{{/* +================================================================================ +BR-STA - HELM TEMPLATE HELPERS +================================================================================ +br-sta is a Go/Fiber HTTP service. One Deployment, one pod, one process +(the /service binary). It requires PostgreSQL and Redis/Valkey. +================================================================================ +*/}} + +{{/* +================================================================================ +NAME HELPERS +================================================================================ +*/}} + +{{/* +Top-level chart name. +*/}} +{{- define "br-sta.name" -}} +{{- default "br-sta" .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Application name (single deployment). +*/}} +{{- define "br-sta.fullname" -}} +{{- if .Values.fullnameOverride }} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- else }} +{{- default "br-sta" .Values.app.name | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- end }} + +{{/* +================================================================================ +CHART HELPERS +================================================================================ +*/}} + +{{- define "br-sta.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Resolve the application image tag (Chart.appVersion if app.image.tag is empty). +*/}} +{{- define "br-sta.defaultTag" -}} +{{- default .Chart.AppVersion .Values.app.image.tag }} +{{- end -}} + +{{/* +Sanitize tag for use in app.kubernetes.io/version label. +*/}} +{{- define "br-sta.versionLabelValue" -}} +{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "br-sta.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }} +{{- end -}} + +{{/* +================================================================================ +LABEL HELPERS +================================================================================ +*/}} + +{{/* +Common labels. +Usage: {{ include "br-sta.labels" (dict "context" .) }} +*/}} +{{- define "br-sta.labels" -}} +helm.sh/chart: {{ include "br-sta.chart" .context }} +{{ include "br-sta.selectorLabels" (dict "context" .context) }} +app.kubernetes.io/version: {{ include "br-sta.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +app.kubernetes.io/part-of: br-sta +{{- end }} + +{{/* +Selector labels. +*/}} +{{- define "br-sta.selectorLabels" -}} +app.kubernetes.io/name: {{ include "br-sta.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- end }} + +{{/* +================================================================================ +SERVICE ACCOUNT HELPER +================================================================================ +*/}} + +{{- define "br-sta.serviceAccountName" -}} +{{- if .Values.app.serviceAccount.create }} +{{- default (include "br-sta.fullname" .) .Values.app.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.app.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +================================================================================ +NAMESPACE HELPER +================================================================================ +*/}} + +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* +infraSecretRef — emit a `- name: valueFrom: secretKeyRef: {name,key}` env entry +pointing at a Bitnami subchart's generated Secret (or the operator's existingSecret override). +Inputs (dict): context (root .), subchart ("postgresql"|"valkey"), +key (data key), envName (container env var name). +See docs/helm-chart-standard.md "Single-Source Infra Secrets". +*/}} +{{- define "br-sta.infraSecretRef" -}} +{{- $ctx := .context -}} +{{- $sub := .subchart -}} +{{- $auth := default dict (index $ctx.Values $sub "auth") -}} +{{- $secretName := "" -}} +{{- if $auth.existingSecret -}} +{{- $secretName = $auth.existingSecret -}} +{{- else -}} +{{- $secretName = include "common.names.dependency.fullname" (dict "chartName" $sub "chartValues" (index $ctx.Values $sub) "context" $ctx) -}} +{{- end -}} +- name: {{ .envName }} + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: {{ .key }} +{{- end }} + +{{/* +================================================================================ +DEPENDENCY ENABLED HELPERS +================================================================================ +*/}} + +{{/* Nil-aware: ne (toString .enabled) "false" is true for unset/true, false only for + an explicit false — avoids the `default true` coercion GOTCHA in the standard. */}} +{{- define "postgresql.enabled" -}} +{{- if and (ne (toString .Values.postgresql.enabled) "false") (not .Values.postgresql.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{- define "valkey.enabled" -}} +{{- if and (ne (toString .Values.valkey.enabled) "false") (not .Values.valkey.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{/* RabbitMQ is OPTIONAL and disabled by default, so an unset value must NOT + coerce to enabled — the nil-aware check treats unset/true as enabled and an + explicit false (the default) as disabled. Honors .external for external mode. */}} +{{- define "rabbitmq.enabled" -}} +{{- $rmq := .Values.rabbitmq | default dict -}} +{{- if and (ne (toString $rmq.enabled) "false") (not $rmq.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{/* +================================================================================ +VALIDATION HELPERS +================================================================================ +ERRORS (fail) block deployment for truly required fields. br-sta only requires +operator input for optional integrations that have been toggled on (multi-tenant). +================================================================================ +*/}} + +{{- define "br-sta.validateRequired" -}} + +{{/* PostgreSQL password is single-sourced from the postgresql subchart Secret + via secretKeyRef; see docs/helm-chart-standard.md "Single-Source Infra + Secrets". No gate here: for the bundled subchart the value is generated; + for external Postgres the operator supplies postgresql.auth.existingSecret + or app.secrets.POSTGRES_PASSWORD. The same reasoning applies to Valkey. */}} + +{{/* Multi-tenant required fields when enabled */}} +{{- if eq (.Values.app.configmap.MULTI_TENANT_ENABLED | toString) "true" }} +{{- if not .Values.app.configmap.MULTI_TENANT_URL }} +{{- fail "\n\nERROR: app.configmap.MULTI_TENANT_URL is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} +{{- end }} +{{- if not .Values.app.secrets.MULTI_TENANT_SERVICE_API_KEY }} +{{- fail "\n\nERROR: app.secrets.MULTI_TENANT_SERVICE_API_KEY is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} +{{- end }} +{{- end }} + +{{- end }} + +{{/* +Generate annotation listing default-value warnings (non-blocking). +*/}} +{{- define "br-sta.secretWarnings" -}} +{{- $warnings := list -}} +{{- if .Values.postgresql.enabled -}} +{{- if eq (.Values.postgresql.auth.password | toString) "lerian" -}} +{{- $warnings = append $warnings "postgresql.auth.password is using default value 'lerian'" -}} +{{- end -}} +{{- end -}} +{{- if .Values.valkey.enabled -}} +{{- if eq (.Values.valkey.auth.password | toString) "lerian" -}} +{{- $warnings = append $warnings "valkey.auth.password is using default value 'lerian'" -}} +{{- end -}} +{{- end -}} +{{- if gt (len $warnings) 0 -}} +lerian.studio/security-warnings: {{ $warnings | join "; " | quote }} +{{- end -}} +{{- end -}} + +{{/* +Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra +Secret/Service names render even when all bundled subcharts are disabled +(external-infra path). Self-contained: no other common.* helpers required. +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/br-sta/templates/bootstrap-postgres.yaml b/charts/br-sta/templates/bootstrap-postgres.yaml new file mode 100644 index 00000000..fd7dec89 --- /dev/null +++ b/charts/br-sta/templates/bootstrap-postgres.yaml @@ -0,0 +1,133 @@ +{{- if .Values.global.externalPostgresDefinitions.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "br-sta.fullname" . }}-bootstrap-postgres + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + app.kubernetes.io/component: bootstrap-postgres +spec: + ttlSecondsAfterFinished: 300 + completions: 1 + parallelism: 1 + backoffLimit: 3 + template: + spec: + restartPolicy: Never + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + echo "Checking $DB_HOST:$DB_PORT..."; + while ! nc -z "$DB_HOST" "$DB_PORT"; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for $DB_HOST:$DB_PORT after ${TIMEOUT}s"; + exit 1; + fi; + echo "$DB_HOST:$DB_PORT not ready, waiting (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "$DB_HOST:$DB_PORT is ready!"; + containers: + - name: psql + image: postgres:17 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + - name: DB_USER_ADMIN + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_USER_ADMIN + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.username | quote }} + {{- end }} + - name: DB_ADMIN_PASSWORD + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_ADMIN_PASSWORD + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.password | quote }} + {{- end }} + - name: DB_PASSWORD_BR_STA + {{- if .Values.global.externalPostgresDefinitions.appCredentials.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.appCredentials.useExistingSecret.name | quote }} + key: DB_PASSWORD_BR_STA + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.appCredentials.password | quote }} + {{- end }} + - name: DB_DATABASE + value: postgres + - name: APP_DB + value: br_sta + - name: APP_ROLE + value: br_sta + command: + - /bin/sh + - -c + - | + set -euo pipefail + echo "=== br-sta PostgreSQL Bootstrap ===" + echo "Host: $DB_HOST:$DB_PORT" + echo "" + + echo "Checking existing PostgreSQL objects..." + DB_EXISTS=0 + ROLE_EXISTS=0 + + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname='$APP_DB'" | grep -q 1; then + DB_EXISTS=1 + fi + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname='$APP_ROLE'" | grep -q 1; then + ROLE_EXISTS=1 + fi + + if [ "$DB_EXISTS" = "1" ] && [ "$ROLE_EXISTS" = "1" ]; then + echo "Bootstrap already complete (database '$APP_DB' and role '$APP_ROLE' exist). Skipping creation." + else + if [ "$ROLE_EXISTS" = "1" ]; then + echo "Role '$APP_ROLE' already exists. Skipping creation." + else + echo "Creating role '$APP_ROLE'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_BR_STA" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE br_sta LOGIN PASSWORD :'pw'" + fi + + if [ "$DB_EXISTS" = "1" ]; then + echo "Database '$APP_DB' already exists. Skipping creation." + else + echo "Creating database '$APP_DB'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE br_sta OWNER br_sta" + fi + fi + + # Privileges (idempotent) + echo "Ensuring privileges and schema permissions..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE br_sta TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL ON SCHEMA public TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO br_sta" + + echo "" + echo "=== br-sta PostgreSQL Bootstrap completed successfully ===" +{{- end }} diff --git a/charts/br-sta/templates/configmap.yaml b/charts/br-sta/templates/configmap.yaml new file mode 100644 index 00000000..df617795 --- /dev/null +++ b/charts/br-sta/templates/configmap.yaml @@ -0,0 +1,66 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} +data: + # Application environment values + {{- range $key, $value := .Values.app.configmap }} + {{- if and (ne $key "POSTGRES_HOST") (ne $key "REDIS_HOST") (ne $key "RABBITMQ_HOST") }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + + # PostgreSQL host: explicit value or dynamic default derived from the Bitnami subchart's + # own name helper (honors release-name collapse, nameOverride and fullnameOverride) when + # in-cluster Postgres is enabled. The subchart exposes the primary Service at + # "-primary" in replication architecture and at "" + # in standalone architecture. + {{- if .Values.app.configmap.POSTGRES_HOST }} + POSTGRES_HOST: {{ .Values.app.configmap.POSTGRES_HOST | quote }} + {{- else if eq (include "postgresql.enabled" .) "true" }} + {{- $pgArch := default "standalone" .Values.postgresql.architecture }} + {{- $pgFullname := include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" (index .Values "postgresql") "context" .) }} + {{- if eq $pgArch "replication" }} + POSTGRES_HOST: {{ printf "%s-primary.%s.svc.cluster.local" $pgFullname (include "global.namespace" .) | quote }} + {{- else }} + POSTGRES_HOST: {{ printf "%s.%s.svc.cluster.local" $pgFullname (include "global.namespace" .) | quote }} + {{- end }} + {{- else }} + POSTGRES_HOST: "" + {{- end }} + + # Redis/Valkey host: br-sta expects a combined "host:port" value in REDIS_HOST. + # Explicit value wins; otherwise derive the bundled Valkey subchart's primary + # Service (collapse-aware) when in-cluster Valkey is enabled. Bitnami Valkey + # exposes its primary Service at "-primary". + {{- if .Values.app.configmap.REDIS_HOST }} + REDIS_HOST: {{ .Values.app.configmap.REDIS_HOST | quote }} + {{- else if eq (include "valkey.enabled" .) "true" }} + {{- $vkFullname := include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" (index .Values "valkey") "context" .) }} + REDIS_HOST: {{ printf "%s-primary.%s.svc.cluster.local:6379" $vkFullname (include "global.namespace" .) | quote }} + {{- else }} + REDIS_HOST: "" + {{- end }} + + # RabbitMQ host: explicit value wins; otherwise, when the bundled broker is + # enabled, derive the groundhog2k Service name "-rabbitmq" (that + # subchart names its Service after the release, not collapse-aware Bitnami). + {{- if .Values.app.configmap.RABBITMQ_HOST }} + RABBITMQ_HOST: {{ .Values.app.configmap.RABBITMQ_HOST | quote }} + {{- else if eq (include "rabbitmq.enabled" .) "true" }} + RABBITMQ_HOST: {{ printf "%s-rabbitmq.%s.svc.cluster.local" .Release.Name (include "global.namespace" .) | quote }} + {{- else }} + RABBITMQ_HOST: "" + {{- end }} + + # Always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from the resolved image tag + VERSION: {{ include "br-sta.defaultTag" . | quote }} + OTEL_RESOURCE_SERVICE_VERSION: {{ include "br-sta.defaultTag" . | quote }} + + # Extra environment variables (passthrough from values.app.extraEnvVars) + {{- with .Values.app.extraEnvVars }} + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/charts/br-sta/templates/deployment.yaml b/charts/br-sta/templates/deployment.yaml new file mode 100644 index 00000000..7744b142 --- /dev/null +++ b/charts/br-sta/templates/deployment.yaml @@ -0,0 +1,159 @@ +{{- include "br-sta.validateRequired" . }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + {{- with .Values.app.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + revisionHistoryLimit: {{ .Values.app.revisionHistoryLimit | default 10 }} + {{- with .Values.app.deploymentStrategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + replicas: {{ .Values.app.replicaCount }} + selector: + matchLabels: + {{- include "br-sta.selectorLabels" (dict "context" .) | nindent 6 }} + template: + metadata: + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 8 }} + {{- with .Values.app.podAnnotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + spec: + {{- with .Values.app.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "br-sta.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ .Values.app.terminationGracePeriodSeconds | default 60 }} + {{- with .Values.app.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.app.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or (eq (include "postgresql.enabled" .) "true") (eq (include "valkey.enabled" .) "true") }} + initContainers: + - name: wait-for-infra + image: busybox:1.37 + envFrom: + - configMapRef: + name: {{ include "br-sta.fullname" . }} + command: + - /bin/sh + - -c + - > + {{- if eq (include "postgresql.enabled" .) "true" }} + echo "Waiting for PostgreSQL $POSTGRES_HOST:$POSTGRES_PORT..."; + until nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do + echo "$POSTGRES_HOST:$POSTGRES_PORT not ready, sleeping 5s"; + sleep 5; + done; + echo "PostgreSQL is ready"; + {{- end }} + {{- if eq (include "valkey.enabled" .) "true" }} + REDIS_SVC=$(echo "$REDIS_HOST" | cut -d: -f1); + REDIS_PORT_NUM=$(echo "$REDIS_HOST" | cut -d: -f2); + [ -z "$REDIS_PORT_NUM" ] && REDIS_PORT_NUM=6379; + echo "Waiting for Redis/Valkey $REDIS_SVC:$REDIS_PORT_NUM..."; + until nc -z "$REDIS_SVC" "$REDIS_PORT_NUM"; do + echo "$REDIS_SVC:$REDIS_PORT_NUM not ready, sleeping 5s"; + sleep 5; + done; + echo "Redis/Valkey is ready"; + {{- end }} + {{- end }} + containers: + - name: {{ include "br-sta.fullname" . }} + securityContext: + {{- toYaml .Values.app.securityContext | nindent 12 }} + image: "{{ .Values.app.image.repository }}:{{ .Values.app.image.tag | default (include "br-sta.defaultTag" .) }}" + imagePullPolicy: {{ .Values.app.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.app.service.port }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "br-sta.fullname" . }} + - secretRef: + name: {{ if .Values.app.useExistingSecret }}{{ .Values.app.existingSecretName }}{{ else }}{{ include "br-sta.fullname" . }}{{ end }} + env: + {{- $secretName := ternary .Values.app.existingSecretName (include "br-sta.fullname" .) .Values.app.useExistingSecret }} + {{- $pg := .Values.postgresql | default dict }} + {{- $pgAuth := $pg.auth | default dict }} + {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} + {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} + {{- else if .Values.app.secrets.POSTGRES_PASSWORD }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + {{- end }} + {{- $vk := .Values.valkey | default dict }} + {{- $vkAuth := $vk.auth | default dict }} + {{- if or (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled) $vkAuth.existingSecret }} + {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "valkey" "key" "valkey-password" "envName" "REDIS_PASSWORD") | nindent 12 }} + {{- else if .Values.app.secrets.REDIS_PASSWORD }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: REDIS_PASSWORD + {{- end }} + {{- if (index .Values "otel-collector-lerian").enabled }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + resources: + {{- toYaml .Values.app.resources | nindent 12 }} + readinessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: {{ .Values.app.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ .Values.app.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ .Values.app.readinessProbe.timeoutSeconds | default 3 }} + successThreshold: {{ .Values.app.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.app.readinessProbe.failureThreshold | default 2 }} + livenessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: {{ .Values.app.livenessProbe.initialDelaySeconds | default 30 }} + periodSeconds: {{ .Values.app.livenessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ .Values.app.livenessProbe.timeoutSeconds | default 3 }} + successThreshold: {{ .Values.app.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.app.livenessProbe.failureThreshold | default 3 }} + {{- with .Values.app.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.app.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.app.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/br-sta/templates/hpa.yaml b/charts/br-sta/templates/hpa.yaml new file mode 100644 index 00000000..cc6afca7 --- /dev/null +++ b/charts/br-sta/templates/hpa.yaml @@ -0,0 +1,36 @@ +{{- if .Values.app.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "br-sta.fullname" . }} + minReplicas: {{ .Values.app.autoscaling.minReplicas }} + maxReplicas: {{ .Values.app.autoscaling.maxReplicas }} + metrics: + {{- if .Values.app.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.app.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.app.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.app.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} + behavior: + scaleDown: + stabilizationWindowSeconds: {{ .Values.app.autoscaling.scaleDownStabilizationSeconds | default 300 }} +{{- end }} diff --git a/charts/br-sta/templates/ingress.yaml b/charts/br-sta/templates/ingress.yaml new file mode 100644 index 00000000..69355692 --- /dev/null +++ b/charts/br-sta/templates/ingress.yaml @@ -0,0 +1,62 @@ +{{- if .Values.app.ingress.enabled -}} +{{- $fullName := include "br-sta.fullname" . -}} +{{- $svcPort := .Values.app.service.port -}} +{{- if and .Values.app.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.app.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.app.ingress.annotations "kubernetes.io/ingress.class" .Values.app.ingress.className }} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $fullName }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + {{- with .Values.app.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.app.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.app.ingress.className }} + {{- end }} + {{- if .Values.app.ingress.tls }} + tls: + {{- range .Values.app.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.app.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $fullName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/templates/pdb.yaml b/charts/br-sta/templates/pdb.yaml new file mode 100644 index 00000000..57c5bd60 --- /dev/null +++ b/charts/br-sta/templates/pdb.yaml @@ -0,0 +1,24 @@ +{{- if .Values.app.pdb.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + {{- with .Values.app.pdb.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + {{- if .Values.app.pdb.maxUnavailable }} + maxUnavailable: {{ .Values.app.pdb.maxUnavailable }} + {{- else }} + minAvailable: {{ .Values.app.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- include "br-sta.selectorLabels" (dict "context" .) | nindent 6 }} +{{- end }} diff --git a/charts/br-sta/templates/secrets.yaml b/charts/br-sta/templates/secrets.yaml new file mode 100644 index 00000000..544d9f49 --- /dev/null +++ b/charts/br-sta/templates/secrets.yaml @@ -0,0 +1,24 @@ +{{- if not .Values.app.useExistingSecret }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + annotations: + "helm.sh/hook": "pre-install,pre-upgrade" + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": "before-hook-creation" + {{- $warns := include "br-sta.secretWarnings" . }} + {{- if $warns }} + {{ $warns | nindent 4 }} + {{- end }} +type: Opaque +stringData: + {{- range $key, $value := .Values.app.secrets }} + {{- if $value }} + {{ $key }}: {{ $value | toString | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/templates/service.yaml b/charts/br-sta/templates/service.yaml new file mode 100644 index 00000000..52fc97bd --- /dev/null +++ b/charts/br-sta/templates/service.yaml @@ -0,0 +1,22 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "br-sta.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + {{- with .Values.app.service.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + type: {{ .Values.app.service.type }} + ports: + - port: {{ .Values.app.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "br-sta.selectorLabels" (dict "context" .) | nindent 4 }} diff --git a/charts/br-sta/templates/serviceaccount.yaml b/charts/br-sta/templates/serviceaccount.yaml new file mode 100644 index 00000000..41a3fd31 --- /dev/null +++ b/charts/br-sta/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.app.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "br-sta.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + {{- with .Values.app.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/values-template.yaml b/charts/br-sta/values-template.yaml new file mode 100644 index 00000000..ef24edd3 --- /dev/null +++ b/charts/br-sta/values-template.yaml @@ -0,0 +1,74 @@ +# Production values overlay starter for br-sta-helm. +# Copy this file, fill in the placeholders, and pass it to helm install/upgrade. +# +# helm upgrade --install br-sta lerian/br-sta-helm \ +# -n --create-namespace \ +# -f values-prod.yaml + +app: + replicaCount: 2 + image: + tag: "latest" # pin to a published immutable tag + ingress: + enabled: false + className: nginx + annotations: {} + hosts: + - host: br-sta.example.com + paths: + - path: / + pathType: Prefix + tls: + - secretName: br-sta-tls + hosts: + - br-sta.example.com + configmap: + ENV_NAME: "production" + LOG_LEVEL: "info" + # External PostgreSQL — leave empty only if postgresql.enabled=true. + POSTGRES_HOST: "" + POSTGRES_SSLMODE: "require" + # External Redis/Valkey (host:port) — leave empty only if valkey.enabled=true. + REDIS_HOST: "" + REDIS_TLS: "false" + # Multi-tenancy (set to "true" to enable — then MULTI_TENANT_URL + API key are required) + MULTI_TENANT_ENABLED: "false" + # MULTI_TENANT_URL: "" + # OpenTelemetry (or use otel-collector-lerian.enabled below for host injection) + ENABLE_TELEMETRY: "false" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + secrets: + # Database — leave empty when postgresql.enabled=true (auto-generated). + POSTGRES_PASSWORD: "" + # Redis/Valkey — leave empty when valkey.enabled=true (auto-generated). + REDIS_PASSWORD: "" + # Multi-tenancy (REQUIRED when MULTI_TENANT_ENABLED=true) + # MULTI_TENANT_SERVICE_API_KEY: "" + # RabbitMQ (only relevant when RABBITMQ_ENABLED=true) + # RABBITMQ_DEFAULT_PASS: "" + autoscaling: + enabled: true + minReplicas: 2 + maxReplicas: 5 + +# Use managed Postgres + Redis in production. +postgresql: + enabled: false +valkey: + enabled: false + +# When using a fresh external Postgres, optionally run the bootstrap Job once: +# global: +# externalPostgresDefinitions: +# enabled: true +# connection: +# host: my-rds.example.com +# port: "5432" +# postgresAdminLogin: +# username: postgres +# password: +# appCredentials: +# password: + +# otel-collector-lerian: +# enabled: true diff --git a/charts/br-sta/values.schema.json b/charts/br-sta/values.schema.json new file mode 100644 index 00000000..6ad7a287 --- /dev/null +++ b/charts/br-sta/values.schema.json @@ -0,0 +1,52 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "additionalProperties": true, + "properties": { + "nameOverride": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "namespaceOverride": { + "type": "string" + }, + "global": { + "type": "object", + "additionalProperties": true + }, + "app": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "postgresql": { + "type": "object", + "additionalProperties": true + }, + "valkey": { + "type": "object", + "additionalProperties": true + }, + "rabbitmq": { + "type": "object", + "additionalProperties": true + }, + "otel-collector-lerian": { + "type": "object", + "additionalProperties": true + }, + "br-sta": { + "type": "object", + "additionalProperties": true + } + } +} diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml new file mode 100644 index 00000000..b4ae39bf --- /dev/null +++ b/charts/br-sta/values.yaml @@ -0,0 +1,491 @@ +# Default values for br-sta. +# This is a YAML-formatted file. +# +# Runtime model: ONE Deployment, ONE pod, ONE process (the /service binary). +# br-sta is a Go/Fiber HTTP service. It requires PostgreSQL (SQL migrations at +# startup) and Redis/Valkey (caching + rate limiting). RabbitMQ, plugin-auth, +# multi-tenant, outbox and telemetry are all OPTIONAL and disabled by default. + +# -- Override the chart top-level name +nameOverride: "br-sta" +# -- Override the fully generated name +fullnameOverride: "" +# -- Override the namespace used by templates +namespaceOverride: "" + +global: + # -- Bootstrap job for external PostgreSQL: creates database and role + externalPostgresDefinitions: + # -- Enable or disable the PostgreSQL bootstrap job + enabled: false + # -- PostgreSQL connection settings (used by the bootstrap job only) + connection: + # -- PostgreSQL host + host: "br-sta-postgresql-primary" + # -- PostgreSQL port + port: "5432" + # -- Admin (superuser) credentials used to create the application DB and role + postgresAdminLogin: + useExistingSecret: + # -- Name of existing secret containing DB_USER_ADMIN and DB_ADMIN_PASSWORD keys + name: "" + # -- Admin username (ignored if useExistingSecret.name is set) + username: "postgres" + # -- Admin password (ignored if useExistingSecret.name is set) + password: "" + # -- Credentials for the br_sta role created by the job + appCredentials: + useExistingSecret: + # -- Name of existing secret containing DB_PASSWORD_BR_STA key + name: "" + # -- Password for br_sta role (ignored if useExistingSecret.name is set) + password: "" + +# ============================================================================== +# APPLICATION +# Single Deployment running the /service binary (Go/Fiber HTTP server). +# ============================================================================== +app: + # -- Service name + name: "br-sta" + # -- Number of replicas + replicaCount: 2 + # -- Number of old ReplicaSets to retain for rollback + revisionHistoryLimit: 10 + # -- Annotations applied to the Deployment resource + annotations: {} + # -- Annotations applied to the pods + podAnnotations: {} + image: + # -- Repository for the br-sta image + repository: ghcr.io/lerianstudio/br-sta + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Image tag (defaults to Chart.appVersion if empty) + tag: "" + # -- Image pull secrets for private registries + imagePullSecrets: [] + # -- Override of the resource name + nameOverride: "" + # -- Override of the fully qualified resource name + fullnameOverride: "" + # -- Termination grace period. + terminationGracePeriodSeconds: 60 + # -- Pod security context + podSecurityContext: {} + # -- Container security context (Distroless nonroot UID/GID is 65532) + securityContext: + runAsGroup: 65532 + runAsUser: 65532 + runAsNonRoot: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + # -- PodDisruptionBudget configuration + pdb: + enabled: true + minAvailable: 1 + maxUnavailable: "" + annotations: {} + # -- Deployment strategy + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + # -- Service configuration + service: + type: ClusterIP + port: 8080 + annotations: {} + # -- Ingress configuration + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + tls: [] + # -- Resource requests and limits + resources: + limits: + cpu: 1000m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + # -- HorizontalPodAutoscaler configuration + autoscaling: + enabled: true + minReplicas: 2 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + scaleDownStabilizationSeconds: 300 + # -- Readiness probe configuration + readinessProbe: + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 3 + successThreshold: 1 + failureThreshold: 2 + # -- Liveness probe configuration + livenessProbe: + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 3 + successThreshold: 1 + failureThreshold: 3 + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + # -- Tolerations for scheduling on tainted nodes + tolerations: [] + # -- Affinity rules for pod scheduling + affinity: {} + # -- Host aliases for custom DNS resolution inside the pod + hostAliases: [] + # -- ConfigMap (non-sensitive environment variables) + # @default -- templates/configmap.yaml + configmap: + # Application Settings + ENV_NAME: "production" + LOG_LEVEL: "info" + # ServerAddress binds to all interfaces inside the pod so kubelet probes can reach it. + SERVER_ADDRESS: "0.0.0.0:8080" + HTTP_BODY_LIMIT_BYTES: "104857600" + # CORS Configuration + CORS_ALLOWED_ORIGINS: "*" + CORS_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + CORS_ALLOWED_HEADERS: "Origin,Content-Type,Accept,Authorization,X-Request-ID" + CORS_EXPOSE_HEADERS: "" + CORS_ALLOW_CREDENTIALS: "false" + # TLS (terminate at ingress in production) + TLS_TERMINATED_UPSTREAM: "true" + # Single-tenant default tenant ID (must be a valid UUID) + DEFAULT_TENANT_ID: "11111111-1111-1111-1111-111111111111" + # Multi-Tenant Starter (tenant-manager) — OPTIONAL + # When enabled, MULTI_TENANT_URL and MULTI_TENANT_SERVICE_API_KEY become required. + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_URL: "" + MULTI_TENANT_REDIS_HOST: "" + MULTI_TENANT_REDIS_PORT: "6379" + MULTI_TENANT_REDIS_TLS: "false" + MULTI_TENANT_MAX_TENANT_POOLS: "100" + MULTI_TENANT_IDLE_TIMEOUT_SEC: "300" + MULTI_TENANT_TIMEOUT: "30" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" + MULTI_TENANT_CACHE_TTL_SEC: "120" + MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: "30" + # PostgreSQL Primary (host defaults dynamically in configmap when empty) + POSTGRES_HOST: "" # Empty -> dynamic default in configmap template + POSTGRES_PORT: "5432" + POSTGRES_USER: "br_sta" + POSTGRES_NAME: "br_sta" + POSTGRES_SSLMODE: "require" + # Migrations path (applied at startup by the /service binary) + MIGRATIONS_PATH: "migrations" + # Runtime config plane (operational knobs only; disabled preserves env-only mode) + SYSTEMPLANE_ENABLED: "false" + # Connection Pool + POSTGRES_MAX_OPEN_CONNS: "25" + POSTGRES_MAX_IDLE_CONNS: "5" + POSTGRES_CONN_MAX_LIFETIME_MINS: "30" + POSTGRES_CONN_MAX_IDLE_TIME_MINS: "5" + POSTGRES_CONNECT_TIMEOUT_SEC: "10" + # PostgreSQL Replica (optional - for CQRS read scaling) + # POSTGRES_REPLICA_HOST: "" + # POSTGRES_REPLICA_PORT: "5433" + # POSTGRES_REPLICA_USER: "" + # POSTGRES_REPLICA_NAME: "" + # POSTGRES_REPLICA_SSLMODE: "" + # Infrastructure boot timeout + INFRA_CONNECT_TIMEOUT_SEC: "30" + # Redis / Valkey (host defaults dynamically in configmap when empty) + REDIS_HOST: "" # Empty -> dynamic default "-primary..svc.cluster.local:6379" + REDIS_DB: "0" + REDIS_PROTOCOL: "3" + REDIS_POOL_SIZE: "10" + REDIS_MIN_IDLE_CONNS: "2" + REDIS_READ_TIMEOUT: "3" + REDIS_WRITE_TIMEOUT: "3" + REDIS_DIAL_TIMEOUT: "5" + REDIS_POOL_TIMEOUT: "2" + REDIS_MAX_RETRIES: "3" + REDIS_MIN_RETRY_BACKOFF: "8" + REDIS_MAX_RETRY_BACKOFF: "1" + # REDIS_MASTER_NAME: "" + REDIS_TLS: "false" + # REDIS_CA_CERT: "" + # Event-Driven Starter - Circuit Breaker + CIRCUIT_BREAKER_ENABLED: "false" + # Event-Driven Starter - RabbitMQ — OPTIONAL. + # Disabled by default. Set both RABBITMQ_ENABLED="true" AND rabbitmq.enabled=true + # (bottom of this file) to bundle the groundhog2k broker as a subchart. + RABBITMQ_ENABLED: "false" + # RABBITMQ_URL: "" + # RABBITMQ_HOST: empty -> dynamic default "-rabbitmq..svc.cluster.local" + # when the bundled broker is enabled; set explicitly for an external broker. + RABBITMQ_HOST: "" + RABBITMQ_PORT_AMQP: "5672" + RABBITMQ_PORT_HOST: "15672" + # Must match rabbitmq.authentication.user.value when the bundled broker is enabled. + RABBITMQ_DEFAULT_USER: "br_sta" + RABBITMQ_VHOST: "/" + # RABBITMQ_QUEUE: "" + RABBITMQ_EXCHANGE: "events" + # RABBITMQ_HEALTH_CHECK_URL: "" + # RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS: "" + RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS: "false" + RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK: "false" + RABBITMQ_ALLOW_INSECURE_TLS: "false" + RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS: "5000" + RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS: "1000" + RABBITMQ_PUBLISHER_RECOVERY_MAX_MS: "30000" + RABBITMQ_PUBLISHER_MAX_RECOVERIES: "10" + # Event-Driven Starter - Outbox — OPTIONAL + OUTBOX_ENABLED: "false" + OUTBOX_TABLE_NAME: "outbox_events" + OUTBOX_DISPATCH_INTERVAL_SEC: "2" + OUTBOX_BATCH_SIZE: "50" + OUTBOX_PUBLISH_MAX_ATTEMPTS: "3" + OUTBOX_PUBLISH_BACKOFF_MS: "200" + OUTBOX_RETRY_WINDOW_SEC: "300" + OUTBOX_MAX_DISPATCH_ATTEMPTS: "10" + OUTBOX_PROCESSING_TIMEOUT_SEC: "600" + OUTBOX_MAX_FAILED_PER_BATCH: "25" + OUTBOX_INCLUDE_TENANT_METRICS: "false" + # OUTBOX_PRIORITY_EVENT_TYPES: "" + OUTBOX_ALLOW_EMPTY_TENANT: "true" + # Authentication (lib-auth + plugin-auth) — OPTIONAL + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_HOST: "" + # Resilience example (repo-local simulation only) + EXAMPLE_STATUS_PROVIDER_MODE: "healthy" + # API Documentation (Swagger) + SWAGGER_ENABLED: "false" + SWAGGER_TITLE: "br-sta" + # SWAGGER_DESCRIPTION: "" + SWAGGER_VERSION: "1.0.0" + SWAGGER_BASE_PATH: "/" + SWAGGER_LEFT_DELIM: "{{" + SWAGGER_RIGHT_DELIM: "}}" + # OpenTelemetry — OPTIONAL + ENABLE_TELEMETRY: "false" + OTEL_LIBRARY_NAME: "github.com/LerianStudio/br-sta" + OTEL_RESOURCE_SERVICE_NAME: "br-sta" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + # Rate Limiting + RATE_LIMIT_ENABLED: "true" + RATE_LIMIT_MAX: "500" + RATE_LIMIT_WINDOW_SEC: "60" + AGGRESSIVE_RATE_LIMIT_MAX: "100" + AGGRESSIVE_RATE_LIMIT_WINDOW_SEC: "60" + RELAXED_RATE_LIMIT_MAX: "1000" + RELAXED_RATE_LIMIT_WINDOW_SEC: "60" + # Observability & Metrics + DB_METRICS_INTERVAL_SEC: "15" + # Idempotency + IDEMPOTENCY_RETRY_WINDOW_SEC: "300" + # M2M Credentials (for services with target service dependencies) + # M2M_TARGET_SERVICE: "" + M2M_CREDENTIAL_CACHE_TTL_SEC: "300" + AWS_REGION: "us-east-1" + # Pagination + MAX_PAGINATION_LIMIT: "100" + MAX_PAGINATION_MONTH_DATE_RANGE: "3" + # -- Secrets (sensitive environment variables) + # @default -- templates/secrets.yaml + secrets: + # PostgreSQL password is single-sourced from the postgresql subchart Secret + # (name derived collapse-aware via common.names.dependency.fullname; key "password") + # and read via secretKeyRef on the deployment — leave empty with the bundled subchart. + # Only set this for an EXTERNAL Postgres without postgresql.auth.existingSecret. + # See docs/helm-chart-standard.md "Single-Source Infra Secrets". + POSTGRES_PASSWORD: "" + # POSTGRES_REPLICA_PASSWORD: "" + # Redis/Valkey password is single-sourced from the valkey subchart Secret + # (key "valkey-password") and read via secretKeyRef — leave empty with the + # bundled subchart. Only set this for an EXTERNAL Redis without + # valkey.auth.existingSecret. + REDIS_PASSWORD: "" + # RabbitMQ password — kept in the app Secret (only relevant when RABBITMQ_ENABLED=true). + RABBITMQ_DEFAULT_PASS: "" + # Multi-Tenant Manager API key (REQUIRED when MULTI_TENANT_ENABLED=true) + MULTI_TENANT_SERVICE_API_KEY: "" + # MULTI_TENANT_REDIS_PASSWORD: "" + # -- Use an externally managed Secret instead of generating one + useExistingSecret: false + # -- Name of the externally managed Secret + existingSecretName: "" + # -- Extra environment variables (map of key:value pairs) + extraEnvVars: {} + # -- ServiceAccount configuration + serviceAccount: + create: true + annotations: {} + name: "" + +# ============================================================================== +# POSTGRESQL SUB-CHART (Bitnami) +# Default: enabled with replication for in-cluster development/staging. +# Production: set postgresql.enabled=false and configure +# global.externalPostgresDefinitions for an externally managed Postgres. +# ============================================================================== +postgresql: + enabled: true + external: false + global: + security: + # Bitnami moved free images to bitnamisecure / bitnamilegacy in 2025; + # the upstream Bitnami chart treats those repos as "non-standard" and + # blocks them unless this flag is set. Required for fresh installs. + allowInsecureImages: true + image: + repository: bitnamisecure/postgresql + tag: "latest" + architecture: replication + replication: + numSynchronousReplicas: 1 + auth: + enabled: true + enablePostgresUser: true + postgresPassword: "" + username: "br_sta" + password: "" + database: "br_sta" + replicationUsername: "replicator" + replicationPassword: "" + primary: + persistence: + size: 8Gi + resourcesPreset: "medium" + extendedConfiguration: | + shared_buffers = 512MB + max_wal_senders = 20 + wal_keep_size = 512MB + max_replication_slots = 20 + extraEnvVars: + - name: POSTGRESQL_WAL_LEVEL + value: "logical" + - name: POSTGRESQL_HOST_STANDBY + value: "on" + - name: POSTGRESQL_MAX_CONNECTIONS + value: "200" + readReplicas: + name: replication + replicaCount: 1 + persistence: + size: 8Gi + resourcesPreset: "medium" + extendedConfiguration: | + shared_buffers = 512MB + max_wal_senders = 20 + max_replication_slots = 20 + wal_keep_size = 512MB + extraEnvVars: + - name: POSTGRESQL_WAL_LEVEL + value: "logical" + - name: POSTGRESQL_HOST_STANDBY + value: "on" + - name: POSTGRESQL_MAX_CONNECTIONS + value: "200" + +# ============================================================================== +# VALKEY SUB-CHART (Bitnami, Redis-compatible) +# Default: enabled (standalone) for in-cluster development/staging. +# Provides caching + rate limiting for br-sta (REDIS_* env vars). +# Production: set valkey.enabled=false and point REDIS_HOST/REDIS_PASSWORD at +# an externally managed Redis/Valkey. +# ============================================================================== +valkey: + enabled: true + external: false + global: + security: + allowInsecureImages: true + image: + repository: bitnamisecure/valkey + tag: "latest" + architecture: standalone + auth: + enabled: true + password: "" + username: br_sta + primary: + kind: Deployment + resourcesPreset: "medium" + persistence: + enabled: false + extraFlags: + - "--maxmemory 640mb" + - "--maxmemory-policy allkeys-lru" + - "--hz 100" + - "--maxclients 10000" + +# ============================================================================== +# RABBITMQ SUB-CHART (groundhog2k) — OPTIONAL +# Disabled by default. Set rabbitmq.enabled=true to bundle an in-cluster broker +# for the event-driven starter. When enabled, also set app.configmap.RABBITMQ_ENABLED="true". +# The broker Service is "-rabbitmq" (AMQP :5672) — RABBITMQ_HOST is +# derived from it automatically in the ConfigMap unless overridden. +# Production: set rabbitmq.enabled=false and point RABBITMQ_HOST / RABBITMQ_DEFAULT_USER +# / app.secrets.RABBITMQ_DEFAULT_PASS at an externally managed broker. +# ============================================================================== +rabbitmq: + enabled: false + external: false + image: + tag: "3.13.6" + persistence: + size: 8Gi + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + podSecurityContext: + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 + fsGroupChangePolicy: "OnRootMismatch" + seccompProfile: {type: RuntimeDefault} + containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: {drop: ["ALL"]} + authentication: + user: + # Must match app.configmap.RABBITMQ_DEFAULT_USER. + value: "br_sta" + password: + # Operators MUST supply this AND the matching app.secrets.RABBITMQ_DEFAULT_PASS + # when rabbitmq.enabled=true. Both must be the same value. + value: "" + erlangCookie: + # Operators MUST supply a stable cookie (e.g. openssl rand -base64 32) when + # rabbitmq.enabled=true. It must not change across upgrades (breaks clustering). + value: "" + +# ============================================================================== +# OPTIONAL OTEL COLLECTOR INTEGRATION +# Setting otel-collector-lerian.enabled=true causes the deployment to inject +# HOST_IP/OTEL_EXPORTER_OTLP_ENDPOINT pointing at the host node's collector. +# ============================================================================== +otel-collector-lerian: + enabled: false + +# Tag at end of file for image-update tooling. +br-sta: + image: + tag: "1.0.0-beta.5" From 26ca70285d1f5ac89cfcc2d740a046ad4e32b704 Mon Sep 17 00:00:00 2001 From: Guilherme Moreira Rodrigues Date: Mon, 6 Jul 2026 13:39:43 -0300 Subject: [PATCH 029/113] refactor(br-sta): rename app block -> br-sta (component convention) --- charts/br-sta/README.md | 26 ++++----- charts/br-sta/templates/NOTES.txt | 11 ++-- charts/br-sta/templates/_helpers.tpl | 16 +++--- charts/br-sta/templates/configmap.yaml | 17 +++--- charts/br-sta/templates/deployment.yaml | 63 +++++++++++---------- charts/br-sta/templates/hpa.yaml | 17 +++--- charts/br-sta/templates/ingress.yaml | 23 ++++---- charts/br-sta/templates/pdb.yaml | 11 ++-- charts/br-sta/templates/secrets.yaml | 5 +- charts/br-sta/templates/service.yaml | 7 ++- charts/br-sta/templates/serviceaccount.yaml | 5 +- charts/br-sta/values.schema.json | 20 +++---- charts/br-sta/values.yaml | 6 +- 13 files changed, 114 insertions(+), 113 deletions(-) diff --git a/charts/br-sta/README.md b/charts/br-sta/README.md index be4554e9..640ce7a9 100644 --- a/charts/br-sta/README.md +++ b/charts/br-sta/README.md @@ -3,7 +3,7 @@ ## Chart Contract - Chart type: `single-service` -- Required secrets: `None for default render`. With the bundled PostgreSQL and Valkey subcharts the database and Redis passwords are auto-generated and read via `secretKeyRef`. Only supply `app.secrets.POSTGRES_PASSWORD` / `app.secrets.REDIS_PASSWORD` for external infra without `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. `app.secrets.MULTI_TENANT_SERVICE_API_KEY` is required only when `MULTI_TENANT_ENABLED=true`. +- Required secrets: `None for default render`. With the bundled PostgreSQL and Valkey subcharts the database and Redis passwords are auto-generated and read via `secretKeyRef`. Only supply `br-sta.secrets.POSTGRES_PASSWORD` / `br-sta.secrets.REDIS_PASSWORD` for external infra without `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. `br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY` is required only when `MULTI_TENANT_ENABLED=true`. - Dependency notes: Bundles two local subcharts — Bitnami `postgresql` (`postgresql.enabled`, default `true`) and Bitnami `valkey` (`valkey.enabled`, default `true`). RabbitMQ is optional, config-only, and NOT bundled (`RABBITMQ_ENABLED=false`). All can be pointed at external services. - Production overrides: Disable the bundled subcharts and point `POSTGRES_HOST` / `REDIS_HOST` at managed services; supply credentials via chart secrets or an existing Secret; override image tag, ingress, resources, and persistence. - Source/license: Source is in `github.com/LerianStudio/br-sta`; chart license is Apache-2.0. @@ -53,9 +53,9 @@ The chart deploys **one Deployment, one process** (`/service`, a Go/Fiber HTTP s Following [`docs/helm-chart-standard.md`](../../docs/helm-chart-standard.md): -- With the bundled **PostgreSQL** subchart (default), the password is auto-generated into the subchart's own Secret and read by the app via `secretKeyRef` (key `password`) — leave `app.secrets.POSTGRES_PASSWORD` empty. -- With the bundled **Valkey** subchart (default), the password is auto-generated into the subchart's own Secret and read via `secretKeyRef` (key `valkey-password`) — leave `app.secrets.REDIS_PASSWORD` empty. -- For external infra (subchart disabled), supply `app.secrets.POSTGRES_PASSWORD` / `app.secrets.REDIS_PASSWORD`, or set `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. +- With the bundled **PostgreSQL** subchart (default), the password is auto-generated into the subchart's own Secret and read by the app via `secretKeyRef` (key `password`) — leave `br-sta.secrets.POSTGRES_PASSWORD` empty. +- With the bundled **Valkey** subchart (default), the password is auto-generated into the subchart's own Secret and read via `secretKeyRef` (key `valkey-password`) — leave `br-sta.secrets.REDIS_PASSWORD` empty. +- For external infra (subchart disabled), supply `br-sta.secrets.POSTGRES_PASSWORD` / `br-sta.secrets.REDIS_PASSWORD`, or set `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. ## Required configuration @@ -63,8 +63,8 @@ The chart **fails fast** on `helm install` only when an enabled optional integra | Field | When required | |-------|---------------| -| `app.configmap.MULTI_TENANT_URL` | `MULTI_TENANT_ENABLED=true` | -| `app.secrets.MULTI_TENANT_SERVICE_API_KEY` | `MULTI_TENANT_ENABLED=true` | +| `br-sta.configmap.MULTI_TENANT_URL` | `MULTI_TENANT_ENABLED=true` | +| `br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY` | `MULTI_TENANT_ENABLED=true` | ## Probes @@ -77,12 +77,12 @@ The chart **fails fast** on `helm install` only when an enabled optional integra | Key | Default | Description | |-----|---------|-------------| -| `app.replicaCount` | `2` | Number of replicas. | -| `app.image.repository` | `ghcr.io/lerianstudio/br-sta` | Container image. | -| `app.image.tag` | `""` (Chart `appVersion`) | Image tag. | -| `app.service.port` | `8080` | Service port. | -| `app.ingress.enabled` | `false` | Expose via Ingress. | -| `app.autoscaling.enabled` | `true` | Enable HPA. | +| `br-sta.replicaCount` | `2` | Number of replicas. | +| `br-sta.image.repository` | `ghcr.io/lerianstudio/br-sta` | Container image. | +| `br-sta.image.tag` | `""` (Chart `appVersion`) | Image tag. | +| `br-sta.service.port` | `8080` | Service port. | +| `br-sta.ingress.enabled` | `false` | Expose via Ingress. | +| `br-sta.autoscaling.enabled` | `true` | Enable HPA. | | `postgresql.enabled` | `true` | Deploy the in-cluster PostgreSQL subchart. | | `postgresql.architecture` | `replication` | Primary + read replica. | | `valkey.enabled` | `true` | Deploy the in-cluster Valkey subchart. | @@ -141,7 +141,7 @@ helm uninstall my-br-sta -n br-sta If the bundled PostgreSQL was used, its PVCs are NOT deleted automatically: ```bash -kubectl delete pvc -n br-sta -l app.kubernetes.io/instance=my-br-sta +kubectl delete pvc -n br-sta -l br-sta.kubernetes.io/instance=my-br-sta ``` ## License diff --git a/charts/br-sta/templates/NOTES.txt b/charts/br-sta/templates/NOTES.txt index c1851e8d..0c7ab461 100644 --- a/charts/br-sta/templates/NOTES.txt +++ b/charts/br-sta/templates/NOTES.txt @@ -1,3 +1,4 @@ +{{- $component := index .Values "br-sta" -}} # br-sta Thank you for installing {{ .Chart.Name }} v{{ .Chart.Version }}! @@ -12,10 +13,10 @@ The chart has been INSTALLED at version {{ .Chart.Version }} (appVersion {{ .Cha ## Component Deployed -Single Deployment ({{ .Values.app.replicaCount }} replica(s)) running the /service binary +Single Deployment ({{ $component.replicaCount }} replica(s)) running the /service binary (Go/Fiber HTTP server). - Service: {{ include "br-sta.fullname" . }}.{{ include "global.namespace" . }}.svc.cluster.local:{{ .Values.app.service.port }} + Service: {{ include "br-sta.fullname" . }}.{{ include "global.namespace" . }}.svc.cluster.local:{{ $component.service.port }} Health: /health API: /api/v1/... @@ -65,13 +66,13 @@ app.secrets.POSTGRES_PASSWORD / app.secrets.REDIS_PASSWORD (or existingSecret). ## Accessing the API -{{- if contains "ClusterIP" .Values.app.service.type }} +{{- if contains "ClusterIP" $component.service.type }} Port-forward locally: - kubectl port-forward -n {{ include "global.namespace" . }} svc/{{ include "br-sta.fullname" . }} {{ .Values.app.service.port }}:{{ .Values.app.service.port }} + kubectl port-forward -n {{ include "global.namespace" . }} svc/{{ include "br-sta.fullname" . }} {{ $component.service.port }}:{{ $component.service.port }} -Then access: http://localhost:{{ .Values.app.service.port }}/health +Then access: http://localhost:{{ $component.service.port }}/health {{- end }} ## Useful Commands diff --git a/charts/br-sta/templates/_helpers.tpl b/charts/br-sta/templates/_helpers.tpl index 5718c69a..fb2ebe45 100644 --- a/charts/br-sta/templates/_helpers.tpl +++ b/charts/br-sta/templates/_helpers.tpl @@ -27,7 +27,7 @@ Application name (single deployment). {{- if .Values.fullnameOverride }} {{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} {{- else }} -{{- default "br-sta" .Values.app.name | trunc 63 | trimSuffix "-" }} +{{- default "br-sta" (index .Values "br-sta").name | trunc 63 | trimSuffix "-" }} {{- end }} {{- end }} @@ -45,7 +45,7 @@ CHART HELPERS Resolve the application image tag (Chart.appVersion if app.image.tag is empty). */}} {{- define "br-sta.defaultTag" -}} -{{- default .Chart.AppVersion .Values.app.image.tag }} +{{- default .Chart.AppVersion (index .Values "br-sta").image.tag }} {{- end -}} {{/* @@ -88,10 +88,10 @@ SERVICE ACCOUNT HELPER */}} {{- define "br-sta.serviceAccountName" -}} -{{- if .Values.app.serviceAccount.create }} -{{- default (include "br-sta.fullname" .) .Values.app.serviceAccount.name }} +{{- if (index .Values "br-sta").serviceAccount.create }} +{{- default (include "br-sta.fullname" .) (index .Values "br-sta").serviceAccount.name }} {{- else }} -{{- default "default" .Values.app.serviceAccount.name }} +{{- default "default" (index .Values "br-sta").serviceAccount.name }} {{- end }} {{- end }} @@ -183,11 +183,11 @@ operator input for optional integrations that have been toggled on (multi-tenant or app.secrets.POSTGRES_PASSWORD. The same reasoning applies to Valkey. */}} {{/* Multi-tenant required fields when enabled */}} -{{- if eq (.Values.app.configmap.MULTI_TENANT_ENABLED | toString) "true" }} -{{- if not .Values.app.configmap.MULTI_TENANT_URL }} +{{- if eq ((index .Values "br-sta").configmap.MULTI_TENANT_ENABLED | toString) "true" }} +{{- if not (index .Values "br-sta").configmap.MULTI_TENANT_URL }} {{- fail "\n\nERROR: app.configmap.MULTI_TENANT_URL is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} {{- end }} -{{- if not .Values.app.secrets.MULTI_TENANT_SERVICE_API_KEY }} +{{- if not (index .Values "br-sta").secrets.MULTI_TENANT_SERVICE_API_KEY }} {{- fail "\n\nERROR: app.secrets.MULTI_TENANT_SERVICE_API_KEY is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} {{- end }} {{- end }} diff --git a/charts/br-sta/templates/configmap.yaml b/charts/br-sta/templates/configmap.yaml index df617795..77d45294 100644 --- a/charts/br-sta/templates/configmap.yaml +++ b/charts/br-sta/templates/configmap.yaml @@ -1,3 +1,4 @@ +{{- $component := index .Values "br-sta" -}} apiVersion: v1 kind: ConfigMap metadata: @@ -7,7 +8,7 @@ metadata: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} data: # Application environment values - {{- range $key, $value := .Values.app.configmap }} + {{- range $key, $value := $component.configmap }} {{- if and (ne $key "POSTGRES_HOST") (ne $key "REDIS_HOST") (ne $key "RABBITMQ_HOST") }} {{ $key }}: {{ $value | quote }} {{- end }} @@ -18,8 +19,8 @@ data: # in-cluster Postgres is enabled. The subchart exposes the primary Service at # "-primary" in replication architecture and at "" # in standalone architecture. - {{- if .Values.app.configmap.POSTGRES_HOST }} - POSTGRES_HOST: {{ .Values.app.configmap.POSTGRES_HOST | quote }} + {{- if $component.configmap.POSTGRES_HOST }} + POSTGRES_HOST: {{ $component.configmap.POSTGRES_HOST | quote }} {{- else if eq (include "postgresql.enabled" .) "true" }} {{- $pgArch := default "standalone" .Values.postgresql.architecture }} {{- $pgFullname := include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" (index .Values "postgresql") "context" .) }} @@ -36,8 +37,8 @@ data: # Explicit value wins; otherwise derive the bundled Valkey subchart's primary # Service (collapse-aware) when in-cluster Valkey is enabled. Bitnami Valkey # exposes its primary Service at "-primary". - {{- if .Values.app.configmap.REDIS_HOST }} - REDIS_HOST: {{ .Values.app.configmap.REDIS_HOST | quote }} + {{- if $component.configmap.REDIS_HOST }} + REDIS_HOST: {{ $component.configmap.REDIS_HOST | quote }} {{- else if eq (include "valkey.enabled" .) "true" }} {{- $vkFullname := include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" (index .Values "valkey") "context" .) }} REDIS_HOST: {{ printf "%s-primary.%s.svc.cluster.local:6379" $vkFullname (include "global.namespace" .) | quote }} @@ -48,8 +49,8 @@ data: # RabbitMQ host: explicit value wins; otherwise, when the bundled broker is # enabled, derive the groundhog2k Service name "-rabbitmq" (that # subchart names its Service after the release, not collapse-aware Bitnami). - {{- if .Values.app.configmap.RABBITMQ_HOST }} - RABBITMQ_HOST: {{ .Values.app.configmap.RABBITMQ_HOST | quote }} + {{- if $component.configmap.RABBITMQ_HOST }} + RABBITMQ_HOST: {{ $component.configmap.RABBITMQ_HOST | quote }} {{- else if eq (include "rabbitmq.enabled" .) "true" }} RABBITMQ_HOST: {{ printf "%s-rabbitmq.%s.svc.cluster.local" .Release.Name (include "global.namespace" .) | quote }} {{- else }} @@ -61,6 +62,6 @@ data: OTEL_RESOURCE_SERVICE_VERSION: {{ include "br-sta.defaultTag" . | quote }} # Extra environment variables (passthrough from values.app.extraEnvVars) - {{- with .Values.app.extraEnvVars }} + {{- with $component.extraEnvVars }} {{- toYaml . | nindent 2 }} {{- end }} diff --git a/charts/br-sta/templates/deployment.yaml b/charts/br-sta/templates/deployment.yaml index 7744b142..9aa1697f 100644 --- a/charts/br-sta/templates/deployment.yaml +++ b/charts/br-sta/templates/deployment.yaml @@ -1,3 +1,4 @@ +{{- $component := index .Values "br-sta" -}} {{- include "br-sta.validateRequired" . }} apiVersion: apps/v1 kind: Deployment @@ -6,19 +7,19 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} - {{- with .Values.app.annotations }} + {{- with $component.annotations }} annotations: {{- range $key, $value := . }} {{ $key }}: {{ $value | quote }} {{- end }} {{- end }} spec: - revisionHistoryLimit: {{ .Values.app.revisionHistoryLimit | default 10 }} - {{- with .Values.app.deploymentStrategy }} + revisionHistoryLimit: {{ $component.revisionHistoryLimit | default 10 }} + {{- with $component.deploymentStrategy }} strategy: {{- toYaml . | nindent 4 }} {{- end }} - replicas: {{ .Values.app.replicaCount }} + replicas: {{ $component.replicaCount }} selector: matchLabels: {{- include "br-sta.selectorLabels" (dict "context" .) | nindent 6 }} @@ -26,24 +27,24 @@ spec: metadata: labels: {{- include "br-sta.labels" (dict "context" .) | nindent 8 }} - {{- with .Values.app.podAnnotations }} + {{- with $component.podAnnotations }} annotations: {{- range $key, $value := . }} {{ $key }}: {{ $value | quote }} {{- end }} {{- end }} spec: - {{- with .Values.app.imagePullSecrets }} + {{- with $component.imagePullSecrets }} imagePullSecrets: {{- toYaml . | nindent 8 }} {{- end }} serviceAccountName: {{ include "br-sta.serviceAccountName" . }} - terminationGracePeriodSeconds: {{ .Values.app.terminationGracePeriodSeconds | default 60 }} - {{- with .Values.app.podSecurityContext }} + terminationGracePeriodSeconds: {{ $component.terminationGracePeriodSeconds | default 60 }} + {{- with $component.podSecurityContext }} securityContext: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.app.hostAliases }} + {{- with $component.hostAliases }} hostAliases: {{- toYaml . | nindent 8 }} {{- end }} @@ -81,25 +82,25 @@ spec: containers: - name: {{ include "br-sta.fullname" . }} securityContext: - {{- toYaml .Values.app.securityContext | nindent 12 }} - image: "{{ .Values.app.image.repository }}:{{ .Values.app.image.tag | default (include "br-sta.defaultTag" .) }}" - imagePullPolicy: {{ .Values.app.image.pullPolicy }} + {{- toYaml $component.securityContext | nindent 12 }} + image: "{{ $component.image.repository }}:{{ $component.image.tag | default (include "br-sta.defaultTag" .) }}" + imagePullPolicy: {{ $component.image.pullPolicy }} ports: - name: http - containerPort: {{ .Values.app.service.port }} + containerPort: {{ $component.service.port }} protocol: TCP envFrom: - configMapRef: name: {{ include "br-sta.fullname" . }} - secretRef: - name: {{ if .Values.app.useExistingSecret }}{{ .Values.app.existingSecretName }}{{ else }}{{ include "br-sta.fullname" . }}{{ end }} + name: {{ if $component.useExistingSecret }}{{ $component.existingSecretName }}{{ else }}{{ include "br-sta.fullname" . }}{{ end }} env: - {{- $secretName := ternary .Values.app.existingSecretName (include "br-sta.fullname" .) .Values.app.useExistingSecret }} + {{- $secretName := ternary $component.existingSecretName (include "br-sta.fullname" .) $component.useExistingSecret }} {{- $pg := .Values.postgresql | default dict }} {{- $pgAuth := $pg.auth | default dict }} {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} - {{- else if .Values.app.secrets.POSTGRES_PASSWORD }} + {{- else if $component.secrets.POSTGRES_PASSWORD }} - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: @@ -110,7 +111,7 @@ spec: {{- $vkAuth := $vk.auth | default dict }} {{- if or (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled) $vkAuth.existingSecret }} {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "valkey" "key" "valkey-password" "envName" "REDIS_PASSWORD") | nindent 12 }} - {{- else if .Values.app.secrets.REDIS_PASSWORD }} + {{- else if $component.secrets.REDIS_PASSWORD }} - name: REDIS_PASSWORD valueFrom: secretKeyRef: @@ -126,34 +127,34 @@ spec: value: "$(HOST_IP):4317" {{- end }} resources: - {{- toYaml .Values.app.resources | nindent 12 }} + {{- toYaml $component.resources | nindent 12 }} readinessProbe: httpGet: path: /health port: http - initialDelaySeconds: {{ .Values.app.readinessProbe.initialDelaySeconds | default 5 }} - periodSeconds: {{ .Values.app.readinessProbe.periodSeconds | default 5 }} - timeoutSeconds: {{ .Values.app.readinessProbe.timeoutSeconds | default 3 }} - successThreshold: {{ .Values.app.readinessProbe.successThreshold | default 1 }} - failureThreshold: {{ .Values.app.readinessProbe.failureThreshold | default 2 }} + initialDelaySeconds: {{ $component.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ $component.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ $component.readinessProbe.timeoutSeconds | default 3 }} + successThreshold: {{ $component.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $component.readinessProbe.failureThreshold | default 2 }} livenessProbe: httpGet: path: /health port: http - initialDelaySeconds: {{ .Values.app.livenessProbe.initialDelaySeconds | default 30 }} - periodSeconds: {{ .Values.app.livenessProbe.periodSeconds | default 10 }} - timeoutSeconds: {{ .Values.app.livenessProbe.timeoutSeconds | default 3 }} - successThreshold: {{ .Values.app.livenessProbe.successThreshold | default 1 }} - failureThreshold: {{ .Values.app.livenessProbe.failureThreshold | default 3 }} - {{- with .Values.app.nodeSelector }} + initialDelaySeconds: {{ $component.livenessProbe.initialDelaySeconds | default 30 }} + periodSeconds: {{ $component.livenessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $component.livenessProbe.timeoutSeconds | default 3 }} + successThreshold: {{ $component.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $component.livenessProbe.failureThreshold | default 3 }} + {{- with $component.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.app.affinity }} + {{- with $component.affinity }} affinity: {{- toYaml . | nindent 8 }} {{- end }} - {{- with .Values.app.tolerations }} + {{- with $component.tolerations }} tolerations: {{- toYaml . | nindent 8 }} {{- end }} diff --git a/charts/br-sta/templates/hpa.yaml b/charts/br-sta/templates/hpa.yaml index cc6afca7..61f14a92 100644 --- a/charts/br-sta/templates/hpa.yaml +++ b/charts/br-sta/templates/hpa.yaml @@ -1,4 +1,5 @@ -{{- if .Values.app.autoscaling.enabled }} +{{- $component := index .Values "br-sta" -}} +{{- if $component.autoscaling.enabled }} apiVersion: autoscaling/v2 kind: HorizontalPodAutoscaler metadata: @@ -11,26 +12,26 @@ spec: apiVersion: apps/v1 kind: Deployment name: {{ include "br-sta.fullname" . }} - minReplicas: {{ .Values.app.autoscaling.minReplicas }} - maxReplicas: {{ .Values.app.autoscaling.maxReplicas }} + minReplicas: {{ $component.autoscaling.minReplicas }} + maxReplicas: {{ $component.autoscaling.maxReplicas }} metrics: - {{- if .Values.app.autoscaling.targetCPUUtilizationPercentage }} + {{- if $component.autoscaling.targetCPUUtilizationPercentage }} - type: Resource resource: name: cpu target: type: Utilization - averageUtilization: {{ .Values.app.autoscaling.targetCPUUtilizationPercentage }} + averageUtilization: {{ $component.autoscaling.targetCPUUtilizationPercentage }} {{- end }} - {{- if .Values.app.autoscaling.targetMemoryUtilizationPercentage }} + {{- if $component.autoscaling.targetMemoryUtilizationPercentage }} - type: Resource resource: name: memory target: type: Utilization - averageUtilization: {{ .Values.app.autoscaling.targetMemoryUtilizationPercentage }} + averageUtilization: {{ $component.autoscaling.targetMemoryUtilizationPercentage }} {{- end }} behavior: scaleDown: - stabilizationWindowSeconds: {{ .Values.app.autoscaling.scaleDownStabilizationSeconds | default 300 }} + stabilizationWindowSeconds: {{ $component.autoscaling.scaleDownStabilizationSeconds | default 300 }} {{- end }} diff --git a/charts/br-sta/templates/ingress.yaml b/charts/br-sta/templates/ingress.yaml index 69355692..18828d1e 100644 --- a/charts/br-sta/templates/ingress.yaml +++ b/charts/br-sta/templates/ingress.yaml @@ -1,9 +1,10 @@ -{{- if .Values.app.ingress.enabled -}} +{{- $component := index .Values "br-sta" -}} +{{- if $component.ingress.enabled -}} {{- $fullName := include "br-sta.fullname" . -}} -{{- $svcPort := .Values.app.service.port -}} -{{- if and .Values.app.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} - {{- if not (hasKey .Values.app.ingress.annotations "kubernetes.io/ingress.class") }} - {{- $_ := set .Values.app.ingress.annotations "kubernetes.io/ingress.class" .Values.app.ingress.className }} +{{- $svcPort := $component.service.port -}} +{{- if and $component.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey $component.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set $component.ingress.annotations "kubernetes.io/ingress.class" $component.ingress.className }} {{- end }} {{- end }} {{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} @@ -19,17 +20,17 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} - {{- with .Values.app.ingress.annotations }} + {{- with $component.ingress.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} spec: - {{- if and .Values.app.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} - ingressClassName: {{ .Values.app.ingress.className }} + {{- if and $component.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ $component.ingress.className }} {{- end }} - {{- if .Values.app.ingress.tls }} + {{- if $component.ingress.tls }} tls: - {{- range .Values.app.ingress.tls }} + {{- range $component.ingress.tls }} - hosts: {{- range .hosts }} - {{ . | quote }} @@ -38,7 +39,7 @@ spec: {{- end }} {{- end }} rules: - {{- range .Values.app.ingress.hosts }} + {{- range $component.ingress.hosts }} - host: {{ .host | quote }} http: paths: diff --git a/charts/br-sta/templates/pdb.yaml b/charts/br-sta/templates/pdb.yaml index 57c5bd60..00868253 100644 --- a/charts/br-sta/templates/pdb.yaml +++ b/charts/br-sta/templates/pdb.yaml @@ -1,4 +1,5 @@ -{{- if .Values.app.pdb.enabled }} +{{- $component := index .Values "br-sta" -}} +{{- if $component.pdb.enabled }} apiVersion: policy/v1 kind: PodDisruptionBudget metadata: @@ -6,17 +7,17 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} - {{- with .Values.app.pdb.annotations }} + {{- with $component.pdb.annotations }} annotations: {{- range $key, $value := . }} {{ $key }}: {{ $value | quote }} {{- end }} {{- end }} spec: - {{- if .Values.app.pdb.maxUnavailable }} - maxUnavailable: {{ .Values.app.pdb.maxUnavailable }} + {{- if $component.pdb.maxUnavailable }} + maxUnavailable: {{ $component.pdb.maxUnavailable }} {{- else }} - minAvailable: {{ .Values.app.pdb.minAvailable | default 1 }} + minAvailable: {{ $component.pdb.minAvailable | default 1 }} {{- end }} selector: matchLabels: diff --git a/charts/br-sta/templates/secrets.yaml b/charts/br-sta/templates/secrets.yaml index 544d9f49..3b017e2b 100644 --- a/charts/br-sta/templates/secrets.yaml +++ b/charts/br-sta/templates/secrets.yaml @@ -1,4 +1,5 @@ -{{- if not .Values.app.useExistingSecret }} +{{- $component := index .Values "br-sta" -}} +{{- if not $component.useExistingSecret }} apiVersion: v1 kind: Secret metadata: @@ -16,7 +17,7 @@ metadata: {{- end }} type: Opaque stringData: - {{- range $key, $value := .Values.app.secrets }} + {{- range $key, $value := $component.secrets }} {{- if $value }} {{ $key }}: {{ $value | toString | quote }} {{- end }} diff --git a/charts/br-sta/templates/service.yaml b/charts/br-sta/templates/service.yaml index 52fc97bd..48ccfd2f 100644 --- a/charts/br-sta/templates/service.yaml +++ b/charts/br-sta/templates/service.yaml @@ -1,3 +1,4 @@ +{{- $component := index .Values "br-sta" -}} apiVersion: v1 kind: Service metadata: @@ -5,16 +6,16 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} - {{- with .Values.app.service.annotations }} + {{- with $component.service.annotations }} annotations: {{- range $key, $value := . }} {{ $key }}: {{ $value | quote }} {{- end }} {{- end }} spec: - type: {{ .Values.app.service.type }} + type: {{ $component.service.type }} ports: - - port: {{ .Values.app.service.port }} + - port: {{ $component.service.port }} targetPort: http protocol: TCP name: http diff --git a/charts/br-sta/templates/serviceaccount.yaml b/charts/br-sta/templates/serviceaccount.yaml index 41a3fd31..9fd7bce6 100644 --- a/charts/br-sta/templates/serviceaccount.yaml +++ b/charts/br-sta/templates/serviceaccount.yaml @@ -1,4 +1,5 @@ -{{- if .Values.app.serviceAccount.create }} +{{- $component := index .Values "br-sta" -}} +{{- if $component.serviceAccount.create }} apiVersion: v1 kind: ServiceAccount metadata: @@ -6,7 +7,7 @@ metadata: namespace: {{ include "global.namespace" . }} labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} - {{- with .Values.app.serviceAccount.annotations }} + {{- with $component.serviceAccount.annotations }} annotations: {{- toYaml . | nindent 4 }} {{- end }} diff --git a/charts/br-sta/values.schema.json b/charts/br-sta/values.schema.json index 6ad7a287..56a0a3b8 100644 --- a/charts/br-sta/values.schema.json +++ b/charts/br-sta/values.schema.json @@ -16,18 +16,6 @@ "type": "object", "additionalProperties": true }, - "app": { - "type": "object", - "properties": { - "configmap": { - "type": "object" - }, - "secrets": { - "type": "object" - } - }, - "additionalProperties": true - }, "postgresql": { "type": "object", "additionalProperties": true @@ -46,6 +34,14 @@ }, "br-sta": { "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, "additionalProperties": true } } diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index b4ae39bf..27cd69fe 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -45,7 +45,7 @@ global: # APPLICATION # Single Deployment running the /service binary (Go/Fiber HTTP server). # ============================================================================== -app: +br-sta: # -- Service name name: "br-sta" # -- Number of replicas @@ -485,7 +485,3 @@ rabbitmq: otel-collector-lerian: enabled: false -# Tag at end of file for image-update tooling. -br-sta: - image: - tag: "1.0.0-beta.5" From f8b02f5154ee80224b5f1b6a9762ee7cc266ccee Mon Sep 17 00:00:00 2001 From: arthurkz Date: Tue, 7 Jul 2026 09:43:03 -0300 Subject: [PATCH 030/113] feat(br-sta): add background worker Deployment MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add a second Deployment that runs the cmd/worker binary for br-sta's background jobs (audit outbox publisher/consumer, leader-gated scheduler for credential rotation/retention/stale-protocol cleanup, and the credential-recovery-on-boot sweep). Previously the chart deployed only the manager, so those jobs never ran. The worker runs the SAME published image as the manager via a command override (command: [/worker]) — the image ships both binaries. It reuses the manager ConfigMap + Secret via envFrom for all shared infra config (Postgres/Redis/RabbitMQ/S3/master keys) and layers worker-only knobs on top. It serves only the probe endpoints (WorkerMode), gets its own app.kubernetes.io/name so its selector never overlaps the manager's, and defaults to a single replica (no leader election yet — do not scale out). Requires a br-sta image built from the multi-binary Dockerfile; older single-binary images have no /worker and CrashLoop on command:[/worker]. - templates/worker/{deployment,configmap,serviceaccount}.yaml (new) - _helpers.tpl: worker name/label/selector/SA helpers - values.yaml: worker block (enabled, probes, resources, audit/scheduler env) - Chart.yaml: chart-type single-service -> multi-component, 1.0.0 -> 1.1.0, appVersion -> 1.0.0-beta.32 --- charts/br-sta/Chart.yaml | 8 +- charts/br-sta/templates/_helpers.tpl | 59 ++++++ charts/br-sta/templates/worker/configmap.yaml | 22 ++ .../br-sta/templates/worker/deployment.yaml | 188 ++++++++++++++++++ .../templates/worker/serviceaccount.yaml | 17 ++ charts/br-sta/values.yaml | 123 ++++++++++++ 6 files changed, 413 insertions(+), 4 deletions(-) create mode 100644 charts/br-sta/templates/worker/configmap.yaml create mode 100644 charts/br-sta/templates/worker/deployment.yaml create mode 100644 charts/br-sta/templates/worker/serviceaccount.yaml diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index 8455727b..72a78ee6 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -1,10 +1,10 @@ apiVersion: v2 name: br-sta-helm description: A Helm chart for br-sta, a Lerian Studio Go/Fiber HTTP service - backed by PostgreSQL and Redis/Valkey. + (manager) plus its background worker, backed by PostgreSQL and Redis/Valkey. type: application annotations: - lerian.studio/chart-type: single-service + lerian.studio/chart-type: multi-component home: https://github.com/LerianStudio/br-sta sources: - https://github.com/LerianStudio/helm/tree/main/charts/br-sta @@ -15,10 +15,10 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.0.0 +version: 1.1.0 # This is the version number of the application being deployed. -appVersion: "1.0.0-beta.5" +appVersion: "1.0.0-beta.32" # A list of keywords about the chart. This helps others discover the chart. keywords: diff --git a/charts/br-sta/templates/_helpers.tpl b/charts/br-sta/templates/_helpers.tpl index fb2ebe45..86cf85b8 100644 --- a/charts/br-sta/templates/_helpers.tpl +++ b/charts/br-sta/templates/_helpers.tpl @@ -95,6 +95,65 @@ SERVICE ACCOUNT HELPER {{- end }} {{- end }} +{{/* +================================================================================ +WORKER HELPERS +================================================================================ +The worker is a SECOND Deployment running the /worker binary (background jobs: +audit publisher/consumer, scheduler, credential-recovery sweep, inbound poll). +It reuses the manager's ConfigMap + Secret (all shared infra config) and layers +worker-only env on top. It gets its OWN app.kubernetes.io/name so its selector +never overlaps the manager's (selectors are immutable across upgrades). +================================================================================ +*/}} + +{{/* Worker resource name: "-worker". */}} +{{- define "br-sta.worker.fullname" -}} +{{- printf "%s-worker" (include "br-sta.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* Worker app name (distinct from the manager so selectors don't overlap). */}} +{{- define "br-sta.worker.name" -}} +{{- printf "%s-worker" (include "br-sta.name" .) | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* Worker selector labels — distinct name keeps the two Deployments apart. */}} +{{- define "br-sta.worker.selectorLabels" -}} +app.kubernetes.io/name: {{ include "br-sta.worker.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- end }} + +{{/* Worker common labels. */}} +{{- define "br-sta.worker.labels" -}} +helm.sh/chart: {{ include "br-sta.chart" .context }} +{{ include "br-sta.worker.selectorLabels" (dict "context" .context) }} +app.kubernetes.io/version: {{ include "br-sta.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +app.kubernetes.io/part-of: br-sta +app.kubernetes.io/component: worker +{{- end }} + +{{/* Worker ServiceAccount name (own SA, or reuse the manager's when not creating). */}} +{{- define "br-sta.worker.serviceAccountName" -}} +{{- $w := .Values.worker | default dict -}} +{{- $sa := $w.serviceAccount | default dict -}} +{{- if $sa.create }} +{{- default (include "br-sta.worker.fullname" .) $sa.name }} +{{- else }} +{{- default (include "br-sta.serviceAccountName" .) $sa.name }} +{{- end }} +{{- end }} + +{{/* Worker enabled — nil-aware: unset/true enables, explicit false disables. */}} +{{- define "br-sta.worker.enabled" -}} +{{- $w := .Values.worker | default dict -}} +{{- if ne (toString $w.enabled) "false" -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + {{/* ================================================================================ NAMESPACE HELPER diff --git a/charts/br-sta/templates/worker/configmap.yaml b/charts/br-sta/templates/worker/configmap.yaml new file mode 100644 index 00000000..fc334e32 --- /dev/null +++ b/charts/br-sta/templates/worker/configmap.yaml @@ -0,0 +1,22 @@ +{{- if eq (include "br-sta.worker.enabled" .) "true" }} +{{- $w := .Values.worker | default dict -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-sta.worker.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.worker.labels" (dict "context" .) | nindent 4 }} +data: + # Worker-only environment. Layered on top of the manager ConfigMap + Secret + # (envFrom order in the worker Deployment), so keys here win over shared ones. + # The worker binds SERVER_ADDRESS only for its probe server (WorkerMode). + SERVER_ADDRESS: {{ printf "0.0.0.0:%v" ($w.service.port | default 8081) | quote }} + {{- with $w.configmap }} + {{- range $key, $value := . }} + {{- if ne $key "SERVER_ADDRESS" }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/templates/worker/deployment.yaml b/charts/br-sta/templates/worker/deployment.yaml new file mode 100644 index 00000000..c28c1079 --- /dev/null +++ b/charts/br-sta/templates/worker/deployment.yaml @@ -0,0 +1,188 @@ +{{- if eq (include "br-sta.worker.enabled" .) "true" }} +{{- $mgr := index .Values "br-sta" -}} +{{- $w := .Values.worker | default dict -}} +{{- $wImage := $w.image | default dict -}} +{{- $repo := $wImage.repository | default $mgr.image.repository -}} +{{- $tag := $wImage.tag | default (include "br-sta.defaultTag" .) -}} +{{- $pullPolicy := $wImage.pullPolicy | default $mgr.image.pullPolicy -}} +{{- $pullSecrets := $w.imagePullSecrets | default $mgr.imagePullSecrets -}} +{{- $secCtx := $w.securityContext | default $mgr.securityContext -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "br-sta.worker.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.worker.labels" (dict "context" .) | nindent 4 }} + {{- with $w.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + revisionHistoryLimit: {{ $w.revisionHistoryLimit | default 10 }} + {{- with $w.deploymentStrategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + # The worker is leader-gated but does NOT run its own leader election yet; + # keep this at 1 to avoid duplicate background processing (audit drain, + # scheduler, inbound poll). Do NOT add an HPA to the worker. + replicas: {{ $w.replicaCount | default 1 }} + selector: + matchLabels: + {{- include "br-sta.worker.selectorLabels" (dict "context" .) | nindent 6 }} + template: + metadata: + labels: + {{- include "br-sta.worker.labels" (dict "context" .) | nindent 8 }} + {{- with $w.podAnnotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + spec: + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "br-sta.worker.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds | default 60 }} + {{- with $w.podSecurityContext }} + securityContext: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $w.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if or (eq (include "postgresql.enabled" .) "true") (eq (include "valkey.enabled" .) "true") }} + initContainers: + - name: wait-for-infra + image: busybox:1.37 + envFrom: + # POSTGRES_HOST / REDIS_HOST live in the manager ConfigMap. + - configMapRef: + name: {{ include "br-sta.fullname" . }} + command: + - /bin/sh + - -c + - > + {{- if eq (include "postgresql.enabled" .) "true" }} + echo "Waiting for PostgreSQL $POSTGRES_HOST:$POSTGRES_PORT..."; + until nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do + echo "$POSTGRES_HOST:$POSTGRES_PORT not ready, sleeping 5s"; + sleep 5; + done; + echo "PostgreSQL is ready"; + {{- end }} + {{- if eq (include "valkey.enabled" .) "true" }} + REDIS_SVC=$(echo "$REDIS_HOST" | cut -d: -f1); + REDIS_PORT_NUM=$(echo "$REDIS_HOST" | cut -d: -f2); + [ -z "$REDIS_PORT_NUM" ] && REDIS_PORT_NUM=6379; + echo "Waiting for Redis/Valkey $REDIS_SVC:$REDIS_PORT_NUM..."; + until nc -z "$REDIS_SVC" "$REDIS_PORT_NUM"; do + echo "$REDIS_SVC:$REDIS_PORT_NUM not ready, sleeping 5s"; + sleep 5; + done; + echo "Redis/Valkey is ready"; + {{- end }} + {{- end }} + containers: + - name: {{ include "br-sta.worker.fullname" . }} + securityContext: + {{- toYaml $secCtx | nindent 12 }} + image: "{{ $repo }}:{{ $tag }}" + imagePullPolicy: {{ $pullPolicy }} + # Same image as the manager; run the worker binary baked into it. + command: + {{- toYaml ($w.command | default (list "/worker")) | nindent 12 }} + ports: + - name: http + containerPort: {{ $w.service.port | default 8081 }} + protocol: TCP + envFrom: + # Shared config + secrets from the manager (single source of truth). + - configMapRef: + name: {{ include "br-sta.fullname" . }} + - secretRef: + name: {{ if $mgr.useExistingSecret }}{{ $mgr.existingSecretName }}{{ else }}{{ include "br-sta.fullname" . }}{{ end }} + # Worker-only overrides (SERVER_ADDRESS, background-job knobs) — last + # so its keys win over the shared manager ConfigMap. + - configMapRef: + name: {{ include "br-sta.worker.fullname" . }} + env: + {{- $secretName := ternary $mgr.existingSecretName (include "br-sta.fullname" .) $mgr.useExistingSecret }} + {{- $pg := .Values.postgresql | default dict }} + {{- $pgAuth := $pg.auth | default dict }} + {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} + {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} + {{- else if $mgr.secrets.POSTGRES_PASSWORD }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + {{- end }} + {{- $vk := .Values.valkey | default dict }} + {{- $vkAuth := $vk.auth | default dict }} + {{- if or (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled) $vkAuth.existingSecret }} + {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "valkey" "key" "valkey-password" "envName" "REDIS_PASSWORD") | nindent 12 }} + {{- else if $mgr.secrets.REDIS_PASSWORD }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: REDIS_PASSWORD + {{- end }} + {{- if (index .Values "otel-collector-lerian").enabled }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + {{- with $w.extraEnvVars }} + {{- range $key, $value := . }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- end }} + resources: + {{- toYaml ($w.resources | default $mgr.resources) | nindent 12 }} + # The worker binary runs in WorkerMode: it serves ONLY the probe + # endpoints on SERVER_ADDRESS (no business HTTP API). + readinessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: {{ (($w.readinessProbe).initialDelaySeconds) | default 5 }} + periodSeconds: {{ (($w.readinessProbe).periodSeconds) | default 5 }} + timeoutSeconds: {{ (($w.readinessProbe).timeoutSeconds) | default 3 }} + successThreshold: {{ (($w.readinessProbe).successThreshold) | default 1 }} + failureThreshold: {{ (($w.readinessProbe).failureThreshold) | default 2 }} + livenessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: {{ (($w.livenessProbe).initialDelaySeconds) | default 30 }} + periodSeconds: {{ (($w.livenessProbe).periodSeconds) | default 10 }} + timeoutSeconds: {{ (($w.livenessProbe).timeoutSeconds) | default 3 }} + successThreshold: {{ (($w.livenessProbe).successThreshold) | default 1 }} + failureThreshold: {{ (($w.livenessProbe).failureThreshold) | default 3 }} + {{- with $w.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $w.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $w.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/templates/worker/serviceaccount.yaml b/charts/br-sta/templates/worker/serviceaccount.yaml new file mode 100644 index 00000000..2bec051e --- /dev/null +++ b/charts/br-sta/templates/worker/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if eq (include "br-sta.worker.enabled" .) "true" }} +{{- $w := .Values.worker | default dict -}} +{{- $sa := $w.serviceAccount | default dict -}} +{{- if $sa.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "br-sta.worker.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-sta.worker.labels" (dict "context" .) | nindent 4 }} + {{- with $sa.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index 27cd69fe..812ecb69 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -334,6 +334,129 @@ br-sta: annotations: {} name: "" +# ============================================================================== +# WORKER +# Second Deployment running the /worker binary from the SAME image as the +# manager (command override — both binaries ship in one image). It runs the +# background jobs: audit outbox publisher/consumer, the leader-gated scheduler +# (credential expiry/rotation, retention, stale-protocol cleanup), the +# credential-recovery-on-boot sweep, and the inbound BACEN poll loop. It serves +# ONLY the probe endpoints (WorkerMode — no business HTTP API), reuses the +# manager ConfigMap + Secret for all shared infra config, and layers the +# worker-only knobs below on top. +# ============================================================================== +worker: + # -- Enable the worker Deployment. REQUIRES a br-sta image that ships BOTH + # binaries (manager /service + worker /worker in one image, from the + # multi-binary Dockerfile). Older single-binary images have no /worker and + # the pod will CrashLoop on command:[/worker]; keep this false until such an + # image is published. + enabled: true + # -- Replicas. The background jobs are leader-gated but the worker does NOT + # run its own leader election yet — keep this at 1 (and do not add an HPA) to + # avoid duplicate processing. + replicaCount: 1 + # -- Number of old ReplicaSets to retain for rollback + revisionHistoryLimit: 10 + # -- Annotations applied to the Deployment resource + annotations: {} + # -- Annotations applied to the pods + podAnnotations: {} + # -- Worker image. Empty repository/tag inherit the manager image (same + # published image carries both binaries); override only to pin separately. + image: + repository: "" + tag: "" + pullPolicy: IfNotPresent + # -- Image pull secrets (empty inherits the manager's) + imagePullSecrets: [] + # -- Container command — the worker binary baked into the shared image + command: + - /worker + # -- Termination grace period + terminationGracePeriodSeconds: 60 + # -- Pod security context + podSecurityContext: {} + # -- Container security context (empty inherits the manager's) + securityContext: {} + # -- ServiceAccount configuration + serviceAccount: + create: true + annotations: {} + name: "" + # -- Probe server port. WorkerMode binds SERVER_ADDRESS here; no Service or + # Ingress is created for the worker. + service: + port: 8081 + # -- Resource requests and limits + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + # -- Deployment strategy + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 0 + # -- Readiness probe configuration + readinessProbe: + initialDelaySeconds: 5 + periodSeconds: 5 + timeoutSeconds: 3 + successThreshold: 1 + failureThreshold: 2 + # -- Liveness probe configuration + livenessProbe: + initialDelaySeconds: 30 + periodSeconds: 10 + timeoutSeconds: 3 + successThreshold: 1 + failureThreshold: 3 + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + # -- Tolerations for scheduling on tainted nodes + tolerations: [] + # -- Affinity rules for pod scheduling + affinity: {} + # -- Host aliases for custom DNS resolution inside the pod + hostAliases: [] + # -- Worker-only environment (layered on top of the manager ConfigMap/Secret). + # SetConfigFromEnvVars ignores envDefault, so every knob a background job + # needs must be set explicitly. SERVER_ADDRESS is derived from service.port. + # @default -- templates/worker/configmap.yaml + configmap: + # OTEL identity for the worker process + OTEL_RESOURCE_SERVICE_NAME: "br-sta-worker" + # Leader-gated scheduler (credential expiry/rotation, retention, cleanup) + SCHEDULER_ENABLED: "true" + # Resolve credentials left mid-rotation by a prior worker death, at boot + CREDENTIALS_RECOVERY_ON_BOOT: "true" + # Audit outbox publisher (drains audit_outbox -> sta.audit.events). + # Requires the shared RABBITMQ_ENABLED="true". + AUDIT_PUBLISHER_ENABLED: "true" + AUDIT_PUBLISHER_INTERVAL_SEC: "2" + AUDIT_PUBLISHER_BATCH_SIZE: "100" + AUDIT_PUBLISHER_MAX_ATTEMPTS: "10" + AUDIT_PUBLISHER_EXCHANGE: "sta.audit.events" + AUDIT_PUBLISHER_LOCK_CLASS_ID: "7700" + AUDIT_PUBLISHER_SERVICE_NAME: "br-sta-worker" + # Audit consumer (writes hash-chained rows into the audit log tables) + AUDIT_CONSUMER_ENABLED: "true" + AUDIT_CONSUMER_QUEUE: "br-sta.audit.consume" + AUDIT_CONSUMER_EXCHANGE: "sta.audit.events" + AUDIT_CONSUMER_DEDUP_TTL_SEC: "5" + AUDIT_CONSUMER_LOCK_CLASS_ID: "7701" + AUDIT_CONSUMER_MAX_RETRY_ATTEMPTS: "10" + AUDIT_CONSUMER_DLQ_EXCHANGE: "sta.audit.dlq" + AUDIT_CONSUMER_SERVICE_NAME: "br-sta-worker" + # -- Extra environment variables (map of key:value pairs) rendered as inline + # container env (wins over both ConfigMaps). + extraEnvVars: {} + # ============================================================================== # POSTGRESQL SUB-CHART (Bitnami) # Default: enabled with replication for in-cluster development/staging. From 4dfe5ba2d15f5e59c9065a65e58a6093de73ca98 Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Tue, 7 Jul 2026 11:57:10 -0300 Subject: [PATCH 031/113] feat(plugin-br-pix-indirect-btg): add schedule (pix recurrence) worker --- .../plugin-br-pix-indirect-btg/CHANGELOG.md | 10 ++ charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- .../templates/_helpers.tpl | 41 +++++++ .../templates/schedule/configmap.yaml | 44 +++++++ .../templates/schedule/deployment.yaml | 82 +++++++++++++ .../templates/schedule/hpa.yaml | 35 ++++++ .../templates/schedule/pdb.yaml | 23 ++++ .../templates/schedule/secrets.yaml | 15 +++ .../templates/schedule/service.yaml | 15 +++ .../values.schema.json | 12 ++ charts/plugin-br-pix-indirect-btg/values.yaml | 114 ++++++++++++++++++ 11 files changed, 392 insertions(+), 1 deletion(-) create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/hpa.yaml create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/pdb.yaml create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/secrets.yaml create mode 100644 charts/plugin-br-pix-indirect-btg/templates/schedule/service.yaml diff --git a/charts/plugin-br-pix-indirect-btg/CHANGELOG.md b/charts/plugin-br-pix-indirect-btg/CHANGELOG.md index ed83f113..a78804b6 100644 --- a/charts/plugin-br-pix-indirect-btg/CHANGELOG.md +++ b/charts/plugin-br-pix-indirect-btg/CHANGELOG.md @@ -1,5 +1,15 @@ # Plugin-br-pix-indirect-btg Changelog +## [3.4.0](https://github.com/LerianStudio/helm/releases/tag/plugin-br-pix-indirect-btg-v3.4.0) + +- **Features:** + - Added the `schedule` (Pix recurrence) worker: new `schedule` values section, Deployment, Service, ConfigMap, Secret, HPA and PDB templates, mirroring the reconciliation worker. + - The worker listens on port 4018 with probes on `/health` (liveness) and `/readyz` (readiness) and ships dormant (`SCHEDULE_WORKER_ENABLED=false`). + +[Compare changes](https://github.com/LerianStudio/helm/compare/plugin-br-pix-indirect-btg-v3.3.1...plugin-br-pix-indirect-btg-v3.4.0) + +--- + ## [3.3.1](https://github.com/LerianStudio/helm/releases/tag/plugin-br-pix-indirect-btg-v3.3.1) - Fixes: diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index e034593b..a8a4695e 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.3.1 +version: 3.4.0 # This is the version number of the application being deployed. appVersion: "1.7.5" # A list of keywords about the chart. This helps others discover the chart. diff --git a/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl b/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl index 43678b6b..539a352f 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl +++ b/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl @@ -41,6 +41,13 @@ Expand the name for reconciliation worker. {{- default "plugin-br-pix-indirect-btg-worker-reconciliation" .Values.reconciliation.name | trunc 63 | trimSuffix "-" }} {{- end }} +{{/* +Expand the name for schedule worker. +*/}} +{{- define "schedule.name" -}} +{{- default "plugin-br-pix-indirect-btg-worker-schedule" .Values.schedule.name | trunc 63 | trimSuffix "-" }} +{{- end }} + {{/* ================================================================================ FULLNAME HELPERS @@ -80,6 +87,13 @@ Create a default fully qualified app name for reconciliation worker. {{- default "plugin-br-pix-indirect-btg-worker-reconciliation" .Values.reconciliation.name | trunc 63 | trimSuffix "-" }} {{- end }} +{{/* +Create a default fully qualified app name for schedule worker. +*/}} +{{- define "schedule.fullname" -}} +{{- default "plugin-br-pix-indirect-btg-worker-schedule" .Values.schedule.name | trunc 63 | trimSuffix "-" }} +{{- end }} + {{/* ================================================================================ CHART HELPERS @@ -114,6 +128,13 @@ Create chart name for reconciliation. {{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} {{- end }} +{{/* +Create chart name for schedule. +*/}} +{{- define "schedule.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + {{/* Create app version. */}} @@ -167,6 +188,16 @@ app.kubernetes.io/version: {{ include "plugin.version" .context }} app.kubernetes.io/managed-by: {{ .context.Release.Service }} {{- end }} +{{/* +Common labels for schedule +*/}} +{{- define "schedule.labels" -}} +helm.sh/chart: {{ include "schedule.chart" .context }} +{{ include "schedule.selectorLabels" (dict "context" .context "name" .name) }} +app.kubernetes.io/version: {{ include "plugin.version" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +{{- end }} + {{/* ================================================================================ SELECTOR LABEL HELPERS @@ -216,6 +247,16 @@ app.kubernetes.io/name: {{ include "reconciliation.name" .context }} app.kubernetes.io/instance: {{ .context.Release.Name }} {{- end }} +{{/* +Selector labels for schedule +*/}} +{{- define "schedule.selectorLabels" -}} +{{- if .name -}} +app.kubernetes.io/name: {{ include "schedule.name" .context }} +{{- end }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- end }} + {{/* ================================================================================ SERVICE ACCOUNT HELPER diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml new file mode 100644 index 00000000..077c1445 --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml @@ -0,0 +1,44 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} +data: + ENV_NAME: {{ .Values.schedule.configmap.ENV_NAME | default "development" | quote }} + VERSION: {{ .Values.schedule.image.tag | default .Chart.AppVersion | quote }} + LOG_LEVEL: {{ .Values.schedule.configmap.LOG_LEVEL | default "info" | quote }} + WORKER_PORT: {{ .Values.schedule.configmap.WORKER_PORT | default "4018" | quote }} + + # Schedule Worker Loop Configuration + # Ships dormant: SCHEDULE_WORKER_ENABLED=false. The orchestrator only starts the + # polling loop when this is flipped to true, so the worker can be deployed and + # enabled by config alone. + SCHEDULE_WORKER_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_ENABLED | default "false" | quote }} + SCHEDULE_WORKER_INTERVAL: {{ .Values.schedule.configmap.SCHEDULE_WORKER_INTERVAL | default "15s" | quote }} + SCHEDULE_WORKER_BATCH_SIZE: {{ .Values.schedule.configmap.SCHEDULE_WORKER_BATCH_SIZE | default "50" | quote }} + SCHEDULE_WORKER_STALE_THRESHOLD: {{ .Values.schedule.configmap.SCHEDULE_WORKER_STALE_THRESHOLD | default "5m" | quote }} + SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: {{ .Values.schedule.configmap.SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES | default "10" | quote }} + SCHEDULE_WORKER_TIME_WINDOW_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_TIME_WINDOW_ENABLED | default "false" | quote }} + SCHEDULE_WORKER_WINDOW_START: {{ .Values.schedule.configmap.SCHEDULE_WORKER_WINDOW_START | default "" | quote }} + SCHEDULE_WORKER_WINDOW_END: {{ .Values.schedule.configmap.SCHEDULE_WORKER_WINDOW_END | default "" | quote }} + + # Application (DOMAIN API) Endpoint the worker drives over HTTP. + # SCHEDULE_APP_BASE_URL and PLUGIN_AUTH_URL are operator/Vault-provided per environment. + SCHEDULE_APP_BASE_URL: {{ .Values.schedule.configmap.SCHEDULE_APP_BASE_URL | default "http://plugin-br-pix-indirect-btg.midaz-plugins.svc.cluster.local:4014" | quote }} + SCHEDULE_APP_HTTP_TIMEOUT: {{ .Values.schedule.configmap.SCHEDULE_APP_HTTP_TIMEOUT | default "30s" | quote }} + PLUGIN_AUTH_URL: {{ .Values.schedule.configmap.PLUGIN_AUTH_URL | default "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000/v1/login/oauth/access_token" | quote }} + + # Observability Configuration + OTEL_RESOURCE_SERVICE_NAME: {{ .Values.schedule.configmap.OTEL_RESOURCE_SERVICE_NAME | default "schedule-worker" | quote }} + OTEL_LIBRARY_NAME: {{ .Values.schedule.configmap.OTEL_LIBRARY_NAME | default "schedule" | quote }} + OTEL_RESOURCE_SERVICE_VERSION: {{ .Values.schedule.image.tag | default .Chart.AppVersion | quote }} + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: {{ .Values.schedule.configmap.OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT | default "development" | quote }} + OTEL_EXPORTER_OTLP_ENDPOINT_PORT: {{ .Values.schedule.configmap.OTEL_EXPORTER_OTLP_ENDPOINT_PORT | default "4317" | quote }} + OTEL_EXPORTER_OTLP_ENDPOINT: {{ .Values.schedule.configmap.OTEL_EXPORTER_OTLP_ENDPOINT | default "http://midaz-otel-lgtm:4317" | quote }} + ENABLE_TELEMETRY: {{ .Values.schedule.configmap.ENABLE_TELEMETRY | default "false" | quote }} + + # Extra Env Vars + {{- with .Values.schedule.extraEnvVars }} + {{- toYaml . | nindent 2 }} + {{- end }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml new file mode 100644 index 00000000..d2a62f28 --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml @@ -0,0 +1,82 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} +spec: + revisionHistoryLimit: {{ .Values.schedule.revisionHistoryLimit | default 10 }} + strategy: + {{- toYaml .Values.schedule.deploymentStrategy | nindent 4 }} + replicas: {{ .Values.schedule.replicaCount }} + selector: + matchLabels: + {{- include "schedule.selectorLabels" (dict "context" . "name" .Values.schedule.name) | nindent 6 }} + template: + metadata: + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 8 }} + spec: + {{- with .Values.schedule.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + {{- toYaml .Values.schedule.podSecurityContext | nindent 8 }} + containers: + - name: {{ include "schedule.fullname" . }} + securityContext: + {{- toYaml .Values.schedule.securityContext | nindent 12 }} + image: {{ .Values.schedule.image.repository }}:{{ .Values.schedule.image.tag | default (include "plugin.version" .) }} + imagePullPolicy: {{ .Values.schedule.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.schedule.service.port }} + protocol: TCP + envFrom: + - secretRef: + name: {{ if .Values.schedule.useExistingSecrets }}{{ .Values.schedule.existingSecretName }}{{ else }}{{ include "schedule.fullname" . }}{{ end }} + - configMapRef: + name: {{ include "schedule.fullname" . }} + {{- $otelEnabled := (index .Values "otel-collector-lerian").enabled }} + {{- if $otelEnabled }} + env: + - name: "HOST_IP" + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: "OTEL_EXPORTER_OTLP_ENDPOINT" + value: "$(HOST_IP):4317" + {{- end }} + resources: + {{- toYaml .Values.schedule.resources | nindent 12 }} + readinessProbe: + httpGet: + path: {{ .Values.schedule.readinessProbe.path | default "/readyz" }} + port: {{ .Values.schedule.service.port }} + initialDelaySeconds: {{ .Values.schedule.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ .Values.schedule.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ .Values.schedule.readinessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ .Values.schedule.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.schedule.readinessProbe.failureThreshold | default 3 }} + livenessProbe: + httpGet: + path: {{ .Values.schedule.livenessProbe.path | default "/health" }} + port: {{ .Values.schedule.service.port }} + initialDelaySeconds: {{ .Values.schedule.livenessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ .Values.schedule.livenessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ .Values.schedule.livenessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ .Values.schedule.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.schedule.livenessProbe.failureThreshold | default 3 }} + {{- with .Values.schedule.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.schedule.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.schedule.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/hpa.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/hpa.yaml new file mode 100644 index 00000000..97548675 --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/hpa.yaml @@ -0,0 +1,35 @@ +{{- if .Values.schedule.autoscaling.enabled }} +{{- if not (or .Values.schedule.autoscaling.targetCPUUtilizationPercentage .Values.schedule.autoscaling.targetMemoryUtilizationPercentage) }} +{{- fail "At least one of targetCPUUtilizationPercentage or targetMemoryUtilizationPercentage must be set when autoscaling is enabled" }} +{{- end }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "schedule.fullname" . }} + minReplicas: {{ .Values.schedule.autoscaling.minReplicas }} + maxReplicas: {{ .Values.schedule.autoscaling.maxReplicas }} + metrics: + {{- if .Values.schedule.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.schedule.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.schedule.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.schedule.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/pdb.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/pdb.yaml new file mode 100644 index 00000000..9233c110 --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/pdb.yaml @@ -0,0 +1,23 @@ +{{- if .Values.schedule.pdb.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} + {{- with .Values.schedule.pdb.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + {{- with .Values.schedule.pdb.maxUnavailable }} + maxUnavailable: {{ . }} + {{- else }} + minAvailable: {{ .Values.schedule.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- include "schedule.selectorLabels" (dict "context" . "name" .Values.schedule.name) | nindent 6 }} +{{- end }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/secrets.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/secrets.yaml new file mode 100644 index 00000000..62b03f5f --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/secrets.yaml @@ -0,0 +1,15 @@ +{{- if not .Values.schedule.useExistingSecrets }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} +type: Opaque +data: + # PIX BTG service credentials used by the worker's OAuth2 client. + # Operator/Vault-provided; when PLUGIN_AUTH is disabled locally these stay empty + # and the worker treats auth as optional. + PLUGIN_PIX_BTG_CLIENT_ID: {{ .Values.schedule.secrets.PLUGIN_PIX_BTG_CLIENT_ID | default "" | b64enc | quote }} + PLUGIN_PIX_BTG_CLIENT_SECRET: {{ .Values.schedule.secrets.PLUGIN_PIX_BTG_CLIENT_SECRET | default "" | b64enc | quote }} +{{- end }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/service.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/service.yaml new file mode 100644 index 00000000..7648cedf --- /dev/null +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/service.yaml @@ -0,0 +1,15 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "schedule.fullname" . }} + labels: + {{- include "schedule.labels" (dict "context" . "name" .Values.schedule.name ) | nindent 4 }} +spec: + type: {{ .Values.schedule.service.type }} + ports: + - port: {{ .Values.schedule.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "schedule.selectorLabels" (dict "context" . "name" .Values.schedule.name) | nindent 4 }} diff --git a/charts/plugin-br-pix-indirect-btg/values.schema.json b/charts/plugin-br-pix-indirect-btg/values.schema.json index b4f057e2..adec308d 100644 --- a/charts/plugin-br-pix-indirect-btg/values.schema.json +++ b/charts/plugin-br-pix-indirect-btg/values.schema.json @@ -55,6 +55,18 @@ }, "additionalProperties": true }, + "schedule": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, "postgresql": { "type": "object", "additionalProperties": true diff --git a/charts/plugin-br-pix-indirect-btg/values.yaml b/charts/plugin-br-pix-indirect-btg/values.yaml index c67aaafa..555ca9e8 100644 --- a/charts/plugin-br-pix-indirect-btg/values.yaml +++ b/charts/plugin-br-pix-indirect-btg/values.yaml @@ -666,6 +666,120 @@ reconciliation: extraEnvVars: {} useExistingSecrets: false existingSecretName: "" +schedule: + # -- Readiness probe configuration. All fields override chart defaults. + readinessProbe: + path: /readyz + # -- Liveness probe configuration. All fields override chart defaults. + livenessProbe: + path: /health + replicaCount: 1 + name: "plugin-br-pix-indirect-btg-worker-schedule" + description: "Schedule (Pix recurrence) Worker for Plugin BR PIX Indirect BTG" + # -- Number of old ReplicaSets to retain for deployment rollback + revisionHistoryLimit: 10 + image: + # -- Repository for the container image + repository: ghcr.io/lerianstudio/plugin-br-pix-indirect-btg-worker-schedule + # -- Image pull policy + pullPolicy: Always + # -- Image tag used for deployment + tag: "1.7.5" + # -- Secrets for pulling images from a private registry + imagePullSecrets: [] + # -- Overrides the default generated name by Helm + nameOverride: "" + # -- Overrides the full name generated by Helm + fullnameOverride: "" + service: + # -- Kubernetes service type + type: ClusterIP + # -- Service port (distinct from reconciliation 4017 to keep both co-locatable) + port: 4018 + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + podSecurityContext: {} # fsGroup: 2000 + securityContext: + # -- Defines the group ID for the user running the process inside the container + runAsGroup: 1000 + # -- Defines the user ID for the process running inside the container + runAsUser: 1000 + # -- Ensures the process does not run as root + runAsNonRoot: true + capabilities: + drop: + - ALL + # -- Defines the root filesystem as read-only + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + pdb: + # -- Enable or disable PodDisruptionBudget + enabled: true + # -- Maximum number of unavailable pods + maxUnavailable: 1 + # -- Minimum number of available pods + minAvailable: 0 + # -- Annotations for PodDisruptionBudget + annotations: {} + resources: + # -- CPU and memory limits for pods + limits: + cpu: 500m + memory: 512Mi + # -- Minimum CPU and memory requests + requests: + cpu: 200m + memory: 256Mi + autoscaling: + # -- Enable or disable horizontal pod autoscaling + enabled: false + # -- Minimum number of replicas + minReplicas: 1 + # -- Maximum number of replicas + maxReplicas: 1 + # -- Target CPU utilization percentage for autoscaling + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + # -- Tolerations for scheduling on tainted nodes + tolerations: [] + # -- Affinity rules for pod scheduling + affinity: {} + # -- ConfigMap for environment variables and configurations + # -- All environment variables are declared in the templates/schedule/configmap.yaml + # @default -- templates/schedule/configmap.yaml + configmap: + # Loop is dormant by default; flipped on by config alone. + SCHEDULE_WORKER_ENABLED: "false" + SCHEDULE_WORKER_INTERVAL: "15s" + SCHEDULE_WORKER_BATCH_SIZE: "50" + SCHEDULE_WORKER_STALE_THRESHOLD: "5m" + SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: "10" + SCHEDULE_WORKER_TIME_WINDOW_ENABLED: "false" + SCHEDULE_APP_HTTP_TIMEOUT: "30s" + # Application DOMAIN API endpoint and auth URL (operator/Vault-provided per env). + SCHEDULE_APP_BASE_URL: "" + PLUGIN_AUTH_URL: "" + OTEL_RESOURCE_SERVICE_NAME: "schedule-worker" + OTEL_LIBRARY_NAME: "schedule" + ENABLE_TELEMETRY: "false" + # -- Secrets for storing sensitive data + # -- All secrets are declared in the templates/schedule/secrets.yaml + # @default -- templates/schedule/secrets.yaml + secrets: + # PIX BTG service credentials (operator/Vault-provided). + PLUGIN_PIX_BTG_CLIENT_ID: "" + PLUGIN_PIX_BTG_CLIENT_SECRET: "" + # -- Extra environment variables + extraEnvVars: {} + useExistingSecrets: false + existingSecretName: "" postgresql: enabled: true global: From 347bdec4b98259ec40cbd5f3e606300059fb5f10 Mon Sep 17 00:00:00 2001 From: Gandalf Date: Tue, 7 Jul 2026 12:15:26 -0300 Subject: [PATCH 032/113] chore(schedule): rely on app defaults for SCHEDULE_WORKER_ENABLED (true) and INTERVAL (15m) Remove the explicit false/15s override from the schedule configmap template and values.yaml. The Go binary already ships these defaults, so the chart lets them apply and the worker runs active by default. --- .../templates/schedule/configmap.yaml | 8 +++----- charts/plugin-br-pix-indirect-btg/values.yaml | 6 +++--- 2 files changed, 6 insertions(+), 8 deletions(-) diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml index 077c1445..71014471 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml @@ -11,11 +11,9 @@ data: WORKER_PORT: {{ .Values.schedule.configmap.WORKER_PORT | default "4018" | quote }} # Schedule Worker Loop Configuration - # Ships dormant: SCHEDULE_WORKER_ENABLED=false. The orchestrator only starts the - # polling loop when this is flipped to true, so the worker can be deployed and - # enabled by config alone. - SCHEDULE_WORKER_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_ENABLED | default "false" | quote }} - SCHEDULE_WORKER_INTERVAL: {{ .Values.schedule.configmap.SCHEDULE_WORKER_INTERVAL | default "15s" | quote }} + # SCHEDULE_WORKER_ENABLED (default true) and SCHEDULE_WORKER_INTERVAL (default 15m) + # are intentionally not set here: the binary already ships those defaults, so the + # chart lets the app default apply. Override per-env via extraEnvVars if needed. SCHEDULE_WORKER_BATCH_SIZE: {{ .Values.schedule.configmap.SCHEDULE_WORKER_BATCH_SIZE | default "50" | quote }} SCHEDULE_WORKER_STALE_THRESHOLD: {{ .Values.schedule.configmap.SCHEDULE_WORKER_STALE_THRESHOLD | default "5m" | quote }} SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: {{ .Values.schedule.configmap.SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES | default "10" | quote }} diff --git a/charts/plugin-br-pix-indirect-btg/values.yaml b/charts/plugin-br-pix-indirect-btg/values.yaml index 555ca9e8..7236e4d4 100644 --- a/charts/plugin-br-pix-indirect-btg/values.yaml +++ b/charts/plugin-br-pix-indirect-btg/values.yaml @@ -755,9 +755,9 @@ schedule: # -- All environment variables are declared in the templates/schedule/configmap.yaml # @default -- templates/schedule/configmap.yaml configmap: - # Loop is dormant by default; flipped on by config alone. - SCHEDULE_WORKER_ENABLED: "false" - SCHEDULE_WORKER_INTERVAL: "15s" + # SCHEDULE_WORKER_ENABLED (default true) and SCHEDULE_WORKER_INTERVAL (default 15m) + # are omitted on purpose: the binary already defaults them, so the worker runs + # active on the app's own defaults without redundant chart declarations. SCHEDULE_WORKER_BATCH_SIZE: "50" SCHEDULE_WORKER_STALE_THRESHOLD: "5m" SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: "10" From 59c6b08b58431c8f05b3b6a65d6de3ea49276b9f Mon Sep 17 00:00:00 2001 From: Gandalf Date: Tue, 7 Jul 2026 12:17:28 -0300 Subject: [PATCH 033/113] chore(schedule): declare explicit chart defaults SCHEDULE_WORKER_ENABLED=true, INTERVAL=15m Revert removal from 347bdec. The chart now owns explicit defaults for the schedule worker loop (active, 15m polling) in the schedule configmap template and values.yaml. Per-env overlays may override, but the chart defines the default. --- .../templates/schedule/configmap.yaml | 7 ++++--- charts/plugin-br-pix-indirect-btg/values.yaml | 6 +++--- 2 files changed, 7 insertions(+), 6 deletions(-) diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml index 71014471..f99d4d95 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml @@ -11,9 +11,10 @@ data: WORKER_PORT: {{ .Values.schedule.configmap.WORKER_PORT | default "4018" | quote }} # Schedule Worker Loop Configuration - # SCHEDULE_WORKER_ENABLED (default true) and SCHEDULE_WORKER_INTERVAL (default 15m) - # are intentionally not set here: the binary already ships those defaults, so the - # chart lets the app default apply. Override per-env via extraEnvVars if needed. + # Chart declares explicit defaults: worker runs active with a 15m polling loop. + # Overlays per environment may override these via values, but the chart owns the default. + SCHEDULE_WORKER_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_ENABLED | default "true" | quote }} + SCHEDULE_WORKER_INTERVAL: {{ .Values.schedule.configmap.SCHEDULE_WORKER_INTERVAL | default "15m" | quote }} SCHEDULE_WORKER_BATCH_SIZE: {{ .Values.schedule.configmap.SCHEDULE_WORKER_BATCH_SIZE | default "50" | quote }} SCHEDULE_WORKER_STALE_THRESHOLD: {{ .Values.schedule.configmap.SCHEDULE_WORKER_STALE_THRESHOLD | default "5m" | quote }} SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: {{ .Values.schedule.configmap.SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES | default "10" | quote }} diff --git a/charts/plugin-br-pix-indirect-btg/values.yaml b/charts/plugin-br-pix-indirect-btg/values.yaml index 7236e4d4..44560483 100644 --- a/charts/plugin-br-pix-indirect-btg/values.yaml +++ b/charts/plugin-br-pix-indirect-btg/values.yaml @@ -755,9 +755,9 @@ schedule: # -- All environment variables are declared in the templates/schedule/configmap.yaml # @default -- templates/schedule/configmap.yaml configmap: - # SCHEDULE_WORKER_ENABLED (default true) and SCHEDULE_WORKER_INTERVAL (default 15m) - # are omitted on purpose: the binary already defaults them, so the worker runs - # active on the app's own defaults without redundant chart declarations. + # Chart-level explicit defaults: worker active with a 15m polling loop. + SCHEDULE_WORKER_ENABLED: "true" + SCHEDULE_WORKER_INTERVAL: "15m" SCHEDULE_WORKER_BATCH_SIZE: "50" SCHEDULE_WORKER_STALE_THRESHOLD: "5m" SCHEDULE_WORKER_SWEEP_EVERY_N_CYCLES: "10" From 0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Tue, 7 Jul 2026 16:43:32 -0300 Subject: [PATCH 034/113] feat(br-ccs): add Helm chart Add br-ccs-helm (single-service) chart for the BACEN CCS regulatory service: Deployment running CCS_RUN_MODE=all on ClusterIP:4030, PostgreSQL/Valkey/RabbitMQ optional subcharts, golang-migrate Job via the br-ccs-migrations image, and 100% env coverage from the service config/.env.example. Liveness /health, readiness /readyz. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/CHANGELOG.md | 25 + charts/br-ccs/Chart.lock | 12 + charts/br-ccs/Chart.yaml | 39 + charts/br-ccs/README.md | 85 +++ .../files/rabbitmq/load_definitions.json | 35 + charts/br-ccs/templates/_helpers.tpl | 153 ++++ .../br-ccs/templates/bootstrap-postgres.yaml | 129 ++++ .../br-ccs/templates/bootstrap-rabbitmq.yaml | 175 +++++ charts/br-ccs/templates/configmap.yaml | 320 +++++++++ charts/br-ccs/templates/deployment.yaml | 181 +++++ charts/br-ccs/templates/hpa.yaml | 33 + charts/br-ccs/templates/ingress.yaml | 62 ++ charts/br-ccs/templates/migration-secret.yaml | 33 + charts/br-ccs/templates/migrations.yaml | 162 +++++ charts/br-ccs/templates/pdb.yaml | 24 + .../templates/rabbitmq_load_definitions.yaml | 12 + charts/br-ccs/templates/secrets.yaml | 75 ++ charts/br-ccs/templates/service.yaml | 22 + charts/br-ccs/templates/serviceaccount.yaml | 13 + charts/br-ccs/values-template.yaml | 166 +++++ charts/br-ccs/values.schema.json | 44 ++ charts/br-ccs/values.yaml | 673 ++++++++++++++++++ 22 files changed, 2473 insertions(+) create mode 100644 charts/br-ccs/CHANGELOG.md create mode 100644 charts/br-ccs/Chart.lock create mode 100644 charts/br-ccs/Chart.yaml create mode 100644 charts/br-ccs/README.md create mode 100644 charts/br-ccs/files/rabbitmq/load_definitions.json create mode 100644 charts/br-ccs/templates/_helpers.tpl create mode 100644 charts/br-ccs/templates/bootstrap-postgres.yaml create mode 100644 charts/br-ccs/templates/bootstrap-rabbitmq.yaml create mode 100644 charts/br-ccs/templates/configmap.yaml create mode 100644 charts/br-ccs/templates/deployment.yaml create mode 100644 charts/br-ccs/templates/hpa.yaml create mode 100644 charts/br-ccs/templates/ingress.yaml create mode 100644 charts/br-ccs/templates/migration-secret.yaml create mode 100644 charts/br-ccs/templates/migrations.yaml create mode 100644 charts/br-ccs/templates/pdb.yaml create mode 100644 charts/br-ccs/templates/rabbitmq_load_definitions.yaml create mode 100644 charts/br-ccs/templates/secrets.yaml create mode 100644 charts/br-ccs/templates/service.yaml create mode 100644 charts/br-ccs/templates/serviceaccount.yaml create mode 100644 charts/br-ccs/values-template.yaml create mode 100644 charts/br-ccs/values.schema.json create mode 100644 charts/br-ccs/values.yaml diff --git a/charts/br-ccs/CHANGELOG.md b/charts/br-ccs/CHANGELOG.md new file mode 100644 index 00000000..fe681bb6 --- /dev/null +++ b/charts/br-ccs/CHANGELOG.md @@ -0,0 +1,25 @@ +# Changelog + +All notable changes to the br-ccs Helm chart are documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.1.0] - 2026-07-07 + +### Added + +- Initial Helm chart for the br-ccs service (BACEN CCS regulatory integration). +- Single Deployment running `CCS_RUN_MODE=all` (HTTP API + background workers in one process). +- ClusterIP Service on port 4030 (`SERVER_ADDRESS=:4030`). +- Health probes wired to the verified application endpoints: liveness `GET /health`, + readiness `GET /readyz`. +- Full env-var coverage from `config/.env.example` split across ConfigMap (non-secret) + and Secret (credentials, crypto keys, object-storage keys, M2M API keys). +- PostgreSQL migrations Job using the dedicated `br-ccs-migrations` image + (golang-migrate runner; PreSync for external Postgres, PostSync for the bundled + subchart), plus a migration-only Secret hook for the external chart-managed path. +- Optional subchart dependencies: `postgresql`, `valkey`, `rabbitmq` (all `.enabled`-gated). +- External-infra bootstrap Jobs for PostgreSQL and RabbitMQ (opt-in via `global.*Definitions.enabled`). +- HPA, PodDisruptionBudget, Ingress, ServiceAccount templates. +- Non-root, read-only-root-filesystem, drop-ALL security contexts on all containers. diff --git a/charts/br-ccs/Chart.lock b/charts/br-ccs/Chart.lock new file mode 100644 index 00000000..9cfd83b2 --- /dev/null +++ b/charts/br-ccs/Chart.lock @@ -0,0 +1,12 @@ +dependencies: +- name: valkey + repository: oci://registry-1.docker.io/bitnamicharts + version: 2.4.7 +- name: postgresql + repository: https://charts.bitnami.com/bitnami + version: 16.3.5 +- name: rabbitmq + repository: https://groundhog2k.github.io/helm-charts + version: 2.1.11 +digest: sha256:7bb3353ae1606ded8101b27d09edeeb9e82d7d8b627c74acb4ea6b9badb77c3c +generated: "2026-07-07T11:01:18.762917187-03:00" diff --git a/charts/br-ccs/Chart.yaml b/charts/br-ccs/Chart.yaml new file mode 100644 index 00000000..7d1f0dfb --- /dev/null +++ b/charts/br-ccs/Chart.yaml @@ -0,0 +1,39 @@ +apiVersion: v2 +name: br-ccs-helm +description: A Helm chart for br-ccs — Lerian's BACEN CCS (Cadastro de Clientes do Sistema Financeiro Nacional) regulatory integration service +type: application +annotations: + lerian.studio/chart-type: single-service +home: https://github.com/LerianStudio/helm +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/br-ccs + - https://github.com/LerianStudio/br-ccs +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" + +version: 0.1.0 + +appVersion: "1.0.0" + +keywords: + - ccs + - bacen + - regulatory + - lerian + - ledger + - brazil +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 +dependencies: + - name: valkey + version: "2.4.7" + repository: "oci://registry-1.docker.io/bitnamicharts" + condition: valkey.enabled + - name: postgresql + version: "16.3.5" + repository: "https://charts.bitnami.com/bitnami" + condition: postgresql.enabled + - name: rabbitmq + version: "2.1.11" + repository: "https://groundhog2k.github.io/helm-charts" + condition: rabbitmq.enabled diff --git a/charts/br-ccs/README.md b/charts/br-ccs/README.md new file mode 100644 index 00000000..9d93598c --- /dev/null +++ b/charts/br-ccs/README.md @@ -0,0 +1,85 @@ +# br-ccs Helm Chart + +Helm chart for **br-ccs** — Lerian's Go service for the BACEN **CCS (Cadastro de +Clientes do Sistema Financeiro Nacional)** regulatory integration. It ingests +customer-relationship data (from Fetcher), computes the daily delta, renders the +BACEN XML layouts, transmits via **STA**, and reconciles the responses, honoring +judicial secrecy (liminares / LC 105) and LGPD. + +- Chart name: `br-ccs-helm` +- Chart type: `single-service` +- Source: https://github.com/LerianStudio/br-ccs + +## TL;DR + +```bash +helm dependency build charts/br-ccs +helm install br-ccs charts/br-ccs \ + --set brCcs.configmap.ENV_NAME=production \ + --set brCcs.secrets.POSTGRES_PASSWORD=... \ + --set brCcs.secrets.REDIS_PASSWORD=... \ + --set brCcs.secrets.CCS_CRYPTO_MASTER_KEY=$(openssl rand -hex 32) +``` + +## Service topology + +| Aspect | Value | +|--------|-------| +| Container port / Service port | `4030` (`SERVER_ADDRESS=:4030`) | +| Service type | `ClusterIP` | +| Run mode | Single Deployment, `CCS_RUN_MODE=all` (API + workers) | +| Liveness probe | `GET /health` | +| Readiness probe | `GET /readyz` (PROJECT_RULES §13.4) | +| Persistence | PostgreSQL (no MongoDB) | +| Messaging | RabbitMQ (optional, disabled by default) | +| Cache / idempotency / rate-limit | Redis / Valkey | + +## Dependencies + +All bundled subcharts are `.enabled`-gated. For BYOC / production, disable them +and point the app at external infrastructure (see `values-template.yaml`). + +| Subchart | Version | Repository | +|----------|---------|------------| +| postgresql | 16.3.5 | https://charts.bitnami.com/bitnami | +| valkey | 2.4.7 | oci://registry-1.docker.io/bitnamicharts | +| rabbitmq | 2.1.11 | https://groundhog2k.github.io/helm-charts | + +## Configuration + +Non-secret configuration lives under `brCcs.configmap`; credentials and keys +under `brCcs.secrets`. Every variable from the application's +`config/.env.example` is mapped. Optional knobs not modeled explicitly can be +set via `brCcs.extraEnvVars`. + +### Required secrets + +| Key | Notes | +|-----|-------| +| `POSTGRES_PASSWORD` | Single-sourced from the bundled subchart Secret when `postgresql.enabled=true`; supply here for external Postgres. | +| `REDIS_PASSWORD` | Single-sourced from the bundled valkey Secret when `valkey.enabled=true`; supply here for external Redis. | +| `CCS_CRYPTO_MASTER_KEY` | AES-256-GCM master key, 64 hex chars (`openssl rand -hex 32`). Empty fails fast at boot. | +| `FETCHER_CRYPTO_KEY` | Fetcher snapshot decryption key (base64; same value as Fetcher `APP_ENC_KEY`). | + +### Migrations + +`brCcs.migrations.enabled=true` (default) runs the dedicated `br-ccs-migrations` +image as a Helm/ArgoCD hook: + +- **External Postgres** → PreSync (`pre-install,pre-upgrade`), backed by a + migration-only Secret carrying just `POSTGRES_PASSWORD`. +- **Bundled Postgres subchart** → PostSync (`post-install,post-upgrade`), reading + the app Secret after the database is provisioned. + +## Security + +All containers run non-root (`runAsUser: 1000`, `runAsNonRoot: true`), with +`readOnlyRootFilesystem: true`, `allowPrivilegeEscalation: false`, +`capabilities.drop: [ALL]`, and `seccompProfile: RuntimeDefault`. + +## Validation + +```bash +helm lint charts/br-ccs +helm template charts/br-ccs +``` diff --git a/charts/br-ccs/files/rabbitmq/load_definitions.json b/charts/br-ccs/files/rabbitmq/load_definitions.json new file mode 100644 index 00000000..6ce45fa5 --- /dev/null +++ b/charts/br-ccs/files/rabbitmq/load_definitions.json @@ -0,0 +1,35 @@ +{ + "users": [ + { + "name": "br-ccs", + "tags": "" + } + ], + "vhosts": [ + { + "name": "/" + } + ], + "permissions": [ + { + "user": "br-ccs", + "vhost": "/", + "configure": ".*", + "write": ".*", + "read": ".*" + } + ], + "queues": [], + "exchanges": [ + { + "name": "events", + "vhost": "/", + "type": "topic", + "durable": true, + "auto_delete": false, + "internal": false, + "arguments": {} + } + ], + "bindings": [] +} diff --git a/charts/br-ccs/templates/_helpers.tpl b/charts/br-ccs/templates/_helpers.tpl new file mode 100644 index 00000000..73b2c3db --- /dev/null +++ b/charts/br-ccs/templates/_helpers.tpl @@ -0,0 +1,153 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "br-ccs.name" -}} +{{- default (default "br-ccs" .Values.nameOverride) | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name for br-ccs. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "br-ccs.fullname" -}} +{{- default (include "br-ccs.name" .) .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "br-ccs.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create br-ccs app version +*/}} +{{- define "br-ccs.defaultTag" -}} +{{- default .Chart.AppVersion .Values.brCcs.image.tag }} +{{- end -}} + +{{/* +Return valid br-ccs version label +*/}} +{{- define "br-ccs.versionLabelValue" -}} +{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "br-ccs.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "br-ccs.labels" -}} +helm.sh/chart: {{ include "br-ccs.chart" .context }} +{{ include "br-ccs.selectorLabels" (dict "context" .context "component" .component "name" .name) }} +app.kubernetes.io/version: {{ include "br-ccs.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "br-ccs.selectorLabels" -}} +app.kubernetes.io/name: {{ include "br-ccs.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- if .component }} +app.kubernetes.io/component: {{ .component }} +{{- end }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "br-ccs.serviceAccountName" -}} +{{- if .Values.brCcs.serviceAccount.create }} +{{- default (include "br-ccs.fullname" .) .Values.brCcs.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.brCcs.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Expand the namespace of the release. +Allows overriding it for multi-namespace deployments in combined charts. +*/}} +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* +Enable internal dependencies +These helpers check both .enabled and .external flags +*/}} +{{- define "rabbitmq.enabled" -}} +{{- if and (default true .Values.rabbitmq.enabled) (not .Values.rabbitmq.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{- define "valkey.enabled" -}} +{{- if and (default true .Values.valkey.enabled) (not .Values.valkey.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{- define "postgresql.enabled" -}} +{{- if and (default true .Values.postgresql.enabled) (not .Values.postgresql.external) -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{/* +br-ccs.infraSecretRef — emit a `- name: valueFrom: secretKeyRef: {name,key}` +entry pointing at a Bitnami subchart's generated Secret (or the operator's existingSecret +override). Inputs (dict): context (root .), subchart, key, envName. +*/}} +{{- define "br-ccs.infraSecretRef" -}} +{{- $ctx := .context -}} +{{- $sub := .subchart -}} +{{- $auth := default dict (index $ctx.Values $sub "auth") -}} +{{- $secretName := "" -}} +{{- if $auth.existingSecret -}} +{{- $secretName = $auth.existingSecret -}} +{{- else -}} +{{- $secretName = include "common.names.dependency.fullname" (dict "chartName" $sub "chartValues" (index $ctx.Values $sub) "context" $ctx) -}} +{{- end -}} +- name: {{ .envName }} + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: {{ .key }} +{{- end }} + +{{/* +br-ccs.migrationPostgresPassword — POSTGRES_PASSWORD for the migration-only Secret. +migration-secret.yaml renders ONLY on the EXTERNAL Postgres path (the bundled subchart path +reads the subchart Secret via secretKeyRef instead), so the operator MUST supply the password. +*/}} +{{- define "br-ccs.migrationPostgresPassword" -}} +{{- $secrets := get (.Values.brCcs | default dict) "secrets" | default dict -}} +{{- required "brCcs.secrets.POSTGRES_PASSWORD is required when migrations run against external PostgreSQL with a chart-managed Secret" (get $secrets "POSTGRES_PASSWORD") -}} +{{- end }} + +{{/* +Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra +Secret/Service names render even when all bundled subcharts are disabled +(external-infra path). Self-contained: no other common.* helpers required. +*/}} +{{- define "common.names.dependency.fullname" -}} +{{- if .chartValues.fullnameOverride -}} +{{- .chartValues.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default .chartName .chartValues.nameOverride -}} +{{- if contains $name .context.Release.Name -}} +{{- .context.Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .context.Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} diff --git a/charts/br-ccs/templates/bootstrap-postgres.yaml b/charts/br-ccs/templates/bootstrap-postgres.yaml new file mode 100644 index 00000000..dc94e27b --- /dev/null +++ b/charts/br-ccs/templates/bootstrap-postgres.yaml @@ -0,0 +1,129 @@ +{{- if .Values.global.externalPostgresDefinitions.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "br-ccs.fullname" . }}-bootstrap-postgres + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "bootstrap" "name" "postgres") | nindent 4 }} +spec: + ttlSecondsAfterFinished: 300 + completions: 1 + parallelism: 1 + backoffLimit: 3 + template: + spec: + restartPolicy: Never + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + echo "Checking $DB_HOST:$DB_PORT..."; + while ! nc -z "$DB_HOST" "$DB_PORT"; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for $DB_HOST:$DB_PORT after ${TIMEOUT}s"; + exit 1; + fi; + echo "$DB_HOST:$DB_PORT is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "$DB_HOST:$DB_PORT is ready!"; + containers: + - name: psql + image: postgres:17 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + - name: DB_USER_ADMIN + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_USER_ADMIN + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.username | quote }} + {{- end }} + - name: DB_ADMIN_PASSWORD + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_ADMIN_PASSWORD + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.password | quote }} + {{- end }} + - name: DB_PASSWORD_BR_CCS + {{- if .Values.global.externalPostgresDefinitions.brCcsCredentials.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.brCcsCredentials.useExistingSecret.name | quote }} + key: DB_PASSWORD_BR_CCS + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.brCcsCredentials.password | quote }} + {{- end }} + - name: DB_DATABASE + value: postgres + command: + - /bin/sh + - -c + - | + set -euo pipefail + echo "=== br-ccs PostgreSQL Bootstrap ===" + echo "Host: $DB_HOST:$DB_PORT" + echo "" + + # The role/database name contains a hyphen, so it is always quoted in SQL. + echo "Checking existing PostgreSQL objects..." + DB_EXISTS=0 + ROLE_EXISTS=0 + + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname='br-ccs'" | grep -q 1; then + DB_EXISTS=1 + fi + if PGPASSWORD="$DB_ADMIN_PASSWORD" psql -At -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname='br-ccs'" | grep -q 1; then + ROLE_EXISTS=1 + fi + + if [ "$DB_EXISTS" = "1" ] && [ "$ROLE_EXISTS" = "1" ]; then + echo "PostgreSQL bootstrap already complete (database and role 'br-ccs' exist). Skipping creation." + else + if [ "$ROLE_EXISTS" = "1" ]; then + echo "Role 'br-ccs' already exists. Skipping creation." + else + echo "Creating role 'br-ccs'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_BR_CCS" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE \"br-ccs\" LOGIN PASSWORD :'pw'" + fi + + if [ "$DB_EXISTS" = "1" ]; then + echo "Database 'br-ccs' already exists. Skipping creation." + else + echo "Creating database 'br-ccs'..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE \"br-ccs\" OWNER \"br-ccs\"" + fi + fi + + echo "Ensuring privileges and schema permissions..." + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "ALTER USER \"br-ccs\" CREATEDB" || echo "Warning: Could not grant CREATEDB (may require superuser privileges)" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE \"br-ccs\" TO \"br-ccs\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "br-ccs" -c "GRANT ALL ON SCHEMA public TO \"br-ccs\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "br-ccs" -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \"br-ccs\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "br-ccs" -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \"br-ccs\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "br-ccs" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO \"br-ccs\"" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "br-ccs" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO \"br-ccs\"" + + echo "" + echo "=== br-ccs PostgreSQL Bootstrap completed successfully ===" +{{- end }} diff --git a/charts/br-ccs/templates/bootstrap-rabbitmq.yaml b/charts/br-ccs/templates/bootstrap-rabbitmq.yaml new file mode 100644 index 00000000..45629e60 --- /dev/null +++ b/charts/br-ccs/templates/bootstrap-rabbitmq.yaml @@ -0,0 +1,175 @@ +{{- if .Values.global.externalRabbitmqDefinitions.enabled }} +--- +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-ccs.fullname" . }}-bootstrap-rabbitmq-definitions + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "bootstrap" "name" "rabbitmq") | nindent 4 }} +data: + load_definitions.json: | +{{ .Files.Get "files/rabbitmq/load_definitions.json" | indent 4 }} +--- +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "br-ccs.fullname" . }}-bootstrap-rabbitmq + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "bootstrap" "name" "rabbitmq") | nindent 4 }} +spec: + ttlSecondsAfterFinished: 300 + completions: 1 + parallelism: 1 + backoffLimit: 3 + template: + spec: + restartPolicy: OnFailure + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + env: + - name: RABBITMQ_HOST + value: {{ .Values.global.externalRabbitmqDefinitions.connection.host | quote }} + - name: RABBITMQ_PORT + value: {{ .Values.global.externalRabbitmqDefinitions.connection.portAmqp | quote }} + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + echo "Checking $RABBITMQ_HOST:$RABBITMQ_PORT..."; + while ! nc -z "$RABBITMQ_HOST" "$RABBITMQ_PORT"; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for $RABBITMQ_HOST:$RABBITMQ_PORT after ${TIMEOUT}s"; + exit 1; + fi; + echo "$RABBITMQ_HOST:$RABBITMQ_PORT is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "$RABBITMQ_HOST:$RABBITMQ_PORT is ready!"; + containers: + - name: apply-definitions + image: ghcr.io/jqlang/jq:1.7.1 + command: + - sh + - -c + - | + set -e + + CURL_OPTS="-sS" + if [ "$RABBITMQ_SKIP_TLS_VERIFY" = "true" ]; then + CURL_OPTS="$CURL_OPTS -k" + echo "Warning: TLS verification is disabled" + fi + + if [ "$RABBITMQ_PROTOCOL" = "https" ] && [ "$RABBITMQ_PORT" = "443" ]; then + BASE_URL="$RABBITMQ_PROTOCOL://$RABBITMQ_HOST" + elif [ "$RABBITMQ_PROTOCOL" = "http" ] && [ "$RABBITMQ_PORT" = "80" ]; then + BASE_URL="$RABBITMQ_PROTOCOL://$RABBITMQ_HOST" + else + BASE_URL="$RABBITMQ_PROTOCOL://$RABBITMQ_HOST:$RABBITMQ_PORT" + fi + + echo "=== br-ccs RabbitMQ Bootstrap ===" + echo "API URL: $BASE_URL" + echo "" + + echo "Checking if RabbitMQ user 'br-ccs' already exists..." + BR_CCS_EXISTS=$(curl $CURL_OPTS -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + "$BASE_URL/api/users/br-ccs" 2>/dev/null || echo "not_found") + + SKIP_DEFINITIONS=false + if echo "$BR_CCS_EXISTS" | grep -q '"name":"br-ccs"'; then + echo "RabbitMQ user 'br-ccs' already exists. Checking exchanges..." + EXCHANGE_EXISTS=$(curl $CURL_OPTS -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + "$BASE_URL/api/exchanges/%2F/events" 2>/dev/null || echo "not_found") + if echo "$EXCHANGE_EXISTS" | grep -q '"name":"events"'; then + echo "RabbitMQ definitions already applied (user and exchange exist). Skipping definitions import." + SKIP_DEFINITIONS=true + fi + fi + + if [ "$SKIP_DEFINITIONS" = "false" ]; then + echo "Applying RabbitMQ definitions from file..." + HTTP_CODE=$(curl $CURL_OPTS -o /tmp/response.txt -w "%{http_code}" \ + -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + -H "content-type: application/json" \ + -X POST \ + --data-binary @/definitions/load_definitions.json \ + "$BASE_URL/api/definitions") + if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then + echo "Error applying definitions (HTTP $HTTP_CODE):" + cat /tmp/response.txt + exit 1 + fi + echo "Definitions applied successfully." + fi + + echo "Updating RabbitMQ user 'br-ccs' password..." + USER_JSON=$(jq -n --arg pw "$RABBITMQ_BR_CCS_PASS" '{"password": $pw, "tags": ""}') + HTTP_CODE=$(curl $CURL_OPTS -o /tmp/response.txt -w "%{http_code}" \ + -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + -H "content-type: application/json" \ + -X PUT \ + --data "$USER_JSON" \ + "$BASE_URL/api/users/br-ccs") + if [ "$HTTP_CODE" -lt 200 ] || [ "$HTTP_CODE" -ge 300 ]; then + echo "Error updating br-ccs user (HTTP $HTTP_CODE):" + cat /tmp/response.txt + exit 1 + fi + echo "User password updated successfully." + + echo "" + echo "=== br-ccs RabbitMQ Bootstrap completed successfully ===" + env: + - name: RABBITMQ_PROTOCOL + value: {{ .Values.global.externalRabbitmqDefinitions.connection.protocol | quote }} + - name: RABBITMQ_HOST + value: {{ .Values.global.externalRabbitmqDefinitions.connection.host | quote }} + - name: RABBITMQ_PORT + value: {{ .Values.global.externalRabbitmqDefinitions.connection.port | quote }} + - name: RABBITMQ_SKIP_TLS_VERIFY + value: {{ .Values.global.externalRabbitmqDefinitions.connection.skipTlsVerify | default false | quote }} + - name: RABBITMQ_BR_CCS_PASS + {{- if .Values.global.externalRabbitmqDefinitions.brCcsCredentials.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalRabbitmqDefinitions.brCcsCredentials.useExistingSecret.name | quote }} + key: RABBITMQ_BR_CCS_PASS + {{- else }} + value: {{ .Values.global.externalRabbitmqDefinitions.brCcsCredentials.password | quote }} + {{- end }} + - name: RABBITMQ_ADMIN_PASS + {{- if .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.useExistingSecret.name | quote }} + key: RABBITMQ_ADMIN_PASS + {{- else }} + value: {{ .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.password | quote }} + {{- end }} + - name: RABBITMQ_ADMIN_USER + {{- if .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.useExistingSecret.name | quote }} + key: RABBITMQ_ADMIN_USER + {{- else }} + value: {{ .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.username | quote }} + {{- end }} + volumeMounts: + - name: definitions + mountPath: /definitions + volumes: + - name: definitions + configMap: + name: {{ include "br-ccs.fullname" . }}-bootstrap-rabbitmq-definitions + items: + - key: load_definitions.json + path: load_definitions.json +{{- end }} diff --git a/charts/br-ccs/templates/configmap.yaml b/charts/br-ccs/templates/configmap.yaml new file mode 100644 index 00000000..50034150 --- /dev/null +++ b/charts/br-ccs/templates/configmap.yaml @@ -0,0 +1,320 @@ +{{- if .Values.brCcs.enabled }} +{{- $cm := .Values.brCcs.configmap | default dict }} +{{- $multiTenantEnabled := eq (toString ($cm.MULTI_TENANT_ENABLED | default "false")) "true" }} +{{- $namespace := include "global.namespace" . }} +kind: ConfigMap +apiVersion: v1 +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ $namespace }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} +data: + # ===================================================================== + # APPLICATION IDENTITY + # ===================================================================== + APPLICATION_NAME: {{ $cm.APPLICATION_NAME | default "br-ccs" | quote }} + ENV_NAME: {{ $cm.ENV_NAME | default "production" | quote }} + VERSION: {{ $cm.VERSION | default .Chart.AppVersion | quote }} + LOG_LEVEL: {{ $cm.LOG_LEVEL | default "info" | quote }} + DEPLOYMENT_MODE: {{ $cm.DEPLOYMENT_MODE | default "byoc" | quote }} + CCS_RUN_MODE: {{ $cm.CCS_RUN_MODE | default "all" | quote }} + + # ===================================================================== + # HTTP SERVER + # SERVER_PORT is consumed by the in-container /healthcheck binary. + # ===================================================================== + SERVER_ADDRESS: {{ $cm.SERVER_ADDRESS | default ":4030" | quote }} + SERVER_PORT: {{ $cm.SERVER_PORT | default "4030" | quote }} + GRPC_PORT: {{ $cm.GRPC_PORT | default "7001" | quote }} + HTTP_BODY_LIMIT_BYTES: {{ $cm.HTTP_BODY_LIMIT_BYTES | default "104857600" | quote }} + {{- if $cm.SERVER_TLS_CERT_FILE }} + SERVER_TLS_CERT_FILE: {{ $cm.SERVER_TLS_CERT_FILE | quote }} + {{- end }} + {{- if $cm.SERVER_TLS_KEY_FILE }} + SERVER_TLS_KEY_FILE: {{ $cm.SERVER_TLS_KEY_FILE | quote }} + {{- end }} + TLS_TERMINATED_UPSTREAM: {{ $cm.TLS_TERMINATED_UPSTREAM | default "true" | quote }} + TRUSTED_PROXIES: {{ $cm.TRUSTED_PROXIES | default "" | quote }} + + # ===================================================================== + # CORS POLICY + # ===================================================================== + CORS_ALLOWED_ORIGINS: {{ $cm.CORS_ALLOWED_ORIGINS | default "" | quote }} + CORS_ALLOWED_METHODS: {{ $cm.CORS_ALLOWED_METHODS | default "GET,POST,PUT,PATCH,DELETE,OPTIONS" | quote }} + CORS_ALLOWED_HEADERS: {{ $cm.CORS_ALLOWED_HEADERS | default "Authorization,Content-Type,X-Tenant-ID,X-Idempotency,X-Request-ID" | quote }} + CORS_EXPOSE_HEADERS: {{ $cm.CORS_EXPOSE_HEADERS | default "" | quote }} + CORS_ALLOW_CREDENTIALS: {{ $cm.CORS_ALLOW_CREDENTIALS | default "false" | quote }} + + # ===================================================================== + # MULTI-TENANCY + # Toggle + DEFAULT_TENANT_ID always render. MT infra endpoints render + # only when MULTI_TENANT_ENABLED=true. + # ===================================================================== + DEFAULT_TENANT_ID: {{ $cm.DEFAULT_TENANT_ID | default "11111111-1111-1111-1111-111111111111" | quote }} + MULTI_TENANT_ENABLED: {{ $cm.MULTI_TENANT_ENABLED | default "false" | quote }} + {{- if $multiTenantEnabled }} + MULTI_TENANT_URL: {{ required "brCcs.configmap.MULTI_TENANT_URL is required when MULTI_TENANT_ENABLED=true" $cm.MULTI_TENANT_URL | quote }} + MULTI_TENANT_REDIS_HOST: {{ required "brCcs.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" $cm.MULTI_TENANT_REDIS_HOST | quote }} + MULTI_TENANT_REDIS_PORT: {{ $cm.MULTI_TENANT_REDIS_PORT | default "6379" | quote }} + MULTI_TENANT_REDIS_TLS: {{ $cm.MULTI_TENANT_REDIS_TLS | default "false" | quote }} + MULTI_TENANT_MAX_TENANT_POOLS: {{ $cm.MULTI_TENANT_MAX_TENANT_POOLS | default "100" | quote }} + MULTI_TENANT_IDLE_TIMEOUT_SEC: {{ $cm.MULTI_TENANT_IDLE_TIMEOUT_SEC | default "300" | quote }} + MULTI_TENANT_TIMEOUT: {{ $cm.MULTI_TENANT_TIMEOUT | default "30" | quote }} + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ $cm.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }} + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ $cm.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }} + MULTI_TENANT_CACHE_TTL_SEC: {{ $cm.MULTI_TENANT_CACHE_TTL_SEC | default "120" | quote }} + MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: {{ $cm.MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC | default "30" | quote }} + {{- end }} + + # ===================================================================== + # POSTGRESQL (primary + control-plane) + # POSTGRES_HOST defaults to the bundled subchart primary Service. + # ===================================================================== + POSTGRES_HOST: {{ $cm.POSTGRES_HOST | default (printf "%s-postgresql-primary.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + POSTGRES_PORT: {{ $cm.POSTGRES_PORT | default "5432" | quote }} + POSTGRES_USER: {{ $cm.POSTGRES_USER | default "br-ccs" | quote }} + POSTGRES_NAME: {{ $cm.POSTGRES_NAME | default "br-ccs" | quote }} + POSTGRES_SSLMODE: {{ $cm.POSTGRES_SSLMODE | default "require" | quote }} + MIGRATIONS_PATH: {{ $cm.MIGRATIONS_PATH | default "migrations" | quote }} + SYSTEMPLANE_ENABLED: {{ $cm.SYSTEMPLANE_ENABLED | default "false" | quote }} + POSTGRES_MAX_OPEN_CONNS: {{ $cm.POSTGRES_MAX_OPEN_CONNS | default "25" | quote }} + POSTGRES_MAX_IDLE_CONNS: {{ $cm.POSTGRES_MAX_IDLE_CONNS | default "5" | quote }} + POSTGRES_CONN_MAX_LIFETIME_MINS: {{ $cm.POSTGRES_CONN_MAX_LIFETIME_MINS | default "30" | quote }} + POSTGRES_CONN_MAX_IDLE_TIME_MINS: {{ $cm.POSTGRES_CONN_MAX_IDLE_TIME_MINS | default "5" | quote }} + POSTGRES_CONNECT_TIMEOUT_SEC: {{ $cm.POSTGRES_CONNECT_TIMEOUT_SEC | default "10" | quote }} + INFRA_CONNECT_TIMEOUT_SEC: {{ $cm.INFRA_CONNECT_TIMEOUT_SEC | default "30" | quote }} + {{- if $cm.POSTGRES_REPLICA_HOST }} + POSTGRES_REPLICA_HOST: {{ $cm.POSTGRES_REPLICA_HOST | quote }} + POSTGRES_REPLICA_PORT: {{ $cm.POSTGRES_REPLICA_PORT | default "5432" | quote }} + POSTGRES_REPLICA_USER: {{ $cm.POSTGRES_REPLICA_USER | quote }} + POSTGRES_REPLICA_NAME: {{ $cm.POSTGRES_REPLICA_NAME | quote }} + POSTGRES_REPLICA_SSLMODE: {{ $cm.POSTGRES_REPLICA_SSLMODE | default "require" | quote }} + {{- end }} + + # ===================================================================== + # REDIS / VALKEY (app-level) + # REDIS_HOST is host:port; defaults to the bundled valkey primary Service. + # ===================================================================== + REDIS_HOST: {{ $cm.REDIS_HOST | default (printf "%s-valkey-primary.%s.svc.cluster.local:6379" .Release.Name $namespace) | quote }} + REDIS_DB: {{ $cm.REDIS_DB | default "0" | quote }} + REDIS_PROTOCOL: {{ $cm.REDIS_PROTOCOL | default "3" | quote }} + REDIS_POOL_SIZE: {{ $cm.REDIS_POOL_SIZE | default "10" | quote }} + REDIS_MIN_IDLE_CONNS: {{ $cm.REDIS_MIN_IDLE_CONNS | default "2" | quote }} + REDIS_READ_TIMEOUT: {{ $cm.REDIS_READ_TIMEOUT | default "3" | quote }} + REDIS_WRITE_TIMEOUT: {{ $cm.REDIS_WRITE_TIMEOUT | default "3" | quote }} + REDIS_DIAL_TIMEOUT: {{ $cm.REDIS_DIAL_TIMEOUT | default "5" | quote }} + REDIS_POOL_TIMEOUT: {{ $cm.REDIS_POOL_TIMEOUT | default "2" | quote }} + REDIS_MAX_RETRIES: {{ $cm.REDIS_MAX_RETRIES | default "3" | quote }} + REDIS_MIN_RETRY_BACKOFF: {{ $cm.REDIS_MIN_RETRY_BACKOFF | default "8" | quote }} + REDIS_MAX_RETRY_BACKOFF: {{ $cm.REDIS_MAX_RETRY_BACKOFF | default "1" | quote }} + {{- if $cm.REDIS_TLS }} + REDIS_TLS: {{ $cm.REDIS_TLS | quote }} + {{- end }} + {{- if $cm.REDIS_MASTER_NAME }} + REDIS_MASTER_NAME: {{ $cm.REDIS_MASTER_NAME | quote }} + {{- end }} + + # ===================================================================== + # CIRCUIT BREAKER (prerequisite for object storage adapters) + # ===================================================================== + CIRCUIT_BREAKER_ENABLED: {{ $cm.CIRCUIT_BREAKER_ENABLED | default "true" | quote }} + + # ===================================================================== + # RABBITMQ (optional) + # ===================================================================== + RABBITMQ_ENABLED: {{ $cm.RABBITMQ_ENABLED | default "false" | quote }} + {{- if eq (toString ($cm.RABBITMQ_ENABLED | default "false")) "true" }} + RABBITMQ_URL: {{ $cm.RABBITMQ_URL | default (printf "amqp://br-ccs:$(RABBITMQ_DEFAULT_PASS)@%s-rabbitmq.%s.svc.cluster.local:5672/" .Release.Name $namespace) | quote }} + RABBITMQ_HOST: {{ $cm.RABBITMQ_HOST | default (printf "%s-rabbitmq.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + RABBITMQ_PORT_AMQP: {{ $cm.RABBITMQ_PORT_AMQP | default "5672" | quote }} + RABBITMQ_PORT_HOST: {{ $cm.RABBITMQ_PORT_HOST | default "15672" | quote }} + RABBITMQ_DEFAULT_USER: {{ $cm.RABBITMQ_DEFAULT_USER | default "br-ccs" | quote }} + RABBITMQ_VHOST: {{ $cm.RABBITMQ_VHOST | default "/" | quote }} + RABBITMQ_EXCHANGE: {{ $cm.RABBITMQ_EXCHANGE | default "events" | quote }} + RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS: {{ $cm.RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS | default "false" | quote }} + RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK: {{ $cm.RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK | default "false" | quote }} + RABBITMQ_ALLOW_INSECURE_TLS: {{ $cm.RABBITMQ_ALLOW_INSECURE_TLS | default "false" | quote }} + RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS: {{ $cm.RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS | default "5000" | quote }} + RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS: {{ $cm.RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS | default "1000" | quote }} + RABBITMQ_PUBLISHER_RECOVERY_MAX_MS: {{ $cm.RABBITMQ_PUBLISHER_RECOVERY_MAX_MS | default "30000" | quote }} + RABBITMQ_PUBLISHER_MAX_RECOVERIES: {{ $cm.RABBITMQ_PUBLISHER_MAX_RECOVERIES | default "10" | quote }} + CCS_STA_DLQ_TTL_SECONDS: {{ $cm.CCS_STA_DLQ_TTL_SECONDS | default "30" | quote }} + {{- if $cm.RABBITMQ_QUEUE }} + RABBITMQ_QUEUE: {{ $cm.RABBITMQ_QUEUE | quote }} + {{- end }} + {{- if $cm.RABBITMQ_HEALTH_CHECK_URL }} + RABBITMQ_HEALTH_CHECK_URL: {{ $cm.RABBITMQ_HEALTH_CHECK_URL | quote }} + {{- end }} + {{- if $cm.RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS }} + RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS: {{ $cm.RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS | quote }} + {{- end }} + {{- end }} + + # ===================================================================== + # OUTBOX + # ===================================================================== + OUTBOX_ENABLED: {{ $cm.OUTBOX_ENABLED | default "false" | quote }} + OUTBOX_TABLE_NAME: {{ $cm.OUTBOX_TABLE_NAME | default "outbox_events" | quote }} + OUTBOX_DISPATCH_INTERVAL_SEC: {{ $cm.OUTBOX_DISPATCH_INTERVAL_SEC | default "2" | quote }} + OUTBOX_BATCH_SIZE: {{ $cm.OUTBOX_BATCH_SIZE | default "50" | quote }} + OUTBOX_PUBLISH_MAX_ATTEMPTS: {{ $cm.OUTBOX_PUBLISH_MAX_ATTEMPTS | default "3" | quote }} + OUTBOX_PUBLISH_BACKOFF_MS: {{ $cm.OUTBOX_PUBLISH_BACKOFF_MS | default "200" | quote }} + OUTBOX_RETRY_WINDOW_SEC: {{ $cm.OUTBOX_RETRY_WINDOW_SEC | default "300" | quote }} + OUTBOX_MAX_DISPATCH_ATTEMPTS: {{ $cm.OUTBOX_MAX_DISPATCH_ATTEMPTS | default "10" | quote }} + OUTBOX_PROCESSING_TIMEOUT_SEC: {{ $cm.OUTBOX_PROCESSING_TIMEOUT_SEC | default "600" | quote }} + OUTBOX_MAX_FAILED_PER_BATCH: {{ $cm.OUTBOX_MAX_FAILED_PER_BATCH | default "25" | quote }} + OUTBOX_INCLUDE_TENANT_METRICS: {{ $cm.OUTBOX_INCLUDE_TENANT_METRICS | default "false" | quote }} + OUTBOX_ALLOW_EMPTY_TENANT: {{ $cm.OUTBOX_ALLOW_EMPTY_TENANT | default "true" | quote }} + {{- if $cm.OUTBOX_PRIORITY_EVENT_TYPES }} + OUTBOX_PRIORITY_EVENT_TYPES: {{ $cm.OUTBOX_PRIORITY_EVENT_TYPES | quote }} + {{- end }} + + # ===================================================================== + # FETCHER INTEGRATION + # ===================================================================== + FETCHER_ENABLED: {{ $cm.FETCHER_ENABLED | default "false" | quote }} + {{- if $cm.FETCHER_URL }} + FETCHER_URL: {{ $cm.FETCHER_URL | quote }} + {{- end }} + FETCHER_HTTP_TIMEOUT_SEC: {{ $cm.FETCHER_HTTP_TIMEOUT_SEC | default "30" | quote }} + CCS_OUTBOX_DISPATCH_INTERVAL_MS: {{ $cm.CCS_OUTBOX_DISPATCH_INTERVAL_MS | default "500" | quote }} + CCS_OUTBOX_BATCH_SIZE: {{ $cm.CCS_OUTBOX_BATCH_SIZE | default "50" | quote }} + CCS_OUTBOX_MAX_ATTEMPTS: {{ $cm.CCS_OUTBOX_MAX_ATTEMPTS | default "10" | quote }} + CCS_OUTBOX_DLQ_ROUTING_KEY: {{ $cm.CCS_OUTBOX_DLQ_ROUTING_KEY | default "ccs.outbox.dlq" | quote }} + + # ===================================================================== + # STA INTEGRATION + # ===================================================================== + STA_ENABLED: {{ $cm.STA_ENABLED | default "false" | quote }} + {{- if $cm.STA_BASE_URL }} + STA_BASE_URL: {{ $cm.STA_BASE_URL | quote }} + {{- end }} + STA_HTTP_TIMEOUT_SEC: {{ $cm.STA_HTTP_TIMEOUT_SEC | default "30" | quote }} + + # ===================================================================== + # REPORTER INTEGRATION (optional) + # ===================================================================== + REPORTER_ENABLED: {{ $cm.REPORTER_ENABLED | default "false" | quote }} + {{- if eq (toString ($cm.REPORTER_ENABLED | default "false")) "true" }} + REPORTER_URL: {{ required "brCcs.configmap.REPORTER_URL is required when REPORTER_ENABLED=true" $cm.REPORTER_URL | quote }} + REPORTER_HTTP_TIMEOUT_SEC: {{ $cm.REPORTER_HTTP_TIMEOUT_SEC | default "30" | quote }} + {{- end }} + + # ===================================================================== + # AUTHENTICATION (inbound) + # ===================================================================== + PLUGIN_AUTH_ENABLED: {{ $cm.PLUGIN_AUTH_ENABLED | default "false" | quote }} + {{- if $cm.PLUGIN_AUTH_HOST }} + PLUGIN_AUTH_HOST: {{ $cm.PLUGIN_AUTH_HOST | quote }} + {{- end }} + + # ===================================================================== + # SWAGGER + # ===================================================================== + SWAGGER_ENABLED: {{ $cm.SWAGGER_ENABLED | default "true" | quote }} + SWAGGER_TITLE: {{ $cm.SWAGGER_TITLE | default "br-ccs" | quote }} + SWAGGER_VERSION: {{ $cm.SWAGGER_VERSION | default .Chart.AppVersion | quote }} + SWAGGER_BASE_PATH: {{ $cm.SWAGGER_BASE_PATH | default "/" | quote }} + SWAGGER_LEFT_DELIM: {{ $cm.SWAGGER_LEFT_DELIM | default "{{" | quote }} + SWAGGER_RIGHT_DELIM: {{ $cm.SWAGGER_RIGHT_DELIM | default "}}" | quote }} + {{- if $cm.SWAGGER_DESCRIPTION }} + SWAGGER_DESCRIPTION: {{ $cm.SWAGGER_DESCRIPTION | quote }} + {{- end }} + + # ===================================================================== + # OPENTELEMETRY + # ===================================================================== + ENABLE_TELEMETRY: {{ $cm.ENABLE_TELEMETRY | default "false" | quote }} + OTEL_LIBRARY_NAME: {{ $cm.OTEL_LIBRARY_NAME | default "br-ccs" | quote }} + OTEL_RESOURCE_SERVICE_NAME: {{ $cm.OTEL_RESOURCE_SERVICE_NAME | default "br-ccs" | quote }} + OTEL_RESOURCE_SERVICE_VERSION: {{ $cm.OTEL_RESOURCE_SERVICE_VERSION | default (.Values.brCcs.image.tag | default .Chart.AppVersion) | quote }} + OTEL_EXPORTER_OTLP_ENDPOINT: {{ $cm.OTEL_EXPORTER_OTLP_ENDPOINT | default "" | quote }} + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: {{ $cm.OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT | default "production" | quote }} + + # ===================================================================== + # RATE LIMITING + # ===================================================================== + RATE_LIMIT_ENABLED: {{ $cm.RATE_LIMIT_ENABLED | default "true" | quote }} + RATE_LIMIT_MAX: {{ $cm.RATE_LIMIT_MAX | default "500" | quote }} + RATE_LIMIT_WINDOW_SEC: {{ $cm.RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + AGGRESSIVE_RATE_LIMIT_MAX: {{ $cm.AGGRESSIVE_RATE_LIMIT_MAX | default "100" | quote }} + AGGRESSIVE_RATE_LIMIT_WINDOW_SEC: {{ $cm.AGGRESSIVE_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + RELAXED_RATE_LIMIT_MAX: {{ $cm.RELAXED_RATE_LIMIT_MAX | default "1000" | quote }} + RELAXED_RATE_LIMIT_WINDOW_SEC: {{ $cm.RELAXED_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + EXPORT_RATE_LIMIT_MAX: {{ $cm.EXPORT_RATE_LIMIT_MAX | default "60" | quote }} + EXPORT_RATE_LIMIT_WINDOW_SEC: {{ $cm.EXPORT_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + DISPATCH_RATE_LIMIT_MAX: {{ $cm.DISPATCH_RATE_LIMIT_MAX | default "30" | quote }} + DISPATCH_RATE_LIMIT_WINDOW_SEC: {{ $cm.DISPATCH_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + + # ===================================================================== + # OBSERVABILITY / IDEMPOTENCY / PAGINATION + # ===================================================================== + DB_METRICS_INTERVAL_SEC: {{ $cm.DB_METRICS_INTERVAL_SEC | default "15" | quote }} + IDEMPOTENCY_RETRY_WINDOW_SEC: {{ $cm.IDEMPOTENCY_RETRY_WINDOW_SEC | default "300" | quote }} + MAX_PAGINATION_LIMIT: {{ $cm.MAX_PAGINATION_LIMIT | default "100" | quote }} + MAX_PAGINATION_MONTH_DATE_RANGE: {{ $cm.MAX_PAGINATION_MONTH_DATE_RANGE | default "3" | quote }} + + # ===================================================================== + # M2M CREDENTIALS (non-secret portion — target service / OAuth2 / scope) + # API keys live in the Secret; SaaS uses AWS Secrets Manager. + # ===================================================================== + M2M_CREDENTIAL_CACHE_TTL_SEC: {{ $cm.M2M_CREDENTIAL_CACHE_TTL_SEC | default "300" | quote }} + AWS_REGION: {{ $cm.AWS_REGION | default "us-east-1" | quote }} + {{- range $k := (list "FETCHER_M2M_TARGET_SERVICE" "FETCHER_OAUTH2_TOKEN_URL" "FETCHER_OAUTH2_SCOPE" "REPORTER_M2M_TARGET_SERVICE" "REPORTER_OAUTH2_TOKEN_URL" "REPORTER_OAUTH2_SCOPE" "STA_M2M_TARGET_SERVICE" "STA_OAUTH2_TOKEN_URL" "STA_OAUTH2_SCOPE") }} + {{- if index $cm $k }} + {{ $k }}: {{ index $cm $k | quote }} + {{- end }} + {{- end }} + + # ===================================================================== + # DETAIL RESPONSE TUNING (optional) + # ===================================================================== + {{- range $k := (list "CCS_DETAIL_MESSAGE_EMIT_ENABLED" "CCS_DETAIL_MESSAGE_VALIDATION_ENABLED" "CCS_BACEN_DESTINATARIO_CNPJ_BASE" "CCS_ACCS005_OVERFLOW_THRESHOLD" "CCS_ACCS005_SECRECY_SITUACAO") }} + {{- if index $cm $k }} + {{ $k }}: {{ index $cm $k | quote }} + {{- end }} + {{- end }} + + # ===================================================================== + # READINESS PROBE + GRACEFUL SHUTDOWN + # ===================================================================== + READYZ_PROBE_TIMEOUT_SEC: {{ $cm.READYZ_PROBE_TIMEOUT_SEC | default "5" | quote }} + READYZ_DEP_SLOW_THRESHOLD_MS: {{ $cm.READYZ_DEP_SLOW_THRESHOLD_MS | default "500" | quote }} + STARTUP_SELF_PROBE_MAX_DURATION_SEC: {{ $cm.STARTUP_SELF_PROBE_MAX_DURATION_SEC | default "120" | quote }} + STARTUP_SELF_PROBE_INITIAL_DELAY_MS: {{ $cm.STARTUP_SELF_PROBE_INITIAL_DELAY_MS | default "1000" | quote }} + STARTUP_SELF_PROBE_MAX_DELAY_MS: {{ $cm.STARTUP_SELF_PROBE_MAX_DELAY_MS | default "30000" | quote }} + SHUTDOWN_DRAIN_GRACE_PERIOD_SEC: {{ $cm.SHUTDOWN_DRAIN_GRACE_PERIOD_SEC | default "15" | quote }} + SHUTDOWN_TOTAL_TIMEOUT_SEC: {{ $cm.SHUTDOWN_TOTAL_TIMEOUT_SEC | default "30" | quote }} + + # ===================================================================== + # OBJECT STORAGE (non-secret — endpoints/region/bucket/flags) + # Access + secret keys live in the Secret. + # ===================================================================== + SEAWEEDFS_S3_PORT: {{ $cm.SEAWEEDFS_S3_PORT | default "8342" | quote }} + SEAWEEDFS_MASTER_PORT: {{ $cm.SEAWEEDFS_MASTER_PORT | default "9343" | quote }} + OBJECT_STORAGE_STA_ENDPOINT: {{ $cm.OBJECT_STORAGE_STA_ENDPOINT | default "" | quote }} + OBJECT_STORAGE_STA_REGION: {{ $cm.OBJECT_STORAGE_STA_REGION | default "us-east-1" | quote }} + OBJECT_STORAGE_STA_BUCKET: {{ $cm.OBJECT_STORAGE_STA_BUCKET | default "" | quote }} + OBJECT_STORAGE_STA_USE_PATH_STYLE: {{ $cm.OBJECT_STORAGE_STA_USE_PATH_STYLE | default "true" | quote }} + OBJECT_STORAGE_STA_DISABLE_SSL: {{ $cm.OBJECT_STORAGE_STA_DISABLE_SSL | default "true" | quote }} + OBJECT_STORAGE_CCS_ENDPOINT: {{ $cm.OBJECT_STORAGE_CCS_ENDPOINT | default "" | quote }} + OBJECT_STORAGE_CCS_REGION: {{ $cm.OBJECT_STORAGE_CCS_REGION | default "us-east-1" | quote }} + OBJECT_STORAGE_CCS_BUCKET: {{ $cm.OBJECT_STORAGE_CCS_BUCKET | default "" | quote }} + OBJECT_STORAGE_CCS_USE_PATH_STYLE: {{ $cm.OBJECT_STORAGE_CCS_USE_PATH_STYLE | default "true" | quote }} + OBJECT_STORAGE_CCS_DISABLE_SSL: {{ $cm.OBJECT_STORAGE_CCS_DISABLE_SSL | default "true" | quote }} + OBJECT_STORAGE_FETCHER_ENDPOINT: {{ $cm.OBJECT_STORAGE_FETCHER_ENDPOINT | default "" | quote }} + OBJECT_STORAGE_FETCHER_REGION: {{ $cm.OBJECT_STORAGE_FETCHER_REGION | default "us-east-1" | quote }} + OBJECT_STORAGE_FETCHER_BUCKET: {{ $cm.OBJECT_STORAGE_FETCHER_BUCKET | default "" | quote }} + OBJECT_STORAGE_FETCHER_USE_PATH_STYLE: {{ $cm.OBJECT_STORAGE_FETCHER_USE_PATH_STYLE | default "true" | quote }} + OBJECT_STORAGE_FETCHER_DISABLE_SSL: {{ $cm.OBJECT_STORAGE_FETCHER_DISABLE_SSL | default "true" | quote }} + CCS_OUTBOUND_RETENTION_DAYS: {{ $cm.CCS_OUTBOUND_RETENTION_DAYS | default "30" | quote }} + CCS_ACCS009_RETENTION_DAYS: {{ $cm.CCS_ACCS009_RETENTION_DAYS | default "30" | quote }} + + # ===================================================================== + # EXTRA OVERRIDES (escape hatch for optional knobs not modeled above) + # ===================================================================== + {{- range $key, $value := .Values.brCcs.extraEnvVars }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/deployment.yaml b/charts/br-ccs/templates/deployment.yaml new file mode 100644 index 00000000..9db8e19b --- /dev/null +++ b/charts/br-ccs/templates/deployment.yaml @@ -0,0 +1,181 @@ +{{- if .Values.brCcs.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} +spec: + revisionHistoryLimit: {{ .Values.brCcs.revisionHistoryLimit | default 10 }} + strategy: + type: {{ .Values.brCcs.deploymentUpdate.type }} + {{- if eq .Values.brCcs.deploymentUpdate.type "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ .Values.brCcs.deploymentUpdate.maxSurge }} + maxUnavailable: {{ .Values.brCcs.deploymentUpdate.maxUnavailable }} + {{- end }} + {{- if not .Values.brCcs.autoscaling.enabled }} + replicas: {{ .Values.brCcs.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "br-ccs.selectorLabels" (dict "context" . "name" .Values.brCcs.name ) | nindent 6 }} + template: + metadata: + {{- with .Values.brCcs.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 8 }} + spec: + {{- with .Values.brCcs.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "br-ccs.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.brCcs.podSecurityContext | nindent 8 }} + # br-ccs connects to PostgreSQL (control-plane) and Redis/Valkey at boot in + # both single-tenant and hybrid multi-tenant modes, so the dependency wait + # gate always runs. + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + envFrom: + - configMapRef: + name: {{ include "br-ccs.fullname" . }} + command: + - /bin/sh + - -c + - | + MAX_ATTEMPTS=60 + SLEEP_SECONDS=5 + # Total timeout: 60 * 5 = 300 seconds (5 minutes) + + wait_for_service() { + local HOST="$1" + local PORT="$2" + local ATTEMPTS=0 + echo "Checking $HOST:$PORT..." + while ! nc -z "$HOST" "$PORT"; do + ATTEMPTS=$((ATTEMPTS + 1)) + if [ $ATTEMPTS -ge $MAX_ATTEMPTS ]; then + echo "Timeout waiting for $HOST:$PORT after $((MAX_ATTEMPTS * SLEEP_SECONDS)) seconds" + exit 1 + fi + echo "$HOST:$PORT is not ready yet, waiting... (attempt $ATTEMPTS/$MAX_ATTEMPTS)" + sleep $SLEEP_SECONDS + done + echo "$HOST:$PORT is ready!" + } + + # Wait for PostgreSQL + wait_for_service "$POSTGRES_HOST" "$POSTGRES_PORT" + + # Wait for Redis/Valkey (REDIS_HOST is host:port) + REDIS_SVC=$(echo "$REDIS_HOST" | cut -d: -f1) + REDIS_PORT_NUM=$(echo "$REDIS_HOST" | cut -d: -f2) + wait_for_service "$REDIS_SVC" "$REDIS_PORT_NUM" + + echo "All dependencies are ready!" + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + containers: + - name: {{ include "br-ccs.fullname" . }} + securityContext: + {{- toYaml .Values.brCcs.securityContext | nindent 12 }} + image: "{{ .Values.brCcs.image.repository }}:{{ .Values.brCcs.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.brCcs.image.pullPolicy }} + envFrom: + - secretRef: + name: {{ if .Values.brCcs.useExistingSecret }}{{ required "brCcs.existingSecretName is required when brCcs.useExistingSecret is true" .Values.brCcs.existingSecretName }}{{ else }}{{ include "br-ccs.fullname" . }}{{ end }} + - configMapRef: + name: {{ include "br-ccs.fullname" . }} + env: + {{- $secretName := ternary .Values.brCcs.existingSecretName (include "br-ccs.fullname" .) .Values.brCcs.useExistingSecret }} + {{- $pg := .Values.postgresql | default dict }} + {{- $pgAuth := $pg.auth | default dict }} + {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} + {{- include "br-ccs.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 10 }} + {{- else if .Values.brCcs.secrets.POSTGRES_PASSWORD }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + {{- end }} + {{- $vk := .Values.valkey | default dict }} + {{- $vkAuth := $vk.auth | default dict }} + {{- if or (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled) $vkAuth.existingSecret }} + {{- include "br-ccs.infraSecretRef" (dict "context" $ "subchart" "valkey" "key" "valkey-password" "envName" "REDIS_PASSWORD") | nindent 10 }} + {{- else if .Values.brCcs.secrets.REDIS_PASSWORD }} + - name: REDIS_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: REDIS_PASSWORD + {{- end }} + {{- if eq (toString .Values.brCcs.configmap.ENABLE_TELEMETRY) "true" }} + - name: "HOST_IP" + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: "POD_IP" + valueFrom: + fieldRef: + fieldPath: status.podIP + - name: "OTEL_EXPORTER_OTLP_ENDPOINT" + value: "$(HOST_IP):4317" + - name: "OTEL_RESOURCE_ATTRIBUTES" + value: "k8s.pod.ip=$(POD_IP)" + {{- end }} + ports: + - name: http + containerPort: 4030 + protocol: TCP + livenessProbe: + httpGet: + path: {{ .Values.brCcs.livenessProbe.path | default "/health" }} + port: http + initialDelaySeconds: {{ .Values.brCcs.livenessProbe.initialDelaySeconds | default 15 }} + periodSeconds: {{ .Values.brCcs.livenessProbe.periodSeconds | default 20 }} + timeoutSeconds: {{ .Values.brCcs.livenessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.brCcs.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.brCcs.livenessProbe.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: {{ .Values.brCcs.readinessProbe.path | default "/readyz" }} + port: http + initialDelaySeconds: {{ .Values.brCcs.readinessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ .Values.brCcs.readinessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ .Values.brCcs.readinessProbe.timeoutSeconds | default 5 }} + successThreshold: {{ .Values.brCcs.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ .Values.brCcs.readinessProbe.failureThreshold | default 3 }} + resources: + {{- toYaml .Values.brCcs.resources | nindent 12 }} + {{- with .Values.brCcs.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.brCcs.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.brCcs.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.brCcs.hostAliases }} + hostAliases: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/hpa.yaml b/charts/br-ccs/templates/hpa.yaml new file mode 100644 index 00000000..99894999 --- /dev/null +++ b/charts/br-ccs/templates/hpa.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.brCcs.enabled .Values.brCcs.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "br-ccs.fullname" . }} + minReplicas: {{ .Values.brCcs.autoscaling.minReplicas }} + maxReplicas: {{ .Values.brCcs.autoscaling.maxReplicas }} + metrics: + {{- if .Values.brCcs.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.brCcs.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.brCcs.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.brCcs.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/ingress.yaml b/charts/br-ccs/templates/ingress.yaml new file mode 100644 index 00000000..5575ffaf --- /dev/null +++ b/charts/br-ccs/templates/ingress.yaml @@ -0,0 +1,62 @@ +{{- if .Values.brCcs.ingress.enabled -}} +{{- $ingressName := include "br-ccs.fullname" . -}} +{{- $svcPort := .Values.brCcs.service.port -}} +{{- if and .Values.brCcs.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }} + {{- if not (hasKey .Values.brCcs.ingress.annotations "kubernetes.io/ingress.class") }} + {{- $_ := set .Values.brCcs.ingress.annotations "kubernetes.io/ingress.class" .Values.brCcs.ingress.className}} + {{- end }} +{{- end }} +{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1 +{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}} +apiVersion: networking.k8s.io/v1beta1 +{{- else -}} +apiVersion: extensions/v1beta1 +{{- end }} +kind: Ingress +metadata: + name: {{ $ingressName }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} + {{- with .Values.brCcs.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if and .Values.brCcs.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }} + ingressClassName: {{ .Values.brCcs.ingress.className }} + {{- end }} + {{- if .Values.brCcs.ingress.tls }} + tls: + {{- range .Values.brCcs.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.brCcs.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }} + pathType: {{ .pathType }} + {{- end }} + backend: + {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }} + service: + name: {{ $ingressName }} + port: + number: {{ $svcPort }} + {{- else }} + serviceName: {{ $ingressName }} + servicePort: {{ $svcPort }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/migration-secret.yaml b/charts/br-ccs/templates/migration-secret.yaml new file mode 100644 index 00000000..ded00d6b --- /dev/null +++ b/charts/br-ccs/templates/migration-secret.yaml @@ -0,0 +1,33 @@ +{{- $brCcs := .Values.brCcs | default dict }} +{{- $migrations := get $brCcs "migrations" | default dict }} +{{- $postgresql := .Values.postgresql | default dict }} +{{- $migrationsEnabled := and (eq (lower (toString (get $brCcs "enabled" | default false))) "true") (eq (lower (toString (get $migrations "enabled" | default false))) "true") }} +{{- $internalPg := and (eq (lower (toString (get $postgresql "enabled" | default false))) "true") (not (eq (lower (toString (get $postgresql "external" | default false))) "true")) }} +{{- $migUseExisting := eq (lower (toString (get $migrations "useExistingSecret" | default false))) "true" }} +{{- $appUseExisting := eq (lower (toString (get $brCcs "useExistingSecret" | default false))) "true" }} +{{- /* Minimal, migration-only Secret. Rendered ONLY for: migrations enabled, chart-managed + credential (no existing Secret), EXTERNAL Postgres. In that case the migration runs as a + pre-install/pre-upgrade hook BEFORE the normal application Secret exists, so it needs its + own credential available early. It carries ONLY POSTGRES_PASSWORD — the full application + Secret stays a normal (non-hook) resource so sensitive runtime keys are never orphaned. */}} +{{- if and $migrationsEnabled (not $internalPg) (not $migUseExisting) (not $appUseExisting) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ printf "%s-migrations" (include "br-ccs.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "migrations" "name" (get $brCcs "name")) | nindent 4 }} + annotations: + # Pre-install/pre-upgrade hook (weight -5) so it exists before the migration Job + # (weight -1). Holds ONLY POSTGRES_PASSWORD. + "helm.sh/hook": pre-install,pre-upgrade + "helm.sh/hook-weight": "-5" + "helm.sh/hook-delete-policy": before-hook-creation + "argocd.argoproj.io/hook": PreSync + "argocd.argoproj.io/sync-wave": "-5" + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation +type: Opaque +stringData: + POSTGRES_PASSWORD: {{ include "br-ccs.migrationPostgresPassword" . | quote }} +{{- end }} diff --git a/charts/br-ccs/templates/migrations.yaml b/charts/br-ccs/templates/migrations.yaml new file mode 100644 index 00000000..bd122c2e --- /dev/null +++ b/charts/br-ccs/templates/migrations.yaml @@ -0,0 +1,162 @@ +{{- $brCcs := .Values.brCcs | default dict }} +{{- $migrations := get $brCcs "migrations" | default dict }} +{{- $configmap := get $brCcs "configmap" | default dict }} +{{- $postgresql := .Values.postgresql | default dict }} +{{- $migrationImage := get $migrations "image" | default dict }} +{{- $defaultMigrationResources := dict "requests" (dict "cpu" "50m" "memory" "64Mi") "limits" (dict "cpu" "250m" "memory" "256Mi") }} +{{- $migrationsEnabled := and (eq (lower (toString (get $brCcs "enabled" | default false))) "true") (eq (lower (toString (get $migrations "enabled" | default false))) "true") }} +{{- if $migrationsEnabled }} +{{- /* Internal (chart-managed) Postgres support. When postgresql.enabled=true and not + external, the database is provisioned during the Sync phase (bitnami), so the + migration runs as a POST hook (after the DB exists) with a wait-for-Postgres + initContainer. External/pre-existing Postgres keeps the PRE hook (DB already exists). */}} +{{- $internalPg := and (eq (lower (toString (get $postgresql "enabled" | default false))) "true") (not (eq (lower (toString (get $postgresql "external" | default false))) "true")) }} +{{- $appUseExisting := eq (lower (toString (get $brCcs "useExistingSecret" | default false))) "true" }} +{{- $migUseExisting := eq (lower (toString (get $migrations "useExistingSecret" | default false))) "true" }} +{{- $existingSecretName := "" }} +{{- if $migUseExisting }} +{{- $existingSecretName = required "brCcs.migrations.existingSecretName is required when brCcs.migrations.useExistingSecret=true" (get $migrations "existingSecretName") }} +{{- else if $appUseExisting }} +{{- $existingSecretName = required "brCcs.existingSecretName is required when brCcs.useExistingSecret=true" (get $brCcs "existingSecretName") }} +{{- else if $internalPg }} +{{- $existingSecretName = include "br-ccs.fullname" . }} +{{- else }} +{{- $existingSecretName = printf "%s-migrations" (include "br-ccs.fullname" .) | trunc 63 | trimSuffix "-" }} +{{- end }} +{{- $namespace := include "global.namespace" . }} +{{- $migrationTag := get $migrationImage "tag" | default "" }} +{{- $migrationDigest := get $migrationImage "digest" | default "" }} +{{- if and (empty $migrationTag) (empty $migrationDigest) }} +{{- $migrationTag = .Values.brCcs.image.tag | default .Chart.AppVersion }} +{{- end }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ printf "%s-migrations" (include "br-ccs.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $namespace }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "migrations" "name" (get $brCcs "name") ) | nindent 4 }} + annotations: + {{- if $internalPg }} + # Internal Postgres is provisioned during Sync — run AFTER it exists and is reachable. + "helm.sh/hook": post-install,post-upgrade + "argocd.argoproj.io/hook": PostSync + {{- else }} + # External Postgres already exists — run BEFORE the app rolls out (schema-first). + "helm.sh/hook": pre-install,pre-upgrade + "argocd.argoproj.io/hook": PreSync + {{- end }} + "helm.sh/hook-weight": "-1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation,HookSucceeded + {{- with (get $migrations "annotations") }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + backoffLimit: {{ get $migrations "backoffLimit" | default 3 }} + activeDeadlineSeconds: {{ get $migrations "activeDeadlineSeconds" | default 600 }} + ttlSecondsAfterFinished: {{ get $migrations "ttlSecondsAfterFinished" | default 600 }} + template: + metadata: + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "migrations" "name" (get $brCcs "name") ) | nindent 8 }} + {{- with (get $migrations "podAnnotations") }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with (get $brCcs "imagePullSecrets") }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $migrations "serviceAccountName") }} + serviceAccountName: {{ . | quote }} + {{- end }} + {{- if $internalPg }} + initContainers: + - name: wait-for-postgres + image: busybox:1.37 + command: + - /bin/sh + - -c + - > + echo "Waiting for $POSTGRES_HOST:$POSTGRES_PORT..."; + ELAPSED=0; + while ! nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do + if [ $ELAPSED -ge 300 ]; then echo "Timeout after 300s"; exit 1; fi; + echo "not ready, waiting (${ELAPSED}s/300s)"; sleep 5; ELAPSED=$((ELAPSED + 5)); + done; + echo "Postgres is ready"; + env: + - name: POSTGRES_HOST + value: {{ get $configmap "POSTGRES_HOST" | default (printf "%s-postgresql-primary.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + - name: POSTGRES_PORT + value: {{ get $configmap "POSTGRES_PORT" | default "5432" | quote }} + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + {{- end }} + containers: + - name: migrations + {{- $migrationRepository := get $migrationImage "repository" | default "ghcr.io/lerianstudio/br-ccs-migrations" }} + {{- if $migrationDigest }} + image: "{{ $migrationRepository }}@{{ $migrationDigest }}" + {{- else }} + image: "{{ $migrationRepository }}:{{ $migrationTag }}" + {{- end }} + imagePullPolicy: {{ get $migrationImage "pullPolicy" | default "IfNotPresent" }} + env: + - name: MIGRATIONS_PATH + value: {{ get $migrations "path" | default "/migrations" | quote }} + - name: POSTGRES_HOST + value: {{ get $configmap "POSTGRES_HOST" | default (printf "%s-postgresql-primary.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + - name: POSTGRES_PORT + value: {{ get $configmap "POSTGRES_PORT" | default "5432" | quote }} + - name: POSTGRES_USER + value: {{ get $configmap "POSTGRES_USER" | default "br-ccs" | quote }} + - name: POSTGRES_NAME + value: {{ get $configmap "POSTGRES_NAME" | default "br-ccs" | quote }} + - name: POSTGRES_SSLMODE + value: {{ get $configmap "POSTGRES_SSLMODE" | default "require" | quote }} + - name: POSTGRES_CONNECT_TIMEOUT_SEC + value: {{ get $configmap "POSTGRES_CONNECT_TIMEOUT_SEC" | default "10" | quote }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $existingSecretName }} + key: POSTGRES_PASSWORD + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + {{- toYaml (get $migrations "resources" | default $defaultMigrationResources) | nindent 12 }} + {{- with (get $brCcs "nodeSelector") }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $brCcs "affinity") }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $brCcs "tolerations") }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/pdb.yaml b/charts/br-ccs/templates/pdb.yaml new file mode 100644 index 00000000..d8ba6c5e --- /dev/null +++ b/charts/br-ccs/templates/pdb.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.brCcs.enabled .Values.brCcs.pdb.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} + {{- with .Values.brCcs.pdb.annotations }} + annotations: + {{- range $key, $value := . }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +spec: + {{- with .Values.brCcs.pdb.maxUnavailable }} + maxUnavailable: {{ . }} + {{- else }} + minAvailable: {{ .Values.brCcs.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- include "br-ccs.selectorLabels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 6 }} +{{- end }} diff --git a/charts/br-ccs/templates/rabbitmq_load_definitions.yaml b/charts/br-ccs/templates/rabbitmq_load_definitions.yaml new file mode 100644 index 00000000..d992d181 --- /dev/null +++ b/charts/br-ccs/templates/rabbitmq_load_definitions.yaml @@ -0,0 +1,12 @@ +{{- if .Values.rabbitmq.enabled }} +kind: Secret +apiVersion: v1 +metadata: + name: {{ include "br-ccs.fullname" . }}-rabbitmq-load-definition + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" "rabbitmq" "name" "load-definition") | nindent 4 }} +data: + load_definition.json: | + {{ .Files.Get "files/rabbitmq/load_definitions.json" | b64enc | nindent 4 }} +{{- end }} diff --git a/charts/br-ccs/templates/secrets.yaml b/charts/br-ccs/templates/secrets.yaml new file mode 100644 index 00000000..bb4b73ad --- /dev/null +++ b/charts/br-ccs/templates/secrets.yaml @@ -0,0 +1,75 @@ +{{- if .Values.brCcs.enabled }} +{{- if not .Values.brCcs.useExistingSecret }} +{{- $s := .Values.brCcs.secrets | default dict }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} +type: Opaque +stringData: + # Infra passwords (PostgreSQL / Valkey) are single-sourced from the bundled + # Bitnami subchart Secrets and read via secretKeyRef on the deployment. They + # are written here ONLY for an EXTERNAL infra component without an + # .auth.existingSecret. + {{- $pg := .Values.postgresql | default dict }} + {{- $pgAuth := $pg.auth | default dict }} + {{- if and (not (and (ne (toString $pg.enabled) "false") (not $pg.external))) (not $pgAuth.existingSecret) $s.POSTGRES_PASSWORD }} + POSTGRES_PASSWORD: {{ $s.POSTGRES_PASSWORD | quote }} + {{- if $s.POSTGRES_REPLICA_PASSWORD }} + POSTGRES_REPLICA_PASSWORD: {{ $s.POSTGRES_REPLICA_PASSWORD | quote }} + {{- end }} + {{- end }} + + # Redis/Valkey password (external-only; bundled valkey is read from its subchart Secret) + {{- $vk := .Values.valkey | default dict }} + {{- $vkAuth := $vk.auth | default dict }} + {{- if and (not (and (ne (toString $vk.enabled) "false") (not $vk.external) $vkAuth.enabled)) (not $vkAuth.existingSecret) $s.REDIS_PASSWORD }} + REDIS_PASSWORD: {{ $s.REDIS_PASSWORD | quote }} + {{- end }} + {{- if $s.REDIS_CA_CERT }} + REDIS_CA_CERT: {{ $s.REDIS_CA_CERT | quote }} + {{- end }} + + # Multi-tenant (tenant-manager) secrets + {{- if $s.MULTI_TENANT_SERVICE_API_KEY }} + MULTI_TENANT_SERVICE_API_KEY: {{ $s.MULTI_TENANT_SERVICE_API_KEY | quote }} + {{- end }} + {{- if $s.MULTI_TENANT_REDIS_PASSWORD }} + MULTI_TENANT_REDIS_PASSWORD: {{ $s.MULTI_TENANT_REDIS_PASSWORD | quote }} + {{- end }} + {{- if $s.MULTI_TENANT_REDIS_CA_CERT }} + MULTI_TENANT_REDIS_CA_CERT: {{ $s.MULTI_TENANT_REDIS_CA_CERT | quote }} + {{- end }} + + # RabbitMQ credentials (when RABBITMQ_ENABLED=true) + {{- if $s.RABBITMQ_DEFAULT_PASS }} + RABBITMQ_DEFAULT_PASS: {{ $s.RABBITMQ_DEFAULT_PASS | quote }} + {{- end }} + + # Crypto keys (REQUIRED in production — empty CCS_CRYPTO_MASTER_KEY fails fast + # at boot by design; supply via a secrets manager or an existing Secret). + {{- if $s.CCS_CRYPTO_MASTER_KEY }} + CCS_CRYPTO_MASTER_KEY: {{ $s.CCS_CRYPTO_MASTER_KEY | quote }} + {{- end }} + {{- if $s.FETCHER_CRYPTO_KEY }} + FETCHER_CRYPTO_KEY: {{ $s.FETCHER_CRYPTO_KEY | quote }} + {{- end }} + + # Object storage credentials (per bucket) + {{- range $k := (list "OBJECT_STORAGE_STA_ACCESS_KEY" "OBJECT_STORAGE_STA_SECRET_KEY" "OBJECT_STORAGE_CCS_ACCESS_KEY" "OBJECT_STORAGE_CCS_SECRET_KEY" "OBJECT_STORAGE_FETCHER_ACCESS_KEY" "OBJECT_STORAGE_FETCHER_SECRET_KEY") }} + {{- if index $s $k }} + {{ $k }}: {{ index $s $k | quote }} + {{- end }} + {{- end }} + + # Per-upstream M2M API keys (on-prem / local fallback) + {{- range $k := (list "FETCHER_API_KEY" "REPORTER_API_KEY" "STA_API_KEY") }} + {{- if index $s $k }} + {{ $k }}: {{ index $s $k | quote }} + {{- end }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/br-ccs/templates/service.yaml b/charts/br-ccs/templates/service.yaml new file mode 100644 index 00000000..36625790 --- /dev/null +++ b/charts/br-ccs/templates/service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.brCcs.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "br-ccs.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} + {{- with .Values.brCcs.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.brCcs.service.type }} + ports: + - port: {{ .Values.brCcs.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "br-ccs.selectorLabels" (dict "context" . "name" .Values.brCcs.name) | nindent 4 }} +{{- end }} diff --git a/charts/br-ccs/templates/serviceaccount.yaml b/charts/br-ccs/templates/serviceaccount.yaml new file mode 100644 index 00000000..216c612a --- /dev/null +++ b/charts/br-ccs/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.brCcs.enabled .Values.brCcs.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "br-ccs.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-ccs.labels" (dict "context" . "component" .Values.brCcs.name "name" .Values.brCcs.name ) | nindent 4 }} + {{- with .Values.brCcs.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/br-ccs/values-template.yaml b/charts/br-ccs/values-template.yaml new file mode 100644 index 00000000..47db806a --- /dev/null +++ b/charts/br-ccs/values-template.yaml @@ -0,0 +1,166 @@ +# Template values for br-ccs deployment. +# Copy this file and fill in the required values for your environment. +# REQUIRED fields must be set before deployment. + +brCcs: + name: br-ccs + enabled: true + replicaCount: 2 + + ingress: + enabled: false + className: "" + annotations: {} + hosts: + - host: "" # Set your hostname (e.g., br-ccs.example.com) + paths: + - path: / + pathType: Prefix + tls: [] + migrations: + # -- Enable or disable the migrations job + enabled: true + configmap: + # Chart scope: infrastructure connection + multi-tenant toggle + integration + # master switches + object-storage endpoints. Operational tuning (timeouts, + # retries, rate limits, poll cadence, detail-message flags) ships with + # lib-commons / systemplane defaults or via brCcs.extraEnvVars. + + # ================================================================= + # Application identity + # ================================================================= + ENV_NAME: "" # REQUIRED - Environment name (e.g., production, staging) + DEPLOYMENT_MODE: "byoc" # local | byoc | saas (saas enforces TLS on deps) + CCS_RUN_MODE: "all" # manager | worker | all + SERVER_ADDRESS: ":4030" + SERVER_PORT: "4030" + + # ================================================================= + # TLS / proxy — TRUSTED_PROXIES REQUIRED when ENV_NAME=production + # ================================================================= + TLS_TERMINATED_UPSTREAM: "true" + TRUSTED_PROXIES: "" # e.g. 10.0.0.0/8,172.16.0.0/12 + + # ================================================================= + # Multi-tenancy + # ================================================================= + DEFAULT_TENANT_ID: "11111111-1111-1111-1111-111111111111" + MULTI_TENANT_ENABLED: "false" + # When MULTI_TENANT_ENABLED=true, also set: + # MULTI_TENANT_URL: "" + # MULTI_TENANT_REDIS_HOST: "" + + # ================================================================= + # PostgreSQL primary - REQUIRED + # ================================================================= + POSTGRES_HOST: "" # REQUIRED - PostgreSQL primary host + POSTGRES_PORT: "5432" + POSTGRES_USER: "br-ccs" + POSTGRES_NAME: "br-ccs" + POSTGRES_SSLMODE: "require" + + # ================================================================= + # Redis/Valkey (app-level) - REQUIRED + # ================================================================= + REDIS_HOST: "" # REQUIRED - Redis/Valkey host:port + + # ================================================================= + # Circuit breaker (prerequisite for object storage) + # ================================================================= + CIRCUIT_BREAKER_ENABLED: "true" + + # ================================================================= + # Integrations (master switches; URLs required when enabled) + # ================================================================= + FETCHER_ENABLED: "false" + # FETCHER_URL: "" + STA_ENABLED: "false" + # STA_BASE_URL: "" + REPORTER_ENABLED: "false" + # REPORTER_URL: "" + + # ================================================================= + # Authentication (inbound) + # ================================================================= + PLUGIN_AUTH_ENABLED: "false" + # PLUGIN_AUTH_HOST: "" # REQUIRED when PLUGIN_AUTH_ENABLED=true + + # ================================================================= + # OpenTelemetry + # ================================================================= + ENABLE_TELEMETRY: "false" + OTEL_EXPORTER_OTLP_ENDPOINT: "" # Set if ENABLE_TELEMETRY=true + + # ================================================================= + # Object storage (per bucket; empty *_BUCKET marks readyz dep skipped) + # ================================================================= + OBJECT_STORAGE_STA_ENDPOINT: "" + OBJECT_STORAGE_STA_BUCKET: "" + OBJECT_STORAGE_CCS_ENDPOINT: "" + OBJECT_STORAGE_CCS_BUCKET: "" + OBJECT_STORAGE_FETCHER_ENDPOINT: "" + OBJECT_STORAGE_FETCHER_BUCKET: "" + + secrets: + # PostgreSQL - REQUIRED + POSTGRES_PASSWORD: "" # REQUIRED - PostgreSQL primary password + + # Redis/Valkey - REQUIRED + REDIS_PASSWORD: "" # REQUIRED - Redis/Valkey password + + # Crypto keys - REQUIRED in production (empty CCS_CRYPTO_MASTER_KEY fails fast at boot) + CCS_CRYPTO_MASTER_KEY: "" # AES-256-GCM master key, 64 hex chars (openssl rand -hex 32) + FETCHER_CRYPTO_KEY: "" # Fetcher snapshot decryption key (base64; = Fetcher APP_ENC_KEY) + + # Object storage credentials (set alongside the matching *_BUCKET) + # OBJECT_STORAGE_STA_ACCESS_KEY: "" + # OBJECT_STORAGE_STA_SECRET_KEY: "" + # OBJECT_STORAGE_CCS_ACCESS_KEY: "" + # OBJECT_STORAGE_CCS_SECRET_KEY: "" + # OBJECT_STORAGE_FETCHER_ACCESS_KEY: "" + # OBJECT_STORAGE_FETCHER_SECRET_KEY: "" + + # Per-upstream M2M API keys (on-prem / local fallback; SaaS uses OAuth2) + # FETCHER_API_KEY: "" + # REPORTER_API_KEY: "" + # STA_API_KEY: "" + + # Multi-tenant (tenant-manager) + # MULTI_TENANT_SERVICE_API_KEY: "" + + # RabbitMQ (when RABBITMQ_ENABLED=true) + # RABBITMQ_DEFAULT_PASS: "" + + useExistingSecret: false + existingSecretName: "" + +# ============================================================================== +# INFRASTRUCTURE DEPENDENCIES +# ============================================================================== +# br-ccs is PostgreSQL-only (no MongoDB): +# +# PostgreSQL: +# - Database: br-ccs +# - User: br-ccs (full privileges on the br-ccs database) +# - Schema: public (default). Multi-tenant mode uses schema-per-tenant via +# search_path; there is no tenant_id column. +# +# Redis/Valkey: +# - Used for: rate limiting, idempotency keys, caching. No pre-config needed. +# +# RabbitMQ (OPTIONAL - event bus, disabled by default): +# - Exchange: events (topic, durable) +# ============================================================================== + +# Disable internal dependencies for external infrastructure +valkey: + enabled: false + external: true + +postgresql: + enabled: false + external: true + +rabbitmq: + enabled: false + external: true diff --git a/charts/br-ccs/values.schema.json b/charts/br-ccs/values.schema.json new file mode 100644 index 00000000..0c788732 --- /dev/null +++ b/charts/br-ccs/values.schema.json @@ -0,0 +1,44 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "additionalProperties": true, + "properties": { + "nameOverride": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "namespaceOverride": { + "type": "string" + }, + "global": { + "type": "object", + "additionalProperties": true + }, + "brCcs": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "valkey": { + "type": "object", + "additionalProperties": true + }, + "postgresql": { + "type": "object", + "additionalProperties": true + }, + "rabbitmq": { + "type": "object", + "additionalProperties": true + } + } +} diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml new file mode 100644 index 00000000..37ea5bd5 --- /dev/null +++ b/charts/br-ccs/values.yaml @@ -0,0 +1,673 @@ +# Default values for br-ccs. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. +# +# Env-var coverage note: every variable in the application's config/.env.example +# is mapped either into brCcs.configmap (non-secret) or brCcs.secrets +# (credentials / keys), or is provided by a bundled subchart. Operational tuning +# knobs that ship with lib-commons / systemplane defaults are exposed as +# optional entries and can be set under brCcs.configmap as needed. +nameOverride: "br-ccs" +fullnameOverride: "" +namespaceOverride: "" +global: + # -- Bootstrap job for external PostgreSQL: creates databases, roles, and grants privileges + externalPostgresDefinitions: + # -- Enable or disable the PostgreSQL bootstrap job + enabled: false + # -- PostgreSQL connection settings + connection: + # -- PostgreSQL host + host: "br-ccs-postgresql-primary" + # -- PostgreSQL port + port: "5432" + # -- Admin credentials for PostgreSQL + postgresAdminLogin: + useExistingSecret: + # -- Name of existing secret containing DB_USER_ADMIN and DB_ADMIN_PASSWORD keys + name: "" + # -- Admin username (ignored if useExistingSecret.name is set) + username: "postgres" + # -- Admin password (ignored if useExistingSecret.name is set) + password: "" + # -- Credentials for the br-ccs role created by the job + brCcsCredentials: + useExistingSecret: + # -- Name of existing secret containing DB_PASSWORD_BR_CCS key + name: "" + # -- Password for the br-ccs role (ignored if useExistingSecret.name is set) + password: "" + # -- Bootstrap job for external RabbitMQ: creates users, vhosts, and permissions + externalRabbitmqDefinitions: + # -- Enable or disable the RabbitMQ bootstrap job + enabled: false + # -- RabbitMQ connection settings + connection: + # -- RabbitMQ protocol (http or https) + protocol: "http" + # -- RabbitMQ host (management API endpoint) + host: "br-ccs-rabbitmq" + # -- RabbitMQ HTTP management port + port: "15672" + # -- RabbitMQ AMQP port (for connectivity check) + portAmqp: "5672" + # -- Skip TLS verification for self-signed certificates (not recommended for production) + skipTlsVerify: false + # -- Admin credentials for RabbitMQ management API + rabbitmqAdminLogin: + useExistingSecret: + # -- Name of existing secret containing RABBITMQ_ADMIN_USER and RABBITMQ_ADMIN_PASS keys + name: "" + # -- Admin username (ignored if useExistingSecret.name is set) + username: "admin" + # -- Admin password (ignored if useExistingSecret.name is set) + password: "" + # -- Credentials for the br-ccs user created by the job + brCcsCredentials: + useExistingSecret: + # -- Name of existing secret containing RABBITMQ_BR_CCS_PASS key + name: "" + # -- Password for the br-ccs user (ignored if useExistingSecret.name is set) + password: "" +brCcs: + # -- Readiness probe configuration. All fields override chart defaults. + readinessProbe: {} + # -- Liveness probe configuration. All fields override chart defaults. + livenessProbe: {} + # -- Service name + name: br-ccs + # -- Enable or disable the br-ccs service + enabled: true + # -- Number of replicas for the br-ccs service + replicaCount: 2 + # -- Number of old ReplicaSets to retain for deployment rollback + revisionHistoryLimit: 10 + image: + # -- Repository for the br-ccs service container image + repository: ghcr.io/lerianstudio/br-ccs + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Image tag used for deployment + tag: "1.0.0" + # -- PostgreSQL migrations job (Helm hook; ArgoCD PreSync for external PG, + # PostSync for the bundled subchart). Runs the dedicated br-ccs-migrations + # image (golang-migrate runner; the app image never migrates). The + # chart-managed Secret is rendered as an earlier hook so it exists before the + # migration hook — migrations run against the chart-managed Secret with NO + # pre-existing Secret required. Set useExistingSecret only to read + # POSTGRES_PASSWORD from an operator-provisioned Secret instead. + migrations: + # -- Enable or disable the migrations job. + enabled: true + # -- Optional. When true, migrations read POSTGRES_PASSWORD from a pre-existing + # Secret (existingSecretName) instead of the chart-managed Secret hook. + useExistingSecret: false + # -- Name of the pre-existing Secret containing POSTGRES_PASSWORD + # (only used when useExistingSecret=true). + existingSecretName: "" + # -- MIGRATIONS_PATH inside the migrations image (embedded at /migrations). + path: "/migrations" + image: + # -- Repository for the migrations runner image + repository: ghcr.io/lerianstudio/br-ccs-migrations + # -- Tag for the migrations image. Defaults to the app image tag + # (brCcs.image.tag, or the chart appVersion) when left empty. + tag: "" + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Maximum number of retries before the Job is considered failed + backoffLimit: 3 + resources: + limits: + cpu: 250m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi + # -- Secrets for pulling images from a private registry + imagePullSecrets: [] + # -- Overrides the default generated name by Helm + nameOverride: "" + # -- Overrides the full name generated by Helm + fullnameOverride: "" + # -- Pod annotations for additional metadata + podAnnotations: {} + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + # -- Defines the group ID for the user running the process inside the container + runAsGroup: 1000 + # -- Defines the user ID for the process running inside the container + runAsUser: 1000 + # -- Ensures the process does not run as root + runAsNonRoot: true + capabilities: + drop: + - ALL + allowPrivilegeEscalation: false + # -- Defines the root filesystem as read-only + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + # -- PodDisruptionBudget configuration + pdb: + # -- Enable or disable PodDisruptionBudget + enabled: true + # -- Minimum number of available pods + minAvailable: 1 + # -- Maximum number of unavailable pods + maxUnavailable: 1 + # -- Annotations for the PodDisruptionBudget + annotations: {} + # -- Deployment update strategy + deploymentUpdate: + # -- Type of deployment strategy + type: RollingUpdate + # -- Maximum number of pods that can be created over the desired number of pods + maxSurge: 100% + # -- Maximum number of pods that can be unavailable during the update + maxUnavailable: 0 + service: + # -- Kubernetes service type + type: ClusterIP + # -- Port for the HTTP API + port: 4030 + annotations: {} + ingress: + # -- Enable or disable ingress + enabled: false + # -- Ingress class name + className: "" + # -- Additional ingress annotations + annotations: {} + hosts: + - host: "" + paths: + - path: / + pathType: Prefix + # -- TLS configuration for ingress + tls: [] + # - secretName: chart-example-tls + # hosts: + # - chart-example.local + resources: + # -- CPU and memory limits for pods + limits: + cpu: 1500m + memory: 512Mi + # -- Minimum CPU and memory requests + requests: + cpu: 500m + memory: 256Mi + autoscaling: + # -- Enable or disable horizontal pod autoscaling + enabled: true + # -- Minimum number of replicas + minReplicas: 2 + # -- Maximum number of replicas + maxReplicas: 5 + # -- Target CPU utilization percentage for autoscaling + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + # -- Tolerations for scheduling on tainted nodes + tolerations: [] + # -- Affinity rules for pod scheduling + affinity: {} + # -- Host aliases for custom DNS resolution inside the pod + hostAliases: [] + # -- ConfigMap for environment variables and configurations + # @default -- templates/configmap.yaml + configmap: + # ================================================================= + # Application identity + # ================================================================= + APPLICATION_NAME: "br-ccs" + ENV_NAME: "production" + VERSION: "1.0.0" + LOG_LEVEL: "info" + # DEPLOYMENT_MODE: local | byoc | saas. saas enforces TLS on all dependencies. + DEPLOYMENT_MODE: "byoc" + # CCS_RUN_MODE: manager | worker | all. "all" runs the HTTP API and the + # background workers in a single process (chart default: one deployment). + CCS_RUN_MODE: "all" + SERVER_ADDRESS: ":4030" + # SERVER_PORT is consumed by the in-container /healthcheck binary; keep it + # aligned with the port half of SERVER_ADDRESS. + SERVER_PORT: "4030" + GRPC_PORT: "7001" + HTTP_BODY_LIMIT_BYTES: "104857600" + + # ================================================================= + # CORS policy + # In production the validator rejects wildcard "*" and localhost origins. + # Override CORS_ALLOWED_ORIGINS with the public ingress hostname allowlist. + # ================================================================= + CORS_ALLOWED_ORIGINS: "" + CORS_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + CORS_ALLOWED_HEADERS: "Authorization,Content-Type,X-Tenant-ID,X-Idempotency,X-Request-ID" + CORS_EXPOSE_HEADERS: "" + CORS_ALLOW_CREDENTIALS: "false" + + # ================================================================= + # TLS / proxy + # TRUSTED_PROXIES is REQUIRED when ENV_NAME=production (VPC + ingress CIDR; + # never 0.0.0.0/0). Fiber honours X-Forwarded-For only from these ranges. + # ================================================================= + TLS_TERMINATED_UPSTREAM: "true" + TRUSTED_PROXIES: "" + # SERVER_TLS_CERT_FILE: "" + # SERVER_TLS_KEY_FILE: "" + + # ================================================================= + # Single-tenant defaults + # ================================================================= + DEFAULT_TENANT_ID: "11111111-1111-1111-1111-111111111111" + + # ================================================================= + # Multi-tenancy (tenant-manager starter) + # Toggle + DEFAULT_TENANT_ID always render. MT infra endpoints only + # render when MULTI_TENANT_ENABLED=true. + # ================================================================= + MULTI_TENANT_ENABLED: "false" + # MULTI_TENANT_URL: "" + # MULTI_TENANT_REDIS_HOST: "" + MULTI_TENANT_REDIS_PORT: "6379" + MULTI_TENANT_REDIS_TLS: "false" + MULTI_TENANT_MAX_TENANT_POOLS: "100" + MULTI_TENANT_IDLE_TIMEOUT_SEC: "300" + MULTI_TENANT_TIMEOUT: "30" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" + MULTI_TENANT_CACHE_TTL_SEC: "120" + MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: "30" + + # ================================================================= + # PostgreSQL (primary) + # POSTGRES_HOST defaults to "-postgresql-primary..svc.cluster.local" + # ================================================================= + POSTGRES_PORT: "5432" + POSTGRES_USER: "br-ccs" + POSTGRES_NAME: "br-ccs" + POSTGRES_SSLMODE: "require" + MIGRATIONS_PATH: "migrations" + SYSTEMPLANE_ENABLED: "false" + POSTGRES_MAX_OPEN_CONNS: "25" + POSTGRES_MAX_IDLE_CONNS: "5" + POSTGRES_CONN_MAX_LIFETIME_MINS: "30" + POSTGRES_CONN_MAX_IDLE_TIME_MINS: "5" + POSTGRES_CONNECT_TIMEOUT_SEC: "10" + INFRA_CONNECT_TIMEOUT_SEC: "30" + # PostgreSQL replica (optional — CQRS read scaling) + # POSTGRES_REPLICA_HOST: "" + # POSTGRES_REPLICA_PORT: "5432" + # POSTGRES_REPLICA_USER: "" + # POSTGRES_REPLICA_NAME: "" + # POSTGRES_REPLICA_SSLMODE: "require" + + # ================================================================= + # Redis / Valkey (app-level) + # REDIS_HOST defaults to "-valkey-primary..svc.cluster.local:6379" + # ================================================================= + REDIS_DB: "0" + REDIS_PROTOCOL: "3" + REDIS_POOL_SIZE: "10" + REDIS_MIN_IDLE_CONNS: "2" + REDIS_READ_TIMEOUT: "3" + REDIS_WRITE_TIMEOUT: "3" + REDIS_DIAL_TIMEOUT: "5" + REDIS_POOL_TIMEOUT: "2" + REDIS_MAX_RETRIES: "3" + REDIS_MIN_RETRY_BACKOFF: "8" + REDIS_MAX_RETRY_BACKOFF: "1" + # REDIS_TLS: "false" + # REDIS_MASTER_NAME: "" + + # ================================================================= + # Event-Driven — Circuit Breaker (prerequisite for object storage) + # ================================================================= + CIRCUIT_BREAKER_ENABLED: "true" + + # ================================================================= + # Event-Driven — RabbitMQ (optional, disabled by default) + # RABBITMQ_URL is rendered from chart defaults when RABBITMQ_ENABLED=true. + # ================================================================= + RABBITMQ_ENABLED: "false" + RABBITMQ_PORT_AMQP: "5672" + RABBITMQ_PORT_HOST: "15672" + RABBITMQ_DEFAULT_USER: "br-ccs" + RABBITMQ_VHOST: "/" + RABBITMQ_EXCHANGE: "events" + RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS: "false" + RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK: "false" + RABBITMQ_ALLOW_INSECURE_TLS: "false" + RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS: "5000" + RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS: "1000" + RABBITMQ_PUBLISHER_RECOVERY_MAX_MS: "30000" + RABBITMQ_PUBLISHER_MAX_RECOVERIES: "10" + CCS_STA_DLQ_TTL_SECONDS: "30" + # RABBITMQ_QUEUE: "br-ccs.events" + # RABBITMQ_HEALTH_CHECK_URL: "" + # RABBITMQ_HEALTH_CHECK_ALLOWED_HOSTS: "" + + # ================================================================= + # Event-Driven — Outbox + # ================================================================= + OUTBOX_ENABLED: "false" + OUTBOX_TABLE_NAME: "outbox_events" + OUTBOX_DISPATCH_INTERVAL_SEC: "2" + OUTBOX_BATCH_SIZE: "50" + OUTBOX_PUBLISH_MAX_ATTEMPTS: "3" + OUTBOX_PUBLISH_BACKOFF_MS: "200" + OUTBOX_RETRY_WINDOW_SEC: "300" + OUTBOX_MAX_DISPATCH_ATTEMPTS: "10" + OUTBOX_PROCESSING_TIMEOUT_SEC: "600" + OUTBOX_MAX_FAILED_PER_BATCH: "25" + OUTBOX_INCLUDE_TENANT_METRICS: "false" + OUTBOX_ALLOW_EMPTY_TENANT: "true" + # OUTBOX_PRIORITY_EVENT_TYPES: "" + + # ================================================================= + # Fetcher integration (HTTP client + AMQP completion consumer) + # Master switch — when false the service boots without the Fetcher subsystem. + # ================================================================= + FETCHER_ENABLED: "false" + # FETCHER_URL: "" + FETCHER_HTTP_TIMEOUT_SEC: "30" + CCS_OUTBOX_DISPATCH_INTERVAL_MS: "500" + CCS_OUTBOX_BATCH_SIZE: "50" + CCS_OUTBOX_MAX_ATTEMPTS: "10" + CCS_OUTBOX_DLQ_ROUTING_KEY: "ccs.outbox.dlq" + + # ================================================================= + # STA integration (HTTP client + outbox StaTransferSubmit handler) + # Master switch — independent from FETCHER_ENABLED. + # ================================================================= + STA_ENABLED: "false" + # STA_BASE_URL: "" + STA_HTTP_TIMEOUT_SEC: "30" + + # ================================================================= + # Reporter integration (optional async render — HTTP outbox consumer) + # Master switch; REPORTER_URL is required only when REPORTER_ENABLED=true. + # ================================================================= + REPORTER_ENABLED: "false" + # REPORTER_URL: "" + # REPORTER_HTTP_TIMEOUT_SEC: "30" + + # ================================================================= + # Authentication (lib-auth + plugin-auth) + # PLUGIN_AUTH_HOST is required when PLUGIN_AUTH_ENABLED=true. + # ================================================================= + PLUGIN_AUTH_ENABLED: "false" + # PLUGIN_AUTH_HOST: "" + + # ================================================================= + # API Documentation (Swagger) + # ================================================================= + SWAGGER_ENABLED: "true" + SWAGGER_TITLE: "br-ccs" + SWAGGER_VERSION: "1.0.0" + SWAGGER_BASE_PATH: "/" + SWAGGER_LEFT_DELIM: "{{" + SWAGGER_RIGHT_DELIM: "}}" + # SWAGGER_DESCRIPTION: "" + + # ================================================================= + # OpenTelemetry + # ================================================================= + ENABLE_TELEMETRY: "false" + OTEL_LIBRARY_NAME: "br-ccs" + OTEL_RESOURCE_SERVICE_NAME: "br-ccs" + OTEL_RESOURCE_SERVICE_VERSION: "1.0.0" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + + # ================================================================= + # Rate limiting + # ================================================================= + RATE_LIMIT_ENABLED: "true" + RATE_LIMIT_MAX: "500" + RATE_LIMIT_WINDOW_SEC: "60" + AGGRESSIVE_RATE_LIMIT_MAX: "100" + AGGRESSIVE_RATE_LIMIT_WINDOW_SEC: "60" + RELAXED_RATE_LIMIT_MAX: "1000" + RELAXED_RATE_LIMIT_WINDOW_SEC: "60" + EXPORT_RATE_LIMIT_MAX: "60" + EXPORT_RATE_LIMIT_WINDOW_SEC: "60" + DISPATCH_RATE_LIMIT_MAX: "30" + DISPATCH_RATE_LIMIT_WINDOW_SEC: "60" + + # ================================================================= + # Observability & metrics + # ================================================================= + DB_METRICS_INTERVAL_SEC: "15" + + # ================================================================= + # Idempotency + # ================================================================= + IDEMPOTENCY_RETRY_WINDOW_SEC: "300" + + # ================================================================= + # M2M credentials (per-upstream — target service / OAuth2 URL / scope). + # The *_API_KEY on-prem fallbacks live in brCcs.secrets. AWS Secrets + # Manager paths are used in SaaS mode. + # ================================================================= + M2M_CREDENTIAL_CACHE_TTL_SEC: "300" + AWS_REGION: "us-east-1" + # FETCHER_M2M_TARGET_SERVICE: "fetcher" + # FETCHER_OAUTH2_TOKEN_URL: "" + # FETCHER_OAUTH2_SCOPE: "" + # REPORTER_M2M_TARGET_SERVICE: "reporter" + # REPORTER_OAUTH2_TOKEN_URL: "" + # REPORTER_OAUTH2_SCOPE: "" + # STA_M2M_TARGET_SERVICE: "sta" + # STA_OAUTH2_TOKEN_URL: "" + # STA_OAUTH2_SCOPE: "" + + # ================================================================= + # Detail response tuning (all optional — BACEN-inferred defaults apply) + # ================================================================= + # CCS_DETAIL_MESSAGE_EMIT_ENABLED: "false" + # CCS_DETAIL_MESSAGE_VALIDATION_ENABLED: "false" + # CCS_BACEN_DESTINATARIO_CNPJ_BASE: "00000000" + # CCS_ACCS005_OVERFLOW_THRESHOLD: "30720" + # CCS_ACCS005_SECRECY_SITUACAO: "01" + + # ================================================================= + # Pagination + # ================================================================= + MAX_PAGINATION_LIMIT: "100" + MAX_PAGINATION_MONTH_DATE_RANGE: "3" + + # ================================================================= + # Readiness probe (canonical /readyz handler — PROJECT_RULES §13.4) + # ================================================================= + READYZ_PROBE_TIMEOUT_SEC: "5" + READYZ_DEP_SLOW_THRESHOLD_MS: "500" + STARTUP_SELF_PROBE_MAX_DURATION_SEC: "120" + STARTUP_SELF_PROBE_INITIAL_DELAY_MS: "1000" + STARTUP_SELF_PROBE_MAX_DELAY_MS: "30000" + + # ================================================================= + # Graceful shutdown (PROJECT_RULES §13) + # ================================================================= + SHUTDOWN_DRAIN_GRACE_PERIOD_SEC: "15" + SHUTDOWN_TOTAL_TIMEOUT_SEC: "30" + + # ================================================================= + # Object storage — three distinct S3-compatible buckets. + # Endpoints/region/bucket/flags are non-secret; access + secret keys + # live in brCcs.secrets. Empty *_BUCKET marks that /readyz dep skipped. + # ================================================================= + SEAWEEDFS_S3_PORT: "8342" + SEAWEEDFS_MASTER_PORT: "9343" + # STA inbound (read-only) + OBJECT_STORAGE_STA_ENDPOINT: "" + OBJECT_STORAGE_STA_REGION: "us-east-1" + OBJECT_STORAGE_STA_BUCKET: "sta-files" + OBJECT_STORAGE_STA_USE_PATH_STYLE: "true" + OBJECT_STORAGE_STA_DISABLE_SSL: "true" + # CCS outbound (write) + OBJECT_STORAGE_CCS_ENDPOINT: "" + OBJECT_STORAGE_CCS_REGION: "us-east-1" + OBJECT_STORAGE_CCS_BUCKET: "lerian-ccs" + OBJECT_STORAGE_CCS_USE_PATH_STYLE: "true" + OBJECT_STORAGE_CCS_DISABLE_SSL: "true" + # Fetcher snapshot (read-only) + OBJECT_STORAGE_FETCHER_ENDPOINT: "" + OBJECT_STORAGE_FETCHER_REGION: "us-east-1" + OBJECT_STORAGE_FETCHER_BUCKET: "lerian-fetcher" + OBJECT_STORAGE_FETCHER_USE_PATH_STYLE: "true" + OBJECT_STORAGE_FETCHER_DISABLE_SSL: "true" + # Retention windows + CCS_OUTBOUND_RETENTION_DAYS: "30" + CCS_ACCS009_RETENTION_DAYS: "30" + + # -- Secrets for storing sensitive data. Provide real values via an existing + # Secret (useExistingSecret) or a secrets manager — NEVER commit real values. + # @default -- templates/secrets.yaml + secrets: + # PostgreSQL credentials + POSTGRES_PASSWORD: "" + # POSTGRES_REPLICA_PASSWORD: "" + + # Redis / Valkey password + REDIS_PASSWORD: "" + # REDIS_CA_CERT: "" + + # Multi-tenant (tenant-manager) secrets + # MULTI_TENANT_SERVICE_API_KEY: "" + # MULTI_TENANT_REDIS_PASSWORD: "" + # MULTI_TENANT_REDIS_CA_CERT: "" + + # RabbitMQ credentials (when RABBITMQ_ENABLED=true) + # RABBITMQ_DEFAULT_PASS: "" + + # Crypto keys (REQUIRED in production) + # CCS_CRYPTO_MASTER_KEY — AES-256-GCM master key, 64 hex chars (openssl rand -hex 32). + # FETCHER_CRYPTO_KEY — Fetcher snapshot decryption key (base64; same as Fetcher APP_ENC_KEY). + CCS_CRYPTO_MASTER_KEY: "" + FETCHER_CRYPTO_KEY: "" + + # Object storage credentials (per bucket) + OBJECT_STORAGE_STA_ACCESS_KEY: "" + OBJECT_STORAGE_STA_SECRET_KEY: "" + OBJECT_STORAGE_CCS_ACCESS_KEY: "" + OBJECT_STORAGE_CCS_SECRET_KEY: "" + OBJECT_STORAGE_FETCHER_ACCESS_KEY: "" + OBJECT_STORAGE_FETCHER_SECRET_KEY: "" + + # Per-upstream M2M API keys (on-prem / local fallback; SaaS uses OAuth2) + # FETCHER_API_KEY: "" + # REPORTER_API_KEY: "" + # STA_API_KEY: "" + + # -- Existing secrets name + useExistingSecret: false + existingSecretName: "" + # -- Extra environment variables (map of key: value pairs) — escape hatch for + # optional knobs not modeled above (e.g. RELATIONSHIP_SOURCE_*, CCS_REPORTER_POLL_*). + extraEnvVars: {} + serviceAccount: + # -- Specifies whether a ServiceAccount should be created + create: true + # -- Annotations for the ServiceAccount + annotations: {} + # -- Name of the service account + # @default -- `br-ccs.fullname` + name: "" +# Valkey (Redis-compatible) configuration +valkey: + enabled: true + global: + security: + allowInsecureImages: false + image: + repository: bitnami/valkey + tag: "8.0.2" + external: false + architecture: standalone + auth: + enabled: true + password: "" + primary: + kind: Deployment + resourcesPreset: "medium" + persistence: + enabled: false + extraFlags: + - "--maxmemory 640mb" + - "--maxmemory-policy allkeys-lru" + - "--hz 100" + - "--maxclients 10000" +# PostgreSQL configuration +postgresql: + enabled: true + global: + security: + allowInsecureImages: false + image: + repository: bitnami/postgresql + tag: "17.4.0" + external: false + architecture: standalone + auth: + enabled: true + enablePostgresUser: true + postgresPassword: "" + username: "br-ccs" + password: "" + database: "br-ccs" + primary: + persistence: + size: 8Gi + resourcesPreset: large + extraEnvVars: + - name: POSTGRESQL_MAX_CONNECTIONS + value: "500" + - name: POSTGRESQL_TCP_KEEPALIVES_IDLE + value: "30" + - name: POSTGRESQL_TCP_KEEPALIVES_INTERVAL + value: "10" + - name: POSTGRESQL_TCP_KEEPALIVES_COUNT + value: "5" +# RabbitMQ configuration (optional - disabled by default) +rabbitmq: + enabled: false + image: + tag: "3.13.6" + persistence: + size: 8Gi + resources: + requests: + cpu: 250m + memory: 512Mi + limits: + cpu: "1" + memory: 1Gi + podSecurityContext: + runAsUser: 1001 + runAsGroup: 1001 + fsGroup: 1001 + fsGroupChangePolicy: "OnRootMismatch" + seccompProfile: {type: RuntimeDefault} + containerSecurityContext: + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: {drop: ["ALL"]} + authentication: + user: + value: "br-ccs" + password: + value: "" + erlangCookie: + # Operators MUST supply a stable cookie (e.g. openssl rand -base64 32) when rabbitmq.enabled=true. + value: "" + extraSecrets: + - name: "br-ccs-rabbitmq-load-definition" + mountPath: /etc/rabbitmq/definitions + customConfig: | + management.load_definitions = /etc/rabbitmq/definitions/load_definition.json From 96b69dfe5785ff30f91b8c1567195de25f9c1c5f Mon Sep 17 00:00:00 2001 From: gandalf-bot Date: Tue, 7 Jul 2026 16:34:14 -0300 Subject: [PATCH 035/113] fix(schedule): address CodeRabbit review comments - CHANGELOG: reflect SCHEDULE_WORKER_ENABLED=true default (15m interval) - _helpers.tpl: schedule.fullname delegates to schedule.name to avoid drift - schedule/deployment.yaml: require existingSecretName when useExistingSecrets is true --- charts/plugin-br-pix-indirect-btg/CHANGELOG.md | 2 +- charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl | 2 +- .../templates/schedule/deployment.yaml | 2 +- 3 files changed, 3 insertions(+), 3 deletions(-) diff --git a/charts/plugin-br-pix-indirect-btg/CHANGELOG.md b/charts/plugin-br-pix-indirect-btg/CHANGELOG.md index a78804b6..6c01733a 100644 --- a/charts/plugin-br-pix-indirect-btg/CHANGELOG.md +++ b/charts/plugin-br-pix-indirect-btg/CHANGELOG.md @@ -4,7 +4,7 @@ - **Features:** - Added the `schedule` (Pix recurrence) worker: new `schedule` values section, Deployment, Service, ConfigMap, Secret, HPA and PDB templates, mirroring the reconciliation worker. - - The worker listens on port 4018 with probes on `/health` (liveness) and `/readyz` (readiness) and ships dormant (`SCHEDULE_WORKER_ENABLED=false`). + - The worker listens on port 4018 with probes on `/health` (liveness) and `/readyz` (readiness) and ships active by default (`SCHEDULE_WORKER_ENABLED=true`, 15m interval). [Compare changes](https://github.com/LerianStudio/helm/compare/plugin-br-pix-indirect-btg-v3.3.1...plugin-br-pix-indirect-btg-v3.4.0) diff --git a/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl b/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl index 539a352f..94e0d2ce 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl +++ b/charts/plugin-br-pix-indirect-btg/templates/_helpers.tpl @@ -91,7 +91,7 @@ Create a default fully qualified app name for reconciliation worker. Create a default fully qualified app name for schedule worker. */}} {{- define "schedule.fullname" -}} -{{- default "plugin-br-pix-indirect-btg-worker-schedule" .Values.schedule.name | trunc 63 | trimSuffix "-" }} +{{- include "schedule.name" . }} {{- end }} {{/* diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml index d2a62f28..3b9b55d3 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/deployment.yaml @@ -35,7 +35,7 @@ spec: protocol: TCP envFrom: - secretRef: - name: {{ if .Values.schedule.useExistingSecrets }}{{ .Values.schedule.existingSecretName }}{{ else }}{{ include "schedule.fullname" . }}{{ end }} + name: {{ if .Values.schedule.useExistingSecrets }}{{ required "schedule.existingSecretName is required when schedule.useExistingSecrets is true" .Values.schedule.existingSecretName }}{{ else }}{{ include "schedule.fullname" . }}{{ end }} - configMapRef: name: {{ include "schedule.fullname" . }} {{- $otelEnabled := (index .Values "otel-collector-lerian").enabled }} From 118c1b4c6c878225f2142ab1d39b989980b84e6a Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Tue, 7 Jul 2026 20:00:32 +0000 Subject: [PATCH 036/113] chore(release): 3.4.0-beta.1 ## (2026-07-07) ### Features * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) --- README.md | 2 +- charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0b5c844e..f0b4a0db 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Inbound Version | Outbound Version | Reconciliation Version | | :---: | :---: | :---: | :---: | :---: | -| `3.3.1` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | +| `3.4.0-beta.1` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | ----------------- diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index a8a4695e..34360531 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.4.0 +version: 3.4.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.7.5" # A list of keywords about the chart. This helps others discover the chart. From 09a0c352791489b4468a7b63a7b61c55308c8814 Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Tue, 7 Jul 2026 18:27:29 -0300 Subject: [PATCH 037/113] chore: add br-sta to PR template, PR title scopes, and changelog workflow --- .github/pull_request_template.md | 1 + .github/workflows/gptchangelog.yml | 1 + .github/workflows/pr-title.yml | 1 + 3 files changed, 3 insertions(+) diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index cc608b21..7dbef9f0 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -19,6 +19,7 @@ - [ ] Matcher - [ ] Flowker - [ ] Underwriter +- [ ] BR STA ## Checklist Please check each item after it's completed. diff --git a/.github/workflows/gptchangelog.yml b/.github/workflows/gptchangelog.yml index 81f501e4..a1e60f36 100644 --- a/.github/workflows/gptchangelog.yml +++ b/.github/workflows/gptchangelog.yml @@ -24,6 +24,7 @@ jobs: with: runner_type: "blacksmith-4vcpu-ubuntu-2404" filter_paths: |- + charts/br-sta charts/fetcher charts/lerian-notification charts/midaz diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 9d868fce..6c45b463 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -54,6 +54,7 @@ jobs: underwriter matcher tracer + br-sta new charts common From 75a1b321c9539151a5f8cf986cf778eee87516ba Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Wed, 8 Jul 2026 09:33:54 -0300 Subject: [PATCH 038/113] fix(br-sta): address CodeRabbit review on PR #1618 - README/NOTES/values-template: fix Chart Contract (multi-component), stale app: -> br-sta: key references, and wrong PVC cleanup label - deployment.yaml: stop fighting the HPA on replicas, dedupe secretName - _helpers.tpl: nil-aware secretWarnings, require existingSecretName when useExistingSecret is set, fix stale app.* in validateRequired errors - bootstrap-postgres.yaml: mark as a pre-install/pre-upgrade hook, use $APP_DB/$APP_ROLE consistently instead of hardcoded br_sta - values.yaml: worker defaults to Recreate rollout (no leader election yet, avoid duplicate background processing) and enabled=false until a suitable image is confirmed; fix stale app.* RabbitMQ comments --- charts/br-sta/README.md | 12 +++++----- charts/br-sta/templates/NOTES.txt | 14 ++++++++---- charts/br-sta/templates/_helpers.tpl | 18 ++++++++++----- .../br-sta/templates/bootstrap-postgres.yaml | 20 ++++++++++------- charts/br-sta/templates/deployment.yaml | 6 +++-- charts/br-sta/values-template.yaml | 2 +- charts/br-sta/values.yaml | 22 +++++++++---------- 7 files changed, 57 insertions(+), 37 deletions(-) diff --git a/charts/br-sta/README.md b/charts/br-sta/README.md index 640ce7a9..74758341 100644 --- a/charts/br-sta/README.md +++ b/charts/br-sta/README.md @@ -2,13 +2,13 @@ ## Chart Contract -- Chart type: `single-service` +- Chart type: `multi-component` - Required secrets: `None for default render`. With the bundled PostgreSQL and Valkey subcharts the database and Redis passwords are auto-generated and read via `secretKeyRef`. Only supply `br-sta.secrets.POSTGRES_PASSWORD` / `br-sta.secrets.REDIS_PASSWORD` for external infra without `postgresql.auth.existingSecret` / `valkey.auth.existingSecret`. `br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY` is required only when `MULTI_TENANT_ENABLED=true`. - Dependency notes: Bundles two local subcharts — Bitnami `postgresql` (`postgresql.enabled`, default `true`) and Bitnami `valkey` (`valkey.enabled`, default `true`). RabbitMQ is optional, config-only, and NOT bundled (`RABBITMQ_ENABLED=false`). All can be pointed at external services. - Production overrides: Disable the bundled subcharts and point `POSTGRES_HOST` / `REDIS_HOST` at managed services; supply credentials via chart secrets or an existing Secret; override image tag, ingress, resources, and persistence. - Source/license: Source is in `github.com/LerianStudio/br-sta`; chart license is Apache-2.0. -A Helm chart for [br-sta](https://github.com/LerianStudio/br-sta) — a Lerian Studio Go/Fiber HTTP service. It ships a single Deployment running the `/service` binary, backed by PostgreSQL (SQL migrations applied at startup) and Redis/Valkey (caching + rate limiting). +A Helm chart for [br-sta](https://github.com/LerianStudio/br-sta) — a Lerian Studio Go/Fiber HTTP service. It ships a manager Deployment running the `/service` binary and an optional worker Deployment running background jobs, backed by PostgreSQL (SQL migrations applied at startup) and Redis/Valkey (caching + rate limiting). ## TL;DR @@ -28,7 +28,7 @@ The default render brings up br-sta plus an in-cluster PostgreSQL and Valkey, wi ## Architecture -The chart deploys **one Deployment, one process** (`/service`, a Go/Fiber HTTP server): +The chart deploys a **manager Deployment** (`/service`, a Go/Fiber HTTP server) and an optional **worker Deployment** (`/worker`, background jobs): - HTTP API served on port `8080` (`/health`, `/api/v1/...`). - PostgreSQL is the primary datastore; SQL migrations are applied at startup from `MIGRATIONS_PATH` (`migrations`). @@ -100,7 +100,7 @@ See [`values.yaml`](./values.yaml) for the full list, and [`values-template.yaml enabled: false valkey: enabled: false - app: + br-sta: configmap: POSTGRES_HOST: my-rds-instance.example.com POSTGRES_SSLMODE: require @@ -112,7 +112,7 @@ See [`values.yaml`](./values.yaml) for the full list, and [`values-template.yaml 2. **Use an existing Secret** instead of inline values: ```yaml - app: + br-sta: useExistingSecret: true existingSecretName: br-sta-secrets ``` @@ -141,7 +141,7 @@ helm uninstall my-br-sta -n br-sta If the bundled PostgreSQL was used, its PVCs are NOT deleted automatically: ```bash -kubectl delete pvc -n br-sta -l br-sta.kubernetes.io/instance=my-br-sta +kubectl delete pvc -n br-sta -l app.kubernetes.io/instance=my-br-sta ``` ## License diff --git a/charts/br-sta/templates/NOTES.txt b/charts/br-sta/templates/NOTES.txt index 0c7ab461..b176679e 100644 --- a/charts/br-sta/templates/NOTES.txt +++ b/charts/br-sta/templates/NOTES.txt @@ -13,13 +13,19 @@ The chart has been INSTALLED at version {{ .Chart.Version }} (appVersion {{ .Cha ## Component Deployed -Single Deployment ({{ $component.replicaCount }} replica(s)) running the /service binary +Manager Deployment ({{ $component.replicaCount }} replica(s)) running the /service binary (Go/Fiber HTTP server). Service: {{ include "br-sta.fullname" . }}.{{ include "global.namespace" . }}.svc.cluster.local:{{ $component.service.port }} Health: /health API: /api/v1/... +{{- if eq (include "br-sta.worker.enabled" .) "true" }} + +Worker Deployment ({{ (.Values.worker | default dict).replicaCount | default 1 }} replica(s)) running the /worker binary +(background jobs: audit outbox publisher/consumer, leader-gated scheduler, credential-recovery-on-boot). +{{- end }} + ## Dependencies {{- if eq (include "postgresql.enabled" .) "true" }} @@ -58,11 +64,11 @@ The default render (bundled PostgreSQL + Valkey) requires no operator secrets the infra passwords are auto-generated by the subcharts and read via secretKeyRef. When MULTI_TENANT_ENABLED=true, the following become required: - - app.configmap.MULTI_TENANT_URL - - app.secrets.MULTI_TENANT_SERVICE_API_KEY + - br-sta.configmap.MULTI_TENANT_URL + - br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY For an EXTERNAL PostgreSQL / Redis (subchart disabled), supply the passwords via -app.secrets.POSTGRES_PASSWORD / app.secrets.REDIS_PASSWORD (or existingSecret). +br-sta.secrets.POSTGRES_PASSWORD / br-sta.secrets.REDIS_PASSWORD (or existingSecret). ## Accessing the API diff --git a/charts/br-sta/templates/_helpers.tpl b/charts/br-sta/templates/_helpers.tpl index 86cf85b8..24b8ce0a 100644 --- a/charts/br-sta/templates/_helpers.tpl +++ b/charts/br-sta/templates/_helpers.tpl @@ -239,15 +239,23 @@ operator input for optional integrations that have been toggled on (multi-tenant via secretKeyRef; see docs/helm-chart-standard.md "Single-Source Infra Secrets". No gate here: for the bundled subchart the value is generated; for external Postgres the operator supplies postgresql.auth.existingSecret - or app.secrets.POSTGRES_PASSWORD. The same reasoning applies to Valkey. */}} + or br-sta.secrets.POSTGRES_PASSWORD. The same reasoning applies to Valkey. */}} {{/* Multi-tenant required fields when enabled */}} {{- if eq ((index .Values "br-sta").configmap.MULTI_TENANT_ENABLED | toString) "true" }} {{- if not (index .Values "br-sta").configmap.MULTI_TENANT_URL }} -{{- fail "\n\nERROR: app.configmap.MULTI_TENANT_URL is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} +{{- fail "\n\nERROR: br-sta.configmap.MULTI_TENANT_URL is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} {{- end }} {{- if not (index .Values "br-sta").secrets.MULTI_TENANT_SERVICE_API_KEY }} -{{- fail "\n\nERROR: app.secrets.MULTI_TENANT_SERVICE_API_KEY is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} +{{- fail "\n\nERROR: br-sta.secrets.MULTI_TENANT_SERVICE_API_KEY is REQUIRED when MULTI_TENANT_ENABLED=true.\n" }} +{{- end }} +{{- end }} + +{{/* existingSecretName is required whenever useExistingSecret is enabled, + otherwise secretRef.name renders empty and the pod fails to start. */}} +{{- if (index .Values "br-sta").useExistingSecret }} +{{- if not (index .Values "br-sta").existingSecretName }} +{{- fail "\n\nERROR: br-sta.existingSecretName is REQUIRED when br-sta.useExistingSecret=true.\n" }} {{- end }} {{- end }} @@ -258,12 +266,12 @@ Generate annotation listing default-value warnings (non-blocking). */}} {{- define "br-sta.secretWarnings" -}} {{- $warnings := list -}} -{{- if .Values.postgresql.enabled -}} +{{- if eq (include "postgresql.enabled" .) "true" -}} {{- if eq (.Values.postgresql.auth.password | toString) "lerian" -}} {{- $warnings = append $warnings "postgresql.auth.password is using default value 'lerian'" -}} {{- end -}} {{- end -}} -{{- if .Values.valkey.enabled -}} +{{- if eq (include "valkey.enabled" .) "true" -}} {{- if eq (.Values.valkey.auth.password | toString) "lerian" -}} {{- $warnings = append $warnings "valkey.auth.password is using default value 'lerian'" -}} {{- end -}} diff --git a/charts/br-sta/templates/bootstrap-postgres.yaml b/charts/br-sta/templates/bootstrap-postgres.yaml index fd7dec89..dadd8e53 100644 --- a/charts/br-sta/templates/bootstrap-postgres.yaml +++ b/charts/br-sta/templates/bootstrap-postgres.yaml @@ -7,6 +7,10 @@ metadata: labels: {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} app.kubernetes.io/component: bootstrap-postgres + annotations: + "helm.sh/hook": "pre-install,pre-upgrade" + "helm.sh/hook-weight": "-4" + "helm.sh/hook-delete-policy": "before-hook-creation" spec: ttlSecondsAfterFinished: 300 completions: 1 @@ -108,25 +112,25 @@ spec: echo "Role '$APP_ROLE' already exists. Skipping creation." else echo "Creating role '$APP_ROLE'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_BR_STA" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE br_sta LOGIN PASSWORD :'pw'" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_BR_STA" -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE ROLE ${APP_ROLE} LOGIN PASSWORD :'pw'" fi if [ "$DB_EXISTS" = "1" ]; then echo "Database '$APP_DB' already exists. Skipping creation." else echo "Creating database '$APP_DB'..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE br_sta OWNER br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE ${APP_DB} OWNER ${APP_ROLE}" fi fi # Privileges (idempotent) echo "Ensuring privileges and schema permissions..." - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE br_sta TO br_sta" - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL ON SCHEMA public TO br_sta" - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO br_sta" - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO br_sta" - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO br_sta" - PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d br_sta -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO br_sta" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE ${APP_DB} TO ${APP_ROLE}" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$APP_DB" -c "GRANT ALL ON SCHEMA public TO ${APP_ROLE}" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$APP_DB" -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO ${APP_ROLE}" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$APP_DB" -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO ${APP_ROLE}" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$APP_DB" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO ${APP_ROLE}" + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$APP_DB" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO ${APP_ROLE}" echo "" echo "=== br-sta PostgreSQL Bootstrap completed successfully ===" diff --git a/charts/br-sta/templates/deployment.yaml b/charts/br-sta/templates/deployment.yaml index 9aa1697f..9f3f7095 100644 --- a/charts/br-sta/templates/deployment.yaml +++ b/charts/br-sta/templates/deployment.yaml @@ -19,7 +19,9 @@ spec: strategy: {{- toYaml . | nindent 4 }} {{- end }} + {{- if not $component.autoscaling.enabled }} replicas: {{ $component.replicaCount }} + {{- end }} selector: matchLabels: {{- include "br-sta.selectorLabels" (dict "context" .) | nindent 6 }} @@ -89,13 +91,13 @@ spec: - name: http containerPort: {{ $component.service.port }} protocol: TCP + {{- $secretName := ternary $component.existingSecretName (include "br-sta.fullname" .) $component.useExistingSecret }} envFrom: - configMapRef: name: {{ include "br-sta.fullname" . }} - secretRef: - name: {{ if $component.useExistingSecret }}{{ $component.existingSecretName }}{{ else }}{{ include "br-sta.fullname" . }}{{ end }} + name: {{ $secretName }} env: - {{- $secretName := ternary $component.existingSecretName (include "br-sta.fullname" .) $component.useExistingSecret }} {{- $pg := .Values.postgresql | default dict }} {{- $pgAuth := $pg.auth | default dict }} {{- if or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret }} diff --git a/charts/br-sta/values-template.yaml b/charts/br-sta/values-template.yaml index ef24edd3..a06b0e7c 100644 --- a/charts/br-sta/values-template.yaml +++ b/charts/br-sta/values-template.yaml @@ -5,7 +5,7 @@ # -n --create-namespace \ # -f values-prod.yaml -app: +br-sta: replicaCount: 2 image: tag: "latest" # pin to a published immutable tag diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index 812ecb69..23e69336 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -348,10 +348,11 @@ br-sta: worker: # -- Enable the worker Deployment. REQUIRES a br-sta image that ships BOTH # binaries (manager /service + worker /worker in one image, from the - # multi-binary Dockerfile). Older single-binary images have no /worker and - # the pod will CrashLoop on command:[/worker]; keep this false until such an - # image is published. - enabled: true + # multi-binary Dockerfile) — or an explicit worker.image override pointing + # at a dedicated worker image. Older single-binary images have no /worker + # and the pod will CrashLoop on command:[/worker]; keep this false until + # a suitable image is confirmed available, then enable per-deployment. + enabled: false # -- Replicas. The background jobs are leader-gated but the worker does NOT # run its own leader election yet — keep this at 1 (and do not add an HPA) to # avoid duplicate processing. @@ -396,12 +397,11 @@ worker: requests: cpu: 100m memory: 128Mi - # -- Deployment strategy + # -- Deployment strategy. Recreate by default: the worker is leader-gated but + # runs no leader election, so a RollingUpdate surge would briefly run two + # worker pods and duplicate background processing (audit drain, scheduler). deploymentStrategy: - type: RollingUpdate - rollingUpdate: - maxSurge: 1 - maxUnavailable: 0 + type: Recreate # -- Readiness probe configuration readinessProbe: initialDelaySeconds: 5 @@ -589,10 +589,10 @@ rabbitmq: capabilities: {drop: ["ALL"]} authentication: user: - # Must match app.configmap.RABBITMQ_DEFAULT_USER. + # Must match br-sta.configmap.RABBITMQ_DEFAULT_USER. value: "br_sta" password: - # Operators MUST supply this AND the matching app.secrets.RABBITMQ_DEFAULT_PASS + # Operators MUST supply this AND the matching br-sta.secrets.RABBITMQ_DEFAULT_PASS # when rabbitmq.enabled=true. Both must be the same value. value: "" erlangCookie: From 6808ebff43b9138f589b7ea3bb1523eb7cc8855d Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Wed, 8 Jul 2026 10:04:36 -0300 Subject: [PATCH 039/113] fix(br-sta): add version matrix table to root README MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The br-sta chart was added without a version-matrix section in the root README.md. Every other chart in this monorepo has one, and the semantic release prepareCmd hard-fails when it can't find it: ERROR: Could not find version matrix table in README.md This blocked the first develop release of br-sta (run 28943489450), which also skipped the back-merge-to-develop and release-notification jobs. Adds a ### BR STA section following the Manager/Worker column pattern used by Reporter and Fetcher (also manager+worker charts). Verified by running .github/scripts/update-chart-version-readme against the updated README — it now finds and updates the table instead of exiting 1. --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index f0b4a0db..498b35d8 100644 --- a/README.md +++ b/README.md @@ -275,3 +275,14 @@ For implementation and configuration details, see the [README](https://charts.le | :---: | :---: | | `1.0.0-beta.3` | 1.0.0 | ----------------- + +### BR STA + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/br-sta). + +#### Application Version Mapping + +| Chart Version | Manager Version | Worker Version | +| :---: | :---: | :---: | +| `1.1.0` | 1.0.0-beta.32 | 1.0.0-beta.32 | +----------------- From eb05359c178f184b24dd187fb909d312e808b4b3 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 13:10:25 +0000 Subject: [PATCH 040/113] chore(release): 1.0.0-beta.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## (2026-07-08) ### ⚠ BREAKING CHANGES * **plugin-br-payments:** any values overlay using the previous keys (app.configmap.PROVIDER_*, app.secrets.PROVIDER_*) must be updated in the same change set that pins to 1.0.0-beta.2 or later. The follow-up gitops PR in midaz-firmino-gitops (firmino/dev/plugin-br-payments/values.yaml) is the only known consumer today. * the onboarding and transaction services have been consolidated into the ledger service. All Kubernetes resources (Deployment, Service, ConfigMap, Secret, Ingress, HPA, PDB, ServiceAccount) for both services have been removed from the chart. If you are already using the ledger service, no action is required. Migration (only if you were using onboarding or transaction services): - Remove and blocks from your values overrides - Ensure is set - All configuration is now managed under Also adds missing env vars to ledger configmap/secrets (swagger, multi-tenant, overdraft events, balance sync worker) * **plugin-access-manager:** Values path changed from 'auth.backend.migrations.image' (string) to 'auth.backend.migrations.image.repository' + '.tag' (object). Same for 'auth.initUser.image' and 'auth.initUser.imagePullPolicy'. Existing values overrides using the old string format will need updating. * **midaz:** Ledger service is now enabled by default, replacing the separate onboarding and transaction services. - ledger.enabled now defaults to true - onboarding and transaction services are automatically disabled when ledger is enabled - Existing deployments using onboarding/transaction need to explicitly set ledger.enabled=false to maintain current behavior Migration guide: docs/UPGRADE-5.0.md * **rabbitmq:** Default Rabbitmq no longer uses the bitnami chart. Persistent volume claims from the bitnami Statefulset may not be reused automatically * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **valkey:** Valkey no longer uses StatefulSet. Persistent volume claims from StatefulSet will not be reused automatically. * feat!(midaz): remove onboarding and transaction services from midaz chart ([41e88df](https://github.com/LerianStudio/helm/commit/41e88df0368450368cea9a001129d3d6d0f8bd02)) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **values:** add app new version and reference default config ([b972952](https://github.com/LerianStudio/helm/commit/b97295261b87645884b197bbbf8aeea8dd78e452)) * **values:** add app new version and reference default secret ([ef8069c](https://github.com/LerianStudio/helm/commit/ef8069c403b3e7878571ddb3b92ee6f8be2f251f)) * **plugin-fees:** add APPLICATION_NAME, MULTI_TENANT_TIMEOUT, MULTI_TENANT_CACHE_TTL_SEC ([a7b6199](https://github.com/LerianStudio/helm/commit/a7b6199c800795da1300c47fd31412dd3f3b9853)) * **chart:** add auth backend helpers functions ([7248963](https://github.com/LerianStudio/helm/commit/72489636dfd8d57191e4d61da0369d6267b277df)) * **chart:** add auth backend templates ([57fb163](https://github.com/LerianStudio/helm/commit/57fb163b2c7cca15b1006ef493e3ee43b7cc616c)) * **onboarding:** add auth config ([8a055cb](https://github.com/LerianStudio/helm/commit/8a055cb83b9f6a9d9c76ca3343ab6a61c1d1c00c)) * **transaction:** add auth config ([a7ede5b](https://github.com/LerianStudio/helm/commit/a7ede5b29f6c69752cffad6970d5d73bd21062cb)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **plugin-br-pix-switch:** add bootstrap Jobs for postgres + mongodb ([79f12c7](https://github.com/LerianStudio/helm/commit/79f12c79a33464e64dd4c0dbfdab29ec116e3db9)) * add bootstrap-mongodb.yaml for idempotent MongoDB user/db provisioning ([c36e378](https://github.com/LerianStudio/helm/commit/c36e378b82a709e8ec50f659a19f9e654c3792b1)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **pipe:** add branch develop to generate beta release ([2990c0e](https://github.com/LerianStudio/helm/commit/2990c0e71d5b6773321b67c986b0a5a32b970cd3)) * **ci:** add chart standard validation and render gate ([9d4ab59](https://github.com/LerianStudio/helm/commit/9d4ab5980484335942ae7827954abcc0c97f633c)) * **fetcher:** add common configmap and secrets templates for shared configuration ([7f75dd0](https://github.com/LerianStudio/helm/commit/7f75dd089489faac6e797e657ea10a34f2e876d7)) * **midaz:** add conditional deployment logic for onboarding service and update ingress routing ([f2e3c76](https://github.com/LerianStudio/helm/commit/f2e3c76aa1fe0928439bf2cfbff401bd30078714)) * **midaz:** add conditional deployment logic for transaction service ([df12827](https://github.com/LerianStudio/helm/commit/df128273a67ebc2d6572c3bd0b798d534933489b)) * **plugin-smart-templates:** add configmap annotations ([adac247](https://github.com/LerianStudio/helm/commit/adac247e5d389e8587c8e5867d19547ce98bd810)) * **reporter:** add configurable secret for KEDA TriggerAuthentication ([d84a26d](https://github.com/LerianStudio/helm/commit/d84a26d398d1df7a487e053e25cdddc8cc37df88)) * **plugins:** add CRM data source secrets and disable ingress by default ([e262736](https://github.com/LerianStudio/helm/commit/e26273677fd0d683f02d79f7cb082b43e626a377)) * **midaz:** add CRM service with MongoDB integration and complete Kubernetes manifests ([a9368d2](https://github.com/LerianStudio/helm/commit/a9368d2d9a27d7f1278e0ec06ad7a4e25124b2d5)) * add crm ui functions ([3473c00](https://github.com/LerianStudio/helm/commit/3473c0089f1e0c6efe8eb71704e12c0913d07c55)) * add crm ui templates ([8089ad7](https://github.com/LerianStudio/helm/commit/8089ad7e7056b469abf9b07d880356ace2adbc3f)) * add dependencies to midaz helm ([e1e4095](https://github.com/LerianStudio/helm/commit/e1e4095c7e9fc48c69738c0610ee7ad4bd56c12a)) * **plugin-fees:** add deployment mode and readiness timeout settings ([fa5783b](https://github.com/LerianStudio/helm/commit/fa5783bb7cb7e64d32bb4c15c0e32b637aee5bb0)) * **values:** add deployment strategy definitions ([dd93837](https://github.com/LerianStudio/helm/commit/dd9383729db20e4f88265edde5900d35c7dbbafa)) * **console:** add deployment strategy ([0000ab0](https://github.com/LerianStudio/helm/commit/0000ab0a6c088e2eca167f396bff859638b478e4)) * **onboarding:** add deployment strategy ([220274b](https://github.com/LerianStudio/helm/commit/220274beb453eb54ec6e9c3a6020016cf8a7be91)) * **transaction:** add deployment strategy ([65076f4](https://github.com/LerianStudio/helm/commit/65076f421904b98f46329ff40cb31f7cf409476b)) * add doc ([5593a96](https://github.com/LerianStudio/helm/commit/5593a96ff02c3b968c4a703a5a7ccc2afa53be04)) * add doc ([97daf1e](https://github.com/LerianStudio/helm/commit/97daf1ecb4c2a51415c58cf0bc815a36d1e52cc3)) * add doc ([2f02d2e](https://github.com/LerianStudio/helm/commit/2f02d2ef0fad7ad80fe131253a8e232b66499430)) * add doc ([6e20f92](https://github.com/LerianStudio/helm/commit/6e20f92c1c31fa26560edfa77fec348783564de2)) * **product-console:** add dynamic OTEL host injection support ([4f473e9](https://github.com/LerianStudio/helm/commit/4f473e94c54955f11383f7f439a5c8d2454b47ae)) * **midaz:** add external OTEL collector support ([f38af29](https://github.com/LerianStudio/helm/commit/f38af29a9900c118d72e07481487b146e9dab02e)) * add external secret support for RabbitMQ and Postgres definitions in Helm chart ([0994db6](https://github.com/LerianStudio/helm/commit/0994db63ae8857fc4fd5540164b9334df58b3415)) * add external secret support paramters to values file ([e35c63e](https://github.com/LerianStudio/helm/commit/e35c63efac785fb1b5fa1c31643f1a3df1b143d4)) * add external secret support to deployment ([363ee02](https://github.com/LerianStudio/helm/commit/363ee020e997e8da492cfb284b10d33c08ab780a)) * add external secret support to worker job ([58809e1](https://github.com/LerianStudio/helm/commit/58809e1efded5775234e5bdc3018d3584694a7df)) * add external secret support to worker values file ([4e62d4f](https://github.com/LerianStudio/helm/commit/4e62d4fb02c8f17009f40e6f2d04d837d404feec)) * **scripts:** add fallback to root image.tag in chart version update script ([4fdcb77](https://github.com/LerianStudio/helm/commit/4fdcb77603969e24faab5a82527abddcb2517534)) * **plugin-fees:** add fees ui env var ([c1e52e1](https://github.com/LerianStudio/helm/commit/c1e52e1e525d168adce6be38a70470facaf18590)) * **fetcher:** add fetcher helm chart with manager and worker components ([363c0cf](https://github.com/LerianStudio/helm/commit/363c0cfd5b7c0049be06358ab34e8e4619897a98)) * **doc:** add general readme and moving midaz readme ([41f11fe](https://github.com/LerianStudio/helm/commit/41f11fe167c213be99413d4b0b82a9becbe482f6)) * add gpg key and clean file ([81630ce](https://github.com/LerianStudio/helm/commit/81630ce857b0e00600b63d602c3dec4df45eab61)) * add gRPC port configuration for transaction service ([1f9f761](https://github.com/LerianStudio/helm/commit/1f9f7612cf82f8dd2803c00d665f461fc13c2e12)) * add gRPC port to transaction service ([30351b9](https://github.com/LerianStudio/helm/commit/30351b9dc6622ed4ab3ac1010c777d518537c999)) * **plugins:** add Helm chart for BC Correios plugin ([81bc419](https://github.com/LerianStudio/helm/commit/81bc41948bc410bf1952ab23081e2d205bf1f51f)) * add helm chart for BR PIX direct JD plugin with PostgreSQL dependency ([0adcba2](https://github.com/LerianStudio/helm/commit/0adcba27ed3fd6158b4632d3223f4a2f211545fb)) * add Helm chart for plugin-br-bank-transfer-jd ([2ee97b9](https://github.com/LerianStudio/helm/commit/2ee97b9986a7fc2821c3c3935e34eb183f02daf8)) * **plugin-br-payments:** add helm chart ([85cfe2a](https://github.com/LerianStudio/helm/commit/85cfe2a00eb299bc252b6fe6c496c4166d5cd390)) * **plugin-br-pix-switch:** add helm chart ([8977d4b](https://github.com/LerianStudio/helm/commit/8977d4b73d6f9d3df64153b89f976279e7a3a43d)) * add helm hook weights and delete policies for postgres and rabbitmq resources ([1bb5bf8](https://github.com/LerianStudio/helm/commit/1bb5bf8e3a02b547123d9e0a395163adca958729)) * add Helm hooks to onboarding and transaction ConfigMaps for pre-install/upgrade ordering ([a163833](https://github.com/LerianStudio/helm/commit/a163833ccd5c476f2a624252cea0169780fd55fd)) * add helm-compose config and karpenter node ([9a52467](https://github.com/LerianStudio/helm/commit/9a52467339718fd820e76355e97113cb6104fc2c)) * **plugin-br-pix-indirect-btg:** add HMAC validation and mTLS BTG config envs ([d1563c4](https://github.com/LerianStudio/helm/commit/d1563c48a40a1ef1dc9e8fd387203dc91c188261)) * add IAM Roles Anywhere sidecar support for fetcher and matcher ([a67b756](https://github.com/LerianStudio/helm/commit/a67b756fed6c39b62dfacda1f2ae34fecbd2b12e)) * **plugin-fees:** add IAM Roles Anywhere sidecar support ([d9621a1](https://github.com/LerianStudio/helm/commit/d9621a1da9d48355713f8d53ee881e01f8350143)) * **reporter:** add IAM Roles Anywhere sidecar support ([2b76810](https://github.com/LerianStudio/helm/commit/2b7681083e0bd731d3fc2e8605b1c0a02a3cc975)) * add imagePullSecrets and resource limits to nginx deployment ([73edcda](https://github.com/LerianStudio/helm/commit/73edcda18eb3f27c3c62ade6db7f353e8fdaa78c)) * **plugin-br-pix-switch:** add in-cluster sibling URL defaults ([c1f7b8f](https://github.com/LerianStudio/helm/commit/c1f7b8fdc42bae4bb588987df29a5e32a3969712)) * add index to semantic-release versioning ([4c98cf1](https://github.com/LerianStudio/helm/commit/4c98cf120e280bcdb252fed83aab285f1fa0f5e8)) * add index to semantic-release versioning ([af4c306](https://github.com/LerianStudio/helm/commit/af4c306d8e6ece405b451407c941eb1bf4eff5bd)) * add ingress template ([44b73b2](https://github.com/LerianStudio/helm/commit/44b73b2e3d2330af536435194930132e65d2ecc2)) * **ingress:** add ingress templates ([020369a](https://github.com/LerianStudio/helm/commit/020369a13b9696eb2e6e12c389ed211d2feb95f1)) * **ingress:** add ingress templates ([816fcee](https://github.com/LerianStudio/helm/commit/816fcee9d905744bcd47003fb16b974104c2d2d3)) * add init container in casdoor to check if the database is ready ([#48](https://github.com/LerianStudio/helm/issues/48)) ([8337771](https://github.com/LerianStudio/helm/commit/833777165ff6ed1d4183cc48757acd2d8b7ddd83)) * add initial helm chart for BR Pix Direct JD plugin ([2f097d0](https://github.com/LerianStudio/helm/commit/2f097d0f713783cf599888c880fc82fa6eec0ea3)) * **underwriter:** add initial Helm chart for Underwriter service ([7bbba1a](https://github.com/LerianStudio/helm/commit/7bbba1afcb883a261ef121710a9f5d0a854326ff)) * **plugin-br-pix-indirect-btg:** add INTERNAL_WEBHOOK_SECRET and bump to 1.0.0-rc.26 ([e5ef789](https://github.com/LerianStudio/helm/commit/e5ef7890094698e5bd5faceacc1e56746e0f2305)) * **dependencies:** add job to apply default definitions to external rabbitmq host ([c91db90](https://github.com/LerianStudio/helm/commit/c91db90f8311960f818d7f0b0046bc9eda1a4e6b)) * add Kubernetes manifests for PIX QR code service deployment ([8b1881f](https://github.com/LerianStudio/helm/commit/8b1881f157b140d02bed50cd6d7e70e67b074cb1)) * add Kubernetes manifests for plugin-br-pix-direct-jd job deployment ([9b67a67](https://github.com/LerianStudio/helm/commit/9b67a67fd073657a1c1dd7751288275fe24619d0)) * **midaz:** add ledger service configuration and restructure values files ([d4332f9](https://github.com/LerianStudio/helm/commit/d4332f9a122f4cf9045f76c8ce1e76dd080beda6)) * **midaz:** add ledger service with unified API and migration helpers ([0ee6e83](https://github.com/LerianStudio/helm/commit/0ee6e83a4a04e185585e7391f9ff7271ef8546b1)) * **doc:** add lerian banner ([35b904a](https://github.com/LerianStudio/helm/commit/35b904afb9d910e51b1508693aa7c3ce06ea9a75)) * add logical replication slot and improve SQL formatting ([ec2cfee](https://github.com/LerianStudio/helm/commit/ec2cfee6dab3fc571fb74e7e662c08000836a893)) * **plugin-fees:** add M2M and AWS_REGION env vars to chart ([f026d18](https://github.com/LerianStudio/helm/commit/f026d18e6b053f778b26d24dc1932a91f8c689d5)) * **fetcher:** add manager component Kubernetes manifests with full deployment configuration ([12ec0dd](https://github.com/LerianStudio/helm/commit/12ec0ddca52e9046324204ec7b717b87296e434b)) * **matcher:** add matcher helm chart ([6a235c1](https://github.com/LerianStudio/helm/commit/6a235c1fde13dc7ae70b3e719ed9b7dab4e3bb28)) * **matcher:** add missing env vars for matcher v1.0.0+ ([0bf1e7f](https://github.com/LerianStudio/helm/commit/0bf1e7f71c9dbb9ffea852f369def1d61ebfffac)) * **plugin-br-pix-indirect-btg:** add missing inbound webhook entity envs and security tier config ([ca62f49](https://github.com/LerianStudio/helm/commit/ca62f49564f7bf5c543028ec639870a762410605)) * **charts:** add missing NEU app env vars to reporter and fetcher ([8d4db13](https://github.com/LerianStudio/helm/commit/8d4db13cd6f1c1ebda31797c799b6d2ecebc7e5c)) * **product-console:** add MONGO_PARAMETERS env var for TLS/auth options ([164468c](https://github.com/LerianStudio/helm/commit/164468c7bbe92e069a3d4d25bd05eef17f8827c6)) * **plugin-br-pix-switch:** add mongodb + rabbitmq subchart dependencies ([0e9b3d4](https://github.com/LerianStudio/helm/commit/0e9b3d42d6cadd7e93d1ebd7e3d353d58c57f2cf)) * **console:** add mongodb environments ([256757e](https://github.com/LerianStudio/helm/commit/256757eb38cff41510d114572f4d18d92569fd6f)) * **console:** add mongodb environments ([88db3ba](https://github.com/LerianStudio/helm/commit/88db3bad7e8f2ec4fe5056980cbb7e41cdd02c38)) * **console:** add mongodb environments ([7c86ca0](https://github.com/LerianStudio/helm/commit/7c86ca00a65680a99b642d976ac36578c39c31f9)) * **console:** add mongodb port ([73ec8e2](https://github.com/LerianStudio/helm/commit/73ec8e27a619c333a6f2cfe60fcc0c8d49fd8295)) * **plugin-fees:** add MULTI_TENANT_ALLOW_INSECURE_HTTP to configmap template ([48cf209](https://github.com/LerianStudio/helm/commit/48cf20922c92bf3ece54122be84251913497c9a4)) * **plugin-fees:** add multi-tenant support and fix AVP secret rendering ([#1229](https://github.com/LerianStudio/helm/issues/1229)) ([04e12ac](https://github.com/LerianStudio/helm/commit/04e12acc2a1f0188fe78b227896880aa8f60bd28)) * **flowker:** add multi-tenant support and missing env vars ([9892b7d](https://github.com/LerianStudio/helm/commit/9892b7d9635f3b29d1159eccc60e5fd891d2badc)) * **tracer:** add multi-tenant support to chart (2.1.0-beta.1) ([a4c4a7e](https://github.com/LerianStudio/helm/commit/a4c4a7e62e71016696b0fc166eee66df2c76d61e)) * **console:** add new console env vars ([cf974b8](https://github.com/LerianStudio/helm/commit/cf974b8d696f9eb89e951fd144632d0e5817291f)) * **plugin-fees:** add new env vars for v3.1.0 ([f824431](https://github.com/LerianStudio/helm/commit/f8244314c78d1bfc76a3a83dce58e5e29d330b17)), closes [#1195](https://github.com/LerianStudio/helm/issues/1195) * **console:** add new env vars ([a228e39](https://github.com/LerianStudio/helm/commit/a228e39c856f9f4b561d55949edcaa051d5b9af9)) * **console:** add new env vars ([8b8d76f](https://github.com/LerianStudio/helm/commit/8b8d76f525a96f36c1d694c65db51ed7280a68a5)) * **dependencies:** add new parameters to chart file ([#44](https://github.com/LerianStudio/helm/issues/44)) ([4796070](https://github.com/LerianStudio/helm/commit/4796070cb5ad4c32d28bbb7ffc085b5fb3aeb495)) * **doc:** add new version ([39c0a71](https://github.com/LerianStudio/helm/commit/39c0a71dacbe9c80aa095a580c5d42d153b0947b)) * **doc:** add new version ([f864ad2](https://github.com/LerianStudio/helm/commit/f864ad20353a26f7dbe525332ef3b54f6af6fb74)) * add nginx configuration templates ([5755baa](https://github.com/LerianStudio/helm/commit/5755baaef5a346db79dfb78c7638b74c928c442f)) * add nginx dependence for midaz-console ([baa0cd4](https://github.com/LerianStudio/helm/commit/baa0cd4e4a209c520a2cb8e7de67c154f8a39e24)) * **midaz:** add nginx paramters to midaz-console ([84ff310](https://github.com/LerianStudio/helm/commit/84ff3103d5cd01da01c64c15eec4a83c5df66f17)) * **fetcher:** add OpenTelemetry HOST_IP injection support ([0ea3d75](https://github.com/LerianStudio/helm/commit/0ea3d7570288ab2e6e99a8f81564b031e11af626)) * add option to use existing secrets in helm chart ([f810082](https://github.com/LerianStudio/helm/commit/f810082fe8ce19eb69823f12b92345e418bb68d8)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * add plugin crm ui values ([493e4eb](https://github.com/LerianStudio/helm/commit/493e4eba4bf4457bbd75cf21334d33f16267b833)) * add plugin crm ui values ([c31de8d](https://github.com/LerianStudio/helm/commit/c31de8d30aedca6c9b4cc91b096c1e76a92a1a35)) * add plugin fees ui templates ([3451909](https://github.com/LerianStudio/helm/commit/345190944d3648c0ebae6e47890967cfefcc7e49)) * add plugin to semantic-release ([4ec01d8](https://github.com/LerianStudio/helm/commit/4ec01d8aceef35145239ae5b513977531798b329)) * add plugin to semantic-release ([d102c52](https://github.com/LerianStudio/helm/commit/d102c52039f5c1262f9dc00eb07728d226e656ef)) * add plugin to semantic-release ([a26017e](https://github.com/LerianStudio/helm/commit/a26017e363c87530e30e96e9b5fdc2581c19bb49)) * add plugin to semantic-release ([b001de0](https://github.com/LerianStudio/helm/commit/b001de0f2fad2b2b1cf05b5c0db9f48aa1af5265)) * add plugin to semantic-release ([f786586](https://github.com/LerianStudio/helm/commit/f7865866e41aad38bdf343e45fce351fa2af2a9b)) * add plugin to semantic-release ([13f0af3](https://github.com/LerianStudio/helm/commit/13f0af38e59cf9fb7a3596293a83dd3e6b9757a0)) * add postgres definitions and update security settings for console deployment ([6371b55](https://github.com/LerianStudio/helm/commit/6371b5568b94bc8f6fe57817132dee4644870ef3)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](https://github.com/LerianStudio/helm/commit/f6e469519784f6f301929066c55a152698e16d77)) * add pre-install and pre-upgrade hooks to onboarding and transaction secrets ([8199e92](https://github.com/LerianStudio/helm/commit/8199e92a9904adfc89adc6acf65a367d6c42b7e7)) * **product-console:** add product-console helm chart ([c956078](https://github.com/LerianStudio/helm/commit/c956078bd0959c13f42a018aa52b80862781b11d)) * **fetcher:** add RabbitMQ bootstrap job with definitions for external RabbitMQ instances ([90c5edc](https://github.com/LerianStudio/helm/commit/90c5edc90b4798ed0d31e56ca9479095889a521e)) * add RabbitMQ consumer credentials configuration in values-template ([da5c625](https://github.com/LerianStudio/helm/commit/da5c6255dfc8a2a671f9dfb88bb511d0536ddd6e)) * add rate limit configuration to midaz, fetcher, and reporter charts ([db2ec46](https://github.com/LerianStudio/helm/commit/db2ec461f6df0cc003cfe05fe4dd33df08d27d4e)) * add RBAC and nginx restart capability to service discovery job ([236e62f](https://github.com/LerianStudio/helm/commit/236e62f776e356b716fbd3059c37377cdbd154b6)) * **pipe:** add release step for ghcr ([f0e4f3f](https://github.com/LerianStudio/helm/commit/f0e4f3f5221b392bb68b2a5f87aa85facc5cfbee)) * **plugin-br-pix-indirect-btg:** add required validation for INTERNAL_WEBHOOK_SECRET ([df410e2](https://github.com/LerianStudio/helm/commit/df410e2d27b21a724447b44d50f9faaed7796be6)) * **plugin-fees:** Add SA template Fees ([14af5bd](https://github.com/LerianStudio/helm/commit/14af5bdd8e0cb45747c5d23797ed10ac6f4a96a3)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **console:** add secrets ([ad89e3b](https://github.com/LerianStudio/helm/commit/ad89e3ba7bd1713686bc0546be1e6b11341b10da)) * add security context and service account to nginx deployment ([3eaa99e](https://github.com/LerianStudio/helm/commit/3eaa99e8ecf17e3992e0c952699c2c111cf3aac3)) * **chart:** add security context to plugin identity ([47b48fc](https://github.com/LerianStudio/helm/commit/47b48fc9ec49f706519fceb4a7007c0179f62317)) * **pipe:** Add semantic changelog ([8c65e59](https://github.com/LerianStudio/helm/commit/8c65e5970101edc9ac621ec30b783bbc4fc3225c)) * **pipe:** Add semantic changelog ([452b6e7](https://github.com/LerianStudio/helm/commit/452b6e78b97a10aa4cd94daf5c95cd1545dc8222)) * **pipe:** Add semantic changelog ([c54115e](https://github.com/LerianStudio/helm/commit/c54115ebf8bd43a0dc8d41233d1100ac136ba8c3)) * **pipe:** Add semantic changelog ([d9befbb](https://github.com/LerianStudio/helm/commit/d9befbb65561716987a9825587f5ac0c9b63be3b)) * **ci:** Add Semantic Release changelog ([6537310](https://github.com/LerianStudio/helm/commit/6537310682b459b7f9fd48ed3c18dd739a816b0f)) * add service discovery job to plugins ui ([2bdaf78](https://github.com/LerianStudio/helm/commit/2bdaf789279b7cbefef51dbc4ad4db219325df73)) * **reporter:** add ServiceAccount annotations support for IRSA ([3685103](https://github.com/LerianStudio/helm/commit/3685103f9547e595667f85a9267272e337f3b077)) * **fetcher:** add ServiceAccount support for worker ([aa616c7](https://github.com/LerianStudio/helm/commit/aa616c7e00827621e525f75e3eb23c44fa2c9993)) * add step to update gh-pages ([bd762c7](https://github.com/LerianStudio/helm/commit/bd762c72ead853758a349d52913a63b45ed40a5c)) * add step to update gh-pages ([ddffd1b](https://github.com/LerianStudio/helm/commit/ddffd1b3dfbd179e26958361965f93a62273af07)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **midaz:** add support to external screts ([ab13b87](https://github.com/LerianStudio/helm/commit/ab13b878fdf8c280dc9e95cf015a459ce8b1edc6)) * **tracer:** add tracer helm chart ([275c30e](https://github.com/LerianStudio/helm/commit/275c30e44dcc66052cfc459e997dd0618e5ca766)) * add transaction gRPC configuration and update service versions ([cb48384](https://github.com/LerianStudio/helm/commit/cb4838437068d4e616c864c7cd37340399c0f504)) * **midaz:** add user consumer config to rabbitmq ([fb28359](https://github.com/LerianStudio/helm/commit/fb28359f8a4634317aeebd56e40af1a9083eb857)) * **plugin-br-pix-indirect-btg:** add validation to ensure INTERNAL_WEBHOOK_SECRET matches ([0f485b2](https://github.com/LerianStudio/helm/commit/0f485b225b9b5cd23e01e6154770550df8a69043)) * **plugin-smart-templates:** add valkey to smart templates chart ([709876b](https://github.com/LerianStudio/helm/commit/709876bb3b4d9c61a301d554f2f093615ad91084)) * add values template file ([7252f36](https://github.com/LerianStudio/helm/commit/7252f36fe7070fe18675073c21bb9269443270e8)) * **matcher:** add values-template and rabbitmq definitions ([3063245](https://github.com/LerianStudio/helm/commit/30632451da1ae248b1eeaf1dce680411b075f334)) * **matcher:** add VERSION env var and OTEL support ([cee8f96](https://github.com/LerianStudio/helm/commit/cee8f9682f769b77f6d2a5d52964b53dc92f9253)) * **plugin-br-pix-switch:** add wait-for-dependencies init container ([281226e](https://github.com/LerianStudio/helm/commit/281226e570ce08ce0ba412525986cb0766df77a2)) * **fetcher:** add worker component Kubernetes manifests with deployment, configmap and secrets ([fd8d8f3](https://github.com/LerianStudio/helm/commit/fd8d8f325262e945ed1e738efea2558e5ce9e2c6)) * add worker reconciliation config ([596c5a9](https://github.com/LerianStudio/helm/commit/596c5a91ed1fd498a7efc964f65cad94cc6b47c8)) * **console:** adds new env vars ([473cf5a](https://github.com/LerianStudio/helm/commit/473cf5a8d681e42c9ad8318b42b08dbea1e3e045)) * ajuste utilização recursos console ([44c7e64](https://github.com/LerianStudio/helm/commit/44c7e641170ad5e9b0a3629971c2cdc731059928)) * allow custom nginx configmap names and update plugins.conf path to snippets directory ([fe69b7b](https://github.com/LerianStudio/helm/commit/fe69b7b26b86c85a8d916afae4c9c9b009d8ba0d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **plugin-br-pix-switch:** auto-derive OTEL service version + node-IP OTLP endpoint ([15e6196](https://github.com/LerianStudio/helm/commit/15e6196cf549401084b7c6a1d7afd55c13f194b5)) * **reporter,fetcher:** auto-set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image tag ([bcc28f1](https://github.com/LerianStudio/helm/commit/bcc28f1bdc02b51347e677a8d26ac5ab7d7c40b6)) * **plugin-br-pix-switch:** auto-wire URLs to in-cluster subcharts ([561b398](https://github.com/LerianStudio/helm/commit/561b39871e2a17028eb56b9f3c0490ee74c5df43)) * **plugin-access-manager:** bump auth version ([12d5453](https://github.com/LerianStudio/helm/commit/12d54531235c76ccb25de1e976336505a0c51c91)) * **plugin-access-manager:** bump auth version ([10b5e4c](https://github.com/LerianStudio/helm/commit/10b5e4c9d7cc99ed93ff254b3e5c2632df25b9c6)) * **plugin-access-manager:** bump auth version ([90c6906](https://github.com/LerianStudio/helm/commit/90c6906ac94512dc14308f871aa4ed82717de49d)) * **midaz:** bump chart version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable ([bb157a4](https://github.com/LerianStudio/helm/commit/bb157a4472446033b94ab96837433e4df160555f)) * casdoor bump version ([bf5e28c](https://github.com/LerianStudio/helm/commit/bf5e28c0d3a259c192e94023fe1701bcca3d4fe4)) * **midaz:** config internal collector in midaz ([07d310e](https://github.com/LerianStudio/helm/commit/07d310ef840b1b95f86b6bdf1f75eba1a7e5b64a)) * **midaz:** config internal collector in midaz ([fb7d829](https://github.com/LerianStudio/helm/commit/fb7d8290ad20cb4e92ccd7eea19c07bb46b46bc7)) * **chart:** configure pdb to auth backend ([112bc47](https://github.com/LerianStudio/helm/commit/112bc47d72db94b57e81138297d973cb31d4ddf6)) * **helm:** create chart file to plugin crm ([69b01c8](https://github.com/LerianStudio/helm/commit/69b01c868752eb91973e2d292eb2e7ffaa57c1e0)) * **helm:** create chart file to plugin-fees ([38a0e81](https://github.com/LerianStudio/helm/commit/38a0e81c29d53bb81bb1895869b058942bc1d116)) * create chart midaz opensource ([afeadcf](https://github.com/LerianStudio/helm/commit/afeadcf46aef60af8b74055695a55fc00131f029)) * **helm:** create chart templates to plugin crm ([777ea2f](https://github.com/LerianStudio/helm/commit/777ea2fa1582d1530fbc4946c4ef184ae90598e9)) * **chart:** create chart templates to plugin-fees ([adabbaa](https://github.com/LerianStudio/helm/commit/adabbaaf405b471b111abe208408fce9c0772e99)) * **chart:** create chart templates to plugin-fees ([303caf0](https://github.com/LerianStudio/helm/commit/303caf06a48ff63e20fcdd13fd2c5d0629aae33c)) * **helm:** create doc to plugin crm ([4cbaa9d](https://github.com/LerianStudio/helm/commit/4cbaa9d4e8377260508c5687f292cfec8dbeee36)) * **plugin-smart-templates:** create functions to plugin-smart-templates ui ([d660619](https://github.com/LerianStudio/helm/commit/d6606192c1c6f0c0bd404e3b44c660079ce653b9)) * **plugin-smart-templates:** create helm templates to plugin-smart-templates ui ([a06f9c0](https://github.com/LerianStudio/helm/commit/a06f9c06c2d89de0a7f8ce6ba845057a8af3c268)) * **dependencies:** create init config file ([bddd6f0](https://github.com/LerianStudio/helm/commit/bddd6f025782740e3fc021ae4d7e64c0e78fd580)) * **dependencies:** create init sql file ([dcca103](https://github.com/LerianStudio/helm/commit/dcca103dcf229a307833685ad04711f662099219)) * **midaz:** create internal collector helm chart ([d17a5a4](https://github.com/LerianStudio/helm/commit/d17a5a45388428c30fa2133a58e275d445b634c7)) * **dependencies:** create job to apply migrations in casdoor db ([5a74bcc](https://github.com/LerianStudio/helm/commit/5a74bcc6ca8691159c4a3d11826a5afb34909e49)) * **values:** create pdb definitions ([fe34974](https://github.com/LerianStudio/helm/commit/fe34974aaa497979e0d13b610b77b4d1d7895f2f)) * **console:** create pdb template ([102c56a](https://github.com/LerianStudio/helm/commit/102c56a6e697623317585b8808f09f3cb7458882)) * **onboarding:** create pdb template ([8bc0d48](https://github.com/LerianStudio/helm/commit/8bc0d489407c8c5181a20f2c731e5abc7946b8b6)) * **transaction:** create pdb template ([738f5d3](https://github.com/LerianStudio/helm/commit/738f5d3ff33cc62f155186af1514340fa3133503)) * **chart:** create plugin access manager auth templates ([2fdd9ac](https://github.com/LerianStudio/helm/commit/2fdd9ac466966c5557757afae07a52f9894240fd)) * **chart:** create plugin access manager chart file ([094eecc](https://github.com/LerianStudio/helm/commit/094eeccff09029260104c7428a254c25260d20d6)) * **chart:** create plugin access manager identity templates ([c52068d](https://github.com/LerianStudio/helm/commit/c52068d228e3a79bbf4904e9823fb29407694add)) * **chart:** create plugin access manager templates ([c4221ad](https://github.com/LerianStudio/helm/commit/c4221adf91b52acc3c590d9d7b1f8db314f01d88)) * **values:** create plugin access manager values file ([b1727d0](https://github.com/LerianStudio/helm/commit/b1727d0f162fb1c464b35559f5684740a5af819e)) * create plugin fees ui functions ([0d2c127](https://github.com/LerianStudio/helm/commit/0d2c127d3d4f1aed530a864937e4e0e5fe7c8332)) * **plugin-smart-templates:** create secret to plugin-smart-templates ui ([552d061](https://github.com/LerianStudio/helm/commit/552d06115d589ceb41ac5d201fe972e82fc4c588)) * **plugin-smart-templates:** create values defintions to plugin-smart-templates ui ([48a25ca](https://github.com/LerianStudio/helm/commit/48a25ca3f4d889ba827a3674a284a563dbcbb105)) * **helm:** create values file to plugin crm ([de6b154](https://github.com/LerianStudio/helm/commit/de6b1547947f91d580a9ff5f7fb14c1e5efa4d0d)) * **values:** create values file to plugin-fees ([304f228](https://github.com/LerianStudio/helm/commit/304f22871b76180f4b299daa3ecaac06571ffd92)) * **values:** create values file to plugin-fees ([f383281](https://github.com/LerianStudio/helm/commit/f383281421b709744823d9de1bc053288ab6d747)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-br-pix-switch:** default DEPLOYMENT_MODE to byoc (1.1.0-beta.3) ([aa12385](https://github.com/LerianStudio/helm/commit/aa12385a12d159121c021f53350ebac3f90b3668)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](https://github.com/LerianStudio/helm/commit/4946cb505bb4ee121910113c4ca78a74e8a97269)) * dependency update ([18bd991](https://github.com/LerianStudio/helm/commit/18bd9910348f05785a975b38d8b11068f1069407)) * dependency update ([b56d142](https://github.com/LerianStudio/helm/commit/b56d1421e7251dc932d4b025cc6be4be31ee3c42)) * dependency update ([55eb548](https://github.com/LerianStudio/helm/commit/55eb5489f192d16508b7ecfd93bddcf71aa42feb)) * **grafana:** disable grafana ([423a6f5](https://github.com/LerianStudio/helm/commit/423a6f5495c50c4ccae86c5391cb52841af300e8)) * **plugni-fees:** Disable SA create ([4074905](https://github.com/LerianStudio/helm/commit/4074905ddec1dec2c62eab214fdbff1b548ef329)) * **plugin-fees:** enable extra env vars to configmap template ([5f60cea](https://github.com/LerianStudio/helm/commit/5f60ceac653f34a021d0db1a10447113fb693005)) * **plugin-fees:** enable extra env vars to values yaml ([dc626a7](https://github.com/LerianStudio/helm/commit/dc626a7a5825e0afbd1d44c1f56594f3a97f14fe)) * **plugin-crm:** enable extra env vars ([5ea9e2f](https://github.com/LerianStudio/helm/commit/5ea9e2fc7cda9500fe728d4bf2cd877844b666a4)) * **plugin-smart-templates:** enable extra env vars ([c03007b](https://github.com/LerianStudio/helm/commit/c03007bf50902abd45c54d5bee3296450a13d50b)) * enable karpenter node ([02b029d](https://github.com/LerianStudio/helm/commit/02b029d1a18e462be5c5c11c5d0c5f0cceee6122)) * **midaz:** enable ledger service by default ([1abf1f1](https://github.com/LerianStudio/helm/commit/1abf1f1b1944583717002bd23d2fb72fae71a676)) * enable telemetry for onboarding and transaction services ([2497433](https://github.com/LerianStudio/helm/commit/2497433be24d42829985604f47cf983705c05f6e)) * **console:** enforce absolute DNS resolution ([8e519fe](https://github.com/LerianStudio/helm/commit/8e519fe25255119d50ecfef91ca8ab5a01df5f78)) * **onboarding:** enforce absolute DNS resolution ([c471521](https://github.com/LerianStudio/helm/commit/c471521eb53ce2e100f080247c2ff25bc1255650)) * **transaction:** enforce absolute DNS resolution ([1759a5b](https://github.com/LerianStudio/helm/commit/1759a5b1ce44339302482bd5ccabed5056c33a2f)) * **ci:** enforce single-source infra secrets ([3b787d5](https://github.com/LerianStudio/helm/commit/3b787d508ba556c21b036b41ff990245e7258427)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](https://github.com/LerianStudio/helm/commit/756a1f9c85d570a539866b54f070192d40cb2f59)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **midaz:** extend RBAC permissions for discovery service to access replicasets and list/watch deployments ([9285689](https://github.com/LerianStudio/helm/commit/9285689f5bbb1ae361741668834473809cb7c86b)) * **matcher:** finalize matcher helm chart for v1.0.0 ([2be45e9](https://github.com/LerianStudio/helm/commit/2be45e958cbc4fc001831c1f87b11a1aea472d15)) * **ci:** harden validator with collapse gate ([cc324ee](https://github.com/LerianStudio/helm/commit/cc324ee94663baa3228d6b4ed754cc09d0ac4fbf)) * helm doc ([#26](https://github.com/LerianStudio/helm/issues/26)) ([ccb3021](https://github.com/LerianStudio/helm/commit/ccb30211fbd9ab5b1ff5e3151f1f9361d25e3cff)) * improve Helm setup reliability in release workflow ([eb49cc3](https://github.com/LerianStudio/helm/commit/eb49cc348065b87027112371b4496080b25dd4e4)) * **midaz:** improve RabbitMQ bootstrap script with smart URL handling and enhanced logging ([8d99add](https://github.com/LerianStudio/helm/commit/8d99addbd1dec7b570ccdb9fc7f6add52564172d)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](https://github.com/LerianStudio/helm/commit/e67d89c3fffa8154989f6d71f65582331fba98d9)), closes [#138](https://github.com/LerianStudio/helm/issues/138) * **lerian-notification:** initial chart ([2a001d4](https://github.com/LerianStudio/helm/commit/2a001d4ba433a61cd3317929cc96045c42561bfd)) * **bootstrap-mongodb:** make app user and roles configurable via values ([5a37252](https://github.com/LerianStudio/helm/commit/5a37252bc760b70a50ad1814d5fb7955065f7400)) * **plugin-access-manager:** make createDatabase configurable ([1574601](https://github.com/LerianStudio/helm/commit/1574601cb8d8a8d2a8cdf9f360dc695f5f102bfb)) * midaz helm chart ([8768a8e](https://github.com/LerianStudio/helm/commit/8768a8e1f97dbe82d0cb96b899c3865e7b9c95c3)) * midaz helm chart ([94b2a6e](https://github.com/LerianStudio/helm/commit/94b2a6eab897bb6c1cd6f336fc9cf12f642ad697)) * **rabbitmq:** migrate from Bitnami chart to groundhog2k chart ([454c850](https://github.com/LerianStudio/helm/commit/454c850bb9bce3b24f62bea34cf65997a55fcf2b)) * **valkey:** migrate from StatefulSet to Deployment ([3854dfe](https://github.com/LerianStudio/helm/commit/3854dfe3430eaf7f4d99e39d032103eca4ff10fd)) * **plugin-br-bank-transfer:** move CLIENT_IDs to secrets ([d3e36c0](https://github.com/LerianStudio/helm/commit/d3e36c03dce5f43305daf1c6da2da4f65a142f76)) * **pipe:** new pipe to deploy all charts ([20629f5](https://github.com/LerianStudio/helm/commit/20629f50ce386463a83ac0ebc0fce367430f04a0)) * **pipe:** new releaserc template ([24dc653](https://github.com/LerianStudio/helm/commit/24dc653adae4f036f7d5b9da044f42c43e9acd09)) * onboarding bump version ([4fc43e7](https://github.com/LerianStudio/helm/commit/4fc43e748f50fc4afd34e475a1c7d7360efaf3bc)) * onboarding rabbitmq protocol variable ([add46ac](https://github.com/LerianStudio/helm/commit/add46ac46bdcf1e629db5f92d4e129f550e93cfb)) * onboarding rabbitmq protocol variable ([01b91e6](https://github.com/LerianStudio/helm/commit/01b91e690ca469e58800047c055c872b90ab00d8)) * onboarding rabbitmq protocol variable ([9980d0c](https://github.com/LerianStudio/helm/commit/9980d0cd82b658b34d9244cc524630222f0cf61e)) * onboarding rabbitmq protocol variable ([3d44fa1](https://github.com/LerianStudio/helm/commit/3d44fa1c77b8442600f272497fd4fe79351aadf9)) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](https://github.com/LerianStudio/helm/commit/82dbb81fda6cb8611844cabdaff52b9cc65758b1)) * **charts:** parametrize probe path and timing for all charts using /readyz ([c4d15a2](https://github.com/LerianStudio/helm/commit/c4d15a20995b4edbcf11ce8576c1b80b5a05287d)) * **ci:** per-chart values.schema.json generator ([d295433](https://github.com/LerianStudio/helm/commit/d2954334953f15a1db0ee47064d5885bcec89f6b)) * **plugin-br-pix-switch:** per-component command/args for single-image multi-binary support ([d607978](https://github.com/LerianStudio/helm/commit/d607978e45aedec2137b0ecf5505529a08a254cd)) * **plugin-br-pix-switch:** per-component image repository defaults (1.1.0-beta.6) ([48b9d17](https://github.com/LerianStudio/helm/commit/48b9d17c3930e97c3d84355f6c56c39f739913b8)), closes [#137](https://github.com/LerianStudio/helm/issues/137) * plugin auth bump version ([f99a6fb](https://github.com/LerianStudio/helm/commit/f99a6fb0ad500f482703e87bb47ff5a87be857ff)) * plugin identity bump version ([d98f1b5](https://github.com/LerianStudio/helm/commit/d98f1b57ca9d5445651721904a16587d7689241d)) * **midaz:** plugins ui support to console ([17f2376](https://github.com/LerianStudio/helm/commit/17f23766c70f1e1784f7cb83fccff7f54fcd5333)) * **midaz:** plugins ui support to console ([7eced23](https://github.com/LerianStudio/helm/commit/7eced23afd42a256af0f28f308e814058b046f17)) * **midaz:** plugins ui support to console ([495afa4](https://github.com/LerianStudio/helm/commit/495afa420d2395027082a7b8b14fc7402512ede2)) * **midaz:** plugins ui support to console ([3b8ad93](https://github.com/LerianStudio/helm/commit/3b8ad93dfac6f20ab87a23f3c7e1e0eca853c252)) * **midaz:** plugins ui support to console ([3af6680](https://github.com/LerianStudio/helm/commit/3af668074fe67d2c6abf5a9a15dacb906d9200db)) * **midaz:** plugins ui support to console ([8303bad](https://github.com/LerianStudio/helm/commit/8303badc38db540dbbbb60ad0cf6384a3642ca50)) * **midaz:** plugins ui support to console ([d902801](https://github.com/LerianStudio/helm/commit/d90280110322bed7b0b54fd781320c361582ad36)) * postgres replication ([fa57f99](https://github.com/LerianStudio/helm/commit/fa57f99ed9d8dc8a157b776c65a02beb6f3453b4)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **plugin-br-pix-switch:** providersIngress for outbound-provider adapters (1.1.0-beta.8) ([061f8b9](https://github.com/LerianStudio/helm/commit/061f8b9ed0bc9ac7d94629980121a32022edc020)) * **plugin-br-pix-switch:** refactor chart to multi-component (1.1.0-beta.2) ([ea1ff08](https://github.com/LerianStudio/helm/commit/ea1ff08c41a4c3f6d94715977f9792d307d9ee1d)) * refactor plugin fees templates folder ([af27cba](https://github.com/LerianStudio/helm/commit/af27cbaaf3255ca7b4bb62acd7cbdc221b3ab2bb)) * **midaz:** remove console service and nginx components ([68be4ac](https://github.com/LerianStudio/helm/commit/68be4aca05f97e0a3bcdf35058dfccf8ee8e192a)) * **doc:** remove old components ([954dd09](https://github.com/LerianStudio/helm/commit/954dd097b1be74841efa6022a94d807e228c6ec4)) * **github:** remove pgbouncer reference ([49924e8](https://github.com/LerianStudio/helm/commit/49924e811d918e8ed136e878bb480da51096d98a)) * **pipe:** remove step commit history ([b0fd599](https://github.com/LerianStudio/helm/commit/b0fd5993ef1eecb84d34759552871d9f1447b7a3)) * **pipe:** remove step commit history ([e42b665](https://github.com/LerianStudio/helm/commit/e42b665d1bda4e9461e08b855e120fcb596c6521)) * **pipe:** remove step commit history ([ed1ec98](https://github.com/LerianStudio/helm/commit/ed1ec98c8132bd84ee4c344cd70ac9da355bf9af)) * **pipe:** remove step commit history ([b8b256d](https://github.com/LerianStudio/helm/commit/b8b256d997e838caea71ced0ed190e24aa73896a)) * **pipe:** remove step commit history ([a56f7c6](https://github.com/LerianStudio/helm/commit/a56f7c6027fe4e5c90f08231b2cab83e1dc4cc30)) * **pipe:** remove step commit history ([323b43a](https://github.com/LerianStudio/helm/commit/323b43aa1b8b73d103cdaba3b692d2bde73ff772)) * rename Smart Templates to Reporter and enhance RabbitMQ config ([1b1c269](https://github.com/LerianStudio/helm/commit/1b1c269a3e43625c48535e7d759dff9fb5b159f8)) * **plugins:** restructur plugins with frontend add support for external secrets and create guide to upgrade ([ea4a669](https://github.com/LerianStudio/helm/commit/ea4a66964a13c4331f7cdd4ade710fe29177a23f)) * **plugin-br-pix-switch:** schema migration Jobs (1.1.0-beta.9) ([8e88410](https://github.com/LerianStudio/helm/commit/8e884103cf1e251711f442cec4055d703626d561)), closes [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) * **plugin-br-pix-switch:** shared multi-path ingresses (1.2.0-beta.1) ([78c74f4](https://github.com/LerianStudio/helm/commit/78c74f4ef0129663ce13ae4e2155927b02140468)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **reporter:** support external KEDA operator ([0f19cbe](https://github.com/LerianStudio/helm/commit/0f19cbecb1208201f6413921a6726e89616a09b1)) * support external secrets for RabbitMQ admin credentials in Helm chart ([76fa832](https://github.com/LerianStudio/helm/commit/76fa832de626e9ad6c8d44fb366c75cdd900f55d)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](https://github.com/LerianStudio/helm/commit/86eb65124a2e4c5a5590908fe5b6365c825215e8)) * **tracer:** template ENV_NAME in configmap ([50a6f50](https://github.com/LerianStudio/helm/commit/50a6f501b24164485475f64529514293e1e83211)) * transaction bump version ([84028fb](https://github.com/LerianStudio/helm/commit/84028fb3c2be79e976ac9bea48707696db4f40c4)) * transaction rabbitmq protocol variable ([27e075c](https://github.com/LerianStudio/helm/commit/27e075c1b2762d6648ed26c666491c6c039dd0ae)) * transaction rabbitmq protocol variable ([f0f8334](https://github.com/LerianStudio/helm/commit/f0f8334ff61cbcdad9b434e08547dab328fbf2fa)) * transaction rabbitmq protocol variable ([60ff71f](https://github.com/LerianStudio/helm/commit/60ff71f7b07e90ecfdb8c55895225682b25c2694)) * transaction rabbitmq protocol variable ([7fdc26c](https://github.com/LerianStudio/helm/commit/7fdc26c4bcdf7a7ebffe8bc5aaa662964c9a7605)) * **chart:** update app version ([348b0cc](https://github.com/LerianStudio/helm/commit/348b0ccb5fea5042fe08da2af81cbd0b323a7aca)) * **chart:** update app version ([6f40285](https://github.com/LerianStudio/helm/commit/6f402851add6d9898c04e263d5706644645cacb2)) * **helm:** update app version ([fb2f841](https://github.com/LerianStudio/helm/commit/fb2f84162e5951495e2ab12296f6855edb09fce7)) * **midaz:** update app version ([e18a30b](https://github.com/LerianStudio/helm/commit/e18a30b59c5f33cb462d6ac4bdd8c675097f2d9d)) * **values:** update app version ([598ed6d](https://github.com/LerianStudio/helm/commit/598ed6d478240d26ee9baa9560d73db1912ba05d)) * **values:** update apps version and add backend config ([7cb17c2](https://github.com/LerianStudio/helm/commit/7cb17c2225d0863ee655b6ea5fc5532421ffa93d)) * **dependencies:** update auth backend init file ([be72215](https://github.com/LerianStudio/helm/commit/be72215937655d4adb136ae9802d68ade6a279b9)) * **chart:** update auth backend templates ([8659b67](https://github.com/LerianStudio/helm/commit/8659b6758e533c9a0922d481107ba59656d3f0a5)) * **chart:** update auth templates ([a6221e4](https://github.com/LerianStudio/helm/commit/a6221e4b89edec63f40b80bd31574588d9204a5b)) * **chart:** update auth templates ([c5bcb23](https://github.com/LerianStudio/helm/commit/c5bcb23959466580106b98f7e3312195f7f42f35)) * **values:** update auth version ([b549735](https://github.com/LerianStudio/helm/commit/b54973599235c3f52058e68dcd499c8c21c8dac7)) * **doc:** update charts documentation ([422e771](https://github.com/LerianStudio/helm/commit/422e7717a8f7c79d96f4cdd110421f0c68857d82)) * **doc:** update charts documentation ([b9618c4](https://github.com/LerianStudio/helm/commit/b9618c462cf3f0ad6b3f237347ffae01fc23cb09)) * **midaz:** update console configmap ([bf616a3](https://github.com/LerianStudio/helm/commit/bf616a3ee69f10ab2ffa21fce05ed92a21d10c6e)) * **console:** update console image ([0cf1135](https://github.com/LerianStudio/helm/commit/0cf11350d345410c751d99cf8c5347793219b469)) * **console:** update console image ([4da311d](https://github.com/LerianStudio/helm/commit/4da311d8968411a29d129ef02e133b3ddd0bb25e)) * **console:** update console version ([d789c7d](https://github.com/LerianStudio/helm/commit/d789c7dc7596e65c90c0e18072687b2ea828b295)) * **values:** update console version ([778eea0](https://github.com/LerianStudio/helm/commit/778eea0d86f62b9257f4f94892ef2b340df945da)) * **values:** update extra env vars for postgres ([9852143](https://github.com/LerianStudio/helm/commit/9852143eff1ca1bbc3e6c33660d80ec4bb337d6d)) * **fetcher:** update fetcher-manager@1.1.0, fetcher-worker@1.1.0 - new env vars ([345798a](https://github.com/LerianStudio/helm/commit/345798aca7179ec1b36958b22b4f702fe772ce9a)) * **fetcher:** update fetcher-manager@1.2.0, fetcher-worker@1.2.0 - new env vars ([47785ab](https://github.com/LerianStudio/helm/commit/47785abc7269481a7b2365b49589b5bd614d0f41)) * **fetcher:** update fetcher-manager@1.3.0, fetcher-worker@1.3.0 - new env vars ([679fd73](https://github.com/LerianStudio/helm/commit/679fd73b41b0019aa0c75c782adae169826f1053)) * **pipe:** update gitignore ([6ae09d6](https://github.com/LerianStudio/helm/commit/6ae09d68f21e21e5b93834017c0525511baaf94a)) * **chart:** update identity templates ([f8def52](https://github.com/LerianStudio/helm/commit/f8def529a453cf4c2db448df07ba167ff14d6c83)) * **values:** update identity version ([f8ee875](https://github.com/LerianStudio/helm/commit/f8ee875bb51ac52300d683e366f976aa903077b2)) * **product-console:** update image tag to 1.5.0 and add upgrade guide ([a289f8c](https://github.com/LerianStudio/helm/commit/a289f8c27b440f30174dac68339fe50d83d27679)) * **values:** update midaz version ([#36](https://github.com/LerianStudio/helm/issues/36)) ([af4b898](https://github.com/LerianStudio/helm/commit/af4b898e7ed4e431ab853320a3275b9d219630f7)) * **migrations:** update migration logic and enable migrations job ([643f703](https://github.com/LerianStudio/helm/commit/643f703aed35990cb8997a2df90f1fe2bacf9494)) * **midaz:** update onboarding configmap ([7a28f50](https://github.com/LerianStudio/helm/commit/7a28f50d694f2b527d51d201205d486ce8b2d3d5)) * **midaz:** update otel env var ([769a770](https://github.com/LerianStudio/helm/commit/769a77004aebb612aed5d81b9dec30624a003734)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.10, job@1.2.1-beta.10 - new env vars ([63ae72c](https://github.com/LerianStudio/helm/commit/63ae72c6add50c9e0fbeff1567bb018afe3ef553)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.11, job@1.2.1-beta.11 - new env vars ([3b07e6b](https://github.com/LerianStudio/helm/commit/3b07e6bd9b5c07c865599da7749bff593f593da8)) * **chart:** update plugin access manager values ([e4221eb](https://github.com/LerianStudio/helm/commit/e4221ebc5da46a51c5d71ef0755bba35e3313584)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.0, plugin-br-pix-indirect-btg-worker-inbound@1.5.0, plugin-br-pix-indirect-btg-worker-outbound@1.5.0 - new env vars ([80fe4fc](https://github.com/LerianStudio/helm/commit/80fe4fc55014cf24844c1e1626b213475d5419a3)) * **plugin-fees:** update plugin-fees@3.1.0 - new env vars ([0111ef7](https://github.com/LerianStudio/helm/commit/0111ef72746c78f97321c78b110ffb0e2ac68e61)) * **docs:** update rabbitmq documentation ([cae5467](https://github.com/LerianStudio/helm/commit/cae54677bcf8a2a26949ed341df9caea50cea762)) * **docs:** update readme file ([314da0e](https://github.com/LerianStudio/helm/commit/314da0e538e7534a79cbea9423d2d6b5c08c3a8e)) * **reporter:** update reporter-manager@1.2.0, reporter-worker@1.2.0 - new env vars ([624ec97](https://github.com/LerianStudio/helm/commit/624ec978ef73810b568c9a8a578d4f8635f998d2)) * **values:** update resources limits ([04ccb18](https://github.com/LerianStudio/helm/commit/04ccb184cd7393e5c1f60fa5945fd89d0b5289d2)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **midaz:** update transaction configmap ([be52752](https://github.com/LerianStudio/helm/commit/be5275243af5315dc64026f436460f345eb41e78)) * **midaz:** update transaction otel env var ([79717c5](https://github.com/LerianStudio/helm/commit/79717c5815e8c1f5a9e859cea47ef3553fe821df)) * **midaz:** update transaction otel env var ([927f39e](https://github.com/LerianStudio/helm/commit/927f39e5ab03e15460d28769bacb9fe1ac43d0ed)) * **plugin-crm:** update ui env vars ([9fab16d](https://github.com/LerianStudio/helm/commit/9fab16dbcbc80ccc55c0bc2c32e2d099facb6110)) * **midaz:** update values file ([98e396c](https://github.com/LerianStudio/helm/commit/98e396cb1a366691c8b0a3f32f697086583c99bf)) * **midaz:** update values file ([c0cbef1](https://github.com/LerianStudio/helm/commit/c0cbef16e5225e218a60d25d71496c2085250820)) * **values:** update values file ([db9b3db](https://github.com/LerianStudio/helm/commit/db9b3db3961bea039663a7dba0f548601e3c146b)) * **values:** update values file ([cc698a0](https://github.com/LerianStudio/helm/commit/cc698a0a76b24e97b4ff890605535e9ad128e886)) * **midaz:** update values template ([90f3133](https://github.com/LerianStudio/helm/commit/90f31338d4158ddaeca92ab47417b9ca8e7cf20b)) * **chart:** update version ([40d723d](https://github.com/LerianStudio/helm/commit/40d723d6159d78f2a198cdfa9c7c969d07219289)) * **chart:** update version ([22e2930](https://github.com/LerianStudio/helm/commit/22e2930ce80b8e33926bb6db7a5f70ca6faa4fa5)) * **chart:** update version ([8031ceb](https://github.com/LerianStudio/helm/commit/8031cebf57f599fda19f74224cd17a746bfe1e21)) * **chart:** update version ([a8af389](https://github.com/LerianStudio/helm/commit/a8af389aa9135313e2e534e4fd0af358a3b8fcf2)) * **chart:** update version ([412e782](https://github.com/LerianStudio/helm/commit/412e782cff316594cb5b6ea0410a7c5d66ebf6a1)) * **chart:** update version ([4a42b13](https://github.com/LerianStudio/helm/commit/4a42b1367e2ac41654210610641c44fcb7f8b463)) * upgrade app version to 3.3.0 and add SSL mode configs for database connections ([c9d334f](https://github.com/LerianStudio/helm/commit/c9d334f2354705719d3469d614317d6524fd9987)) * **lerian-notification:** use /migrate binary in migrations Job ([1696dd7](https://github.com/LerianStudio/helm/commit/1696dd7f1af6292d634a1e2a428eb2a69aeb6d86)), closes [LerianStudio/lerian-notification#40](https://github.com/LerianStudio/lerian-notification/issues/40) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) * values template file ([2f7c796](https://github.com/LerianStudio/helm/commit/2f7c79606290492be77d34dfbd6ec76e89334cbb)) * values template file ([54ba721](https://github.com/LerianStudio/helm/commit/54ba721da0981d80e2df95a008d22d0fb0b03fd8)) ### Bug Fixes * **release:** add branch check to release notification job to only run on main branch ([f2f8e02](https://github.com/LerianStudio/helm/commit/f2f8e02c5eacdc9ea06d1b5af6df99a73df589db)) * **values:** add comments in values ([#43](https://github.com/LerianStudio/helm/issues/43)) ([03a5842](https://github.com/LerianStudio/helm/commit/03a5842787db8dc1b4d954038b36a343ad7180c1)) * **plugin-access-manager:** add configurable DB_SSLMODE for auth PostgreSQL connections ([dd1d626](https://github.com/LerianStudio/helm/commit/dd1d626766129b1459e768732e2f826d3ad96eac)) * **new:** add DEFAULT_MIDAZ_ORGANIZATION_ID to configmap for enhanced multi-tenancy support ([d7b66a0](https://github.com/LerianStudio/helm/commit/d7b66a052d47394096ecdc18809e7c2d4fffeed3)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([33adde3](https://github.com/LerianStudio/helm/commit/33adde3650e26f65c09643ba8b2fd669bd504adc)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([5f8ca7b](https://github.com/LerianStudio/helm/commit/5f8ca7b5abc6ca7c895af8c3ae1055907689c1d3)) * **product-console:** add image annotation for product-console 1.6.0 ([03c927c](https://github.com/LerianStudio/helm/commit/03c927c3029714c435534a4c72ca450bcdccbd08)) * add kindIs guard for backward compat with string image values ([313d9f6](https://github.com/LerianStudio/helm/commit/313d9f6b646cf3b3bb26cc2644063b16806c1847)) * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](https://github.com/LerianStudio/helm/commit/79ef8f5ea3d7bc2626972fcd4621b1e327c08aed)) * **matcher:** add missing env vars for systemplane and multi-tenant ([965da94](https://github.com/LerianStudio/helm/commit/965da94cdddb8c11654625e071e28c7a83193938)) * add missing MONGO_HOST/MONGO_PORT and align MONGODB_DB_NAME ([0725fa2](https://github.com/LerianStudio/helm/commit/0725fa2b26ed516c15ff1b5292b35581ff437de2)) * **midaz:** add missing MONGO_PARAMETERS to CRM configmap ([2bfecc2](https://github.com/LerianStudio/helm/commit/2bfecc220b7646c57b5e47f141cfb6e79469baec)) * add missing space in MIDAZ_CONSOLE_BASE_PATH template expression ([7b9bb67](https://github.com/LerianStudio/helm/commit/7b9bb677785cd1d381d1b8d497ee0a8bdc921c83)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](https://github.com/LerianStudio/helm/commit/d7765b455710ba5009a931493d351f88f735a1ce)) * **product-console:** add MongoDB connection info to NOTES.txt ([b4d6557](https://github.com/LerianStudio/helm/commit/b4d6557b5ccf5a93a70104bc5d5533171bc0147f)) * **product-console:** add mongodb.enabled flag to values-template ([7024d9d](https://github.com/LerianStudio/helm/commit/7024d9d0d47422b362b400b9494cfd440378122a)) * **configmap:** add new configuration options for deployment mode, private upstreams, and reconciliation settings ([f1a475e](https://github.com/LerianStudio/helm/commit/f1a475ea82bed1d9174193e58e271a5a730a5cc1)) * **plugin-access-manager:** add new configuration options for logging, rate limiting, and MFA in configmap.yaml ([d1e83b2](https://github.com/LerianStudio/helm/commit/d1e83b286a91b144bc44788a4fb457c4273b052f)) * **chart:** add new env var to enable auth plugin ([53b8ffb](https://github.com/LerianStudio/helm/commit/53b8ffb5ef5beaf77756b45e815b946b106c9320)) * add newline at end of values.yaml file ([044905f](https://github.com/LerianStudio/helm/commit/044905f48ff2d9fe8bd7f84770f34bebd700baf9)) * add plugin-br-bank-transfer-jd section to README version matrix ([ccd19ac](https://github.com/LerianStudio/helm/commit/ccd19acf8352c2e4a1390af297c61f0d63d7ae1e)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](https://github.com/LerianStudio/helm/commit/7ba4f9d8fede36092d0a7a60f08620f5ca3fd777)), closes [#1404](https://github.com/LerianStudio/helm/issues/1404) * **fetcher:** add RabbitMQ and storage configuration options, remove unused secret template ([865613d](https://github.com/LerianStudio/helm/commit/865613d1cf6264ee5b97e5e85d342e5f36043415)) * **plugin-br-pix-switch:** add RABBITMQ_URI to dict-hub-vsync configmap ([75074ae](https://github.com/LerianStudio/helm/commit/75074ae94521b346e0a0c167a166988d65084497)) * add required validation for Roles Anywhere ARNs and README migration note ([50e4718](https://github.com/LerianStudio/helm/commit/50e47186dee052e541566d65d2362c8fe175e5a5)), closes [#1](https://github.com/LerianStudio/helm/issues/1) [#3](https://github.com/LerianStudio/helm/issues/3) [#1113](https://github.com/LerianStudio/helm/issues/1113) * add trailing slash to default MIDAZ_ONBOARDING_URL in fees configmap ([fe394c5](https://github.com/LerianStudio/helm/commit/fe394c5e4fde1fb3cca5a5c7cc9a3019ac92cd5f)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **plugin-br-pix-indirect-btg:** add WEBHOOK_DEFAULT_URL to outbound configmap ([0dd6d81](https://github.com/LerianStudio/helm/commit/0dd6d81592f19d983e0ddfa75dbaf5e00b8fbd85)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * address CodeRabbit CLI review findings ([974bbb8](https://github.com/LerianStudio/helm/commit/974bbb85bee5549825b25a379042eeeaf3f79ba7)) * **plugin-br-pix-switch:** address CodeRabbit feedback on NOTES, README, configmap, and labeler ([78e4615](https://github.com/LerianStudio/helm/commit/78e4615949c5e9b7dabcc2f497d687deae7ccfe4)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **plugin-br-pix-indirect-btg:** address coderabbit review feedback ([bb664a9](https://github.com/LerianStudio/helm/commit/bb664a9eb52c4e2636397955b7bde365643e34db)) * **lerian-notification:** address CodeRabbit review on initial chart ([36c326f](https://github.com/LerianStudio/helm/commit/36c326fe1bbabd80112ef82cab3bb862fa0a18b1)), closes [#1332](https://github.com/LerianStudio/helm/issues/1332) * **product-console:** address CodeRabbit review on NOTES.txt ([e8cf8d7](https://github.com/LerianStudio/helm/commit/e8cf8d7157aedb39c4d58be3d88e6ac4a044391f)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **charts:** address CodeRabbit review on revamp PR [#1470](https://github.com/LerianStudio/helm/issues/1470) ([98288a5](https://github.com/LerianStudio/helm/commit/98288a5c6b09efe520675e9c4d605ddb4e8d71f0)), closes [#1](https://github.com/LerianStudio/helm/issues/1) * address CodeRabbit security and quality issues ([eb80852](https://github.com/LerianStudio/helm/commit/eb80852c7012443feebb00cb5d3cb1e6a2a80c2c)) * address remaining CodeRabbit review comments ([6f26a8b](https://github.com/LerianStudio/helm/commit/6f26a8b44643d9eaaa3957d1892f0f763d9da3c3)) * **pix-btg:** adjust default url ([51c4753](https://github.com/LerianStudio/helm/commit/51c4753e916e653ae44829792c8b47a9fc625efd)) * **midaz:** adjust ledger component port from 3000 to 3002 ([8e01518](https://github.com/LerianStudio/helm/commit/8e015184256566ca18c2973067fb8d48e8332fb5)) * **midaz:** adjust ledger component port from 3000 to 3002 ([bb58334](https://github.com/LerianStudio/helm/commit/bb583344a4ba4b59f114355eef6c4339b6d4b102)) * **midaz:** adjust midaz-crm repository image ([5f9fdcb](https://github.com/LerianStudio/helm/commit/5f9fdcb9733aa2b6d620a8d5b61ca7fc54036265)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **tracer:** align chart default port with source convention (2.0.0-beta.6) ([0f8683d](https://github.com/LerianStudio/helm/commit/0f8683dfacda22346b632511a0bfa92b4119f550)), closes [#193](https://github.com/LerianStudio/helm/issues/193) * **flowker:** align chart default port with source convention (2.1.0-beta.6) ([662ad6e](https://github.com/LerianStudio/helm/commit/662ad6e4a39aef852901dd2e1c861018e89fdfaa)), closes [#1308](https://github.com/LerianStudio/helm/issues/1308) * **underwriter:** align chart with app config + standardize VERSION ([9d9a875](https://github.com/LerianStudio/helm/commit/9d9a875ce000cd6136c36fd22967c24c743dbd3a)) * align comment with actual template keys per CodeRabbit review ([338e19c](https://github.com/LerianStudio/helm/commit/338e19ccf967d764ef4165818b585b4698d8e8a5)) * **matcher:** align default securityContext with distroless nonroot UID ([87f0c59](https://github.com/LerianStudio/helm/commit/87f0c59675607d596145d2caa99f96dfd09f1e35)) * **flowker:** align Mongo env vars with app source code ([fdeb22c](https://github.com/LerianStudio/helm/commit/fdeb22c6d2b98425b2c9fae436d4eb81d871eec3)) * align NextAuth URLs with reporter UI base URL ([8d5f4f7](https://github.com/LerianStudio/helm/commit/8d5f4f7e6a671872f6d8e3b95f60b119f89416e0)) * **matcher:** align OTEL env vars with app and bump to v1.0.0-beta.3 ([d1616fb](https://github.com/LerianStudio/helm/commit/d1616fb09bd3e80cce2bbd3e91930771f985ff75)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](https://github.com/LerianStudio/helm/commit/75ad0d4a418787d0d3e85ef8311ee822202e1a2e)) * always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image.tag ([56bfc66](https://github.com/LerianStudio/helm/commit/56bfc666dd2c8d8d83802f026f4ec6436bda8dc4)) * **plugin-br-pix-switch:** apply container securityContext, fix tolerations type, add NOTES defaults ([86b7f17](https://github.com/LerianStudio/helm/commit/86b7f1789c06a09a46d32f9cc2fddcbd560fa25d)) * **onboarding:** auth endpoint and remove old env var ([de370da](https://github.com/LerianStudio/helm/commit/de370daa57563a194d5273888587f0aa95262a0b)) * **transaction:** auth endpoint ([12d8f6d](https://github.com/LerianStudio/helm/commit/12d8f6d3c9d52bff108f220f297d0d4f1db6ca78)) * **values:** auth env vars ([23b34a1](https://github.com/LerianStudio/helm/commit/23b34a13ea547a1587d71689b30adfe02f580dc0)) * **plugin-br-pix-switch:** bootstrap Job fixes surfaced by live install test ([fc9e125](https://github.com/LerianStudio/helm/commit/fc9e12530d40da9dfc6cec51ba2afbd0e66bf9f0)) * bump chart and console versions to 4.4.3 and 3.4.3 ([1cb77cc](https://github.com/LerianStudio/helm/commit/1cb77cc00932d6302e3a71f9bd08253d85f2c3d0)) * **console:** bump image tag to 2.2.1 ([9dfde6e](https://github.com/LerianStudio/helm/commit/9dfde6ee7deb61ef67376dd84d3396845f88fe9f)) * bump plugin-fees chart to version 3.4.4 ([8aaed46](https://github.com/LerianStudio/helm/commit/8aaed46539f10d3879eb7563c1cfa63841d6ddb2)) * change Helm hooks from post-install to pre-install for Postgres and RabbitMQ initialization ([374ccbb](https://github.com/LerianStudio/helm/commit/374ccbb36160f5a614271f65c0a55cf79be568f1)) * chart ([81f1126](https://github.com/LerianStudio/helm/commit/81f112612a3327fffc69da8720b2222122df44a4)) * chart ([f6e6446](https://github.com/LerianStudio/helm/commit/f6e644662db2f641b0e71e3cccd518fa4fe715dc)) * chart app version ([4ae59b0](https://github.com/LerianStudio/helm/commit/4ae59b08085f19e6a20617782e5a3b28044c01f6)) * **tracer:** chart cleanup for 2.0.0-beta.5 ([b8767d5](https://github.com/LerianStudio/helm/commit/b8767d5853b9108a751590468dea17400815f906)) * chart name ([78ae357](https://github.com/LerianStudio/helm/commit/78ae357d208a2835174345b9179c596cf50a401b)) * chart name ([6db8350](https://github.com/LerianStudio/helm/commit/6db83502f0f75b59a5345c27eeade292b31078a9)) * chart name ([1f78da5](https://github.com/LerianStudio/helm/commit/1f78da504538d1a518f503e69b21b1696a893313)) * clean dead OTEL defaults and fix SWAGGER_HOST service names ([76909b8](https://github.com/LerianStudio/helm/commit/76909b801a697be8c28fb345d1f9de611be88bee)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](https://github.com/LerianStudio/helm/commit/5ff9c1d027c1079a972ea550e63d1417b8e3c34d)) * codeowners groups ([#23](https://github.com/LerianStudio/helm/issues/23)) ([b51ff0c](https://github.com/LerianStudio/helm/commit/b51ff0ce5f7d838c2f01565340d91a79cd9c772f)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](https://github.com/LerianStudio/helm/commit/fcaa3b46bf7c06be7c94b7d21bf61b728265bd9d)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](https://github.com/LerianStudio/helm/commit/14924af14cbb6299471ff1d52c0e3591892f13a6)), closes [#1470](https://github.com/LerianStudio/helm/issues/1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](https://github.com/LerianStudio/helm/commit/a3946586aa847615a7082a2c4583646926d53792)) * complete standardization of VERSION across all remaining charts ([63adbb9](https://github.com/LerianStudio/helm/commit/63adbb959f5ea18a22219d7f78d6422f4e9ffb38)) * **plugin-access-manager:** construct dataSourceName at runtime with environment variables ([ac4fd9f](https://github.com/LerianStudio/helm/commit/ac4fd9f94212fed2adbc7d5c6b17e9ad10e3b9cd)) * **plugin-br-pix-switch:** correct appVersion to 1.0.0-beta.1 and add to compatibility matrix ([85bd001](https://github.com/LerianStudio/helm/commit/85bd0015bd9aa7e1def72ed14f981e3a8d080c19)) * **bank-transfer:** correct encryption key env var names ([fb79deb](https://github.com/LerianStudio/helm/commit/fb79deb833c798f68b75e075f8cf6aa2146ad523)) * **flowker:** correct livenessProbe default path from /health/live to /health ([f588107](https://github.com/LerianStudio/helm/commit/f588107a6a543361ceb00d798c9479d1ad37cec3)) * **midaz:** correct RabbitMQ bootstrap secret key reference from RABBITMQ_TRANSACTION_PASS to RABBITMQ_DEFAULT_PASS ([f86aa98](https://github.com/LerianStudio/helm/commit/f86aa9826b425861d1614f01ffacb8f68726975f)) * correct RabbitMQ configuration path in transaction service ([eab6df2](https://github.com/LerianStudio/helm/commit/eab6df2eb2793166f7dc2a3455e562a399dcb096)) * **plugin-access-manager:** correct REDIS_PASSWORD reference in identity secrets ([2c6c323](https://github.com/LerianStudio/helm/commit/2c6c323da55401c0323e3023eb9f6958089bbe5e)) * **plugin-access-manager:** correct REDIS_PORT reference from au to identity in configmap ([aafd65a](https://github.com/LerianStudio/helm/commit/aafd65aebbe2b4d27724a02e969701a3a408621a)) * **fetcher:** correct repository URL in Chart.yaml home field ([378a458](https://github.com/LerianStudio/helm/commit/378a458596b151f37393f4292ef8badf88fc57b5)) * crm ui port ([35f387b](https://github.com/LerianStudio/helm/commit/35f387b6037c85963dc793229e6975ca5addc65c)) * **lerian-notification:** declare kubeVersion compatibility ([fd3067e](https://github.com/LerianStudio/helm/commit/fd3067e0a78ac2d207dc1c64f19f7fad5cdca8cc)) * **product-console:** derive MongoDB service name dynamically in NOTES.txt ([4bbf749](https://github.com/LerianStudio/helm/commit/4bbf749465bf0cbf6112ed3cc32653a0d3972480)) * **auth:** disable auth ingress ([4e08d7a](https://github.com/LerianStudio/helm/commit/4e08d7af33f67b9500b459a40ad93473cf82007f)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](https://github.com/LerianStudio/helm/commit/a38dca3beda61b5ad6a4b56c4712dc63ea3e1555)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](https://github.com/LerianStudio/helm/commit/734a38a07fdb6d694b373b52097502dd0aaae440)) * **midaz:** enable external service bootstrap jobs by default for RabbitMQ and PostgreSQL ([f65f8ff](https://github.com/LerianStudio/helm/commit/f65f8ff4f669f99d0eb55f32826dfb7e2891695d)) * **plugin-access-manager:** enable extra env vars to auth configmap template ([1be8107](https://github.com/LerianStudio/helm/commit/1be8107a59d8f0c5e9a12ceb4b70829dbc90b858)) * **plugin-access-manager:** enable extra env vars to auth ([a085323](https://github.com/LerianStudio/helm/commit/a085323623b5df8283e7583b9f03fefeb3202260)) * **plugin-access-manager:** enable extra env vars to identity configmap template ([01f1efe](https://github.com/LerianStudio/helm/commit/01f1efe5c64a1c8237722d1da80ee322e8e27067)) * **plugin-access-manager:** enable extra env vars to identity ([356b815](https://github.com/LerianStudio/helm/commit/356b8157cdcc1a503aa514f077142283e8ea9b21)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** fail loud on missing infra creds ([5bfc010](https://github.com/LerianStudio/helm/commit/5bfc01046118dc1df300b9c4640186c99a304bf8)) * fix ([8e3d5ad](https://github.com/LerianStudio/helm/commit/8e3d5ad6deff4dc6a84d7f0c343d5e605428686f)) * fix ([3ff9f64](https://github.com/LerianStudio/helm/commit/3ff9f645ed8119d28a4dc256848d27206a4d80ce)) * **audit:** fix audit configmap ([#41](https://github.com/LerianStudio/helm/issues/41)) ([429fdef](https://github.com/LerianStudio/helm/commit/429fdef691c87dc5b4a7e44c236b2550f548c20d)) * **values:** fix autoscaling parameters ([69585b6](https://github.com/LerianStudio/helm/commit/69585b6743736edad8d393c5e50eddc9e4ff114d)) * **matcher:** fix configmap archival condition and S3 endpoint for IAM Roles Anywhere ([53232ae](https://github.com/LerianStudio/helm/commit/53232ae6aec2f6fd8b1a4dba74edad8bf261056f)) * **transaction:** fix default value of rabbitmq secret ([71afd7a](https://github.com/LerianStudio/helm/commit/71afd7a7067ee4b1cf429669e4a44c58479af037)) * **doc:** fix midaz transaction container port ([bab48e6](https://github.com/LerianStudio/helm/commit/bab48e600b179abf07bbc207982803102ea1d704)) * **pipe:** fix pr title workflow ([#34](https://github.com/LerianStudio/helm/issues/34)) ([5134118](https://github.com/LerianStudio/helm/commit/51341186dfd7f643e3be1d598c51d3909748a3dd)) * **midaz:** fix rabbitmq job to apply default definition ([a1349ff](https://github.com/LerianStudio/helm/commit/a1349ff2891e3368d21d9b077fab46c448685356)) * **chart:** fix set secret ref to console deployment ([34b4885](https://github.com/LerianStudio/helm/commit/34b488597985e744a4108eda086a9e14eddac702)) * **transaction:** fix transaction container port ([cb4ec59](https://github.com/LerianStudio/helm/commit/cb4ec592c2c47036bee2b519d795ca08336904dc)) * **midaz:** fix transaction deployment template ([c269284](https://github.com/LerianStudio/helm/commit/c2692846f8f3a30f73c41da792ebf47595e067b1)) * **chart:** fix typo in environment variable name ([2f57d53](https://github.com/LerianStudio/helm/commit/2f57d53b1b47b8ef0829729a37d819949efd03c4)) * **plugin-br-pix-indirect-btg:** fix useExistingSecrets typo in all deployments ([fa2dc49](https://github.com/LerianStudio/helm/commit/fa2dc4964c8080f0825471be4a1a2a3889fa7833)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](https://github.com/LerianStudio/helm/commit/9ae56b40a5b127510b82256975682648e06bbaea)) * generate multiples CHANGELOG's ([3f60787](https://github.com/LerianStudio/helm/commit/3f607875b618db474e4055c44a2cffd8216f4261)) * **lerian-notification:** handle explicit maxUnavailable: null in PDB ([03ee596](https://github.com/LerianStudio/helm/commit/03ee596ecdba8da4e6727236b2785c2d14c0c1c5)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](https://github.com/LerianStudio/helm/issues/1467)) ([7c62a98](https://github.com/LerianStudio/helm/commit/7c62a98cabe072e32a717169317018a2af334e5c)) * helm chart ([9b6552f](https://github.com/LerianStudio/helm/commit/9b6552f37d039bb5187c92319bcc3787d1c4ddcc)) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **plugin-br-pix-indirect-btg:** improve reconciliation config and remove vault annotations ([ad64484](https://github.com/LerianStudio/helm/commit/ad64484db87788071ff7ade533a04754eed58347)) * **components:** init file for auth app ([4939e82](https://github.com/LerianStudio/helm/commit/4939e823f60cdbc0965281f496b058178bf70a00)) * job to apply rabbitmq definitions ([b959644](https://github.com/LerianStudio/helm/commit/b959644941d2f137fd6d766ff3cb6c022ac3354d)) * **plugin-br-pix-switch:** leave adapter-btg-mock ingress untouched ([7a1c827](https://github.com/LerianStudio/helm/commit/7a1c827984df9e31a819f18e05cb5de77aa32457)) * **plugin-br-pix-switch:** liveness probe path /live -> /health ([030af5f](https://github.com/LerianStudio/helm/commit/030af5fd92687e5980a6f2e3357493f037e56496)) * **components:** load definitions for rabbitmq ([167c80a](https://github.com/LerianStudio/helm/commit/167c80a8e156fb653e2e365f155c4c35e2785fca)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](https://github.com/LerianStudio/helm/issues/1465)) ([a39f2c6](https://github.com/LerianStudio/helm/commit/a39f2c652365001992fa259b8d7932f45d65ed8a)) * **plugin-br-pix-switch:** match probe template fallbacks to per-component routePrefix ([ee914d7](https://github.com/LerianStudio/helm/commit/ee914d78ef23df3d368a4465eef80f8641c21730)) * **midaz:** midaz console configmap ([5d8428c](https://github.com/LerianStudio/helm/commit/5d8428ce7fa7fd2678b18b1146bcadbb2fc4ced7)) * midaz nginx proxy config ([46d3af2](https://github.com/LerianStudio/helm/commit/46d3af2330ae02cf7298efc8275cf6e4ee309685)) * move MONGO_URI to secrets and support JD sandbox mode ([6d41468](https://github.com/LerianStudio/helm/commit/6d41468e7e14de2a61f99b90769b7b7643208d0d)) * **plugin-br-pix-switch:** namespace handling + global image tag override ([0fd1ef6](https://github.com/LerianStudio/helm/commit/0fd1ef681a03fabd2937ed48477ad9469ab95c70)) * **midaz:** nginx server definition ([b63b23a](https://github.com/LerianStudio/helm/commit/b63b23a5bf3292d2a36e8872bd3e3a3c257152c5)) * **midaz:** nginx server definition ([d4f18da](https://github.com/LerianStudio/helm/commit/d4f18dadfda3b4446df5cc5f094784decc247f9d)) * **midaz:** nginx server definitions ([9863437](https://github.com/LerianStudio/helm/commit/9863437a6a3d925edcf547ae801389cb9954c145)) * onboarding adjust default value of env var ([d274067](https://github.com/LerianStudio/helm/commit/d274067915c39400b9f920ef6af93f02bbc7d9d9)) * onboarding init container ([46284e5](https://github.com/LerianStudio/helm/commit/46284e5bee1bf07269aeac457c7f7dad74b848b6)) * **lerian-notification:** order SA/ConfigMap/Secret before migrations Job ([23069fc](https://github.com/LerianStudio/helm/commit/23069fcc638795bdc02bc093c770f9cafb0ea135)) * **product-console:** parametrize probes that were missed in initial commit ([5be4277](https://github.com/LerianStudio/helm/commit/5be4277d671dd74af3fbe64dc7bd95295272d50a)) * **reporter:** prevent null env in manager and worker deployments ([51a72c6](https://github.com/LerianStudio/helm/commit/51a72c640b78716a69f2ddee05e5a5be3e1125cd)) * **reporter:** prevent null env in ScaledJob when no env vars are configured ([7fa29b4](https://github.com/LerianStudio/helm/commit/7fa29b47d0859aaae3097af6b33b4585412b230c)) * **plugin-br-pix-switch:** probe paths follow per-component routePrefix ([d6e5264](https://github.com/LerianStudio/helm/commit/d6e5264d2fca1a64ac207978e90ab1a1b2cbde75)), closes [#135](https://github.com/LerianStudio/helm/issues/135) * **plugin-br-pix-switch:** providers ingress default path /mock-btg -> /btg-mock ([b6df396](https://github.com/LerianStudio/helm/commit/b6df396a0984f06c6c3774c0d89bf48bdfd20ac3)) * **docs:** rabbitmq mispelling name ([cefee91](https://github.com/LerianStudio/helm/commit/cefee916b39020938945ce97f442dbdbf3ba6d63)) * **onboarding:** rabbitmq mispelling name ([bf8de0c](https://github.com/LerianStudio/helm/commit/bf8de0cf79e4a40a3fa0bb7581a7f11b9458de76)) * **transaction:** rabbitmq mispelling name ([8e05032](https://github.com/LerianStudio/helm/commit/8e050329da399b563d2ce6f5fa70edcf2291cccd)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** remove common secret to match reporter pattern ([37050a0](https://github.com/LerianStudio/helm/commit/37050a0834a3fc70676e00e3b5dd4018f9e0ec02)) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * remove duplicate reporter-manager/secret.yaml with incorrect template references ([e8cc8b6](https://github.com/LerianStudio/helm/commit/e8cc8b6e63e587a9c5fc7c45284c1482ec766564)) * remove empty variable ([48052b2](https://github.com/LerianStudio/helm/commit/48052b2c411e6d882c5c7067f19b4364cdb363e6)) * **release:** remove generate_changelog dependency from back-merge step ([40dfa39](https://github.com/LerianStudio/helm/commit/40dfa390347ce04d88ae8bf22dde9dcc824f93b2)) * **onboarding:** remove grpc port from container ([3bd9621](https://github.com/LerianStudio/helm/commit/3bd96218a95decae1c58cc29078c8bbfd71736a9)) * **midaz:** remove hardcoded localhost URLs from console configmap ([75ab6e8](https://github.com/LerianStudio/helm/commit/75ab6e87a0271f08e48f496b8b753b0f1721d843)) * remove hardcoded namespaceOverride to use release namespace ([f650315](https://github.com/LerianStudio/helm/commit/f650315e2ca1849da559dffb51fd0f01f5669167)) * remove hook ([aa92d78](https://github.com/LerianStudio/helm/commit/aa92d78f74000f6f4f2c7fc22db35cc0010916ca)) * remove hotfix branch from release config ([11d0188](https://github.com/LerianStudio/helm/commit/11d018800fe55cbfc1cc840974248b8c85b5fb0b)) * **plugin-access-manager:** remove imagePullSecrets from values.yaml for identity and auth sections ([238ca51](https://github.com/LerianStudio/helm/commit/238ca519ce930eb2b4431abfd6a0fd69f1efda27)) * **product-console:** remove inconsistent artifacthub image annotation ([77e46c4](https://github.com/LerianStudio/helm/commit/77e46c4b36f2ebf51e7da2d6d6864b3b0d244733)) * **plugin-fees:** remove MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC from configmap ([f3e7f9b](https://github.com/LerianStudio/helm/commit/f3e7f9bae9113bba8d11602afcbd4048778b892a)) * **onboarding:** remove old secrets ([0c7966f](https://github.com/LerianStudio/helm/commit/0c7966f91207c688b0e014bab463dac40846f56e)) * **trasaction:** remove old secrets ([1a2a10c](https://github.com/LerianStudio/helm/commit/1a2a10c9a165c0767f45b7909276c287d5c4d3a3)) * remove RabbitMQ health check from onboarding deployment ([181179e](https://github.com/LerianStudio/helm/commit/181179e4dea9faea9717eb0eafc946f86d6a1192)) * **plugin-br-pix-indirect-btg:** remove trailing newline from values.yaml ([938bf17](https://github.com/LerianStudio/helm/commit/938bf17d10d468c257d83fa4e2a46778deb071aa)) * **plugin-br-bank-transfer:** rename chart to include -helm suffix ([f393e35](https://github.com/LerianStudio/helm/commit/f393e35ec6b5ad070ccc24214771b3c2cfd81fb0)) * **audit:** rename env vars and update container port ([9796046](https://github.com/LerianStudio/helm/commit/979604649c30ce6b8788acb3c1f67dff1a765f63)) * **transaction:** rename env vars and update container port ([4052bc5](https://github.com/LerianStudio/helm/commit/4052bc51634b989fba34c2245319db767aa02275)) * **chart:** rename ledger component to onboarding ([47dd9d0](https://github.com/LerianStudio/helm/commit/47dd9d01c491f30669c3f4ec6271bae1c8d0de75)) * **chart:** rename ledger component to onboarding ([e04404b](https://github.com/LerianStudio/helm/commit/e04404b79c78396a6cb1227cafa5bad10b51d3ee)) * **doc:** rename ledger component to onboarding ([0aa6e34](https://github.com/LerianStudio/helm/commit/0aa6e34ed38d68308cec31b5280b17c017c3d277)) * **components:** rename ledger db for onboarding ([40e49b8](https://github.com/LerianStudio/helm/commit/40e49b8cb2dcf6b169ea4a9c32b5c516f0d06b57)) * **pipe:** rename ledger to onboarding ([448ce90](https://github.com/LerianStudio/helm/commit/448ce9015baee8d553a81f6253d77d76bb96c3ba)) * **bank-transfer:** rename MULTI_TENANT_INFRA_ENABLED to MULTI_TENANT_ENABLED for consistency ([0fb14a6](https://github.com/LerianStudio/helm/commit/0fb14a62d9644d039931afe1c5a6f7291bbaafa8)) * **dependencies:** rename otel to grafana ([#57](https://github.com/LerianStudio/helm/issues/57)) ([974c47f](https://github.com/LerianStudio/helm/commit/974c47f6974d42804e5210d530829efa0394d734)) * **tracer:** rename PLUGIN_AUTH_HOST to PLUGIN_AUTH_ADDRESS (2.0.0-beta.4) ([4be1526](https://github.com/LerianStudio/helm/commit/4be1526c4e9f1415e4ef8dec74533ff1a4ac98fa)) * rename PRIVATE_KEY to KEY in qr-code secrets template ([8736d13](https://github.com/LerianStudio/helm/commit/8736d1343048542d33331c97ded6b3aff1cce369)) * **chart:** resources limits in onboarding and transaction values ([9d788f5](https://github.com/LerianStudio/helm/commit/9d788f5dc9639cb97bf285332c31033fedb0545a)) * **plugin-fees:** revert MIDAZ_TRANSACTION_URL to midaz-transaction default ([0871187](https://github.com/LerianStudio/helm/commit/0871187b0197c5af9439f0cd9f6f1813b68ae4c4)) * rollback midaz version ([e458c1c](https://github.com/LerianStudio/helm/commit/e458c1ccfa01a5f67fb221a3cf33b8cb8054d4b7)) * rollback plugin-access-manager version ([ce2b088](https://github.com/LerianStudio/helm/commit/ce2b08841977784e729d7efeb635c64780072b54)) * **lerian-notification:** self-contain migrations Job; drop hook annotations from SA/ConfigMap/Secret ([068b1e3](https://github.com/LerianStudio/helm/commit/068b1e3fe5ef93f274bf4f219031fc867f43ffc6)) * **plugins:** separate RABBITMQ_HOST from RABBITMQ_URL in bc-correios chart ([#1268](https://github.com/LerianStudio/helm/issues/1268)) ([780aff8](https://github.com/LerianStudio/helm/commit/780aff85155d47316160f60a596dfc7e70b0c6be)) * **plugin-br-pix-indirect-btg:** set DB_SSL_MODE default to disable ([29f2348](https://github.com/LerianStudio/helm/commit/29f2348e7c55bb7eafcb6cfddbc013d2ceeae3f7)) * **plugin-br-pix-switch:** set default PLUGIN_AUTH_URL on auth-using components ([f689afc](https://github.com/LerianStudio/helm/commit/f689afcc5173a3a15fd105fd7a4fbb2605b26f71)) * **product-console:** set image tag to 1.3.0 in values.yaml ([a535b88](https://github.com/LerianStudio/helm/commit/a535b885158731c4ef859e5197f3283dcd2c1b60)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](https://github.com/LerianStudio/helm/issues/1405)) ([e0d9084](https://github.com/LerianStudio/helm/commit/e0d908413cf66830d4afa6a53bac3ce8573a10af)) * **plugin-br-pix-indirect-btg:** set REDIS_TLS default to false in reconciliation configmap ([b8dc4d1](https://github.com/LerianStudio/helm/commit/b8dc4d1af0462ae2f12ba9b1542711d0ebdce300)) * setup otel in template ([#24](https://github.com/LerianStudio/helm/issues/24)) ([837fd03](https://github.com/LerianStudio/helm/commit/837fd03c642b14387299b9b4a50fe00dc22e2f29)) * simplify hotfix branch prerelease configuration ([8f61d2d](https://github.com/LerianStudio/helm/commit/8f61d2d31b87a6f4273beab1f73fe64b3fb78cf0)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](https://github.com/LerianStudio/helm/commit/582ea9751785df979371f64e367c4ceb8a2731de)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](https://github.com/LerianStudio/helm/commit/45d152ab94251e5d08eeeba666d0908c2d90c287)) * **plugin-access-manager:** split migrations and initUser image into repository/tag fields ([5be206a](https://github.com/LerianStudio/helm/commit/5be206ad28843d9de908efb7c329e9305070415f)) * **components:** sql init for auth app ([9824943](https://github.com/LerianStudio/helm/commit/9824943ab8a6d2e038cd55448259c27149c50546)) * **midaz:** standardize base URL configuration using MIDAZ_CONSOLE_BASE_PATH as source of truth ([bc4705a](https://github.com/LerianStudio/helm/commit/bc4705aafe9ab36a3c56264099400543202d7412)) * **plugins:** standardize MIDAZ console URL configuration ([b89bb83](https://github.com/LerianStudio/helm/commit/b89bb837974a805cc9b238684e7d8ab7e752eef6)) * standardize VERSION/OTEL_RESOURCE_SERVICE_VERSION in remaining charts ([4172495](https://github.com/LerianStudio/helm/commit/4172495136f2d17d0897c6b4bdbcc081634a372a)) * **plugin-br-pix-switch:** swap envFrom order so Secret overrides ConfigMap (1.1.0-beta.4) ([c1241c0](https://github.com/LerianStudio/helm/commit/c1241c0f9b2839cbf22ef2ecd73a738a54fa9920)) * **new:** sync migrations job and app versions ([d90d1d7](https://github.com/LerianStudio/helm/commit/d90d1d7042bd1b82a4638dd993274539d9aeed42)) * templates ([bc18fc3](https://github.com/LerianStudio/helm/commit/bc18fc3fddd8736d8694f3be401d1a85fc781039)) * transaction adjust default value of env var ([6e807a9](https://github.com/LerianStudio/helm/commit/6e807a9da365d88d023746233992b316ef1696df)) * transaction init container ([3d3492c](https://github.com/LerianStudio/helm/commit/3d3492c9e0c017d7e904fc26e9aeadfdfbe76c8e)) * **midaz:** update app image tag from 2.2.0 to 2.2.1 ([3103f2d](https://github.com/LerianStudio/helm/commit/3103f2d2f97fdc4021e3702efc7e0f5494fd6fe0)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](https://github.com/LerianStudio/helm/commit/944e1ce9b6af49dfcbd3bce0851093cefc4989eb)) * **configmap:** update APPLICATION_NAME default value to crm ([53b65c3](https://github.com/LerianStudio/helm/commit/53b65c3ecc9a07f901832e99efc45fec3bd1d65f)) * **plugin-access-manager:** update appVersion and image tags to 2.6.2 ([ed831fb](https://github.com/LerianStudio/helm/commit/ed831fb2dca1a1f65988b03edc9d4d14bc14e6bf)) * **plugin-access-manager:** update appVersion and image tags to 2.6.3 ([f4d26c0](https://github.com/LerianStudio/helm/commit/f4d26c0378bfb41d6f0be5de46e7be614463529d)) * **product-console:** update appVersion to 1.3.0 ([c708e76](https://github.com/LerianStudio/helm/commit/c708e76df0e532850dd8d5e2472a4b34c72a249c)) * **plugin-access-manager:** update appVersion to 2.6.5 ([db5045a](https://github.com/LerianStudio/helm/commit/db5045a532276e6bd34b4b30682f58e7f2bca567)) * **plugin-bc-correios:** update br-spb-bc-correios@1.2.0 ([f5d8eca](https://github.com/LerianStudio/helm/commit/f5d8eca7c779bf8b941f7a5bfa94fa6db2bba394)) * update casdoor backend images ([ea9e82b](https://github.com/LerianStudio/helm/commit/ea9e82bfce3259bf88fb13b0b39b0a2f6280c7a1)) * update casdoor backend images ([8c1741d](https://github.com/LerianStudio/helm/commit/8c1741dcd6e3c7df86ed6f5f59d07309792754ba)) * **plugin-fees:** update chart version to 5.4.0 and app version to 3.2.0 ([303911d](https://github.com/LerianStudio/helm/commit/303911d1c080482ac5df1440cf50ad58ea26a581)) * **midaz:** update console@3.4.8, onboarding@3.4.8, transaction@3.4.8 and add back-merge workflow ([2400460](https://github.com/LerianStudio/helm/commit/2400460545b915829faf6f5871c4551f6cc51445)) * update default NGINX_BASE_PATH to use correct service name midaz-console-nginx ([ed89e32](https://github.com/LerianStudio/helm/commit/ed89e324691ebe09e742abb5d9d4e56216efdce5)) * update default value to swagger hot env var ([a691862](https://github.com/LerianStudio/helm/commit/a6918621eee89815ab6e074dbd841f5d7d520b3d)) * update default value to swagger hot env var ([25fe35e](https://github.com/LerianStudio/helm/commit/25fe35e5cba187cdebd9a711f6ceee31e6687936)) * **bank-transfer:** update DEFAULT_TENANT_ID to allow empty default value in configmap ([10ea45e](https://github.com/LerianStudio/helm/commit/10ea45e0ff6d8b0023efc0a293db31390566300c)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](https://github.com/LerianStudio/helm/commit/f7aa25b6756bf756a3d7cc3e0f90fba1b85f31df)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **ci:** update Helm setup action to v3.5 in release workflow ([6736085](https://github.com/LerianStudio/helm/commit/673608587a310dece3aeb5fda8fd0d408584c4ad)) * **plugin-access-manager:** update identity@2.1.1, auth@2.4.0 and use image.tag for version fields ([e260dee](https://github.com/LerianStudio/helm/commit/e260deef9bc8bafe34a85755c1532a400aac416a)) * update image repository ([4d9116f](https://github.com/LerianStudio/helm/commit/4d9116fd515d1628be6159dbd0c4512de0720a8c)) * update image repository ([43d0cc0](https://github.com/LerianStudio/helm/commit/43d0cc0cc1559589afae24aa9b568206a9902649)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](https://github.com/LerianStudio/helm/commit/68bcd0ba0581b73f7e41b9edcdfe6aff4d9a56fc)) * **plugin-access-manager:** update image tags and add CORS, rate limiting, multi-tenancy, and circuit breaker configurations ([628ad1d](https://github.com/LerianStudio/helm/commit/628ad1d77b88e3bfde9bcf07d14ae64f0f234603)) * **plugin-access-manager:** update image tags for identity and auth components to latest versions ([08f9a6a](https://github.com/LerianStudio/helm/commit/08f9a6a9216b2db51fe0cbd9a35f97eba037a762)) * **midaz:** update ledger service default port from 3000 to 3002 ([2878908](https://github.com/LerianStudio/helm/commit/28789085b331fe28430cfce77a6a2e7f9bb65b97)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **midaz:** update midaz-crm@3.6.2, midaz-ledger@3.6.2 ([960a392](https://github.com/LerianStudio/helm/commit/960a392f9d63e4576dabcc3ed1008be42063c4b5)) * **midaz:** update midaz-crm@3.6.3, midaz-ledger@3.6.3 ([1cce7ba](https://github.com/LerianStudio/helm/commit/1cce7ba9f7494151eb9f62361d6b07915063210a)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](https://github.com/LerianStudio/helm/commit/3c9bea0fedc48926df8151fa421d4c0a27f07ccb)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](https://github.com/LerianStudio/helm/commit/5ee7f4531e5fe78d61e63142f528f98d220bf131)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](https://github.com/LerianStudio/helm/commit/67021d410f8bd95628dc2e1fda00029e587a6408)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](https://github.com/LerianStudio/helm/commit/4852190a64cc81e28e78f9a27d7978187cd1ac72)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](https://github.com/LerianStudio/helm/commit/5c2edb0ebd628ad373269f290736c0ee56899f3b)) * update mongodb ([858c934](https://github.com/LerianStudio/helm/commit/858c93496a5e45fcb84389614536d63ca6b84a02)) * **console:** update mongodb default port ([fd58b09](https://github.com/LerianStudio/helm/commit/fd58b09788b9f7ccc03937ac5e950060110cedf3)) * update nginx deployment config with correct service account and simplified configmap names ([b1119fd](https://github.com/LerianStudio/helm/commit/b1119fdad81d1d4bbcb2c3aecbe74d56cd0a3136)) * **doc:** update nginx ingress config ([#35](https://github.com/LerianStudio/helm/issues/35)) ([d9763ea](https://github.com/LerianStudio/helm/commit/d9763ea4c2139c7d5f020d71422a634f37e15172)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.7, job@1.2.1-beta.7 ([4010717](https://github.com/LerianStudio/helm/commit/4010717e52a535803550f84faf3092439cb063b7)) * update plugin registration URL to use midaz-console-nginx hostname ([0eaca46](https://github.com/LerianStudio/helm/commit/0eaca4642ff0d7907302ecc7e95c1426378a56a8)) * **plugin-access-manager:** update plugin-auth@2.6.0 ([6b5b3d8](https://github.com/LerianStudio/helm/commit/6b5b3d85f0f2312dd0104b79ab3efb7fa707ec80)) * **plugin-access-manager:** update plugin-auth@2.6.1 ([253b5e8](https://github.com/LerianStudio/helm/commit/253b5e8c6dc6940884d28b3d3064b941e7936742)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](https://github.com/LerianStudio/helm/commit/b5892a37b4b8b67cbcf3bee1bb8557b807e637ce)) * **plugin-br-bank-transfer-jd:** update plugin-br-bank-transfer-jd@1.0.0 ([afcdded](https://github.com/LerianStudio/helm/commit/afcdded551872f8fea45bd5811129d967862fc48)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@2.1.0 ([3e29c6c](https://github.com/LerianStudio/helm/commit/3e29c6cbcda36b88db0140e18d1995e41d711ada)) * update plugin-br-pix-indirect-btg pix OTEL_RESOURCE_SERVICE_VERSION ([4fa8d3f](https://github.com/LerianStudio/helm/commit/4fa8d3fa16f4c4db14a353fee4132f3734177229)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.1 ([4397bc6](https://github.com/LerianStudio/helm/commit/4397bc641c2009520ddfa74db5b07ce560682137)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.3 ([b9a4b68](https://github.com/LerianStudio/helm/commit/b9a4b68daddf3bc7f34ece779be416e297372c46)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.2.0 ([5e4b893](https://github.com/LerianStudio/helm/commit/5e4b89388355b6970ad8a7d381b36c66ab7ef7e4)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.0 ([df6de7b](https://github.com/LerianStudio/helm/commit/df6de7b0c40b062351913790901f48423e5f664a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.2 ([ffb414d](https://github.com/LerianStudio/helm/commit/ffb414d8b71c60108afc8d8ca997616610c88a05)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.1 ([adbe456](https://github.com/LerianStudio/helm/commit/adbe456f10361ac91c79e72b81bd171d9d1a28da)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.2 ([2c2b639](https://github.com/LerianStudio/helm/commit/2c2b639e67f749a6e98452ecb09aab79a327e468)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.3 ([e08d78a](https://github.com/LerianStudio/helm/commit/e08d78a8e4220c78695d51a6764417241f8ff8ea)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.4 ([a42a959](https://github.com/LerianStudio/helm/commit/a42a959fd56639a0805eef3dca75d117cdcb407e)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.6 ([fe3749c](https://github.com/LerianStudio/helm/commit/fe3749cd1cd6dae57a2d156181cab624db53aa76)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.7 ([793be45](https://github.com/LerianStudio/helm/commit/793be450b2ee8fdb9042dca0b275845d4461fff8)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.8 ([55681de](https://github.com/LerianStudio/helm/commit/55681def27a6eaf2655b0cdd03ba1d90956db54a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.3.0 ([35c27d1](https://github.com/LerianStudio/helm/commit/35c27d157a06baf08d0c35587b0ba42fa83e003f)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.4.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.4.1, plugin-br-pix-indirect-btg-worker-inbound@1.4.1, plugin-br-pix-indirect-btg-worker-outbound@1.4.1 ([3c6970f](https://github.com/LerianStudio/helm/commit/3c6970fa684f810608c93c9b5a14762913fa0642)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.1, plugin-br-pix-indirect-btg-worker-inbound@1.5.1, plugin-br-pix-indirect-btg-worker-outbound@1.5.1 ([226f506](https://github.com/LerianStudio/helm/commit/226f506964e0b271d4f61ec451a52121371096a3)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.2, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.2, plugin-br-pix-indirect-btg-worker-inbound@1.5.2, plugin-br-pix-indirect-btg-worker-outbound@1.5.2 ([6dbb46c](https://github.com/LerianStudio/helm/commit/6dbb46cfa97ec25e3a96a7c296452ed5a2a93f38)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](https://github.com/LerianStudio/helm/commit/a3c2b6d91208d9a2def2fffe15f9065d6d12e0c0)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-fees:** update plugin-fees@3.0.7 ([844537d](https://github.com/LerianStudio/helm/commit/844537d1ff6d902a454b6f49bd70e431a1b9055f)) * **plugin-fees:** update plugin-fees@3.0.8 ([8c5579c](https://github.com/LerianStudio/helm/commit/8c5579c72b31b43e4a5389112a9849092e645617)) * **plugin-access-manager:** update plugin-identity@2.4.2 ([8b01a14](https://github.com/LerianStudio/helm/commit/8b01a14b077f8fdbc0dd642c1f09b695f27d8623)) * update rabbitmq authentication format to use value field in helm chart ([9ef3305](https://github.com/LerianStudio/helm/commit/9ef33051275a99abd848ef6b1717a8e613e49f94)) * update rabbitmq authentication username field to user ([07a183a](https://github.com/LerianStudio/helm/commit/07a183a8be746cdef266d09dbfe011b04b5da468)) * **product-console:** update readiness probe path to default to root ([2996200](https://github.com/LerianStudio/helm/commit/29962007e8b4428251289da18ac13c97c46fac02)) * **midaz:** update README with ledger service documentation and remove console/nginx references ([e472f4f](https://github.com/LerianStudio/helm/commit/e472f4f192b3ab73f75e17f0968150dca1394e26)) * update reporter cm ([fcdd63c](https://github.com/LerianStudio/helm/commit/fcdd63c752b873d83618c75093f9709aaaebf353)) * **reporter:** update reporter-manager@1.0.0, reporter-worker@1.0.0 ([d586bf1](https://github.com/LerianStudio/helm/commit/d586bf17c2427509b5bdc6a33797b15d4fd126b5)) * **reporter:** update reporter-manager@1.1.1 ([4f98acf](https://github.com/LerianStudio/helm/commit/4f98acfb798423cf6e82b27b2b9dbe97b44d4351)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **matcher:** update securityContext to run as root ([8de4a13](https://github.com/LerianStudio/helm/commit/8de4a13461263bfdac56c72f5521fa4bb228f5b4)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](https://github.com/LerianStudio/helm/commit/4492c3d629bbe1048e250967572a7b6599a15a68)) * **plugin-br-bank-transfer:** update service port and server address to 4027 in configuration files ([dd4e2a0](https://github.com/LerianStudio/helm/commit/dd4e2a05f1c62f619f3cd45bd4f8a9b01a596546)) * update transaction service DNS name in onboarding config ([b98a488](https://github.com/LerianStudio/helm/commit/b98a488e3b27c077eebd65e3bbffcddac2a313e1)) * **reporter:** update worker default image tag to match latest stable release ([147ed4c](https://github.com/LerianStudio/helm/commit/147ed4c20cb81a955402d3d4361852966a11516e)) * **bootstrap-mongodb:** use /bin/bash instead of /bin/sh for mongosh container ([b956943](https://github.com/LerianStudio/helm/commit/b956943f69f1ecee7e90f3db5f75b37c2827d179)) * use /bin/sh instead of /bin/bash in alpine kubectl container ([24c9fc0](https://github.com/LerianStudio/helm/commit/24c9fc0702fd5252105c7ec2774413647a0b7009)) * **matcher:** use configmap value for OBJECT_STORAGE_ENDPOINT with IAM Roles Anywhere ([c0f19a4](https://github.com/LerianStudio/helm/commit/c0f19a4648595b8784d0d5e7ce3f9991074978ac)) * **midaz:** use dig function for safer nested value access in ledger init container timeout ([86ee67d](https://github.com/LerianStudio/helm/commit/86ee67d4f3bfe9281f5336a68a59cb8175e4e2d4)) * use dynamic service names based on release name ([cc9e734](https://github.com/LerianStudio/helm/commit/cc9e7345d452a7ba32263269c8e974a7856c5544)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](https://github.com/LerianStudio/helm/commit/ac4c1e82a13017aa3d2c7d031f449c86ad63bc23)) * **plugin-fees:** use midaz-ledger service for MIDAZ_TRANSACTION_URL default ([9515b35](https://github.com/LerianStudio/helm/commit/9515b3520d4e36ec74eb0279ff30933c0955499e)) * **bootstrap-mongodb:** use name helpers instead of hardcoded names ([d932f48](https://github.com/LerianStudio/helm/commit/d932f48eec2054013278151769001633b0c94091)) * **reporter:** use RABBITMQ_URI for KEDA scaler host ([60809c9](https://github.com/LerianStudio/helm/commit/60809c9273e1f1af8a177038e6c922d3a672b057)) * **plugin-access-manager:** use separate repository and tag for auth backend image ([01b9a5c](https://github.com/LerianStudio/helm/commit/01b9a5c85abd3d26e56ce698b5b0661a227d6c77)) * **reporter:** use unique names for cluster-scoped resources ([5cdaa80](https://github.com/LerianStudio/helm/commit/5cdaa8066d13a312d84a138d81609226f492a745)) * **bootstrap-mongodb:** use updateUser + process.env for safer reconciliation ([13ee1dc](https://github.com/LerianStudio/helm/commit/13ee1dc99078c5581a659ed33b361e7191229200)), closes [#1187](https://github.com/LerianStudio/helm/issues/1187) * **charts:** value key typo and stale README notes ([91ce16f](https://github.com/LerianStudio/helm/commit/91ce16fd0abb82f251f6151bdf34cfd7029edf80)) * values ([b1dc8f7](https://github.com/LerianStudio/helm/commit/b1dc8f7105ab3aa0bbed2549525f013875087b7d)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](https://github.com/LerianStudio/helm/issues/1430)) ([f38d6d9](https://github.com/LerianStudio/helm/commit/f38d6d91fec753cada642103ae242bb388e67669)) ### Performance Improvements * Update resources ([b5f07f0](https://github.com/LerianStudio/helm/commit/b5f07f0fd2319f2bbe3155fd075c1ae7874cf59c)) * Update resources ([9ffc743](https://github.com/LerianStudio/helm/commit/9ffc7430951db115934fb10223f0d9287adfcf60)) ### Reverts * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET from global to component-level secrets ([653594c](https://github.com/LerianStudio/helm/commit/653594ccc07a2fdde1e3f7b09ff627089278a668)) * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET validation from global to pix.secrets ([f95be82](https://github.com/LerianStudio/helm/commit/f95be8266c5b88c92c839060063a69b581a41edf)) ### Miscellaneous Chores * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([28de7ce](https://github.com/LerianStudio/helm/commit/28de7ceb2dd9b39d87ae64d0f64573530a03be9b)) * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([e2113c0](https://github.com/LerianStudio/helm/commit/e2113c0bd99fe8f04e3c4ede5766f3fb99497ec0)) ### Code Refactoring * **plugin-br-payments:** rename PROVIDER_* values to BTG_* ([6454fc3](https://github.com/LerianStudio/helm/commit/6454fc3ff1395821bb4b7d21f3f0bd5915964cc6)) --- README.md | 2 +- charts/br-sta/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 498b35d8..d516c658 100644 --- a/README.md +++ b/README.md @@ -284,5 +284,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `1.1.0` | 1.0.0-beta.32 | 1.0.0-beta.32 | +| `1.0.0-beta.1` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index 72a78ee6..6c5a0954 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.1.0 +version: 1.0.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.32" From 4c1c218f0e92f3cc759df536a4328ec07e76e699 Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Wed, 8 Jul 2026 10:17:41 -0300 Subject: [PATCH 041/113] fix(br-sta): require existingSecretName in schema when useExistingSecret is set Completes the CodeRabbit finding from PR #1618 (comment 3539685868): br-sta.validateRequired already fails fast on this in _helpers.tpl, but values.schema.json didn't enforce it, so the error only surfaced at template-render time instead of at 'helm lint'/schema-validation time. Adds an if/then to the br-sta schema block: when useExistingSecret=true, existingSecretName must be a non-empty string. Verified with helm lint and helm template against both branches (missing name fails with a schema error, present name renders normally). --- charts/br-sta/values.schema.json | 24 +++++++++++++++++++++++- 1 file changed, 23 insertions(+), 1 deletion(-) diff --git a/charts/br-sta/values.schema.json b/charts/br-sta/values.schema.json index 56a0a3b8..2409b732 100644 --- a/charts/br-sta/values.schema.json +++ b/charts/br-sta/values.schema.json @@ -40,9 +40,31 @@ }, "secrets": { "type": "object" + }, + "useExistingSecret": { + "type": "boolean" + }, + "existingSecretName": { + "type": "string" } }, - "additionalProperties": true + "additionalProperties": true, + "if": { + "properties": { + "useExistingSecret": { + "const": true + } + }, + "required": ["useExistingSecret"] + }, + "then": { + "properties": { + "existingSecretName": { + "minLength": 1 + } + }, + "required": ["existingSecretName"] + } } } } From fb5f337deaa45b13a00bbd3d6a1e3796467892a1 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 13:24:35 +0000 Subject: [PATCH 042/113] chore(release): 1.0.0-beta.2 ## (2026-07-08) ### Bug Fixes * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) --- README.md | 2 +- charts/br-sta/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index d516c658..a7fb0e0f 100644 --- a/README.md +++ b/README.md @@ -284,5 +284,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `1.0.0-beta.1` | 1.0.0-beta.32 | 1.0.0-beta.32 | +| `1.0.0-beta.2` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index 6c5a0954..44047721 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.0.0-beta.1 +version: 1.0.0-beta.2 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.32" From 4aefd1c32aa31d36c87643315d2bb7bb87cc600a Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Wed, 8 Jul 2026 11:10:19 -0300 Subject: [PATCH 043/113] fix(br-sta): worker command must match the image's /service entrypoint MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The worker pod in benedita's br-sta-dev-st crashed on every start: exec: "/worker": stat /worker: no such file or directory Root cause: LerianStudio/br-sta ships the manager and worker as two SEPARATE images (cmd/manager/Dockerfile, cmd/worker/Dockerfile), and both Dockerfiles intentionally build/copy/ENTRYPOINT their binary as /service — documented in the Dockerfile comments as the one deliberate difference being BINARY_PATH and image labels, not the binary's name. There is no /worker binary in any published br-sta image; the chart's assumption of 'one multi-binary image, command selects which binary' does not match how the application is actually built and released. Fix: default worker.command to /service (matching the dedicated worker image's own ENTRYPOINT) instead of /worker. Also corrects the WORKER section comments in values.yaml, which described the same wrong single-image/command-override model. Verified with helm lint and helm template --set worker.enabled=true: the worker container now renders command: [/service]. --- .../br-sta/templates/worker/deployment.yaml | 5 ++- charts/br-sta/values.yaml | 40 ++++++++++--------- 2 files changed, 25 insertions(+), 20 deletions(-) diff --git a/charts/br-sta/templates/worker/deployment.yaml b/charts/br-sta/templates/worker/deployment.yaml index c28c1079..5b676f42 100644 --- a/charts/br-sta/templates/worker/deployment.yaml +++ b/charts/br-sta/templates/worker/deployment.yaml @@ -96,9 +96,10 @@ spec: {{- toYaml $secCtx | nindent 12 }} image: "{{ $repo }}:{{ $tag }}" imagePullPolicy: {{ $pullPolicy }} - # Same image as the manager; run the worker binary baked into it. + # Matches the worker image's own ENTRYPOINT (/service, built from + # cmd/worker) — see the worker.command comment in values.yaml. command: - {{- toYaml ($w.command | default (list "/worker")) | nindent 12 }} + {{- toYaml ($w.command | default (list "/service")) | nindent 12 }} ports: - name: http containerPort: {{ $w.service.port | default 8081 }} diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index 23e69336..ed58e1c3 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -336,22 +336,23 @@ br-sta: # ============================================================================== # WORKER -# Second Deployment running the /worker binary from the SAME image as the -# manager (command override — both binaries ship in one image). It runs the -# background jobs: audit outbox publisher/consumer, the leader-gated scheduler -# (credential expiry/rotation, retention, stale-protocol cleanup), the -# credential-recovery-on-boot sweep, and the inbound BACEN poll loop. It serves -# ONLY the probe endpoints (WorkerMode — no business HTTP API), reuses the -# manager ConfigMap + Secret for all shared infra config, and layers the -# worker-only knobs below on top. +# Second Deployment running the br-sta worker component. Upstream builds the +# manager (cmd/manager) and worker (cmd/worker) as two SEPARATE images, each +# with its own ENTRYPOINT already set to the right compiled binary (both are +# named /service inside their respective images by convention — see +# github.com/LerianStudio/br-sta's per-component Dockerfiles). Set +# worker.image to the dedicated worker image; do not point it at the manager +# image. It runs the background jobs: audit outbox publisher/consumer, the +# leader-gated scheduler (credential expiry/rotation, retention, +# stale-protocol cleanup), the credential-recovery-on-boot sweep, and the +# inbound BACEN poll loop. It serves ONLY the probe endpoints (WorkerMode — +# no business HTTP API), reuses the manager ConfigMap + Secret for all shared +# infra config, and layers the worker-only knobs below on top. # ============================================================================== worker: - # -- Enable the worker Deployment. REQUIRES a br-sta image that ships BOTH - # binaries (manager /service + worker /worker in one image, from the - # multi-binary Dockerfile) — or an explicit worker.image override pointing - # at a dedicated worker image. Older single-binary images have no /worker - # and the pod will CrashLoop on command:[/worker]; keep this false until - # a suitable image is confirmed available, then enable per-deployment. + # -- Enable the worker Deployment. REQUIRES worker.image to point at a + # dedicated worker image (built from cmd/worker) — keep this false until + # that image is confirmed available, then enable per-deployment. enabled: false # -- Replicas. The background jobs are leader-gated but the worker does NOT # run its own leader election yet — keep this at 1 (and do not add an HPA) to @@ -363,17 +364,20 @@ worker: annotations: {} # -- Annotations applied to the pods podAnnotations: {} - # -- Worker image. Empty repository/tag inherit the manager image (same - # published image carries both binaries); override only to pin separately. + # -- Worker image. REQUIRED: point at the dedicated worker image (built + # from cmd/worker). Empty repository/tag fall back to the manager image, + # which does NOT run the worker's logic — only set for local testing. image: repository: "" tag: "" pullPolicy: IfNotPresent # -- Image pull secrets (empty inherits the manager's) imagePullSecrets: [] - # -- Container command — the worker binary baked into the shared image + # -- Container command. The worker image's own ENTRYPOINT already runs the + # correct binary (/service, built from cmd/worker) — this override matches + # that ENTRYPOINT rather than replacing it with a different binary name. command: - - /worker + - /service # -- Termination grace period terminationGracePeriodSeconds: 60 # -- Pod security context From 5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8 Mon Sep 17 00:00:00 2001 From: Lucas Bedatty Date: Wed, 8 Jul 2026 11:19:07 -0300 Subject: [PATCH 044/113] fix(br-sta): address CodeRabbit review on PR #1621 _helpers.tpl and NOTES.txt still described the worker as running the /worker binary, contradicting the command fix in this PR. Update both to say /service, matching the worker image's actual ENTRYPOINT. --- charts/br-sta/templates/NOTES.txt | 2 +- charts/br-sta/templates/_helpers.tpl | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/charts/br-sta/templates/NOTES.txt b/charts/br-sta/templates/NOTES.txt index b176679e..61a23a0e 100644 --- a/charts/br-sta/templates/NOTES.txt +++ b/charts/br-sta/templates/NOTES.txt @@ -22,7 +22,7 @@ Manager Deployment ({{ $component.replicaCount }} replica(s)) running the /servi {{- if eq (include "br-sta.worker.enabled" .) "true" }} -Worker Deployment ({{ (.Values.worker | default dict).replicaCount | default 1 }} replica(s)) running the /worker binary +Worker Deployment ({{ (.Values.worker | default dict).replicaCount | default 1 }} replica(s)) running the /service binary (background jobs: audit outbox publisher/consumer, leader-gated scheduler, credential-recovery-on-boot). {{- end }} diff --git a/charts/br-sta/templates/_helpers.tpl b/charts/br-sta/templates/_helpers.tpl index 24b8ce0a..e670ee17 100644 --- a/charts/br-sta/templates/_helpers.tpl +++ b/charts/br-sta/templates/_helpers.tpl @@ -99,7 +99,7 @@ SERVICE ACCOUNT HELPER ================================================================================ WORKER HELPERS ================================================================================ -The worker is a SECOND Deployment running the /worker binary (background jobs: +The worker is a SECOND Deployment running the /service binary (background jobs: audit publisher/consumer, scheduler, credential-recovery sweep, inbound poll). It reuses the manager's ConfigMap + Secret (all shared infra config) and layers worker-only env on top. It gets its OWN app.kubernetes.io/name so its selector From 6868e871e8948466e97433ec22ad26408af7109b Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 14:24:45 +0000 Subject: [PATCH 045/113] chore(release): 1.0.0-beta.3 ## (2026-07-08) ### Bug Fixes * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/br-sta/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index a7fb0e0f..5dfd0ea4 100644 --- a/README.md +++ b/README.md @@ -284,5 +284,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `1.0.0-beta.2` | 1.0.0-beta.32 | 1.0.0-beta.32 | +| `1.0.0-beta.3` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index 44047721..c52a11ce 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.0.0-beta.2 +version: 1.0.0-beta.3 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.32" From 4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Wed, 8 Jul 2026 14:35:03 -0300 Subject: [PATCH 046/113] feat(plugin-access-manager): mirror POSTGRES_* env in migrations Job MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The Casdoor migrations Job (templates/auth-backend/migrations.yaml) only injected DB_HOST/DB_PORT/DB_NAME/DB_USER/DB_PASS/DB_SSLMODE, hardcoded to match casdoor-migrations' env contract. Caradhras's own migration runner (cmd/postgres-migrations, ghcr.io/lerianstudio/caradhras-postgres-migrations) reads POSTGRES_HOST/PORT/USER/PASSWORD/DB/SSLMODE instead. Adds the POSTGRES_* mirrors, sourced from the same ConfigMap/Secret keys, so the same Job template works with either migrations image via auth.backend.migrations.image — no new value, no behavior change for existing casdoor-migrations installs (which ignore the unused POSTGRES_* vars). Render-equivalence checked: helm template diff shows only the 6 added env entries, nothing else changed. --- .../templates/auth-backend/migrations.yaml | 32 +++++++++++++++++++ 1 file changed, 32 insertions(+) diff --git a/charts/plugin-access-manager/templates/auth-backend/migrations.yaml b/charts/plugin-access-manager/templates/auth-backend/migrations.yaml index fb3d69e2..7387e476 100644 --- a/charts/plugin-access-manager/templates/auth-backend/migrations.yaml +++ b/charts/plugin-access-manager/templates/auth-backend/migrations.yaml @@ -68,4 +68,36 @@ spec: configMapKeyRef: name: {{ include "plugin-auth.fullname" . }} key: DB_SSLMODE + # POSTGRES_* mirrors of the DB_* vars above, mapped from the same + # ConfigMap/Secret keys. The caradhras migration runner + # (cmd/postgres-migrations) reads POSTGRES_HOST/PORT/USER/PASSWORD/DB/SSLMODE + # instead of Casdoor's DB_* contract; keeping both sets lets this single + # Job template run either migrations image via auth.backend.migrations.image, + # with no functional effect on casdoor-migrations (which ignores POSTGRES_*). + - name: POSTGRES_HOST + valueFrom: + configMapKeyRef: + name: {{ include "plugin-auth.fullname" . }} + key: DB_HOST + - name: POSTGRES_PORT + valueFrom: + configMapKeyRef: + name: {{ include "plugin-auth.fullname" . }} + key: DB_PORT + - name: POSTGRES_DB + valueFrom: + configMapKeyRef: + name: {{ include "plugin-auth.fullname" . }} + key: DB_NAME + - name: POSTGRES_USER + valueFrom: + configMapKeyRef: + name: {{ include "plugin-auth.fullname" . }} + key: DB_USER + {{- include "plugin-auth.dbPasswordEnv" (dict "context" $ "envName" "POSTGRES_PASSWORD") | nindent 12 }} + - name: POSTGRES_SSLMODE + valueFrom: + configMapKeyRef: + name: {{ include "plugin-auth.fullname" . }} + key: DB_SSLMODE restartPolicy: OnFailure \ No newline at end of file From d546c66279a3e976877d9feef1ea906d4ea4a96b Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 17:41:49 +0000 Subject: [PATCH 047/113] chore(release): 8.4.0-beta.1 ## (2026-07-08) ### Features * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-access-manager/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5dfd0ea4..e0ba1206 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Auth Version | Identity Version | | :---: | :---: | :---: | -| `8.3.0` | 2.6.7 | 2.4.5 | +| `8.4.0-beta.1` | 2.6.7 | 2.4.5 | ----------------- ### Plugin Fees Helm Chart diff --git a/charts/plugin-access-manager/Chart.yaml b/charts/plugin-access-manager/Chart.yaml index 83739344..4645738c 100644 --- a/charts/plugin-access-manager/Chart.yaml +++ b/charts/plugin-access-manager/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 8.3.0 +version: 8.4.0-beta.1 # This is the version number of the application being deployed. appVersion: "2.6.7" # A list of keywords about the chart. This helps others discover the chart. From 9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Wed, 8 Jul 2026 15:11:50 -0300 Subject: [PATCH 048/113] feat(plugin-access-manager): support extraEnvVars on auth-backend MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The auth-backend (casdoor/caradhras) ConfigMap had no way to inject arbitrary env vars, unlike the auth and identity components which both already support .Values..extraEnvVars merged directly into their ConfigMap. Adds the same pattern (auth.backend.extraEnvVars) to templates/auth-backend/configmap.yaml. Needed because caradhras (unlike casdoor) has an outbox postgres client that reads ALLOW_INSECURE_TLS and has no other way to receive it today — the backend container has no extraEnvVars passthrough at all. No default value set here (empty extraEnvVars is a no-op, {{- with }} skips rendering); existing casdoor installs are unaffected. Render- equivalence checked: helm template diff with default values shows no change; setting auth.backend.extraEnvVars.ALLOW_INSECURE_TLS renders it correctly into the ConfigMap. --- .../templates/auth-backend/configmap.yaml | 7 ++++++- 1 file changed, 6 insertions(+), 1 deletion(-) diff --git a/charts/plugin-access-manager/templates/auth-backend/configmap.yaml b/charts/plugin-access-manager/templates/auth-backend/configmap.yaml index 42793b60..218a85e5 100644 --- a/charts/plugin-access-manager/templates/auth-backend/configmap.yaml +++ b/charts/plugin-access-manager/templates/auth-backend/configmap.yaml @@ -19,4 +19,9 @@ data: enableGzip: "true" quota: '{"organization": -1, "user": -1, "application": -1, "provider": -1}' logConfig: '{"filename": "logs/casdoor.log", "maxdays": 99999, "perm": "0770"}' - initDataFile: {{ .Values.auth.backend.initDataFile | default "./init_data.json" | quote }} \ No newline at end of file + initDataFile: {{ .Values.auth.backend.initDataFile | default "./init_data.json" | quote }} + + # Extra Env Vars + {{- with .Values.auth.backend.extraEnvVars }} + {{- toYaml . | nindent 2 }} + {{- end }} \ No newline at end of file From 055b42888c1a2ef394eb9298f85136a0b530bcf2 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Wed, 8 Jul 2026 15:15:57 -0300 Subject: [PATCH 049/113] feat(plugin-access-manager): default ALLOW_INSECURE_TLS on auth-backend MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Adds an explicit ALLOW_INSECURE_TLS key to the auth-backend ConfigMap, defaulting to "true" (same default and rationale as auth.configmap.ALLOW_INSECURE_TLS and identity.configmap.ALLOW_INSECURE_TLS). Casdoor never reads this key, so existing installs are unaffected in behavior, only in ConfigMap contents (one new key, always "true" unless overridden via auth.backend.allowInsecureTLS). Caradhras' outbox Postgres client reads it and fails closed without it — this was the last missing env var blocking caradhras from booting as auth-backend in the stg-mt test instance. Caveat: setting ALLOW_INSECURE_TLS via auth.backend.extraEnvVars in addition to this key produces a duplicate map key in the rendered ConfigMap (last-wins in practice, but invalid YAML strictly) — same latent risk already accepted for the auth/identity components. Prefer auth.backend.allowInsecureTLS to override. --- .../templates/auth-backend/configmap.yaml | 5 +++++ 1 file changed, 5 insertions(+) diff --git a/charts/plugin-access-manager/templates/auth-backend/configmap.yaml b/charts/plugin-access-manager/templates/auth-backend/configmap.yaml index 218a85e5..386a2f63 100644 --- a/charts/plugin-access-manager/templates/auth-backend/configmap.yaml +++ b/charts/plugin-access-manager/templates/auth-backend/configmap.yaml @@ -20,6 +20,11 @@ data: quota: '{"organization": -1, "user": -1, "application": -1, "provider": -1}' logConfig: '{"filename": "logs/casdoor.log", "maxdays": 99999, "perm": "0770"}' initDataFile: {{ .Values.auth.backend.initDataFile | default "./init_data.json" | quote }} + # Allows the backend's outbox Postgres client to connect without a valid + # certificate. Same default and rationale as auth.configmap.ALLOW_INSECURE_TLS + # and identity.configmap.ALLOW_INSECURE_TLS. Casdoor ignores this key; only + # caradhras' outbox client reads it, and it fails closed without it. + ALLOW_INSECURE_TLS: {{ .Values.auth.backend.allowInsecureTLS | default "true" | quote }} # Extra Env Vars {{- with .Values.auth.backend.extraEnvVars }} From 29ce8ffe6aa45651520bb3a2c0bef9081282aae1 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 18:27:40 +0000 Subject: [PATCH 050/113] chore(release): 8.4.0-beta.2 ## (2026-07-08) ### Features * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) --- README.md | 2 +- charts/plugin-access-manager/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index e0ba1206..97740242 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Auth Version | Identity Version | | :---: | :---: | :---: | -| `8.4.0-beta.1` | 2.6.7 | 2.4.5 | +| `8.4.0-beta.2` | 2.6.7 | 2.4.5 | ----------------- ### Plugin Fees Helm Chart diff --git a/charts/plugin-access-manager/Chart.yaml b/charts/plugin-access-manager/Chart.yaml index 4645738c..d5747365 100644 --- a/charts/plugin-access-manager/Chart.yaml +++ b/charts/plugin-access-manager/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 8.4.0-beta.1 +version: 8.4.0-beta.2 # This is the version number of the application being deployed. appVersion: "2.6.7" # A list of keywords about the chart. This helps others discover the chart. From b4112dd39592aa8049b8a56026205867f6bc545a Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Wed, 8 Jul 2026 15:43:36 -0300 Subject: [PATCH 051/113] fix(br-ccs): address CodeRabbit review on PR #1617 - bootstrap-postgres: run psql bootstrap under bash (dash rejects set -o pipefail) - bootstrap-rabbitmq: add securityContext to both containers; write curl creds to a umask-077 /tmp/curlrc (-K) instead of -u to keep them out of argv - configmap: require POSTGRES_HOST/REDIS_HOST when their subchart is disabled; drop the broken RABBITMQ_URL default ($() does not expand via envFrom) - migrations: read POSTGRES_PASSWORD from the subchart secret via infraSecretRef on the internal-Postgres path - values-template/README: clarify external-infra host requirement and mark FETCHER_CRYPTO_KEY optional (empty = passthrough) Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/README.md | 12 +++---- .../br-ccs/templates/bootstrap-postgres.yaml | 2 +- .../br-ccs/templates/bootstrap-rabbitmq.yaml | 32 ++++++++++++++++--- charts/br-ccs/templates/configmap.yaml | 16 +++++++++- charts/br-ccs/templates/migrations.yaml | 4 +++ charts/br-ccs/values-template.yaml | 12 ++++--- 6 files changed, 62 insertions(+), 16 deletions(-) diff --git a/charts/br-ccs/README.md b/charts/br-ccs/README.md index 9d93598c..0a69ded3 100644 --- a/charts/br-ccs/README.md +++ b/charts/br-ccs/README.md @@ -54,12 +54,12 @@ set via `brCcs.extraEnvVars`. ### Required secrets -| Key | Notes | -|-----|-------| -| `POSTGRES_PASSWORD` | Single-sourced from the bundled subchart Secret when `postgresql.enabled=true`; supply here for external Postgres. | -| `REDIS_PASSWORD` | Single-sourced from the bundled valkey Secret when `valkey.enabled=true`; supply here for external Redis. | -| `CCS_CRYPTO_MASTER_KEY` | AES-256-GCM master key, 64 hex chars (`openssl rand -hex 32`). Empty fails fast at boot. | -| `FETCHER_CRYPTO_KEY` | Fetcher snapshot decryption key (base64; same value as Fetcher `APP_ENC_KEY`). | +| Key | Required | Notes | +|-----|----------|-------| +| `POSTGRES_PASSWORD` | Yes | Single-sourced from the bundled subchart Secret when `postgresql.enabled=true`; supply here for external Postgres. | +| `REDIS_PASSWORD` | Yes | Single-sourced from the bundled valkey Secret when `valkey.enabled=true`; supply here for external Redis. | +| `CCS_CRYPTO_MASTER_KEY` | Yes | AES-256-GCM master key, 64 hex chars (`openssl rand -hex 32`). Empty fails fast at boot. | +| `FETCHER_CRYPTO_KEY` | No | Optional. Empty = passthrough / plaintext (dev/staging); set to the Fetcher `APP_ENC_KEY` to decrypt snapshots. | ### Migrations diff --git a/charts/br-ccs/templates/bootstrap-postgres.yaml b/charts/br-ccs/templates/bootstrap-postgres.yaml index dc94e27b..3a247b10 100644 --- a/charts/br-ccs/templates/bootstrap-postgres.yaml +++ b/charts/br-ccs/templates/bootstrap-postgres.yaml @@ -77,7 +77,7 @@ spec: - name: DB_DATABASE value: postgres command: - - /bin/sh + - /bin/bash - -c - | set -euo pipefail diff --git a/charts/br-ccs/templates/bootstrap-rabbitmq.yaml b/charts/br-ccs/templates/bootstrap-rabbitmq.yaml index 45629e60..415c2bb2 100644 --- a/charts/br-ccs/templates/bootstrap-rabbitmq.yaml +++ b/charts/br-ccs/templates/bootstrap-rabbitmq.yaml @@ -51,6 +51,15 @@ spec: ELAPSED=$((ELAPSED + 5)); done; echo "$RABBITMQ_HOST:$RABBITMQ_PORT is ready!"; + securityContext: + runAsUser: 1000 + runAsGroup: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL containers: - name: apply-definitions image: ghcr.io/jqlang/jq:1.7.1 @@ -60,6 +69,9 @@ spec: - | set -e + umask 077 + printf 'user = "%s:%s"\n' "$RABBITMQ_ADMIN_USER" "$RABBITMQ_ADMIN_PASS" > /tmp/curlrc + CURL_OPTS="-sS" if [ "$RABBITMQ_SKIP_TLS_VERIFY" = "true" ]; then CURL_OPTS="$CURL_OPTS -k" @@ -79,13 +91,13 @@ spec: echo "" echo "Checking if RabbitMQ user 'br-ccs' already exists..." - BR_CCS_EXISTS=$(curl $CURL_OPTS -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + BR_CCS_EXISTS=$(curl $CURL_OPTS -K /tmp/curlrc \ "$BASE_URL/api/users/br-ccs" 2>/dev/null || echo "not_found") SKIP_DEFINITIONS=false if echo "$BR_CCS_EXISTS" | grep -q '"name":"br-ccs"'; then echo "RabbitMQ user 'br-ccs' already exists. Checking exchanges..." - EXCHANGE_EXISTS=$(curl $CURL_OPTS -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + EXCHANGE_EXISTS=$(curl $CURL_OPTS -K /tmp/curlrc \ "$BASE_URL/api/exchanges/%2F/events" 2>/dev/null || echo "not_found") if echo "$EXCHANGE_EXISTS" | grep -q '"name":"events"'; then echo "RabbitMQ definitions already applied (user and exchange exist). Skipping definitions import." @@ -96,7 +108,7 @@ spec: if [ "$SKIP_DEFINITIONS" = "false" ]; then echo "Applying RabbitMQ definitions from file..." HTTP_CODE=$(curl $CURL_OPTS -o /tmp/response.txt -w "%{http_code}" \ - -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + -K /tmp/curlrc \ -H "content-type: application/json" \ -X POST \ --data-binary @/definitions/load_definitions.json \ @@ -112,7 +124,7 @@ spec: echo "Updating RabbitMQ user 'br-ccs' password..." USER_JSON=$(jq -n --arg pw "$RABBITMQ_BR_CCS_PASS" '{"password": $pw, "tags": ""}') HTTP_CODE=$(curl $CURL_OPTS -o /tmp/response.txt -w "%{http_code}" \ - -u "$RABBITMQ_ADMIN_USER:$RABBITMQ_ADMIN_PASS" \ + -K /tmp/curlrc \ -H "content-type: application/json" \ -X PUT \ --data "$USER_JSON" \ @@ -162,9 +174,19 @@ spec: {{- else }} value: {{ .Values.global.externalRabbitmqDefinitions.rabbitmqAdminLogin.username | quote }} {{- end }} + securityContext: + runAsUser: 1000 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL volumeMounts: - name: definitions mountPath: /definitions + - name: tmp + mountPath: /tmp volumes: - name: definitions configMap: @@ -172,4 +194,6 @@ spec: items: - key: load_definitions.json path: load_definitions.json + - name: tmp + emptyDir: {} {{- end }} diff --git a/charts/br-ccs/templates/configmap.yaml b/charts/br-ccs/templates/configmap.yaml index 50034150..9d446e04 100644 --- a/charts/br-ccs/templates/configmap.yaml +++ b/charts/br-ccs/templates/configmap.yaml @@ -1,6 +1,10 @@ {{- if .Values.brCcs.enabled }} {{- $cm := .Values.brCcs.configmap | default dict }} {{- $multiTenantEnabled := eq (toString ($cm.MULTI_TENANT_ENABLED | default "false")) "true" }} +{{- $pg := .Values.postgresql | default dict }} +{{- $vk := .Values.valkey | default dict }} +{{- $pgInternal := and (ne (toString $pg.enabled) "false") (not $pg.external) }} +{{- $vkInternal := and (ne (toString $vk.enabled) "false") (not $vk.external) }} {{- $namespace := include "global.namespace" . }} kind: ConfigMap apiVersion: v1 @@ -71,7 +75,11 @@ data: # POSTGRESQL (primary + control-plane) # POSTGRES_HOST defaults to the bundled subchart primary Service. # ===================================================================== + {{- if $pgInternal }} POSTGRES_HOST: {{ $cm.POSTGRES_HOST | default (printf "%s-postgresql-primary.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + {{- else }} + POSTGRES_HOST: {{ required "brCcs.configmap.POSTGRES_HOST is required when the bundled postgresql subchart is disabled (external infra)" $cm.POSTGRES_HOST | quote }} + {{- end }} POSTGRES_PORT: {{ $cm.POSTGRES_PORT | default "5432" | quote }} POSTGRES_USER: {{ $cm.POSTGRES_USER | default "br-ccs" | quote }} POSTGRES_NAME: {{ $cm.POSTGRES_NAME | default "br-ccs" | quote }} @@ -96,7 +104,11 @@ data: # REDIS / VALKEY (app-level) # REDIS_HOST is host:port; defaults to the bundled valkey primary Service. # ===================================================================== + {{- if $vkInternal }} REDIS_HOST: {{ $cm.REDIS_HOST | default (printf "%s-valkey-primary.%s.svc.cluster.local:6379" .Release.Name $namespace) | quote }} + {{- else }} + REDIS_HOST: {{ required "brCcs.configmap.REDIS_HOST is required when the bundled valkey subchart is disabled (external infra)" $cm.REDIS_HOST | quote }} + {{- end }} REDIS_DB: {{ $cm.REDIS_DB | default "0" | quote }} REDIS_PROTOCOL: {{ $cm.REDIS_PROTOCOL | default "3" | quote }} REDIS_POOL_SIZE: {{ $cm.REDIS_POOL_SIZE | default "10" | quote }} @@ -125,7 +137,9 @@ data: # ===================================================================== RABBITMQ_ENABLED: {{ $cm.RABBITMQ_ENABLED | default "false" | quote }} {{- if eq (toString ($cm.RABBITMQ_ENABLED | default "false")) "true" }} - RABBITMQ_URL: {{ $cm.RABBITMQ_URL | default (printf "amqp://br-ccs:$(RABBITMQ_DEFAULT_PASS)@%s-rabbitmq.%s.svc.cluster.local:5672/" .Release.Name $namespace) | quote }} + {{- if $cm.RABBITMQ_URL }} + RABBITMQ_URL: {{ $cm.RABBITMQ_URL | quote }} + {{- end }} RABBITMQ_HOST: {{ $cm.RABBITMQ_HOST | default (printf "%s-rabbitmq.%s.svc.cluster.local" .Release.Name $namespace) | quote }} RABBITMQ_PORT_AMQP: {{ $cm.RABBITMQ_PORT_AMQP | default "5672" | quote }} RABBITMQ_PORT_HOST: {{ $cm.RABBITMQ_PORT_HOST | default "15672" | quote }} diff --git a/charts/br-ccs/templates/migrations.yaml b/charts/br-ccs/templates/migrations.yaml index bd122c2e..734cd71a 100644 --- a/charts/br-ccs/templates/migrations.yaml +++ b/charts/br-ccs/templates/migrations.yaml @@ -131,11 +131,15 @@ spec: value: {{ get $configmap "POSTGRES_SSLMODE" | default "require" | quote }} - name: POSTGRES_CONNECT_TIMEOUT_SEC value: {{ get $configmap "POSTGRES_CONNECT_TIMEOUT_SEC" | default "10" | quote }} + {{- if $internalPg }} + {{- include "br-ccs.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} + {{- else }} - name: POSTGRES_PASSWORD valueFrom: secretKeyRef: name: {{ $existingSecretName }} key: POSTGRES_PASSWORD + {{- end }} securityContext: runAsUser: 1000 runAsGroup: 1000 diff --git a/charts/br-ccs/values-template.yaml b/charts/br-ccs/values-template.yaml index 47db806a..3885303d 100644 --- a/charts/br-ccs/values-template.yaml +++ b/charts/br-ccs/values-template.yaml @@ -51,18 +51,22 @@ brCcs: # MULTI_TENANT_REDIS_HOST: "" # ================================================================= - # PostgreSQL primary - REQUIRED + # PostgreSQL primary + # POSTGRES_HOST is REQUIRED when the bundled postgresql subchart is + # disabled or external; leave empty to use the bundled subchart Service. # ================================================================= - POSTGRES_HOST: "" # REQUIRED - PostgreSQL primary host + POSTGRES_HOST: "" # REQUIRED for external infra (postgresql disabled/external) POSTGRES_PORT: "5432" POSTGRES_USER: "br-ccs" POSTGRES_NAME: "br-ccs" POSTGRES_SSLMODE: "require" # ================================================================= - # Redis/Valkey (app-level) - REQUIRED + # Redis/Valkey (app-level) + # REDIS_HOST is REQUIRED when the bundled valkey subchart is disabled + # or external; leave empty to use the bundled subchart Service. # ================================================================= - REDIS_HOST: "" # REQUIRED - Redis/Valkey host:port + REDIS_HOST: "" # REQUIRED for external infra (valkey disabled/external); host:port # ================================================================= # Circuit breaker (prerequisite for object storage) From a5ba0b3230059607c719d03e17fb2d641338ed09 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Wed, 8 Jul 2026 15:55:07 -0300 Subject: [PATCH 052/113] fix(br-ccs): add Chart Contract section to README The helm-chart-standard validator requires a '## Chart Contract' section with the required-secrets, dependency-notes, production-overrides and source/license fragments. Add it to satisfy the readme-contract check. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/charts/br-ccs/README.md b/charts/br-ccs/README.md index 0a69ded3..7422cd71 100644 --- a/charts/br-ccs/README.md +++ b/charts/br-ccs/README.md @@ -10,6 +10,14 @@ judicial secrecy (liminares / LC 105) and LGPD. - Chart type: `single-service` - Source: https://github.com/LerianStudio/br-ccs +## Chart Contract + +- Chart type: `single-service` +- Required secrets: `brCcs.secrets.CCS_CRYPTO_MASTER_KEY` (AES-256-GCM, 64 hex chars — empty fails fast at boot). `POSTGRES_PASSWORD` and `REDIS_PASSWORD` are single-sourced from the bundled `-{postgresql,valkey}` Secrets via `secretKeyRef` when those subcharts are enabled; supply them (or `.auth.existingSecret`) for external infra. `FETCHER_CRYPTO_KEY` is optional (empty = passthrough). See `docs/helm-chart-standard.md`. +- Dependency notes: Bundled PostgreSQL and Valkey subcharts are used unless external services are configured; RabbitMQ is optional and disabled by default. No MongoDB. +- Production overrides: Disable the bundled subcharts (`.enabled=false`, `.external=true`), set `POSTGRES_HOST`/`REDIS_HOST`, and supply secrets via a secrets manager or `brCcs.useExistingSecret`; override image tags, ingress, resources, and integration endpoints (Fetcher/STA/Reporter). +- Source/license: Source is in `github.com/LerianStudio/helm` and `github.com/LerianStudio/br-ccs`; license is Apache-2.0. + ## TL;DR ```bash From 00fda2ae0519a2c9cdbd4586f0bb3c6544c333e1 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 19:22:18 +0000 Subject: [PATCH 053/113] chore(release): 1.0.0-beta.4 ## (2026-07-08) ### Features * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/streaming-hub/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 97740242..82f7394d 100644 --- a/README.md +++ b/README.md @@ -273,7 +273,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.3` | 1.0.0 | +| `1.0.0-beta.4` | 1.0.0 | ----------------- ### BR STA diff --git a/charts/streaming-hub/Chart.yaml b/charts/streaming-hub/Chart.yaml index e922122e..fed35340 100644 --- a/charts/streaming-hub/Chart.yaml +++ b/charts/streaming-hub/Chart.yaml @@ -8,7 +8,7 @@ type: application # version is a PLACEHOLDER. semantic-release in the `helm` repo owns the real # chart version on merge — do NOT hand-pick a final number here. -version: 1.0.0-beta.3 +version: 1.0.0-beta.4 appVersion: "1.0.0" annotations: From 55c40e6be47777ccc7029a2bfae6ac00bf5b0e41 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Wed, 8 Jul 2026 16:35:45 -0300 Subject: [PATCH 054/113] chore(br-ccs): register chart in PR title scopes, template and labeler Add br-ccs to the semantic PR-title scope allowlist, the PR template component checklist, and the labeler path rules so PRs for this chart pass the title check and get auto-labeled (mirrors the br-sta registration). Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/configs/labeler.yaml | 6 +++++- .github/pull_request_template.md | 1 + .github/workflows/pr-title.yml | 1 + 3 files changed, 7 insertions(+), 1 deletion(-) diff --git a/.github/configs/labeler.yaml b/.github/configs/labeler.yaml index 069a6c84..17e2826f 100644 --- a/.github/configs/labeler.yaml +++ b/.github/configs/labeler.yaml @@ -68,4 +68,8 @@ flowker: underwriter: - changed-files: - - any-glob-to-any-file: charts/underwriter/** \ No newline at end of file + - any-glob-to-any-file: charts/underwriter/** + +br-ccs: + - changed-files: + - any-glob-to-any-file: charts/br-ccs/** \ No newline at end of file diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index 7dbef9f0..ce5be779 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -20,6 +20,7 @@ - [ ] Flowker - [ ] Underwriter - [ ] BR STA +- [ ] BR CCS ## Checklist Please check each item after it's completed. diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 6c45b463..935b5dd2 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -55,6 +55,7 @@ jobs: matcher tracer br-sta + br-ccs new charts common From b9f5bea547af1631342c92e49f54e1133ce6b2f7 Mon Sep 17 00:00:00 2001 From: arthurkz Date: Wed, 8 Jul 2026 17:04:07 -0300 Subject: [PATCH 055/113] feat(br-sta): add postgres migrations Job to chart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Mirror the plugin-br-bank-transfer migrations pattern: a schema-migration Job (init/postgres-migrations runner image) run as an Argo hook — PreSync for external Postgres (schema-first, before rollout) or PostSync + wait-for-postgres for the bundled subchart. Adapted to br-sta conventions: .Values["br-sta"] root, br-sta helpers, POSTGRES_NAME (not POSTGRES_DB), no ALLOW_INSECURE_TLS (the runner accepts sslmode=disable), password mirrors deployment.yaml (subchart secretKeyRef via infraSecretRef, else the chart-managed app Secret which is itself a PreSync -5 hook — so no separate migration-only Secret). Multi-tenant render guard, nonroot 65532. Disabled by default. X-Lerian-Ref: 0x1 --- charts/br-sta/templates/migrations.yaml | 197 ++++++++++++++++++++++++ charts/br-sta/values.yaml | 47 ++++++ 2 files changed, 244 insertions(+) create mode 100644 charts/br-sta/templates/migrations.yaml diff --git a/charts/br-sta/templates/migrations.yaml b/charts/br-sta/templates/migrations.yaml new file mode 100644 index 00000000..bacdf6fb --- /dev/null +++ b/charts/br-sta/templates/migrations.yaml @@ -0,0 +1,197 @@ +{{- $app := index .Values "br-sta" -}} +{{- $migrations := get $app "migrations" | default dict -}} +{{- $configmap := get $app "configmap" | default dict -}} +{{- $migrationImage := get $migrations "image" | default dict -}} +{{- $defaultMigrationResources := dict "requests" (dict "cpu" "50m" "memory" "64Mi") "limits" (dict "cpu" "250m" "memory" "256Mi") -}} +{{- $migrationsEnabled := eq (lower (toString (get $migrations "enabled" | default false))) "true" -}} +{{- if $migrationsEnabled }} +{{- /* The standalone runner (init/postgres-migrations) refuses MULTI_TENANT_ENABLED=true: + tenant databases are migrated by the tenant-manager, not this chart. Fail fast so the + misconfiguration surfaces at render time rather than as a crash-looping Job. */}} +{{- if eq (lower (toString (get $configmap "MULTI_TENANT_ENABLED" | default "false"))) "true" }} +{{- fail "br-sta.migrations.enabled cannot be true when br-sta.configmap.MULTI_TENANT_ENABLED=true; tenant-manager owns tenant database migrations" }} +{{- end }} +{{- $namespace := include "global.namespace" . -}} +{{- $pg := .Values.postgresql | default dict -}} +{{- $pgAuth := $pg.auth | default dict -}} +{{- /* Internal (chart-managed) Postgres: provisioned during Sync (bitnami subchart), so the + migration must run as a POST hook (after the DB exists) with a wait-for-Postgres init. + External/pre-existing Postgres keeps the PRE hook (schema-first, DB already exists). This + mirrors the "postgresql.enabled" helper (enabled && not external). */}} +{{- $internalPg := eq (include "postgresql.enabled" .) "true" -}} +{{- /* POSTGRES_PASSWORD source mirrors deployment.yaml exactly: + - bundled subchart OR postgresql.auth.existingSecret → single-source the subchart Secret + via secretKeyRef (br-sta.infraSecretRef). + - external, chart-managed → the app Secret (secrets.yaml) is itself a pre-install/ + pre-upgrade hook at weight -5, so it already exists before this Job (weight -1); no + separate migration-only Secret is required. + A migration-specific or app-level existing Secret overrides the chart-managed name. */}} +{{- $useInfraSecret := or (and (ne (toString $pg.enabled) "false") (not $pg.external)) $pgAuth.existingSecret -}} +{{- $migUseExisting := eq (lower (toString (get $migrations "useExistingSecret" | default false))) "true" -}} +{{- $appUseExisting := eq (lower (toString (get $app "useExistingSecret" | default false))) "true" -}} +{{- $pwSecretName := include "br-sta.fullname" . -}} +{{- if $migUseExisting }} +{{- $pwSecretName = required "br-sta.migrations.existingSecretName is required when br-sta.migrations.useExistingSecret=true" (get $migrations "existingSecretName") -}} +{{- else if $appUseExisting }} +{{- $pwSecretName = required "br-sta.existingSecretName is required when br-sta.useExistingSecret=true" (get $app "existingSecretName") -}} +{{- end }} +{{- /* Resolve POSTGRES_HOST the same way configmap.yaml does when left empty: derive the + collapse-aware subchart primary Service for internal Postgres; external installs set it + explicitly. */}} +{{- $pgHost := get $configmap "POSTGRES_HOST" -}} +{{- if and (not $pgHost) $internalPg }} +{{- $pgFullname := include "common.names.dependency.fullname" (dict "chartName" "postgresql" "chartValues" $pg "context" .) -}} +{{- if eq (default "standalone" $pg.architecture) "replication" }} +{{- $pgHost = printf "%s-primary.%s.svc.cluster.local" $pgFullname $namespace -}} +{{- else }} +{{- $pgHost = printf "%s.%s.svc.cluster.local" $pgFullname $namespace -}} +{{- end }} +{{- end }} +{{- /* Migration image tag is coupled to the app image tag unless an explicit tag/digest is set; + empty tag falls back to br-sta.image.tag, then the chart appVersion. */}} +{{- $migrationTag := get $migrationImage "tag" | default (get (get $app "image" | default dict) "tag" | default .Chart.AppVersion) -}} +{{- $migrationDigest := get $migrationImage "digest" | default "" -}} +{{- $migrationRepository := get $migrationImage "repository" | default "ghcr.io/lerianstudio/br-sta-migrations" -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ printf "%s-migrations" (include "br-sta.fullname" .) | trunc 63 | trimSuffix "-" }} + namespace: {{ $namespace }} + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 4 }} + app.kubernetes.io/component: migrations + annotations: + {{- if $internalPg }} + # Internal Postgres is provisioned during Sync — run AFTER it exists and is reachable. + "helm.sh/hook": post-install,post-upgrade + "argocd.argoproj.io/hook": PostSync + {{- else }} + # External Postgres already exists — run BEFORE the app rolls out (schema-first). Weight -1 + # runs after the app Secret hook (weight -5) so its POSTGRES_PASSWORD is available. + "helm.sh/hook": pre-install,pre-upgrade + "argocd.argoproj.io/hook": PreSync + {{- end }} + "helm.sh/hook-weight": "-1" + "helm.sh/hook-delete-policy": before-hook-creation,hook-succeeded + "argocd.argoproj.io/hook-delete-policy": BeforeHookCreation,HookSucceeded + {{- with (get $migrations "annotations") }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + backoffLimit: {{ get $migrations "backoffLimit" | default 3 }} + activeDeadlineSeconds: {{ get $migrations "activeDeadlineSeconds" | default 600 }} + ttlSecondsAfterFinished: {{ get $migrations "ttlSecondsAfterFinished" | default 600 }} + template: + metadata: + labels: + {{- include "br-sta.labels" (dict "context" .) | nindent 8 }} + app.kubernetes.io/component: migrations + {{- with (get $migrations "podAnnotations") }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with (get $app "imagePullSecrets") }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $migrations "serviceAccountName") }} + serviceAccountName: {{ . | quote }} + {{- end }} + {{- if $internalPg }} + initContainers: + - name: wait-for-postgres + image: busybox:1.37 + command: + - /bin/sh + - -c + - > + echo "Waiting for $POSTGRES_HOST:$POSTGRES_PORT..."; + ELAPSED=0; + while ! nc -z "$POSTGRES_HOST" "$POSTGRES_PORT"; do + if [ $ELAPSED -ge 300 ]; then echo "Timeout after 300s"; exit 1; fi; + echo "not ready, waiting (${ELAPSED}s/300s)"; sleep 5; ELAPSED=$((ELAPSED + 5)); + done; + echo "Postgres is ready"; + env: + - name: POSTGRES_HOST + value: {{ $pgHost | default (printf "%s-postgresql-primary.%s.svc.cluster.local" .Release.Name $namespace) | quote }} + - name: POSTGRES_PORT + value: {{ get $configmap "POSTGRES_PORT" | default "5432" | quote }} + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + {{- end }} + containers: + - name: migrations + {{- if $migrationDigest }} + image: "{{ $migrationRepository }}@{{ $migrationDigest }}" + {{- else }} + image: "{{ $migrationRepository }}:{{ $migrationTag }}" + {{- end }} + imagePullPolicy: {{ get $migrationImage "pullPolicy" | default "IfNotPresent" }} + env: + # The runner reads MIGRATIONS_PATH; the image bundles the SQL at /migrations. + - name: MIGRATIONS_PATH + value: {{ get $migrations "path" | default "/migrations" | quote }} + - name: POSTGRES_HOST + value: {{ $pgHost | quote }} + - name: POSTGRES_PORT + value: {{ get $configmap "POSTGRES_PORT" | default "5432" | quote }} + - name: POSTGRES_USER + value: {{ get $configmap "POSTGRES_USER" | default "br_sta" | quote }} + # br-sta's runner reads the database name from POSTGRES_NAME (not POSTGRES_DB). + - name: POSTGRES_NAME + value: {{ get $configmap "POSTGRES_NAME" | default "br_sta" | quote }} + - name: POSTGRES_SSLMODE + value: {{ get $configmap "POSTGRES_SSLMODE" | default "require" | quote }} + - name: POSTGRES_CONNECT_TIMEOUT_SEC + value: {{ get $configmap "POSTGRES_CONNECT_TIMEOUT_SEC" | default "10" | quote }} + {{- with (get $migrations "timeoutSeconds") }} + - name: MIGRATIONS_TIMEOUT_SEC + value: {{ . | quote }} + {{- end }} + {{- if $useInfraSecret }} + {{- include "br-sta.infraSecretRef" (dict "context" $ "subchart" "postgresql" "key" "password" "envName" "POSTGRES_PASSWORD") | nindent 12 }} + {{- else }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $pwSecretName }} + key: POSTGRES_PASSWORD + {{- end }} + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + resources: + {{- toYaml (get $migrations "resources" | default $defaultMigrationResources) | nindent 12 }} + {{- with (get $app "nodeSelector") }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $app "affinity") }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with (get $app "tolerations") }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index ed58e1c3..e16c2b9c 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -65,6 +65,53 @@ br-sta: tag: "" # -- Image pull secrets for private registries imagePullSecrets: [] + # -- Database migrations Job (init/postgres-migrations runner image). + # Applies the SQL migrations once as an Argo hook — PreSync for external + # Postgres (schema-first, before the app rolls out) or PostSync for the + # bundled subchart (after the DB is provisioned) — so schema changes are + # applied by a dedicated process rather than at application runtime. + # Disabled by default; enable per-environment (e.g. the dev-st gitops values). + migrations: + # -- Enable or disable the migrations Job. + enabled: false + # -- When true, read POSTGRES_PASSWORD from a pre-existing Secret + # (existingSecretName) instead of the chart-managed app Secret. + useExistingSecret: false + # -- Name of the pre-existing Secret containing POSTGRES_PASSWORD + # (only used when useExistingSecret=true). + existingSecretName: "" + image: + # -- Repository for the migrations runner image. + repository: ghcr.io/lerianstudio/br-sta-migrations + # -- Tag for the migrations image. Defaults to the app image tag + # (br-sta.image.tag, or the chart appVersion) when left empty. + tag: "" + # -- Optional image digest (overrides tag when set). + digest: "" + # -- Image pull policy. + pullPolicy: IfNotPresent + # -- Path inside the image where the SQL migrations live. + path: "/migrations" + # -- Maximum retries before the Job is considered failed. + backoffLimit: 3 + # -- Hard wall-clock cap for the Job (seconds). + activeDeadlineSeconds: 600 + # -- Seconds to retain the finished Job before garbage collection. + ttlSecondsAfterFinished: 600 + # -- Optional MIGRATIONS_TIMEOUT_SEC passed to the runner (per-run deadline). + timeoutSeconds: "" + # -- Resource requests/limits for the migrations container. + resources: + requests: + cpu: 50m + memory: 64Mi + limits: + cpu: 250m + memory: 256Mi + # -- Extra annotations on the Job resource. + annotations: {} + # -- Extra annotations on the migration pod. + podAnnotations: {} # -- Override of the resource name nameOverride: "" # -- Override of the fully qualified resource name From 307d104f0ddb33c89ecca4c96ec593b260b2bcac Mon Sep 17 00:00:00 2001 From: bedatty Date: Wed, 8 Jul 2026 17:14:49 -0300 Subject: [PATCH 056/113] docs(br-ccs): add version matrix section for br-ccs chart Adds the missing README section required by update-chart-version-readme-bin so the Helm Release workflow (Semantic Release step) can locate the chart's table and record the published version. Fixes the failed run for #1617. --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index 82f7394d..faba0104 100644 --- a/README.md +++ b/README.md @@ -286,3 +286,14 @@ For implementation and configuration details, see the [README](https://charts.le | :---: | :---: | :---: | | `1.0.0-beta.3` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- + +### Br Ccs + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/br-ccs). + +#### Application Version Mapping + +| Chart Version | App Version | +| :---: | :---: | +| `0.1.0` | 1.0.0 | +----------------- From ba320e339759aa062cc12f5c9cb8305a246e8e80 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 20:17:01 +0000 Subject: [PATCH 057/113] chore(release): 1.0.0-beta.4 ## (2026-07-08) ### Features * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) --- README.md | 2 +- charts/br-sta/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index faba0104..bfc459dd 100644 --- a/README.md +++ b/README.md @@ -284,7 +284,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `1.0.0-beta.3` | 1.0.0-beta.32 | 1.0.0-beta.32 | +| `1.0.0-beta.4` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- ### Br Ccs diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index c52a11ce..92345983 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.0.0-beta.3 +version: 1.0.0-beta.4 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.32" From 391a540b6d149018c0d4cc5758ef9cd8833f408e Mon Sep 17 00:00:00 2001 From: bedatty Date: Wed, 8 Jul 2026 17:19:17 -0300 Subject: [PATCH 058/113] chore(br-ccs): trigger release retry after README fix --- charts/br-ccs/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index 37ea5bd5..0e0b3fff 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -671,3 +671,5 @@ rabbitmq: mountPath: /etc/rabbitmq/definitions customConfig: | management.load_definitions = /etc/rabbitmq/definitions/load_definition.json + +# trigger: retry release after README fix From 58efb73bbe564a10d57447973195f27ca8fe9eef Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 20:23:07 +0000 Subject: [PATCH 059/113] chore(release): 1.0.0-beta.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## (2026-07-08) ### ⚠ BREAKING CHANGES * **plugin-br-payments:** any values overlay using the previous keys (app.configmap.PROVIDER_*, app.secrets.PROVIDER_*) must be updated in the same change set that pins to 1.0.0-beta.2 or later. The follow-up gitops PR in midaz-firmino-gitops (firmino/dev/plugin-br-payments/values.yaml) is the only known consumer today. * the onboarding and transaction services have been consolidated into the ledger service. All Kubernetes resources (Deployment, Service, ConfigMap, Secret, Ingress, HPA, PDB, ServiceAccount) for both services have been removed from the chart. If you are already using the ledger service, no action is required. Migration (only if you were using onboarding or transaction services): - Remove and blocks from your values overrides - Ensure is set - All configuration is now managed under Also adds missing env vars to ledger configmap/secrets (swagger, multi-tenant, overdraft events, balance sync worker) * **plugin-access-manager:** Values path changed from 'auth.backend.migrations.image' (string) to 'auth.backend.migrations.image.repository' + '.tag' (object). Same for 'auth.initUser.image' and 'auth.initUser.imagePullPolicy'. Existing values overrides using the old string format will need updating. * **midaz:** Ledger service is now enabled by default, replacing the separate onboarding and transaction services. - ledger.enabled now defaults to true - onboarding and transaction services are automatically disabled when ledger is enabled - Existing deployments using onboarding/transaction need to explicitly set ledger.enabled=false to maintain current behavior Migration guide: docs/UPGRADE-5.0.md * **rabbitmq:** Default Rabbitmq no longer uses the bitnami chart. Persistent volume claims from the bitnami Statefulset may not be reused automatically * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **valkey:** Valkey no longer uses StatefulSet. Persistent volume claims from StatefulSet will not be reused automatically. * feat!(midaz): remove onboarding and transaction services from midaz chart ([41e88df](https://github.com/LerianStudio/helm/commit/41e88df0368450368cea9a001129d3d6d0f8bd02)) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **values:** add app new version and reference default config ([b972952](https://github.com/LerianStudio/helm/commit/b97295261b87645884b197bbbf8aeea8dd78e452)) * **values:** add app new version and reference default secret ([ef8069c](https://github.com/LerianStudio/helm/commit/ef8069c403b3e7878571ddb3b92ee6f8be2f251f)) * **plugin-fees:** add APPLICATION_NAME, MULTI_TENANT_TIMEOUT, MULTI_TENANT_CACHE_TTL_SEC ([a7b6199](https://github.com/LerianStudio/helm/commit/a7b6199c800795da1300c47fd31412dd3f3b9853)) * **chart:** add auth backend helpers functions ([7248963](https://github.com/LerianStudio/helm/commit/72489636dfd8d57191e4d61da0369d6267b277df)) * **chart:** add auth backend templates ([57fb163](https://github.com/LerianStudio/helm/commit/57fb163b2c7cca15b1006ef493e3ee43b7cc616c)) * **onboarding:** add auth config ([8a055cb](https://github.com/LerianStudio/helm/commit/8a055cb83b9f6a9d9c76ca3343ab6a61c1d1c00c)) * **transaction:** add auth config ([a7ede5b](https://github.com/LerianStudio/helm/commit/a7ede5b29f6c69752cffad6970d5d73bd21062cb)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **plugin-br-pix-switch:** add bootstrap Jobs for postgres + mongodb ([79f12c7](https://github.com/LerianStudio/helm/commit/79f12c79a33464e64dd4c0dbfdab29ec116e3db9)) * add bootstrap-mongodb.yaml for idempotent MongoDB user/db provisioning ([c36e378](https://github.com/LerianStudio/helm/commit/c36e378b82a709e8ec50f659a19f9e654c3792b1)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **pipe:** add branch develop to generate beta release ([2990c0e](https://github.com/LerianStudio/helm/commit/2990c0e71d5b6773321b67c986b0a5a32b970cd3)) * **ci:** add chart standard validation and render gate ([9d4ab59](https://github.com/LerianStudio/helm/commit/9d4ab5980484335942ae7827954abcc0c97f633c)) * **fetcher:** add common configmap and secrets templates for shared configuration ([7f75dd0](https://github.com/LerianStudio/helm/commit/7f75dd089489faac6e797e657ea10a34f2e876d7)) * **midaz:** add conditional deployment logic for onboarding service and update ingress routing ([f2e3c76](https://github.com/LerianStudio/helm/commit/f2e3c76aa1fe0928439bf2cfbff401bd30078714)) * **midaz:** add conditional deployment logic for transaction service ([df12827](https://github.com/LerianStudio/helm/commit/df128273a67ebc2d6572c3bd0b798d534933489b)) * **plugin-smart-templates:** add configmap annotations ([adac247](https://github.com/LerianStudio/helm/commit/adac247e5d389e8587c8e5867d19547ce98bd810)) * **reporter:** add configurable secret for KEDA TriggerAuthentication ([d84a26d](https://github.com/LerianStudio/helm/commit/d84a26d398d1df7a487e053e25cdddc8cc37df88)) * **plugins:** add CRM data source secrets and disable ingress by default ([e262736](https://github.com/LerianStudio/helm/commit/e26273677fd0d683f02d79f7cb082b43e626a377)) * **midaz:** add CRM service with MongoDB integration and complete Kubernetes manifests ([a9368d2](https://github.com/LerianStudio/helm/commit/a9368d2d9a27d7f1278e0ec06ad7a4e25124b2d5)) * add crm ui functions ([3473c00](https://github.com/LerianStudio/helm/commit/3473c0089f1e0c6efe8eb71704e12c0913d07c55)) * add crm ui templates ([8089ad7](https://github.com/LerianStudio/helm/commit/8089ad7e7056b469abf9b07d880356ace2adbc3f)) * add dependencies to midaz helm ([e1e4095](https://github.com/LerianStudio/helm/commit/e1e4095c7e9fc48c69738c0610ee7ad4bd56c12a)) * **plugin-fees:** add deployment mode and readiness timeout settings ([fa5783b](https://github.com/LerianStudio/helm/commit/fa5783bb7cb7e64d32bb4c15c0e32b637aee5bb0)) * **values:** add deployment strategy definitions ([dd93837](https://github.com/LerianStudio/helm/commit/dd9383729db20e4f88265edde5900d35c7dbbafa)) * **console:** add deployment strategy ([0000ab0](https://github.com/LerianStudio/helm/commit/0000ab0a6c088e2eca167f396bff859638b478e4)) * **onboarding:** add deployment strategy ([220274b](https://github.com/LerianStudio/helm/commit/220274beb453eb54ec6e9c3a6020016cf8a7be91)) * **transaction:** add deployment strategy ([65076f4](https://github.com/LerianStudio/helm/commit/65076f421904b98f46329ff40cb31f7cf409476b)) * add doc ([5593a96](https://github.com/LerianStudio/helm/commit/5593a96ff02c3b968c4a703a5a7ccc2afa53be04)) * add doc ([97daf1e](https://github.com/LerianStudio/helm/commit/97daf1ecb4c2a51415c58cf0bc815a36d1e52cc3)) * add doc ([2f02d2e](https://github.com/LerianStudio/helm/commit/2f02d2ef0fad7ad80fe131253a8e232b66499430)) * add doc ([6e20f92](https://github.com/LerianStudio/helm/commit/6e20f92c1c31fa26560edfa77fec348783564de2)) * **product-console:** add dynamic OTEL host injection support ([4f473e9](https://github.com/LerianStudio/helm/commit/4f473e94c54955f11383f7f439a5c8d2454b47ae)) * **midaz:** add external OTEL collector support ([f38af29](https://github.com/LerianStudio/helm/commit/f38af29a9900c118d72e07481487b146e9dab02e)) * add external secret support for RabbitMQ and Postgres definitions in Helm chart ([0994db6](https://github.com/LerianStudio/helm/commit/0994db63ae8857fc4fd5540164b9334df58b3415)) * add external secret support paramters to values file ([e35c63e](https://github.com/LerianStudio/helm/commit/e35c63efac785fb1b5fa1c31643f1a3df1b143d4)) * add external secret support to deployment ([363ee02](https://github.com/LerianStudio/helm/commit/363ee020e997e8da492cfb284b10d33c08ab780a)) * add external secret support to worker job ([58809e1](https://github.com/LerianStudio/helm/commit/58809e1efded5775234e5bdc3018d3584694a7df)) * add external secret support to worker values file ([4e62d4f](https://github.com/LerianStudio/helm/commit/4e62d4fb02c8f17009f40e6f2d04d837d404feec)) * **scripts:** add fallback to root image.tag in chart version update script ([4fdcb77](https://github.com/LerianStudio/helm/commit/4fdcb77603969e24faab5a82527abddcb2517534)) * **plugin-fees:** add fees ui env var ([c1e52e1](https://github.com/LerianStudio/helm/commit/c1e52e1e525d168adce6be38a70470facaf18590)) * **fetcher:** add fetcher helm chart with manager and worker components ([363c0cf](https://github.com/LerianStudio/helm/commit/363c0cfd5b7c0049be06358ab34e8e4619897a98)) * **doc:** add general readme and moving midaz readme ([41f11fe](https://github.com/LerianStudio/helm/commit/41f11fe167c213be99413d4b0b82a9becbe482f6)) * add gpg key and clean file ([81630ce](https://github.com/LerianStudio/helm/commit/81630ce857b0e00600b63d602c3dec4df45eab61)) * add gRPC port configuration for transaction service ([1f9f761](https://github.com/LerianStudio/helm/commit/1f9f7612cf82f8dd2803c00d665f461fc13c2e12)) * add gRPC port to transaction service ([30351b9](https://github.com/LerianStudio/helm/commit/30351b9dc6622ed4ab3ac1010c777d518537c999)) * **plugins:** add Helm chart for BC Correios plugin ([81bc419](https://github.com/LerianStudio/helm/commit/81bc41948bc410bf1952ab23081e2d205bf1f51f)) * add helm chart for BR PIX direct JD plugin with PostgreSQL dependency ([0adcba2](https://github.com/LerianStudio/helm/commit/0adcba27ed3fd6158b4632d3223f4a2f211545fb)) * add Helm chart for plugin-br-bank-transfer-jd ([2ee97b9](https://github.com/LerianStudio/helm/commit/2ee97b9986a7fc2821c3c3935e34eb183f02daf8)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **plugin-br-payments:** add helm chart ([85cfe2a](https://github.com/LerianStudio/helm/commit/85cfe2a00eb299bc252b6fe6c496c4166d5cd390)) * **plugin-br-pix-switch:** add helm chart ([8977d4b](https://github.com/LerianStudio/helm/commit/8977d4b73d6f9d3df64153b89f976279e7a3a43d)) * add helm hook weights and delete policies for postgres and rabbitmq resources ([1bb5bf8](https://github.com/LerianStudio/helm/commit/1bb5bf8e3a02b547123d9e0a395163adca958729)) * add Helm hooks to onboarding and transaction ConfigMaps for pre-install/upgrade ordering ([a163833](https://github.com/LerianStudio/helm/commit/a163833ccd5c476f2a624252cea0169780fd55fd)) * add helm-compose config and karpenter node ([9a52467](https://github.com/LerianStudio/helm/commit/9a52467339718fd820e76355e97113cb6104fc2c)) * **plugin-br-pix-indirect-btg:** add HMAC validation and mTLS BTG config envs ([d1563c4](https://github.com/LerianStudio/helm/commit/d1563c48a40a1ef1dc9e8fd387203dc91c188261)) * add IAM Roles Anywhere sidecar support for fetcher and matcher ([a67b756](https://github.com/LerianStudio/helm/commit/a67b756fed6c39b62dfacda1f2ae34fecbd2b12e)) * **plugin-fees:** add IAM Roles Anywhere sidecar support ([d9621a1](https://github.com/LerianStudio/helm/commit/d9621a1da9d48355713f8d53ee881e01f8350143)) * **reporter:** add IAM Roles Anywhere sidecar support ([2b76810](https://github.com/LerianStudio/helm/commit/2b7681083e0bd731d3fc2e8605b1c0a02a3cc975)) * add imagePullSecrets and resource limits to nginx deployment ([73edcda](https://github.com/LerianStudio/helm/commit/73edcda18eb3f27c3c62ade6db7f353e8fdaa78c)) * **plugin-br-pix-switch:** add in-cluster sibling URL defaults ([c1f7b8f](https://github.com/LerianStudio/helm/commit/c1f7b8fdc42bae4bb588987df29a5e32a3969712)) * add index to semantic-release versioning ([4c98cf1](https://github.com/LerianStudio/helm/commit/4c98cf120e280bcdb252fed83aab285f1fa0f5e8)) * add index to semantic-release versioning ([af4c306](https://github.com/LerianStudio/helm/commit/af4c306d8e6ece405b451407c941eb1bf4eff5bd)) * add ingress template ([44b73b2](https://github.com/LerianStudio/helm/commit/44b73b2e3d2330af536435194930132e65d2ecc2)) * **ingress:** add ingress templates ([020369a](https://github.com/LerianStudio/helm/commit/020369a13b9696eb2e6e12c389ed211d2feb95f1)) * **ingress:** add ingress templates ([816fcee](https://github.com/LerianStudio/helm/commit/816fcee9d905744bcd47003fb16b974104c2d2d3)) * add init container in casdoor to check if the database is ready ([#48](https://github.com/LerianStudio/helm/issues/48)) ([8337771](https://github.com/LerianStudio/helm/commit/833777165ff6ed1d4183cc48757acd2d8b7ddd83)) * add initial helm chart for BR Pix Direct JD plugin ([2f097d0](https://github.com/LerianStudio/helm/commit/2f097d0f713783cf599888c880fc82fa6eec0ea3)) * **underwriter:** add initial Helm chart for Underwriter service ([7bbba1a](https://github.com/LerianStudio/helm/commit/7bbba1afcb883a261ef121710a9f5d0a854326ff)) * **plugin-br-pix-indirect-btg:** add INTERNAL_WEBHOOK_SECRET and bump to 1.0.0-rc.26 ([e5ef789](https://github.com/LerianStudio/helm/commit/e5ef7890094698e5bd5faceacc1e56746e0f2305)) * **dependencies:** add job to apply default definitions to external rabbitmq host ([c91db90](https://github.com/LerianStudio/helm/commit/c91db90f8311960f818d7f0b0046bc9eda1a4e6b)) * add Kubernetes manifests for PIX QR code service deployment ([8b1881f](https://github.com/LerianStudio/helm/commit/8b1881f157b140d02bed50cd6d7e70e67b074cb1)) * add Kubernetes manifests for plugin-br-pix-direct-jd job deployment ([9b67a67](https://github.com/LerianStudio/helm/commit/9b67a67fd073657a1c1dd7751288275fe24619d0)) * **midaz:** add ledger service configuration and restructure values files ([d4332f9](https://github.com/LerianStudio/helm/commit/d4332f9a122f4cf9045f76c8ce1e76dd080beda6)) * **midaz:** add ledger service with unified API and migration helpers ([0ee6e83](https://github.com/LerianStudio/helm/commit/0ee6e83a4a04e185585e7391f9ff7271ef8546b1)) * **doc:** add lerian banner ([35b904a](https://github.com/LerianStudio/helm/commit/35b904afb9d910e51b1508693aa7c3ce06ea9a75)) * add logical replication slot and improve SQL formatting ([ec2cfee](https://github.com/LerianStudio/helm/commit/ec2cfee6dab3fc571fb74e7e662c08000836a893)) * **plugin-fees:** add M2M and AWS_REGION env vars to chart ([f026d18](https://github.com/LerianStudio/helm/commit/f026d18e6b053f778b26d24dc1932a91f8c689d5)) * **fetcher:** add manager component Kubernetes manifests with full deployment configuration ([12ec0dd](https://github.com/LerianStudio/helm/commit/12ec0ddca52e9046324204ec7b717b87296e434b)) * **matcher:** add matcher helm chart ([6a235c1](https://github.com/LerianStudio/helm/commit/6a235c1fde13dc7ae70b3e719ed9b7dab4e3bb28)) * **matcher:** add missing env vars for matcher v1.0.0+ ([0bf1e7f](https://github.com/LerianStudio/helm/commit/0bf1e7f71c9dbb9ffea852f369def1d61ebfffac)) * **plugin-br-pix-indirect-btg:** add missing inbound webhook entity envs and security tier config ([ca62f49](https://github.com/LerianStudio/helm/commit/ca62f49564f7bf5c543028ec639870a762410605)) * **charts:** add missing NEU app env vars to reporter and fetcher ([8d4db13](https://github.com/LerianStudio/helm/commit/8d4db13cd6f1c1ebda31797c799b6d2ecebc7e5c)) * **product-console:** add MONGO_PARAMETERS env var for TLS/auth options ([164468c](https://github.com/LerianStudio/helm/commit/164468c7bbe92e069a3d4d25bd05eef17f8827c6)) * **plugin-br-pix-switch:** add mongodb + rabbitmq subchart dependencies ([0e9b3d4](https://github.com/LerianStudio/helm/commit/0e9b3d42d6cadd7e93d1ebd7e3d353d58c57f2cf)) * **console:** add mongodb environments ([256757e](https://github.com/LerianStudio/helm/commit/256757eb38cff41510d114572f4d18d92569fd6f)) * **console:** add mongodb environments ([88db3ba](https://github.com/LerianStudio/helm/commit/88db3bad7e8f2ec4fe5056980cbb7e41cdd02c38)) * **console:** add mongodb environments ([7c86ca0](https://github.com/LerianStudio/helm/commit/7c86ca00a65680a99b642d976ac36578c39c31f9)) * **console:** add mongodb port ([73ec8e2](https://github.com/LerianStudio/helm/commit/73ec8e27a619c333a6f2cfe60fcc0c8d49fd8295)) * **plugin-fees:** add MULTI_TENANT_ALLOW_INSECURE_HTTP to configmap template ([48cf209](https://github.com/LerianStudio/helm/commit/48cf20922c92bf3ece54122be84251913497c9a4)) * **plugin-fees:** add multi-tenant support and fix AVP secret rendering ([#1229](https://github.com/LerianStudio/helm/issues/1229)) ([04e12ac](https://github.com/LerianStudio/helm/commit/04e12acc2a1f0188fe78b227896880aa8f60bd28)) * **flowker:** add multi-tenant support and missing env vars ([9892b7d](https://github.com/LerianStudio/helm/commit/9892b7d9635f3b29d1159eccc60e5fd891d2badc)) * **tracer:** add multi-tenant support to chart (2.1.0-beta.1) ([a4c4a7e](https://github.com/LerianStudio/helm/commit/a4c4a7e62e71016696b0fc166eee66df2c76d61e)) * **console:** add new console env vars ([cf974b8](https://github.com/LerianStudio/helm/commit/cf974b8d696f9eb89e951fd144632d0e5817291f)) * **plugin-fees:** add new env vars for v3.1.0 ([f824431](https://github.com/LerianStudio/helm/commit/f8244314c78d1bfc76a3a83dce58e5e29d330b17)), closes [#1195](https://github.com/LerianStudio/helm/issues/1195) * **console:** add new env vars ([a228e39](https://github.com/LerianStudio/helm/commit/a228e39c856f9f4b561d55949edcaa051d5b9af9)) * **console:** add new env vars ([8b8d76f](https://github.com/LerianStudio/helm/commit/8b8d76f525a96f36c1d694c65db51ed7280a68a5)) * **dependencies:** add new parameters to chart file ([#44](https://github.com/LerianStudio/helm/issues/44)) ([4796070](https://github.com/LerianStudio/helm/commit/4796070cb5ad4c32d28bbb7ffc085b5fb3aeb495)) * **doc:** add new version ([39c0a71](https://github.com/LerianStudio/helm/commit/39c0a71dacbe9c80aa095a580c5d42d153b0947b)) * **doc:** add new version ([f864ad2](https://github.com/LerianStudio/helm/commit/f864ad20353a26f7dbe525332ef3b54f6af6fb74)) * add nginx configuration templates ([5755baa](https://github.com/LerianStudio/helm/commit/5755baaef5a346db79dfb78c7638b74c928c442f)) * add nginx dependence for midaz-console ([baa0cd4](https://github.com/LerianStudio/helm/commit/baa0cd4e4a209c520a2cb8e7de67c154f8a39e24)) * **midaz:** add nginx paramters to midaz-console ([84ff310](https://github.com/LerianStudio/helm/commit/84ff3103d5cd01da01c64c15eec4a83c5df66f17)) * **fetcher:** add OpenTelemetry HOST_IP injection support ([0ea3d75](https://github.com/LerianStudio/helm/commit/0ea3d7570288ab2e6e99a8f81564b031e11af626)) * add option to use existing secrets in helm chart ([f810082](https://github.com/LerianStudio/helm/commit/f810082fe8ce19eb69823f12b92345e418bb68d8)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * add plugin crm ui values ([493e4eb](https://github.com/LerianStudio/helm/commit/493e4eba4bf4457bbd75cf21334d33f16267b833)) * add plugin crm ui values ([c31de8d](https://github.com/LerianStudio/helm/commit/c31de8d30aedca6c9b4cc91b096c1e76a92a1a35)) * add plugin fees ui templates ([3451909](https://github.com/LerianStudio/helm/commit/345190944d3648c0ebae6e47890967cfefcc7e49)) * add plugin to semantic-release ([4ec01d8](https://github.com/LerianStudio/helm/commit/4ec01d8aceef35145239ae5b513977531798b329)) * add plugin to semantic-release ([d102c52](https://github.com/LerianStudio/helm/commit/d102c52039f5c1262f9dc00eb07728d226e656ef)) * add plugin to semantic-release ([a26017e](https://github.com/LerianStudio/helm/commit/a26017e363c87530e30e96e9b5fdc2581c19bb49)) * add plugin to semantic-release ([b001de0](https://github.com/LerianStudio/helm/commit/b001de0f2fad2b2b1cf05b5c0db9f48aa1af5265)) * add plugin to semantic-release ([f786586](https://github.com/LerianStudio/helm/commit/f7865866e41aad38bdf343e45fce351fa2af2a9b)) * add plugin to semantic-release ([13f0af3](https://github.com/LerianStudio/helm/commit/13f0af38e59cf9fb7a3596293a83dd3e6b9757a0)) * add postgres definitions and update security settings for console deployment ([6371b55](https://github.com/LerianStudio/helm/commit/6371b5568b94bc8f6fe57817132dee4644870ef3)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](https://github.com/LerianStudio/helm/commit/f6e469519784f6f301929066c55a152698e16d77)) * add pre-install and pre-upgrade hooks to onboarding and transaction secrets ([8199e92](https://github.com/LerianStudio/helm/commit/8199e92a9904adfc89adc6acf65a367d6c42b7e7)) * **product-console:** add product-console helm chart ([c956078](https://github.com/LerianStudio/helm/commit/c956078bd0959c13f42a018aa52b80862781b11d)) * **fetcher:** add RabbitMQ bootstrap job with definitions for external RabbitMQ instances ([90c5edc](https://github.com/LerianStudio/helm/commit/90c5edc90b4798ed0d31e56ca9479095889a521e)) * add RabbitMQ consumer credentials configuration in values-template ([da5c625](https://github.com/LerianStudio/helm/commit/da5c6255dfc8a2a671f9dfb88bb511d0536ddd6e)) * add rate limit configuration to midaz, fetcher, and reporter charts ([db2ec46](https://github.com/LerianStudio/helm/commit/db2ec461f6df0cc003cfe05fe4dd33df08d27d4e)) * add RBAC and nginx restart capability to service discovery job ([236e62f](https://github.com/LerianStudio/helm/commit/236e62f776e356b716fbd3059c37377cdbd154b6)) * **pipe:** add release step for ghcr ([f0e4f3f](https://github.com/LerianStudio/helm/commit/f0e4f3f5221b392bb68b2a5f87aa85facc5cfbee)) * **plugin-br-pix-indirect-btg:** add required validation for INTERNAL_WEBHOOK_SECRET ([df410e2](https://github.com/LerianStudio/helm/commit/df410e2d27b21a724447b44d50f9faaed7796be6)) * **plugin-fees:** Add SA template Fees ([14af5bd](https://github.com/LerianStudio/helm/commit/14af5bdd8e0cb45747c5d23797ed10ac6f4a96a3)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **console:** add secrets ([ad89e3b](https://github.com/LerianStudio/helm/commit/ad89e3ba7bd1713686bc0546be1e6b11341b10da)) * add security context and service account to nginx deployment ([3eaa99e](https://github.com/LerianStudio/helm/commit/3eaa99e8ecf17e3992e0c952699c2c111cf3aac3)) * **chart:** add security context to plugin identity ([47b48fc](https://github.com/LerianStudio/helm/commit/47b48fc9ec49f706519fceb4a7007c0179f62317)) * **pipe:** Add semantic changelog ([8c65e59](https://github.com/LerianStudio/helm/commit/8c65e5970101edc9ac621ec30b783bbc4fc3225c)) * **pipe:** Add semantic changelog ([452b6e7](https://github.com/LerianStudio/helm/commit/452b6e78b97a10aa4cd94daf5c95cd1545dc8222)) * **pipe:** Add semantic changelog ([c54115e](https://github.com/LerianStudio/helm/commit/c54115ebf8bd43a0dc8d41233d1100ac136ba8c3)) * **pipe:** Add semantic changelog ([d9befbb](https://github.com/LerianStudio/helm/commit/d9befbb65561716987a9825587f5ac0c9b63be3b)) * **ci:** Add Semantic Release changelog ([6537310](https://github.com/LerianStudio/helm/commit/6537310682b459b7f9fd48ed3c18dd739a816b0f)) * add service discovery job to plugins ui ([2bdaf78](https://github.com/LerianStudio/helm/commit/2bdaf789279b7cbefef51dbc4ad4db219325df73)) * **reporter:** add ServiceAccount annotations support for IRSA ([3685103](https://github.com/LerianStudio/helm/commit/3685103f9547e595667f85a9267272e337f3b077)) * **fetcher:** add ServiceAccount support for worker ([aa616c7](https://github.com/LerianStudio/helm/commit/aa616c7e00827621e525f75e3eb23c44fa2c9993)) * add step to update gh-pages ([bd762c7](https://github.com/LerianStudio/helm/commit/bd762c72ead853758a349d52913a63b45ed40a5c)) * add step to update gh-pages ([ddffd1b](https://github.com/LerianStudio/helm/commit/ddffd1b3dfbd179e26958361965f93a62273af07)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **midaz:** add support to external screts ([ab13b87](https://github.com/LerianStudio/helm/commit/ab13b878fdf8c280dc9e95cf015a459ce8b1edc6)) * **tracer:** add tracer helm chart ([275c30e](https://github.com/LerianStudio/helm/commit/275c30e44dcc66052cfc459e997dd0618e5ca766)) * add transaction gRPC configuration and update service versions ([cb48384](https://github.com/LerianStudio/helm/commit/cb4838437068d4e616c864c7cd37340399c0f504)) * **midaz:** add user consumer config to rabbitmq ([fb28359](https://github.com/LerianStudio/helm/commit/fb28359f8a4634317aeebd56e40af1a9083eb857)) * **plugin-br-pix-indirect-btg:** add validation to ensure INTERNAL_WEBHOOK_SECRET matches ([0f485b2](https://github.com/LerianStudio/helm/commit/0f485b225b9b5cd23e01e6154770550df8a69043)) * **plugin-smart-templates:** add valkey to smart templates chart ([709876b](https://github.com/LerianStudio/helm/commit/709876bb3b4d9c61a301d554f2f093615ad91084)) * add values template file ([7252f36](https://github.com/LerianStudio/helm/commit/7252f36fe7070fe18675073c21bb9269443270e8)) * **matcher:** add values-template and rabbitmq definitions ([3063245](https://github.com/LerianStudio/helm/commit/30632451da1ae248b1eeaf1dce680411b075f334)) * **matcher:** add VERSION env var and OTEL support ([cee8f96](https://github.com/LerianStudio/helm/commit/cee8f9682f769b77f6d2a5d52964b53dc92f9253)) * **plugin-br-pix-switch:** add wait-for-dependencies init container ([281226e](https://github.com/LerianStudio/helm/commit/281226e570ce08ce0ba412525986cb0766df77a2)) * **fetcher:** add worker component Kubernetes manifests with deployment, configmap and secrets ([fd8d8f3](https://github.com/LerianStudio/helm/commit/fd8d8f325262e945ed1e738efea2558e5ce9e2c6)) * add worker reconciliation config ([596c5a9](https://github.com/LerianStudio/helm/commit/596c5a91ed1fd498a7efc964f65cad94cc6b47c8)) * **console:** adds new env vars ([473cf5a](https://github.com/LerianStudio/helm/commit/473cf5a8d681e42c9ad8318b42b08dbea1e3e045)) * ajuste utilização recursos console ([44c7e64](https://github.com/LerianStudio/helm/commit/44c7e641170ad5e9b0a3629971c2cdc731059928)) * allow custom nginx configmap names and update plugins.conf path to snippets directory ([fe69b7b](https://github.com/LerianStudio/helm/commit/fe69b7b26b86c85a8d916afae4c9c9b009d8ba0d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **plugin-br-pix-switch:** auto-derive OTEL service version + node-IP OTLP endpoint ([15e6196](https://github.com/LerianStudio/helm/commit/15e6196cf549401084b7c6a1d7afd55c13f194b5)) * **reporter,fetcher:** auto-set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image tag ([bcc28f1](https://github.com/LerianStudio/helm/commit/bcc28f1bdc02b51347e677a8d26ac5ab7d7c40b6)) * **plugin-br-pix-switch:** auto-wire URLs to in-cluster subcharts ([561b398](https://github.com/LerianStudio/helm/commit/561b39871e2a17028eb56b9f3c0490ee74c5df43)) * **plugin-access-manager:** bump auth version ([12d5453](https://github.com/LerianStudio/helm/commit/12d54531235c76ccb25de1e976336505a0c51c91)) * **plugin-access-manager:** bump auth version ([10b5e4c](https://github.com/LerianStudio/helm/commit/10b5e4c9d7cc99ed93ff254b3e5c2632df25b9c6)) * **plugin-access-manager:** bump auth version ([90c6906](https://github.com/LerianStudio/helm/commit/90c6906ac94512dc14308f871aa4ed82717de49d)) * **midaz:** bump chart version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable ([bb157a4](https://github.com/LerianStudio/helm/commit/bb157a4472446033b94ab96837433e4df160555f)) * casdoor bump version ([bf5e28c](https://github.com/LerianStudio/helm/commit/bf5e28c0d3a259c192e94023fe1701bcca3d4fe4)) * **midaz:** config internal collector in midaz ([07d310e](https://github.com/LerianStudio/helm/commit/07d310ef840b1b95f86b6bdf1f75eba1a7e5b64a)) * **midaz:** config internal collector in midaz ([fb7d829](https://github.com/LerianStudio/helm/commit/fb7d8290ad20cb4e92ccd7eea19c07bb46b46bc7)) * **chart:** configure pdb to auth backend ([112bc47](https://github.com/LerianStudio/helm/commit/112bc47d72db94b57e81138297d973cb31d4ddf6)) * **helm:** create chart file to plugin crm ([69b01c8](https://github.com/LerianStudio/helm/commit/69b01c868752eb91973e2d292eb2e7ffaa57c1e0)) * **helm:** create chart file to plugin-fees ([38a0e81](https://github.com/LerianStudio/helm/commit/38a0e81c29d53bb81bb1895869b058942bc1d116)) * create chart midaz opensource ([afeadcf](https://github.com/LerianStudio/helm/commit/afeadcf46aef60af8b74055695a55fc00131f029)) * **helm:** create chart templates to plugin crm ([777ea2f](https://github.com/LerianStudio/helm/commit/777ea2fa1582d1530fbc4946c4ef184ae90598e9)) * **chart:** create chart templates to plugin-fees ([adabbaa](https://github.com/LerianStudio/helm/commit/adabbaaf405b471b111abe208408fce9c0772e99)) * **chart:** create chart templates to plugin-fees ([303caf0](https://github.com/LerianStudio/helm/commit/303caf06a48ff63e20fcdd13fd2c5d0629aae33c)) * **helm:** create doc to plugin crm ([4cbaa9d](https://github.com/LerianStudio/helm/commit/4cbaa9d4e8377260508c5687f292cfec8dbeee36)) * **plugin-smart-templates:** create functions to plugin-smart-templates ui ([d660619](https://github.com/LerianStudio/helm/commit/d6606192c1c6f0c0bd404e3b44c660079ce653b9)) * **plugin-smart-templates:** create helm templates to plugin-smart-templates ui ([a06f9c0](https://github.com/LerianStudio/helm/commit/a06f9c06c2d89de0a7f8ce6ba845057a8af3c268)) * **dependencies:** create init config file ([bddd6f0](https://github.com/LerianStudio/helm/commit/bddd6f025782740e3fc021ae4d7e64c0e78fd580)) * **dependencies:** create init sql file ([dcca103](https://github.com/LerianStudio/helm/commit/dcca103dcf229a307833685ad04711f662099219)) * **midaz:** create internal collector helm chart ([d17a5a4](https://github.com/LerianStudio/helm/commit/d17a5a45388428c30fa2133a58e275d445b634c7)) * **dependencies:** create job to apply migrations in casdoor db ([5a74bcc](https://github.com/LerianStudio/helm/commit/5a74bcc6ca8691159c4a3d11826a5afb34909e49)) * **values:** create pdb definitions ([fe34974](https://github.com/LerianStudio/helm/commit/fe34974aaa497979e0d13b610b77b4d1d7895f2f)) * **console:** create pdb template ([102c56a](https://github.com/LerianStudio/helm/commit/102c56a6e697623317585b8808f09f3cb7458882)) * **onboarding:** create pdb template ([8bc0d48](https://github.com/LerianStudio/helm/commit/8bc0d489407c8c5181a20f2c731e5abc7946b8b6)) * **transaction:** create pdb template ([738f5d3](https://github.com/LerianStudio/helm/commit/738f5d3ff33cc62f155186af1514340fa3133503)) * **chart:** create plugin access manager auth templates ([2fdd9ac](https://github.com/LerianStudio/helm/commit/2fdd9ac466966c5557757afae07a52f9894240fd)) * **chart:** create plugin access manager chart file ([094eecc](https://github.com/LerianStudio/helm/commit/094eeccff09029260104c7428a254c25260d20d6)) * **chart:** create plugin access manager identity templates ([c52068d](https://github.com/LerianStudio/helm/commit/c52068d228e3a79bbf4904e9823fb29407694add)) * **chart:** create plugin access manager templates ([c4221ad](https://github.com/LerianStudio/helm/commit/c4221adf91b52acc3c590d9d7b1f8db314f01d88)) * **values:** create plugin access manager values file ([b1727d0](https://github.com/LerianStudio/helm/commit/b1727d0f162fb1c464b35559f5684740a5af819e)) * create plugin fees ui functions ([0d2c127](https://github.com/LerianStudio/helm/commit/0d2c127d3d4f1aed530a864937e4e0e5fe7c8332)) * **plugin-smart-templates:** create secret to plugin-smart-templates ui ([552d061](https://github.com/LerianStudio/helm/commit/552d06115d589ceb41ac5d201fe972e82fc4c588)) * **plugin-smart-templates:** create values defintions to plugin-smart-templates ui ([48a25ca](https://github.com/LerianStudio/helm/commit/48a25ca3f4d889ba827a3674a284a563dbcbb105)) * **helm:** create values file to plugin crm ([de6b154](https://github.com/LerianStudio/helm/commit/de6b1547947f91d580a9ff5f7fb14c1e5efa4d0d)) * **values:** create values file to plugin-fees ([304f228](https://github.com/LerianStudio/helm/commit/304f22871b76180f4b299daa3ecaac06571ffd92)) * **values:** create values file to plugin-fees ([f383281](https://github.com/LerianStudio/helm/commit/f383281421b709744823d9de1bc053288ab6d747)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** default DEPLOYMENT_MODE to byoc (1.1.0-beta.3) ([aa12385](https://github.com/LerianStudio/helm/commit/aa12385a12d159121c021f53350ebac3f90b3668)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](https://github.com/LerianStudio/helm/commit/4946cb505bb4ee121910113c4ca78a74e8a97269)) * dependency update ([18bd991](https://github.com/LerianStudio/helm/commit/18bd9910348f05785a975b38d8b11068f1069407)) * dependency update ([b56d142](https://github.com/LerianStudio/helm/commit/b56d1421e7251dc932d4b025cc6be4be31ee3c42)) * dependency update ([55eb548](https://github.com/LerianStudio/helm/commit/55eb5489f192d16508b7ecfd93bddcf71aa42feb)) * **grafana:** disable grafana ([423a6f5](https://github.com/LerianStudio/helm/commit/423a6f5495c50c4ccae86c5391cb52841af300e8)) * **plugni-fees:** Disable SA create ([4074905](https://github.com/LerianStudio/helm/commit/4074905ddec1dec2c62eab214fdbff1b548ef329)) * **plugin-fees:** enable extra env vars to configmap template ([5f60cea](https://github.com/LerianStudio/helm/commit/5f60ceac653f34a021d0db1a10447113fb693005)) * **plugin-fees:** enable extra env vars to values yaml ([dc626a7](https://github.com/LerianStudio/helm/commit/dc626a7a5825e0afbd1d44c1f56594f3a97f14fe)) * **plugin-crm:** enable extra env vars ([5ea9e2f](https://github.com/LerianStudio/helm/commit/5ea9e2fc7cda9500fe728d4bf2cd877844b666a4)) * **plugin-smart-templates:** enable extra env vars ([c03007b](https://github.com/LerianStudio/helm/commit/c03007bf50902abd45c54d5bee3296450a13d50b)) * enable karpenter node ([02b029d](https://github.com/LerianStudio/helm/commit/02b029d1a18e462be5c5c11c5d0c5f0cceee6122)) * **midaz:** enable ledger service by default ([1abf1f1](https://github.com/LerianStudio/helm/commit/1abf1f1b1944583717002bd23d2fb72fae71a676)) * enable telemetry for onboarding and transaction services ([2497433](https://github.com/LerianStudio/helm/commit/2497433be24d42829985604f47cf983705c05f6e)) * **console:** enforce absolute DNS resolution ([8e519fe](https://github.com/LerianStudio/helm/commit/8e519fe25255119d50ecfef91ca8ab5a01df5f78)) * **onboarding:** enforce absolute DNS resolution ([c471521](https://github.com/LerianStudio/helm/commit/c471521eb53ce2e100f080247c2ff25bc1255650)) * **transaction:** enforce absolute DNS resolution ([1759a5b](https://github.com/LerianStudio/helm/commit/1759a5b1ce44339302482bd5ccabed5056c33a2f)) * **ci:** enforce single-source infra secrets ([3b787d5](https://github.com/LerianStudio/helm/commit/3b787d508ba556c21b036b41ff990245e7258427)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](https://github.com/LerianStudio/helm/commit/756a1f9c85d570a539866b54f070192d40cb2f59)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **midaz:** extend RBAC permissions for discovery service to access replicasets and list/watch deployments ([9285689](https://github.com/LerianStudio/helm/commit/9285689f5bbb1ae361741668834473809cb7c86b)) * **matcher:** finalize matcher helm chart for v1.0.0 ([2be45e9](https://github.com/LerianStudio/helm/commit/2be45e958cbc4fc001831c1f87b11a1aea472d15)) * **ci:** harden validator with collapse gate ([cc324ee](https://github.com/LerianStudio/helm/commit/cc324ee94663baa3228d6b4ed754cc09d0ac4fbf)) * helm doc ([#26](https://github.com/LerianStudio/helm/issues/26)) ([ccb3021](https://github.com/LerianStudio/helm/commit/ccb30211fbd9ab5b1ff5e3151f1f9361d25e3cff)) * improve Helm setup reliability in release workflow ([eb49cc3](https://github.com/LerianStudio/helm/commit/eb49cc348065b87027112371b4496080b25dd4e4)) * **midaz:** improve RabbitMQ bootstrap script with smart URL handling and enhanced logging ([8d99add](https://github.com/LerianStudio/helm/commit/8d99addbd1dec7b570ccdb9fc7f6add52564172d)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](https://github.com/LerianStudio/helm/commit/e67d89c3fffa8154989f6d71f65582331fba98d9)), closes [#138](https://github.com/LerianStudio/helm/issues/138) * **lerian-notification:** initial chart ([2a001d4](https://github.com/LerianStudio/helm/commit/2a001d4ba433a61cd3317929cc96045c42561bfd)) * **bootstrap-mongodb:** make app user and roles configurable via values ([5a37252](https://github.com/LerianStudio/helm/commit/5a37252bc760b70a50ad1814d5fb7955065f7400)) * **plugin-access-manager:** make createDatabase configurable ([1574601](https://github.com/LerianStudio/helm/commit/1574601cb8d8a8d2a8cdf9f360dc695f5f102bfb)) * midaz helm chart ([8768a8e](https://github.com/LerianStudio/helm/commit/8768a8e1f97dbe82d0cb96b899c3865e7b9c95c3)) * midaz helm chart ([94b2a6e](https://github.com/LerianStudio/helm/commit/94b2a6eab897bb6c1cd6f336fc9cf12f642ad697)) * **rabbitmq:** migrate from Bitnami chart to groundhog2k chart ([454c850](https://github.com/LerianStudio/helm/commit/454c850bb9bce3b24f62bea34cf65997a55fcf2b)) * **valkey:** migrate from StatefulSet to Deployment ([3854dfe](https://github.com/LerianStudio/helm/commit/3854dfe3430eaf7f4d99e39d032103eca4ff10fd)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-br-bank-transfer:** move CLIENT_IDs to secrets ([d3e36c0](https://github.com/LerianStudio/helm/commit/d3e36c03dce5f43305daf1c6da2da4f65a142f76)) * **pipe:** new pipe to deploy all charts ([20629f5](https://github.com/LerianStudio/helm/commit/20629f50ce386463a83ac0ebc0fce367430f04a0)) * **pipe:** new releaserc template ([24dc653](https://github.com/LerianStudio/helm/commit/24dc653adae4f036f7d5b9da044f42c43e9acd09)) * onboarding bump version ([4fc43e7](https://github.com/LerianStudio/helm/commit/4fc43e748f50fc4afd34e475a1c7d7360efaf3bc)) * onboarding rabbitmq protocol variable ([add46ac](https://github.com/LerianStudio/helm/commit/add46ac46bdcf1e629db5f92d4e129f550e93cfb)) * onboarding rabbitmq protocol variable ([01b91e6](https://github.com/LerianStudio/helm/commit/01b91e690ca469e58800047c055c872b90ab00d8)) * onboarding rabbitmq protocol variable ([9980d0c](https://github.com/LerianStudio/helm/commit/9980d0cd82b658b34d9244cc524630222f0cf61e)) * onboarding rabbitmq protocol variable ([3d44fa1](https://github.com/LerianStudio/helm/commit/3d44fa1c77b8442600f272497fd4fe79351aadf9)) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](https://github.com/LerianStudio/helm/commit/82dbb81fda6cb8611844cabdaff52b9cc65758b1)) * **charts:** parametrize probe path and timing for all charts using /readyz ([c4d15a2](https://github.com/LerianStudio/helm/commit/c4d15a20995b4edbcf11ce8576c1b80b5a05287d)) * **ci:** per-chart values.schema.json generator ([d295433](https://github.com/LerianStudio/helm/commit/d2954334953f15a1db0ee47064d5885bcec89f6b)) * **plugin-br-pix-switch:** per-component command/args for single-image multi-binary support ([d607978](https://github.com/LerianStudio/helm/commit/d607978e45aedec2137b0ecf5505529a08a254cd)) * **plugin-br-pix-switch:** per-component image repository defaults (1.1.0-beta.6) ([48b9d17](https://github.com/LerianStudio/helm/commit/48b9d17c3930e97c3d84355f6c56c39f739913b8)), closes [#137](https://github.com/LerianStudio/helm/issues/137) * plugin auth bump version ([f99a6fb](https://github.com/LerianStudio/helm/commit/f99a6fb0ad500f482703e87bb47ff5a87be857ff)) * plugin identity bump version ([d98f1b5](https://github.com/LerianStudio/helm/commit/d98f1b57ca9d5445651721904a16587d7689241d)) * **midaz:** plugins ui support to console ([17f2376](https://github.com/LerianStudio/helm/commit/17f23766c70f1e1784f7cb83fccff7f54fcd5333)) * **midaz:** plugins ui support to console ([7eced23](https://github.com/LerianStudio/helm/commit/7eced23afd42a256af0f28f308e814058b046f17)) * **midaz:** plugins ui support to console ([495afa4](https://github.com/LerianStudio/helm/commit/495afa420d2395027082a7b8b14fc7402512ede2)) * **midaz:** plugins ui support to console ([3b8ad93](https://github.com/LerianStudio/helm/commit/3b8ad93dfac6f20ab87a23f3c7e1e0eca853c252)) * **midaz:** plugins ui support to console ([3af6680](https://github.com/LerianStudio/helm/commit/3af668074fe67d2c6abf5a9a15dacb906d9200db)) * **midaz:** plugins ui support to console ([8303bad](https://github.com/LerianStudio/helm/commit/8303badc38db540dbbbb60ad0cf6384a3642ca50)) * **midaz:** plugins ui support to console ([d902801](https://github.com/LerianStudio/helm/commit/d90280110322bed7b0b54fd781320c361582ad36)) * postgres replication ([fa57f99](https://github.com/LerianStudio/helm/commit/fa57f99ed9d8dc8a157b776c65a02beb6f3453b4)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **plugin-br-pix-switch:** providersIngress for outbound-provider adapters (1.1.0-beta.8) ([061f8b9](https://github.com/LerianStudio/helm/commit/061f8b9ed0bc9ac7d94629980121a32022edc020)) * **plugin-br-pix-switch:** refactor chart to multi-component (1.1.0-beta.2) ([ea1ff08](https://github.com/LerianStudio/helm/commit/ea1ff08c41a4c3f6d94715977f9792d307d9ee1d)) * refactor plugin fees templates folder ([af27cba](https://github.com/LerianStudio/helm/commit/af27cbaaf3255ca7b4bb62acd7cbdc221b3ab2bb)) * **midaz:** remove console service and nginx components ([68be4ac](https://github.com/LerianStudio/helm/commit/68be4aca05f97e0a3bcdf35058dfccf8ee8e192a)) * **doc:** remove old components ([954dd09](https://github.com/LerianStudio/helm/commit/954dd097b1be74841efa6022a94d807e228c6ec4)) * **github:** remove pgbouncer reference ([49924e8](https://github.com/LerianStudio/helm/commit/49924e811d918e8ed136e878bb480da51096d98a)) * **pipe:** remove step commit history ([b0fd599](https://github.com/LerianStudio/helm/commit/b0fd5993ef1eecb84d34759552871d9f1447b7a3)) * **pipe:** remove step commit history ([e42b665](https://github.com/LerianStudio/helm/commit/e42b665d1bda4e9461e08b855e120fcb596c6521)) * **pipe:** remove step commit history ([ed1ec98](https://github.com/LerianStudio/helm/commit/ed1ec98c8132bd84ee4c344cd70ac9da355bf9af)) * **pipe:** remove step commit history ([b8b256d](https://github.com/LerianStudio/helm/commit/b8b256d997e838caea71ced0ed190e24aa73896a)) * **pipe:** remove step commit history ([a56f7c6](https://github.com/LerianStudio/helm/commit/a56f7c6027fe4e5c90f08231b2cab83e1dc4cc30)) * **pipe:** remove step commit history ([323b43a](https://github.com/LerianStudio/helm/commit/323b43aa1b8b73d103cdaba3b692d2bde73ff772)) * rename Smart Templates to Reporter and enhance RabbitMQ config ([1b1c269](https://github.com/LerianStudio/helm/commit/1b1c269a3e43625c48535e7d759dff9fb5b159f8)) * **plugins:** restructur plugins with frontend add support for external secrets and create guide to upgrade ([ea4a669](https://github.com/LerianStudio/helm/commit/ea4a66964a13c4331f7cdd4ade710fe29177a23f)) * **plugin-br-pix-switch:** schema migration Jobs (1.1.0-beta.9) ([8e88410](https://github.com/LerianStudio/helm/commit/8e884103cf1e251711f442cec4055d703626d561)), closes [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) * **plugin-br-pix-switch:** shared multi-path ingresses (1.2.0-beta.1) ([78c74f4](https://github.com/LerianStudio/helm/commit/78c74f4ef0129663ce13ae4e2155927b02140468)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **reporter:** support external KEDA operator ([0f19cbe](https://github.com/LerianStudio/helm/commit/0f19cbecb1208201f6413921a6726e89616a09b1)) * support external secrets for RabbitMQ admin credentials in Helm chart ([76fa832](https://github.com/LerianStudio/helm/commit/76fa832de626e9ad6c8d44fb366c75cdd900f55d)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](https://github.com/LerianStudio/helm/commit/86eb65124a2e4c5a5590908fe5b6365c825215e8)) * **tracer:** template ENV_NAME in configmap ([50a6f50](https://github.com/LerianStudio/helm/commit/50a6f501b24164485475f64529514293e1e83211)) * transaction bump version ([84028fb](https://github.com/LerianStudio/helm/commit/84028fb3c2be79e976ac9bea48707696db4f40c4)) * transaction rabbitmq protocol variable ([27e075c](https://github.com/LerianStudio/helm/commit/27e075c1b2762d6648ed26c666491c6c039dd0ae)) * transaction rabbitmq protocol variable ([f0f8334](https://github.com/LerianStudio/helm/commit/f0f8334ff61cbcdad9b434e08547dab328fbf2fa)) * transaction rabbitmq protocol variable ([60ff71f](https://github.com/LerianStudio/helm/commit/60ff71f7b07e90ecfdb8c55895225682b25c2694)) * transaction rabbitmq protocol variable ([7fdc26c](https://github.com/LerianStudio/helm/commit/7fdc26c4bcdf7a7ebffe8bc5aaa662964c9a7605)) * **chart:** update app version ([348b0cc](https://github.com/LerianStudio/helm/commit/348b0ccb5fea5042fe08da2af81cbd0b323a7aca)) * **chart:** update app version ([6f40285](https://github.com/LerianStudio/helm/commit/6f402851add6d9898c04e263d5706644645cacb2)) * **helm:** update app version ([fb2f841](https://github.com/LerianStudio/helm/commit/fb2f84162e5951495e2ab12296f6855edb09fce7)) * **midaz:** update app version ([e18a30b](https://github.com/LerianStudio/helm/commit/e18a30b59c5f33cb462d6ac4bdd8c675097f2d9d)) * **values:** update app version ([598ed6d](https://github.com/LerianStudio/helm/commit/598ed6d478240d26ee9baa9560d73db1912ba05d)) * **values:** update apps version and add backend config ([7cb17c2](https://github.com/LerianStudio/helm/commit/7cb17c2225d0863ee655b6ea5fc5532421ffa93d)) * **dependencies:** update auth backend init file ([be72215](https://github.com/LerianStudio/helm/commit/be72215937655d4adb136ae9802d68ade6a279b9)) * **chart:** update auth backend templates ([8659b67](https://github.com/LerianStudio/helm/commit/8659b6758e533c9a0922d481107ba59656d3f0a5)) * **chart:** update auth templates ([a6221e4](https://github.com/LerianStudio/helm/commit/a6221e4b89edec63f40b80bd31574588d9204a5b)) * **chart:** update auth templates ([c5bcb23](https://github.com/LerianStudio/helm/commit/c5bcb23959466580106b98f7e3312195f7f42f35)) * **values:** update auth version ([b549735](https://github.com/LerianStudio/helm/commit/b54973599235c3f52058e68dcd499c8c21c8dac7)) * **doc:** update charts documentation ([422e771](https://github.com/LerianStudio/helm/commit/422e7717a8f7c79d96f4cdd110421f0c68857d82)) * **doc:** update charts documentation ([b9618c4](https://github.com/LerianStudio/helm/commit/b9618c462cf3f0ad6b3f237347ffae01fc23cb09)) * **midaz:** update console configmap ([bf616a3](https://github.com/LerianStudio/helm/commit/bf616a3ee69f10ab2ffa21fce05ed92a21d10c6e)) * **console:** update console image ([0cf1135](https://github.com/LerianStudio/helm/commit/0cf11350d345410c751d99cf8c5347793219b469)) * **console:** update console image ([4da311d](https://github.com/LerianStudio/helm/commit/4da311d8968411a29d129ef02e133b3ddd0bb25e)) * **console:** update console version ([d789c7d](https://github.com/LerianStudio/helm/commit/d789c7dc7596e65c90c0e18072687b2ea828b295)) * **values:** update console version ([778eea0](https://github.com/LerianStudio/helm/commit/778eea0d86f62b9257f4f94892ef2b340df945da)) * **values:** update extra env vars for postgres ([9852143](https://github.com/LerianStudio/helm/commit/9852143eff1ca1bbc3e6c33660d80ec4bb337d6d)) * **fetcher:** update fetcher-manager@1.1.0, fetcher-worker@1.1.0 - new env vars ([345798a](https://github.com/LerianStudio/helm/commit/345798aca7179ec1b36958b22b4f702fe772ce9a)) * **fetcher:** update fetcher-manager@1.2.0, fetcher-worker@1.2.0 - new env vars ([47785ab](https://github.com/LerianStudio/helm/commit/47785abc7269481a7b2365b49589b5bd614d0f41)) * **fetcher:** update fetcher-manager@1.3.0, fetcher-worker@1.3.0 - new env vars ([679fd73](https://github.com/LerianStudio/helm/commit/679fd73b41b0019aa0c75c782adae169826f1053)) * **pipe:** update gitignore ([6ae09d6](https://github.com/LerianStudio/helm/commit/6ae09d68f21e21e5b93834017c0525511baaf94a)) * **chart:** update identity templates ([f8def52](https://github.com/LerianStudio/helm/commit/f8def529a453cf4c2db448df07ba167ff14d6c83)) * **values:** update identity version ([f8ee875](https://github.com/LerianStudio/helm/commit/f8ee875bb51ac52300d683e366f976aa903077b2)) * **product-console:** update image tag to 1.5.0 and add upgrade guide ([a289f8c](https://github.com/LerianStudio/helm/commit/a289f8c27b440f30174dac68339fe50d83d27679)) * **values:** update midaz version ([#36](https://github.com/LerianStudio/helm/issues/36)) ([af4b898](https://github.com/LerianStudio/helm/commit/af4b898e7ed4e431ab853320a3275b9d219630f7)) * **migrations:** update migration logic and enable migrations job ([643f703](https://github.com/LerianStudio/helm/commit/643f703aed35990cb8997a2df90f1fe2bacf9494)) * **midaz:** update onboarding configmap ([7a28f50](https://github.com/LerianStudio/helm/commit/7a28f50d694f2b527d51d201205d486ce8b2d3d5)) * **midaz:** update otel env var ([769a770](https://github.com/LerianStudio/helm/commit/769a77004aebb612aed5d81b9dec30624a003734)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.10, job@1.2.1-beta.10 - new env vars ([63ae72c](https://github.com/LerianStudio/helm/commit/63ae72c6add50c9e0fbeff1567bb018afe3ef553)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.11, job@1.2.1-beta.11 - new env vars ([3b07e6b](https://github.com/LerianStudio/helm/commit/3b07e6bd9b5c07c865599da7749bff593f593da8)) * **chart:** update plugin access manager values ([e4221eb](https://github.com/LerianStudio/helm/commit/e4221ebc5da46a51c5d71ef0755bba35e3313584)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.0, plugin-br-pix-indirect-btg-worker-inbound@1.5.0, plugin-br-pix-indirect-btg-worker-outbound@1.5.0 - new env vars ([80fe4fc](https://github.com/LerianStudio/helm/commit/80fe4fc55014cf24844c1e1626b213475d5419a3)) * **plugin-fees:** update plugin-fees@3.1.0 - new env vars ([0111ef7](https://github.com/LerianStudio/helm/commit/0111ef72746c78f97321c78b110ffb0e2ac68e61)) * **docs:** update rabbitmq documentation ([cae5467](https://github.com/LerianStudio/helm/commit/cae54677bcf8a2a26949ed341df9caea50cea762)) * **docs:** update readme file ([314da0e](https://github.com/LerianStudio/helm/commit/314da0e538e7534a79cbea9423d2d6b5c08c3a8e)) * **reporter:** update reporter-manager@1.2.0, reporter-worker@1.2.0 - new env vars ([624ec97](https://github.com/LerianStudio/helm/commit/624ec978ef73810b568c9a8a578d4f8635f998d2)) * **values:** update resources limits ([04ccb18](https://github.com/LerianStudio/helm/commit/04ccb184cd7393e5c1f60fa5945fd89d0b5289d2)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **midaz:** update transaction configmap ([be52752](https://github.com/LerianStudio/helm/commit/be5275243af5315dc64026f436460f345eb41e78)) * **midaz:** update transaction otel env var ([79717c5](https://github.com/LerianStudio/helm/commit/79717c5815e8c1f5a9e859cea47ef3553fe821df)) * **midaz:** update transaction otel env var ([927f39e](https://github.com/LerianStudio/helm/commit/927f39e5ab03e15460d28769bacb9fe1ac43d0ed)) * **plugin-crm:** update ui env vars ([9fab16d](https://github.com/LerianStudio/helm/commit/9fab16dbcbc80ccc55c0bc2c32e2d099facb6110)) * **midaz:** update values file ([98e396c](https://github.com/LerianStudio/helm/commit/98e396cb1a366691c8b0a3f32f697086583c99bf)) * **midaz:** update values file ([c0cbef1](https://github.com/LerianStudio/helm/commit/c0cbef16e5225e218a60d25d71496c2085250820)) * **values:** update values file ([db9b3db](https://github.com/LerianStudio/helm/commit/db9b3db3961bea039663a7dba0f548601e3c146b)) * **values:** update values file ([cc698a0](https://github.com/LerianStudio/helm/commit/cc698a0a76b24e97b4ff890605535e9ad128e886)) * **midaz:** update values template ([90f3133](https://github.com/LerianStudio/helm/commit/90f31338d4158ddaeca92ab47417b9ca8e7cf20b)) * **chart:** update version ([40d723d](https://github.com/LerianStudio/helm/commit/40d723d6159d78f2a198cdfa9c7c969d07219289)) * **chart:** update version ([22e2930](https://github.com/LerianStudio/helm/commit/22e2930ce80b8e33926bb6db7a5f70ca6faa4fa5)) * **chart:** update version ([8031ceb](https://github.com/LerianStudio/helm/commit/8031cebf57f599fda19f74224cd17a746bfe1e21)) * **chart:** update version ([a8af389](https://github.com/LerianStudio/helm/commit/a8af389aa9135313e2e534e4fd0af358a3b8fcf2)) * **chart:** update version ([412e782](https://github.com/LerianStudio/helm/commit/412e782cff316594cb5b6ea0410a7c5d66ebf6a1)) * **chart:** update version ([4a42b13](https://github.com/LerianStudio/helm/commit/4a42b1367e2ac41654210610641c44fcb7f8b463)) * upgrade app version to 3.3.0 and add SSL mode configs for database connections ([c9d334f](https://github.com/LerianStudio/helm/commit/c9d334f2354705719d3469d614317d6524fd9987)) * **lerian-notification:** use /migrate binary in migrations Job ([1696dd7](https://github.com/LerianStudio/helm/commit/1696dd7f1af6292d634a1e2a428eb2a69aeb6d86)), closes [LerianStudio/lerian-notification#40](https://github.com/LerianStudio/lerian-notification/issues/40) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) * values template file ([2f7c796](https://github.com/LerianStudio/helm/commit/2f7c79606290492be77d34dfbd6ec76e89334cbb)) * values template file ([54ba721](https://github.com/LerianStudio/helm/commit/54ba721da0981d80e2df95a008d22d0fb0b03fd8)) ### Bug Fixes * **release:** add branch check to release notification job to only run on main branch ([f2f8e02](https://github.com/LerianStudio/helm/commit/f2f8e02c5eacdc9ea06d1b5af6df99a73df589db)) * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **values:** add comments in values ([#43](https://github.com/LerianStudio/helm/issues/43)) ([03a5842](https://github.com/LerianStudio/helm/commit/03a5842787db8dc1b4d954038b36a343ad7180c1)) * **plugin-access-manager:** add configurable DB_SSLMODE for auth PostgreSQL connections ([dd1d626](https://github.com/LerianStudio/helm/commit/dd1d626766129b1459e768732e2f826d3ad96eac)) * **new:** add DEFAULT_MIDAZ_ORGANIZATION_ID to configmap for enhanced multi-tenancy support ([d7b66a0](https://github.com/LerianStudio/helm/commit/d7b66a052d47394096ecdc18809e7c2d4fffeed3)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([33adde3](https://github.com/LerianStudio/helm/commit/33adde3650e26f65c09643ba8b2fd669bd504adc)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([5f8ca7b](https://github.com/LerianStudio/helm/commit/5f8ca7b5abc6ca7c895af8c3ae1055907689c1d3)) * **product-console:** add image annotation for product-console 1.6.0 ([03c927c](https://github.com/LerianStudio/helm/commit/03c927c3029714c435534a4c72ca450bcdccbd08)) * add kindIs guard for backward compat with string image values ([313d9f6](https://github.com/LerianStudio/helm/commit/313d9f6b646cf3b3bb26cc2644063b16806c1847)) * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](https://github.com/LerianStudio/helm/commit/79ef8f5ea3d7bc2626972fcd4621b1e327c08aed)) * **matcher:** add missing env vars for systemplane and multi-tenant ([965da94](https://github.com/LerianStudio/helm/commit/965da94cdddb8c11654625e071e28c7a83193938)) * add missing MONGO_HOST/MONGO_PORT and align MONGODB_DB_NAME ([0725fa2](https://github.com/LerianStudio/helm/commit/0725fa2b26ed516c15ff1b5292b35581ff437de2)) * **midaz:** add missing MONGO_PARAMETERS to CRM configmap ([2bfecc2](https://github.com/LerianStudio/helm/commit/2bfecc220b7646c57b5e47f141cfb6e79469baec)) * add missing space in MIDAZ_CONSOLE_BASE_PATH template expression ([7b9bb67](https://github.com/LerianStudio/helm/commit/7b9bb677785cd1d381d1b8d497ee0a8bdc921c83)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](https://github.com/LerianStudio/helm/commit/d7765b455710ba5009a931493d351f88f735a1ce)) * **product-console:** add MongoDB connection info to NOTES.txt ([b4d6557](https://github.com/LerianStudio/helm/commit/b4d6557b5ccf5a93a70104bc5d5533171bc0147f)) * **product-console:** add mongodb.enabled flag to values-template ([7024d9d](https://github.com/LerianStudio/helm/commit/7024d9d0d47422b362b400b9494cfd440378122a)) * **configmap:** add new configuration options for deployment mode, private upstreams, and reconciliation settings ([f1a475e](https://github.com/LerianStudio/helm/commit/f1a475ea82bed1d9174193e58e271a5a730a5cc1)) * **plugin-access-manager:** add new configuration options for logging, rate limiting, and MFA in configmap.yaml ([d1e83b2](https://github.com/LerianStudio/helm/commit/d1e83b286a91b144bc44788a4fb457c4273b052f)) * **chart:** add new env var to enable auth plugin ([53b8ffb](https://github.com/LerianStudio/helm/commit/53b8ffb5ef5beaf77756b45e815b946b106c9320)) * add newline at end of values.yaml file ([044905f](https://github.com/LerianStudio/helm/commit/044905f48ff2d9fe8bd7f84770f34bebd700baf9)) * add plugin-br-bank-transfer-jd section to README version matrix ([ccd19ac](https://github.com/LerianStudio/helm/commit/ccd19acf8352c2e4a1390af297c61f0d63d7ae1e)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](https://github.com/LerianStudio/helm/commit/7ba4f9d8fede36092d0a7a60f08620f5ca3fd777)), closes [#1404](https://github.com/LerianStudio/helm/issues/1404) * **fetcher:** add RabbitMQ and storage configuration options, remove unused secret template ([865613d](https://github.com/LerianStudio/helm/commit/865613d1cf6264ee5b97e5e85d342e5f36043415)) * **plugin-br-pix-switch:** add RABBITMQ_URI to dict-hub-vsync configmap ([75074ae](https://github.com/LerianStudio/helm/commit/75074ae94521b346e0a0c167a166988d65084497)) * add required validation for Roles Anywhere ARNs and README migration note ([50e4718](https://github.com/LerianStudio/helm/commit/50e47186dee052e541566d65d2362c8fe175e5a5)), closes [#1](https://github.com/LerianStudio/helm/issues/1) [#3](https://github.com/LerianStudio/helm/issues/3) [#1113](https://github.com/LerianStudio/helm/issues/1113) * add trailing slash to default MIDAZ_ONBOARDING_URL in fees configmap ([fe394c5](https://github.com/LerianStudio/helm/commit/fe394c5e4fde1fb3cca5a5c7cc9a3019ac92cd5f)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **plugin-br-pix-indirect-btg:** add WEBHOOK_DEFAULT_URL to outbound configmap ([0dd6d81](https://github.com/LerianStudio/helm/commit/0dd6d81592f19d983e0ddfa75dbaf5e00b8fbd85)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * address CodeRabbit CLI review findings ([974bbb8](https://github.com/LerianStudio/helm/commit/974bbb85bee5549825b25a379042eeeaf3f79ba7)) * **plugin-br-pix-switch:** address CodeRabbit feedback on NOTES, README, configmap, and labeler ([78e4615](https://github.com/LerianStudio/helm/commit/78e4615949c5e9b7dabcc2f497d687deae7ccfe4)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **plugin-br-pix-indirect-btg:** address coderabbit review feedback ([bb664a9](https://github.com/LerianStudio/helm/commit/bb664a9eb52c4e2636397955b7bde365643e34db)) * **lerian-notification:** address CodeRabbit review on initial chart ([36c326f](https://github.com/LerianStudio/helm/commit/36c326fe1bbabd80112ef82cab3bb862fa0a18b1)), closes [#1332](https://github.com/LerianStudio/helm/issues/1332) * **product-console:** address CodeRabbit review on NOTES.txt ([e8cf8d7](https://github.com/LerianStudio/helm/commit/e8cf8d7157aedb39c4d58be3d88e6ac4a044391f)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **charts:** address CodeRabbit review on revamp PR [#1470](https://github.com/LerianStudio/helm/issues/1470) ([98288a5](https://github.com/LerianStudio/helm/commit/98288a5c6b09efe520675e9c4d605ddb4e8d71f0)), closes [#1](https://github.com/LerianStudio/helm/issues/1) * address CodeRabbit security and quality issues ([eb80852](https://github.com/LerianStudio/helm/commit/eb80852c7012443feebb00cb5d3cb1e6a2a80c2c)) * address remaining CodeRabbit review comments ([6f26a8b](https://github.com/LerianStudio/helm/commit/6f26a8b44643d9eaaa3957d1892f0f763d9da3c3)) * **pix-btg:** adjust default url ([51c4753](https://github.com/LerianStudio/helm/commit/51c4753e916e653ae44829792c8b47a9fc625efd)) * **midaz:** adjust ledger component port from 3000 to 3002 ([8e01518](https://github.com/LerianStudio/helm/commit/8e015184256566ca18c2973067fb8d48e8332fb5)) * **midaz:** adjust ledger component port from 3000 to 3002 ([bb58334](https://github.com/LerianStudio/helm/commit/bb583344a4ba4b59f114355eef6c4339b6d4b102)) * **midaz:** adjust midaz-crm repository image ([5f9fdcb](https://github.com/LerianStudio/helm/commit/5f9fdcb9733aa2b6d620a8d5b61ca7fc54036265)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **tracer:** align chart default port with source convention (2.0.0-beta.6) ([0f8683d](https://github.com/LerianStudio/helm/commit/0f8683dfacda22346b632511a0bfa92b4119f550)), closes [#193](https://github.com/LerianStudio/helm/issues/193) * **flowker:** align chart default port with source convention (2.1.0-beta.6) ([662ad6e](https://github.com/LerianStudio/helm/commit/662ad6e4a39aef852901dd2e1c861018e89fdfaa)), closes [#1308](https://github.com/LerianStudio/helm/issues/1308) * **underwriter:** align chart with app config + standardize VERSION ([9d9a875](https://github.com/LerianStudio/helm/commit/9d9a875ce000cd6136c36fd22967c24c743dbd3a)) * align comment with actual template keys per CodeRabbit review ([338e19c](https://github.com/LerianStudio/helm/commit/338e19ccf967d764ef4165818b585b4698d8e8a5)) * **matcher:** align default securityContext with distroless nonroot UID ([87f0c59](https://github.com/LerianStudio/helm/commit/87f0c59675607d596145d2caa99f96dfd09f1e35)) * **flowker:** align Mongo env vars with app source code ([fdeb22c](https://github.com/LerianStudio/helm/commit/fdeb22c6d2b98425b2c9fae436d4eb81d871eec3)) * align NextAuth URLs with reporter UI base URL ([8d5f4f7](https://github.com/LerianStudio/helm/commit/8d5f4f7e6a671872f6d8e3b95f60b119f89416e0)) * **matcher:** align OTEL env vars with app and bump to v1.0.0-beta.3 ([d1616fb](https://github.com/LerianStudio/helm/commit/d1616fb09bd3e80cce2bbd3e91930771f985ff75)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](https://github.com/LerianStudio/helm/commit/75ad0d4a418787d0d3e85ef8311ee822202e1a2e)) * always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image.tag ([56bfc66](https://github.com/LerianStudio/helm/commit/56bfc666dd2c8d8d83802f026f4ec6436bda8dc4)) * **plugin-br-pix-switch:** apply container securityContext, fix tolerations type, add NOTES defaults ([86b7f17](https://github.com/LerianStudio/helm/commit/86b7f1789c06a09a46d32f9cc2fddcbd560fa25d)) * **onboarding:** auth endpoint and remove old env var ([de370da](https://github.com/LerianStudio/helm/commit/de370daa57563a194d5273888587f0aa95262a0b)) * **transaction:** auth endpoint ([12d8f6d](https://github.com/LerianStudio/helm/commit/12d8f6d3c9d52bff108f220f297d0d4f1db6ca78)) * **values:** auth env vars ([23b34a1](https://github.com/LerianStudio/helm/commit/23b34a13ea547a1587d71689b30adfe02f580dc0)) * **plugin-br-pix-switch:** bootstrap Job fixes surfaced by live install test ([fc9e125](https://github.com/LerianStudio/helm/commit/fc9e12530d40da9dfc6cec51ba2afbd0e66bf9f0)) * bump chart and console versions to 4.4.3 and 3.4.3 ([1cb77cc](https://github.com/LerianStudio/helm/commit/1cb77cc00932d6302e3a71f9bd08253d85f2c3d0)) * **console:** bump image tag to 2.2.1 ([9dfde6e](https://github.com/LerianStudio/helm/commit/9dfde6ee7deb61ef67376dd84d3396845f88fe9f)) * bump plugin-fees chart to version 3.4.4 ([8aaed46](https://github.com/LerianStudio/helm/commit/8aaed46539f10d3879eb7563c1cfa63841d6ddb2)) * change Helm hooks from post-install to pre-install for Postgres and RabbitMQ initialization ([374ccbb](https://github.com/LerianStudio/helm/commit/374ccbb36160f5a614271f65c0a55cf79be568f1)) * chart ([81f1126](https://github.com/LerianStudio/helm/commit/81f112612a3327fffc69da8720b2222122df44a4)) * chart ([f6e6446](https://github.com/LerianStudio/helm/commit/f6e644662db2f641b0e71e3cccd518fa4fe715dc)) * chart app version ([4ae59b0](https://github.com/LerianStudio/helm/commit/4ae59b08085f19e6a20617782e5a3b28044c01f6)) * **tracer:** chart cleanup for 2.0.0-beta.5 ([b8767d5](https://github.com/LerianStudio/helm/commit/b8767d5853b9108a751590468dea17400815f906)) * chart name ([78ae357](https://github.com/LerianStudio/helm/commit/78ae357d208a2835174345b9179c596cf50a401b)) * chart name ([6db8350](https://github.com/LerianStudio/helm/commit/6db83502f0f75b59a5345c27eeade292b31078a9)) * chart name ([1f78da5](https://github.com/LerianStudio/helm/commit/1f78da504538d1a518f503e69b21b1696a893313)) * clean dead OTEL defaults and fix SWAGGER_HOST service names ([76909b8](https://github.com/LerianStudio/helm/commit/76909b801a697be8c28fb345d1f9de611be88bee)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](https://github.com/LerianStudio/helm/commit/5ff9c1d027c1079a972ea550e63d1417b8e3c34d)) * codeowners groups ([#23](https://github.com/LerianStudio/helm/issues/23)) ([b51ff0c](https://github.com/LerianStudio/helm/commit/b51ff0ce5f7d838c2f01565340d91a79cd9c772f)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](https://github.com/LerianStudio/helm/commit/fcaa3b46bf7c06be7c94b7d21bf61b728265bd9d)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](https://github.com/LerianStudio/helm/commit/14924af14cbb6299471ff1d52c0e3591892f13a6)), closes [#1470](https://github.com/LerianStudio/helm/issues/1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](https://github.com/LerianStudio/helm/commit/a3946586aa847615a7082a2c4583646926d53792)) * complete standardization of VERSION across all remaining charts ([63adbb9](https://github.com/LerianStudio/helm/commit/63adbb959f5ea18a22219d7f78d6422f4e9ffb38)) * **plugin-access-manager:** construct dataSourceName at runtime with environment variables ([ac4fd9f](https://github.com/LerianStudio/helm/commit/ac4fd9f94212fed2adbc7d5c6b17e9ad10e3b9cd)) * **plugin-br-pix-switch:** correct appVersion to 1.0.0-beta.1 and add to compatibility matrix ([85bd001](https://github.com/LerianStudio/helm/commit/85bd0015bd9aa7e1def72ed14f981e3a8d080c19)) * **bank-transfer:** correct encryption key env var names ([fb79deb](https://github.com/LerianStudio/helm/commit/fb79deb833c798f68b75e075f8cf6aa2146ad523)) * **flowker:** correct livenessProbe default path from /health/live to /health ([f588107](https://github.com/LerianStudio/helm/commit/f588107a6a543361ceb00d798c9479d1ad37cec3)) * **midaz:** correct RabbitMQ bootstrap secret key reference from RABBITMQ_TRANSACTION_PASS to RABBITMQ_DEFAULT_PASS ([f86aa98](https://github.com/LerianStudio/helm/commit/f86aa9826b425861d1614f01ffacb8f68726975f)) * correct RabbitMQ configuration path in transaction service ([eab6df2](https://github.com/LerianStudio/helm/commit/eab6df2eb2793166f7dc2a3455e562a399dcb096)) * **plugin-access-manager:** correct REDIS_PASSWORD reference in identity secrets ([2c6c323](https://github.com/LerianStudio/helm/commit/2c6c323da55401c0323e3023eb9f6958089bbe5e)) * **plugin-access-manager:** correct REDIS_PORT reference from au to identity in configmap ([aafd65a](https://github.com/LerianStudio/helm/commit/aafd65aebbe2b4d27724a02e969701a3a408621a)) * **fetcher:** correct repository URL in Chart.yaml home field ([378a458](https://github.com/LerianStudio/helm/commit/378a458596b151f37393f4292ef8badf88fc57b5)) * crm ui port ([35f387b](https://github.com/LerianStudio/helm/commit/35f387b6037c85963dc793229e6975ca5addc65c)) * **lerian-notification:** declare kubeVersion compatibility ([fd3067e](https://github.com/LerianStudio/helm/commit/fd3067e0a78ac2d207dc1c64f19f7fad5cdca8cc)) * **product-console:** derive MongoDB service name dynamically in NOTES.txt ([4bbf749](https://github.com/LerianStudio/helm/commit/4bbf749465bf0cbf6112ed3cc32653a0d3972480)) * **auth:** disable auth ingress ([4e08d7a](https://github.com/LerianStudio/helm/commit/4e08d7af33f67b9500b459a40ad93473cf82007f)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](https://github.com/LerianStudio/helm/commit/a38dca3beda61b5ad6a4b56c4712dc63ea3e1555)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](https://github.com/LerianStudio/helm/commit/734a38a07fdb6d694b373b52097502dd0aaae440)) * **midaz:** enable external service bootstrap jobs by default for RabbitMQ and PostgreSQL ([f65f8ff](https://github.com/LerianStudio/helm/commit/f65f8ff4f669f99d0eb55f32826dfb7e2891695d)) * **plugin-access-manager:** enable extra env vars to auth configmap template ([1be8107](https://github.com/LerianStudio/helm/commit/1be8107a59d8f0c5e9a12ceb4b70829dbc90b858)) * **plugin-access-manager:** enable extra env vars to auth ([a085323](https://github.com/LerianStudio/helm/commit/a085323623b5df8283e7583b9f03fefeb3202260)) * **plugin-access-manager:** enable extra env vars to identity configmap template ([01f1efe](https://github.com/LerianStudio/helm/commit/01f1efe5c64a1c8237722d1da80ee322e8e27067)) * **plugin-access-manager:** enable extra env vars to identity ([356b815](https://github.com/LerianStudio/helm/commit/356b8157cdcc1a503aa514f077142283e8ea9b21)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** fail loud on missing infra creds ([5bfc010](https://github.com/LerianStudio/helm/commit/5bfc01046118dc1df300b9c4640186c99a304bf8)) * fix ([8e3d5ad](https://github.com/LerianStudio/helm/commit/8e3d5ad6deff4dc6a84d7f0c343d5e605428686f)) * fix ([3ff9f64](https://github.com/LerianStudio/helm/commit/3ff9f645ed8119d28a4dc256848d27206a4d80ce)) * **audit:** fix audit configmap ([#41](https://github.com/LerianStudio/helm/issues/41)) ([429fdef](https://github.com/LerianStudio/helm/commit/429fdef691c87dc5b4a7e44c236b2550f548c20d)) * **values:** fix autoscaling parameters ([69585b6](https://github.com/LerianStudio/helm/commit/69585b6743736edad8d393c5e50eddc9e4ff114d)) * **matcher:** fix configmap archival condition and S3 endpoint for IAM Roles Anywhere ([53232ae](https://github.com/LerianStudio/helm/commit/53232ae6aec2f6fd8b1a4dba74edad8bf261056f)) * **transaction:** fix default value of rabbitmq secret ([71afd7a](https://github.com/LerianStudio/helm/commit/71afd7a7067ee4b1cf429669e4a44c58479af037)) * **doc:** fix midaz transaction container port ([bab48e6](https://github.com/LerianStudio/helm/commit/bab48e600b179abf07bbc207982803102ea1d704)) * **pipe:** fix pr title workflow ([#34](https://github.com/LerianStudio/helm/issues/34)) ([5134118](https://github.com/LerianStudio/helm/commit/51341186dfd7f643e3be1d598c51d3909748a3dd)) * **midaz:** fix rabbitmq job to apply default definition ([a1349ff](https://github.com/LerianStudio/helm/commit/a1349ff2891e3368d21d9b077fab46c448685356)) * **chart:** fix set secret ref to console deployment ([34b4885](https://github.com/LerianStudio/helm/commit/34b488597985e744a4108eda086a9e14eddac702)) * **transaction:** fix transaction container port ([cb4ec59](https://github.com/LerianStudio/helm/commit/cb4ec592c2c47036bee2b519d795ca08336904dc)) * **midaz:** fix transaction deployment template ([c269284](https://github.com/LerianStudio/helm/commit/c2692846f8f3a30f73c41da792ebf47595e067b1)) * **chart:** fix typo in environment variable name ([2f57d53](https://github.com/LerianStudio/helm/commit/2f57d53b1b47b8ef0829729a37d819949efd03c4)) * **plugin-br-pix-indirect-btg:** fix useExistingSecrets typo in all deployments ([fa2dc49](https://github.com/LerianStudio/helm/commit/fa2dc4964c8080f0825471be4a1a2a3889fa7833)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](https://github.com/LerianStudio/helm/commit/9ae56b40a5b127510b82256975682648e06bbaea)) * generate multiples CHANGELOG's ([3f60787](https://github.com/LerianStudio/helm/commit/3f607875b618db474e4055c44a2cffd8216f4261)) * **lerian-notification:** handle explicit maxUnavailable: null in PDB ([03ee596](https://github.com/LerianStudio/helm/commit/03ee596ecdba8da4e6727236b2785c2d14c0c1c5)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](https://github.com/LerianStudio/helm/issues/1467)) ([7c62a98](https://github.com/LerianStudio/helm/commit/7c62a98cabe072e32a717169317018a2af334e5c)) * helm chart ([9b6552f](https://github.com/LerianStudio/helm/commit/9b6552f37d039bb5187c92319bcc3787d1c4ddcc)) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **plugin-br-pix-indirect-btg:** improve reconciliation config and remove vault annotations ([ad64484](https://github.com/LerianStudio/helm/commit/ad64484db87788071ff7ade533a04754eed58347)) * **components:** init file for auth app ([4939e82](https://github.com/LerianStudio/helm/commit/4939e823f60cdbc0965281f496b058178bf70a00)) * job to apply rabbitmq definitions ([b959644](https://github.com/LerianStudio/helm/commit/b959644941d2f137fd6d766ff3cb6c022ac3354d)) * **plugin-br-pix-switch:** leave adapter-btg-mock ingress untouched ([7a1c827](https://github.com/LerianStudio/helm/commit/7a1c827984df9e31a819f18e05cb5de77aa32457)) * **plugin-br-pix-switch:** liveness probe path /live -> /health ([030af5f](https://github.com/LerianStudio/helm/commit/030af5fd92687e5980a6f2e3357493f037e56496)) * **components:** load definitions for rabbitmq ([167c80a](https://github.com/LerianStudio/helm/commit/167c80a8e156fb653e2e365f155c4c35e2785fca)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](https://github.com/LerianStudio/helm/issues/1465)) ([a39f2c6](https://github.com/LerianStudio/helm/commit/a39f2c652365001992fa259b8d7932f45d65ed8a)) * **plugin-br-pix-switch:** match probe template fallbacks to per-component routePrefix ([ee914d7](https://github.com/LerianStudio/helm/commit/ee914d78ef23df3d368a4465eef80f8641c21730)) * **midaz:** midaz console configmap ([5d8428c](https://github.com/LerianStudio/helm/commit/5d8428ce7fa7fd2678b18b1146bcadbb2fc4ced7)) * midaz nginx proxy config ([46d3af2](https://github.com/LerianStudio/helm/commit/46d3af2330ae02cf7298efc8275cf6e4ee309685)) * move MONGO_URI to secrets and support JD sandbox mode ([6d41468](https://github.com/LerianStudio/helm/commit/6d41468e7e14de2a61f99b90769b7b7643208d0d)) * **plugin-br-pix-switch:** namespace handling + global image tag override ([0fd1ef6](https://github.com/LerianStudio/helm/commit/0fd1ef681a03fabd2937ed48477ad9469ab95c70)) * **midaz:** nginx server definition ([b63b23a](https://github.com/LerianStudio/helm/commit/b63b23a5bf3292d2a36e8872bd3e3a3c257152c5)) * **midaz:** nginx server definition ([d4f18da](https://github.com/LerianStudio/helm/commit/d4f18dadfda3b4446df5cc5f094784decc247f9d)) * **midaz:** nginx server definitions ([9863437](https://github.com/LerianStudio/helm/commit/9863437a6a3d925edcf547ae801389cb9954c145)) * onboarding adjust default value of env var ([d274067](https://github.com/LerianStudio/helm/commit/d274067915c39400b9f920ef6af93f02bbc7d9d9)) * onboarding init container ([46284e5](https://github.com/LerianStudio/helm/commit/46284e5bee1bf07269aeac457c7f7dad74b848b6)) * **lerian-notification:** order SA/ConfigMap/Secret before migrations Job ([23069fc](https://github.com/LerianStudio/helm/commit/23069fcc638795bdc02bc093c770f9cafb0ea135)) * **product-console:** parametrize probes that were missed in initial commit ([5be4277](https://github.com/LerianStudio/helm/commit/5be4277d671dd74af3fbe64dc7bd95295272d50a)) * **reporter:** prevent null env in manager and worker deployments ([51a72c6](https://github.com/LerianStudio/helm/commit/51a72c640b78716a69f2ddee05e5a5be3e1125cd)) * **reporter:** prevent null env in ScaledJob when no env vars are configured ([7fa29b4](https://github.com/LerianStudio/helm/commit/7fa29b47d0859aaae3097af6b33b4585412b230c)) * **plugin-br-pix-switch:** probe paths follow per-component routePrefix ([d6e5264](https://github.com/LerianStudio/helm/commit/d6e5264d2fca1a64ac207978e90ab1a1b2cbde75)), closes [#135](https://github.com/LerianStudio/helm/issues/135) * **plugin-br-pix-switch:** providers ingress default path /mock-btg -> /btg-mock ([b6df396](https://github.com/LerianStudio/helm/commit/b6df396a0984f06c6c3774c0d89bf48bdfd20ac3)) * **docs:** rabbitmq mispelling name ([cefee91](https://github.com/LerianStudio/helm/commit/cefee916b39020938945ce97f442dbdbf3ba6d63)) * **onboarding:** rabbitmq mispelling name ([bf8de0c](https://github.com/LerianStudio/helm/commit/bf8de0cf79e4a40a3fa0bb7581a7f11b9458de76)) * **transaction:** rabbitmq mispelling name ([8e05032](https://github.com/LerianStudio/helm/commit/8e050329da399b563d2ce6f5fa70edcf2291cccd)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** remove common secret to match reporter pattern ([37050a0](https://github.com/LerianStudio/helm/commit/37050a0834a3fc70676e00e3b5dd4018f9e0ec02)) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * remove duplicate reporter-manager/secret.yaml with incorrect template references ([e8cc8b6](https://github.com/LerianStudio/helm/commit/e8cc8b6e63e587a9c5fc7c45284c1482ec766564)) * remove empty variable ([48052b2](https://github.com/LerianStudio/helm/commit/48052b2c411e6d882c5c7067f19b4364cdb363e6)) * **release:** remove generate_changelog dependency from back-merge step ([40dfa39](https://github.com/LerianStudio/helm/commit/40dfa390347ce04d88ae8bf22dde9dcc824f93b2)) * **onboarding:** remove grpc port from container ([3bd9621](https://github.com/LerianStudio/helm/commit/3bd96218a95decae1c58cc29078c8bbfd71736a9)) * **midaz:** remove hardcoded localhost URLs from console configmap ([75ab6e8](https://github.com/LerianStudio/helm/commit/75ab6e87a0271f08e48f496b8b753b0f1721d843)) * remove hardcoded namespaceOverride to use release namespace ([f650315](https://github.com/LerianStudio/helm/commit/f650315e2ca1849da559dffb51fd0f01f5669167)) * remove hook ([aa92d78](https://github.com/LerianStudio/helm/commit/aa92d78f74000f6f4f2c7fc22db35cc0010916ca)) * remove hotfix branch from release config ([11d0188](https://github.com/LerianStudio/helm/commit/11d018800fe55cbfc1cc840974248b8c85b5fb0b)) * **plugin-access-manager:** remove imagePullSecrets from values.yaml for identity and auth sections ([238ca51](https://github.com/LerianStudio/helm/commit/238ca519ce930eb2b4431abfd6a0fd69f1efda27)) * **product-console:** remove inconsistent artifacthub image annotation ([77e46c4](https://github.com/LerianStudio/helm/commit/77e46c4b36f2ebf51e7da2d6d6864b3b0d244733)) * **plugin-fees:** remove MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC from configmap ([f3e7f9b](https://github.com/LerianStudio/helm/commit/f3e7f9bae9113bba8d11602afcbd4048778b892a)) * **onboarding:** remove old secrets ([0c7966f](https://github.com/LerianStudio/helm/commit/0c7966f91207c688b0e014bab463dac40846f56e)) * **trasaction:** remove old secrets ([1a2a10c](https://github.com/LerianStudio/helm/commit/1a2a10c9a165c0767f45b7909276c287d5c4d3a3)) * remove RabbitMQ health check from onboarding deployment ([181179e](https://github.com/LerianStudio/helm/commit/181179e4dea9faea9717eb0eafc946f86d6a1192)) * **plugin-br-pix-indirect-btg:** remove trailing newline from values.yaml ([938bf17](https://github.com/LerianStudio/helm/commit/938bf17d10d468c257d83fa4e2a46778deb071aa)) * **plugin-br-bank-transfer:** rename chart to include -helm suffix ([f393e35](https://github.com/LerianStudio/helm/commit/f393e35ec6b5ad070ccc24214771b3c2cfd81fb0)) * **audit:** rename env vars and update container port ([9796046](https://github.com/LerianStudio/helm/commit/979604649c30ce6b8788acb3c1f67dff1a765f63)) * **transaction:** rename env vars and update container port ([4052bc5](https://github.com/LerianStudio/helm/commit/4052bc51634b989fba34c2245319db767aa02275)) * **chart:** rename ledger component to onboarding ([47dd9d0](https://github.com/LerianStudio/helm/commit/47dd9d01c491f30669c3f4ec6271bae1c8d0de75)) * **chart:** rename ledger component to onboarding ([e04404b](https://github.com/LerianStudio/helm/commit/e04404b79c78396a6cb1227cafa5bad10b51d3ee)) * **doc:** rename ledger component to onboarding ([0aa6e34](https://github.com/LerianStudio/helm/commit/0aa6e34ed38d68308cec31b5280b17c017c3d277)) * **components:** rename ledger db for onboarding ([40e49b8](https://github.com/LerianStudio/helm/commit/40e49b8cb2dcf6b169ea4a9c32b5c516f0d06b57)) * **pipe:** rename ledger to onboarding ([448ce90](https://github.com/LerianStudio/helm/commit/448ce9015baee8d553a81f6253d77d76bb96c3ba)) * **bank-transfer:** rename MULTI_TENANT_INFRA_ENABLED to MULTI_TENANT_ENABLED for consistency ([0fb14a6](https://github.com/LerianStudio/helm/commit/0fb14a62d9644d039931afe1c5a6f7291bbaafa8)) * **dependencies:** rename otel to grafana ([#57](https://github.com/LerianStudio/helm/issues/57)) ([974c47f](https://github.com/LerianStudio/helm/commit/974c47f6974d42804e5210d530829efa0394d734)) * **tracer:** rename PLUGIN_AUTH_HOST to PLUGIN_AUTH_ADDRESS (2.0.0-beta.4) ([4be1526](https://github.com/LerianStudio/helm/commit/4be1526c4e9f1415e4ef8dec74533ff1a4ac98fa)) * rename PRIVATE_KEY to KEY in qr-code secrets template ([8736d13](https://github.com/LerianStudio/helm/commit/8736d1343048542d33331c97ded6b3aff1cce369)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** resources limits in onboarding and transaction values ([9d788f5](https://github.com/LerianStudio/helm/commit/9d788f5dc9639cb97bf285332c31033fedb0545a)) * **plugin-fees:** revert MIDAZ_TRANSACTION_URL to midaz-transaction default ([0871187](https://github.com/LerianStudio/helm/commit/0871187b0197c5af9439f0cd9f6f1813b68ae4c4)) * rollback midaz version ([e458c1c](https://github.com/LerianStudio/helm/commit/e458c1ccfa01a5f67fb221a3cf33b8cb8054d4b7)) * rollback plugin-access-manager version ([ce2b088](https://github.com/LerianStudio/helm/commit/ce2b08841977784e729d7efeb635c64780072b54)) * **lerian-notification:** self-contain migrations Job; drop hook annotations from SA/ConfigMap/Secret ([068b1e3](https://github.com/LerianStudio/helm/commit/068b1e3fe5ef93f274bf4f219031fc867f43ffc6)) * **plugins:** separate RABBITMQ_HOST from RABBITMQ_URL in bc-correios chart ([#1268](https://github.com/LerianStudio/helm/issues/1268)) ([780aff8](https://github.com/LerianStudio/helm/commit/780aff85155d47316160f60a596dfc7e70b0c6be)) * **plugin-br-pix-indirect-btg:** set DB_SSL_MODE default to disable ([29f2348](https://github.com/LerianStudio/helm/commit/29f2348e7c55bb7eafcb6cfddbc013d2ceeae3f7)) * **plugin-br-pix-switch:** set default PLUGIN_AUTH_URL on auth-using components ([f689afc](https://github.com/LerianStudio/helm/commit/f689afcc5173a3a15fd105fd7a4fbb2605b26f71)) * **product-console:** set image tag to 1.3.0 in values.yaml ([a535b88](https://github.com/LerianStudio/helm/commit/a535b885158731c4ef859e5197f3283dcd2c1b60)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](https://github.com/LerianStudio/helm/issues/1405)) ([e0d9084](https://github.com/LerianStudio/helm/commit/e0d908413cf66830d4afa6a53bac3ce8573a10af)) * **plugin-br-pix-indirect-btg:** set REDIS_TLS default to false in reconciliation configmap ([b8dc4d1](https://github.com/LerianStudio/helm/commit/b8dc4d1af0462ae2f12ba9b1542711d0ebdce300)) * setup otel in template ([#24](https://github.com/LerianStudio/helm/issues/24)) ([837fd03](https://github.com/LerianStudio/helm/commit/837fd03c642b14387299b9b4a50fe00dc22e2f29)) * simplify hotfix branch prerelease configuration ([8f61d2d](https://github.com/LerianStudio/helm/commit/8f61d2d31b87a6f4273beab1f73fe64b3fb78cf0)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](https://github.com/LerianStudio/helm/commit/582ea9751785df979371f64e367c4ceb8a2731de)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](https://github.com/LerianStudio/helm/commit/45d152ab94251e5d08eeeba666d0908c2d90c287)) * **plugin-access-manager:** split migrations and initUser image into repository/tag fields ([5be206a](https://github.com/LerianStudio/helm/commit/5be206ad28843d9de908efb7c329e9305070415f)) * **components:** sql init for auth app ([9824943](https://github.com/LerianStudio/helm/commit/9824943ab8a6d2e038cd55448259c27149c50546)) * **midaz:** standardize base URL configuration using MIDAZ_CONSOLE_BASE_PATH as source of truth ([bc4705a](https://github.com/LerianStudio/helm/commit/bc4705aafe9ab36a3c56264099400543202d7412)) * **plugins:** standardize MIDAZ console URL configuration ([b89bb83](https://github.com/LerianStudio/helm/commit/b89bb837974a805cc9b238684e7d8ab7e752eef6)) * standardize VERSION/OTEL_RESOURCE_SERVICE_VERSION in remaining charts ([4172495](https://github.com/LerianStudio/helm/commit/4172495136f2d17d0897c6b4bdbcc081634a372a)) * **plugin-br-pix-switch:** swap envFrom order so Secret overrides ConfigMap (1.1.0-beta.4) ([c1241c0](https://github.com/LerianStudio/helm/commit/c1241c0f9b2839cbf22ef2ecd73a738a54fa9920)) * **new:** sync migrations job and app versions ([d90d1d7](https://github.com/LerianStudio/helm/commit/d90d1d7042bd1b82a4638dd993274539d9aeed42)) * templates ([bc18fc3](https://github.com/LerianStudio/helm/commit/bc18fc3fddd8736d8694f3be401d1a85fc781039)) * transaction adjust default value of env var ([6e807a9](https://github.com/LerianStudio/helm/commit/6e807a9da365d88d023746233992b316ef1696df)) * transaction init container ([3d3492c](https://github.com/LerianStudio/helm/commit/3d3492c9e0c017d7e904fc26e9aeadfdfbe76c8e)) * **midaz:** update app image tag from 2.2.0 to 2.2.1 ([3103f2d](https://github.com/LerianStudio/helm/commit/3103f2d2f97fdc4021e3702efc7e0f5494fd6fe0)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](https://github.com/LerianStudio/helm/commit/944e1ce9b6af49dfcbd3bce0851093cefc4989eb)) * **configmap:** update APPLICATION_NAME default value to crm ([53b65c3](https://github.com/LerianStudio/helm/commit/53b65c3ecc9a07f901832e99efc45fec3bd1d65f)) * **plugin-access-manager:** update appVersion and image tags to 2.6.2 ([ed831fb](https://github.com/LerianStudio/helm/commit/ed831fb2dca1a1f65988b03edc9d4d14bc14e6bf)) * **plugin-access-manager:** update appVersion and image tags to 2.6.3 ([f4d26c0](https://github.com/LerianStudio/helm/commit/f4d26c0378bfb41d6f0be5de46e7be614463529d)) * **product-console:** update appVersion to 1.3.0 ([c708e76](https://github.com/LerianStudio/helm/commit/c708e76df0e532850dd8d5e2472a4b34c72a249c)) * **plugin-access-manager:** update appVersion to 2.6.5 ([db5045a](https://github.com/LerianStudio/helm/commit/db5045a532276e6bd34b4b30682f58e7f2bca567)) * **plugin-bc-correios:** update br-spb-bc-correios@1.2.0 ([f5d8eca](https://github.com/LerianStudio/helm/commit/f5d8eca7c779bf8b941f7a5bfa94fa6db2bba394)) * update casdoor backend images ([ea9e82b](https://github.com/LerianStudio/helm/commit/ea9e82bfce3259bf88fb13b0b39b0a2f6280c7a1)) * update casdoor backend images ([8c1741d](https://github.com/LerianStudio/helm/commit/8c1741dcd6e3c7df86ed6f5f59d07309792754ba)) * **plugin-fees:** update chart version to 5.4.0 and app version to 3.2.0 ([303911d](https://github.com/LerianStudio/helm/commit/303911d1c080482ac5df1440cf50ad58ea26a581)) * **midaz:** update console@3.4.8, onboarding@3.4.8, transaction@3.4.8 and add back-merge workflow ([2400460](https://github.com/LerianStudio/helm/commit/2400460545b915829faf6f5871c4551f6cc51445)) * update default NGINX_BASE_PATH to use correct service name midaz-console-nginx ([ed89e32](https://github.com/LerianStudio/helm/commit/ed89e324691ebe09e742abb5d9d4e56216efdce5)) * update default value to swagger hot env var ([a691862](https://github.com/LerianStudio/helm/commit/a6918621eee89815ab6e074dbd841f5d7d520b3d)) * update default value to swagger hot env var ([25fe35e](https://github.com/LerianStudio/helm/commit/25fe35e5cba187cdebd9a711f6ceee31e6687936)) * **bank-transfer:** update DEFAULT_TENANT_ID to allow empty default value in configmap ([10ea45e](https://github.com/LerianStudio/helm/commit/10ea45e0ff6d8b0023efc0a293db31390566300c)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](https://github.com/LerianStudio/helm/commit/f7aa25b6756bf756a3d7cc3e0f90fba1b85f31df)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **ci:** update Helm setup action to v3.5 in release workflow ([6736085](https://github.com/LerianStudio/helm/commit/673608587a310dece3aeb5fda8fd0d408584c4ad)) * **plugin-access-manager:** update identity@2.1.1, auth@2.4.0 and use image.tag for version fields ([e260dee](https://github.com/LerianStudio/helm/commit/e260deef9bc8bafe34a85755c1532a400aac416a)) * update image repository ([4d9116f](https://github.com/LerianStudio/helm/commit/4d9116fd515d1628be6159dbd0c4512de0720a8c)) * update image repository ([43d0cc0](https://github.com/LerianStudio/helm/commit/43d0cc0cc1559589afae24aa9b568206a9902649)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](https://github.com/LerianStudio/helm/commit/68bcd0ba0581b73f7e41b9edcdfe6aff4d9a56fc)) * **plugin-access-manager:** update image tags and add CORS, rate limiting, multi-tenancy, and circuit breaker configurations ([628ad1d](https://github.com/LerianStudio/helm/commit/628ad1d77b88e3bfde9bcf07d14ae64f0f234603)) * **plugin-access-manager:** update image tags for identity and auth components to latest versions ([08f9a6a](https://github.com/LerianStudio/helm/commit/08f9a6a9216b2db51fe0cbd9a35f97eba037a762)) * **midaz:** update ledger service default port from 3000 to 3002 ([2878908](https://github.com/LerianStudio/helm/commit/28789085b331fe28430cfce77a6a2e7f9bb65b97)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **midaz:** update midaz-crm@3.6.2, midaz-ledger@3.6.2 ([960a392](https://github.com/LerianStudio/helm/commit/960a392f9d63e4576dabcc3ed1008be42063c4b5)) * **midaz:** update midaz-crm@3.6.3, midaz-ledger@3.6.3 ([1cce7ba](https://github.com/LerianStudio/helm/commit/1cce7ba9f7494151eb9f62361d6b07915063210a)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](https://github.com/LerianStudio/helm/commit/3c9bea0fedc48926df8151fa421d4c0a27f07ccb)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](https://github.com/LerianStudio/helm/commit/5ee7f4531e5fe78d61e63142f528f98d220bf131)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](https://github.com/LerianStudio/helm/commit/67021d410f8bd95628dc2e1fda00029e587a6408)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](https://github.com/LerianStudio/helm/commit/4852190a64cc81e28e78f9a27d7978187cd1ac72)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](https://github.com/LerianStudio/helm/commit/5c2edb0ebd628ad373269f290736c0ee56899f3b)) * update mongodb ([858c934](https://github.com/LerianStudio/helm/commit/858c93496a5e45fcb84389614536d63ca6b84a02)) * **console:** update mongodb default port ([fd58b09](https://github.com/LerianStudio/helm/commit/fd58b09788b9f7ccc03937ac5e950060110cedf3)) * update nginx deployment config with correct service account and simplified configmap names ([b1119fd](https://github.com/LerianStudio/helm/commit/b1119fdad81d1d4bbcb2c3aecbe74d56cd0a3136)) * **doc:** update nginx ingress config ([#35](https://github.com/LerianStudio/helm/issues/35)) ([d9763ea](https://github.com/LerianStudio/helm/commit/d9763ea4c2139c7d5f020d71422a634f37e15172)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.7, job@1.2.1-beta.7 ([4010717](https://github.com/LerianStudio/helm/commit/4010717e52a535803550f84faf3092439cb063b7)) * update plugin registration URL to use midaz-console-nginx hostname ([0eaca46](https://github.com/LerianStudio/helm/commit/0eaca4642ff0d7907302ecc7e95c1426378a56a8)) * **plugin-access-manager:** update plugin-auth@2.6.0 ([6b5b3d8](https://github.com/LerianStudio/helm/commit/6b5b3d85f0f2312dd0104b79ab3efb7fa707ec80)) * **plugin-access-manager:** update plugin-auth@2.6.1 ([253b5e8](https://github.com/LerianStudio/helm/commit/253b5e8c6dc6940884d28b3d3064b941e7936742)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](https://github.com/LerianStudio/helm/commit/b5892a37b4b8b67cbcf3bee1bb8557b807e637ce)) * **plugin-br-bank-transfer-jd:** update plugin-br-bank-transfer-jd@1.0.0 ([afcdded](https://github.com/LerianStudio/helm/commit/afcdded551872f8fea45bd5811129d967862fc48)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@2.1.0 ([3e29c6c](https://github.com/LerianStudio/helm/commit/3e29c6cbcda36b88db0140e18d1995e41d711ada)) * update plugin-br-pix-indirect-btg pix OTEL_RESOURCE_SERVICE_VERSION ([4fa8d3f](https://github.com/LerianStudio/helm/commit/4fa8d3fa16f4c4db14a353fee4132f3734177229)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.1 ([4397bc6](https://github.com/LerianStudio/helm/commit/4397bc641c2009520ddfa74db5b07ce560682137)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.3 ([b9a4b68](https://github.com/LerianStudio/helm/commit/b9a4b68daddf3bc7f34ece779be416e297372c46)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.2.0 ([5e4b893](https://github.com/LerianStudio/helm/commit/5e4b89388355b6970ad8a7d381b36c66ab7ef7e4)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.0 ([df6de7b](https://github.com/LerianStudio/helm/commit/df6de7b0c40b062351913790901f48423e5f664a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.2 ([ffb414d](https://github.com/LerianStudio/helm/commit/ffb414d8b71c60108afc8d8ca997616610c88a05)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.1 ([adbe456](https://github.com/LerianStudio/helm/commit/adbe456f10361ac91c79e72b81bd171d9d1a28da)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.2 ([2c2b639](https://github.com/LerianStudio/helm/commit/2c2b639e67f749a6e98452ecb09aab79a327e468)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.3 ([e08d78a](https://github.com/LerianStudio/helm/commit/e08d78a8e4220c78695d51a6764417241f8ff8ea)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.4 ([a42a959](https://github.com/LerianStudio/helm/commit/a42a959fd56639a0805eef3dca75d117cdcb407e)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.6 ([fe3749c](https://github.com/LerianStudio/helm/commit/fe3749cd1cd6dae57a2d156181cab624db53aa76)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.7 ([793be45](https://github.com/LerianStudio/helm/commit/793be450b2ee8fdb9042dca0b275845d4461fff8)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.8 ([55681de](https://github.com/LerianStudio/helm/commit/55681def27a6eaf2655b0cdd03ba1d90956db54a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.3.0 ([35c27d1](https://github.com/LerianStudio/helm/commit/35c27d157a06baf08d0c35587b0ba42fa83e003f)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.4.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.4.1, plugin-br-pix-indirect-btg-worker-inbound@1.4.1, plugin-br-pix-indirect-btg-worker-outbound@1.4.1 ([3c6970f](https://github.com/LerianStudio/helm/commit/3c6970fa684f810608c93c9b5a14762913fa0642)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.1, plugin-br-pix-indirect-btg-worker-inbound@1.5.1, plugin-br-pix-indirect-btg-worker-outbound@1.5.1 ([226f506](https://github.com/LerianStudio/helm/commit/226f506964e0b271d4f61ec451a52121371096a3)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.2, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.2, plugin-br-pix-indirect-btg-worker-inbound@1.5.2, plugin-br-pix-indirect-btg-worker-outbound@1.5.2 ([6dbb46c](https://github.com/LerianStudio/helm/commit/6dbb46cfa97ec25e3a96a7c296452ed5a2a93f38)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](https://github.com/LerianStudio/helm/commit/a3c2b6d91208d9a2def2fffe15f9065d6d12e0c0)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-fees:** update plugin-fees@3.0.7 ([844537d](https://github.com/LerianStudio/helm/commit/844537d1ff6d902a454b6f49bd70e431a1b9055f)) * **plugin-fees:** update plugin-fees@3.0.8 ([8c5579c](https://github.com/LerianStudio/helm/commit/8c5579c72b31b43e4a5389112a9849092e645617)) * **plugin-access-manager:** update plugin-identity@2.4.2 ([8b01a14](https://github.com/LerianStudio/helm/commit/8b01a14b077f8fdbc0dd642c1f09b695f27d8623)) * update rabbitmq authentication format to use value field in helm chart ([9ef3305](https://github.com/LerianStudio/helm/commit/9ef33051275a99abd848ef6b1717a8e613e49f94)) * update rabbitmq authentication username field to user ([07a183a](https://github.com/LerianStudio/helm/commit/07a183a8be746cdef266d09dbfe011b04b5da468)) * **product-console:** update readiness probe path to default to root ([2996200](https://github.com/LerianStudio/helm/commit/29962007e8b4428251289da18ac13c97c46fac02)) * **midaz:** update README with ledger service documentation and remove console/nginx references ([e472f4f](https://github.com/LerianStudio/helm/commit/e472f4f192b3ab73f75e17f0968150dca1394e26)) * update reporter cm ([fcdd63c](https://github.com/LerianStudio/helm/commit/fcdd63c752b873d83618c75093f9709aaaebf353)) * **reporter:** update reporter-manager@1.0.0, reporter-worker@1.0.0 ([d586bf1](https://github.com/LerianStudio/helm/commit/d586bf17c2427509b5bdc6a33797b15d4fd126b5)) * **reporter:** update reporter-manager@1.1.1 ([4f98acf](https://github.com/LerianStudio/helm/commit/4f98acfb798423cf6e82b27b2b9dbe97b44d4351)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **matcher:** update securityContext to run as root ([8de4a13](https://github.com/LerianStudio/helm/commit/8de4a13461263bfdac56c72f5521fa4bb228f5b4)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](https://github.com/LerianStudio/helm/commit/4492c3d629bbe1048e250967572a7b6599a15a68)) * **plugin-br-bank-transfer:** update service port and server address to 4027 in configuration files ([dd4e2a0](https://github.com/LerianStudio/helm/commit/dd4e2a05f1c62f619f3cd45bd4f8a9b01a596546)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * update transaction service DNS name in onboarding config ([b98a488](https://github.com/LerianStudio/helm/commit/b98a488e3b27c077eebd65e3bbffcddac2a313e1)) * **reporter:** update worker default image tag to match latest stable release ([147ed4c](https://github.com/LerianStudio/helm/commit/147ed4c20cb81a955402d3d4361852966a11516e)) * **bootstrap-mongodb:** use /bin/bash instead of /bin/sh for mongosh container ([b956943](https://github.com/LerianStudio/helm/commit/b956943f69f1ecee7e90f3db5f75b37c2827d179)) * use /bin/sh instead of /bin/bash in alpine kubectl container ([24c9fc0](https://github.com/LerianStudio/helm/commit/24c9fc0702fd5252105c7ec2774413647a0b7009)) * **matcher:** use configmap value for OBJECT_STORAGE_ENDPOINT with IAM Roles Anywhere ([c0f19a4](https://github.com/LerianStudio/helm/commit/c0f19a4648595b8784d0d5e7ce3f9991074978ac)) * **midaz:** use dig function for safer nested value access in ledger init container timeout ([86ee67d](https://github.com/LerianStudio/helm/commit/86ee67d4f3bfe9281f5336a68a59cb8175e4e2d4)) * use dynamic service names based on release name ([cc9e734](https://github.com/LerianStudio/helm/commit/cc9e7345d452a7ba32263269c8e974a7856c5544)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](https://github.com/LerianStudio/helm/commit/ac4c1e82a13017aa3d2c7d031f449c86ad63bc23)) * **plugin-fees:** use midaz-ledger service for MIDAZ_TRANSACTION_URL default ([9515b35](https://github.com/LerianStudio/helm/commit/9515b3520d4e36ec74eb0279ff30933c0955499e)) * **bootstrap-mongodb:** use name helpers instead of hardcoded names ([d932f48](https://github.com/LerianStudio/helm/commit/d932f48eec2054013278151769001633b0c94091)) * **reporter:** use RABBITMQ_URI for KEDA scaler host ([60809c9](https://github.com/LerianStudio/helm/commit/60809c9273e1f1af8a177038e6c922d3a672b057)) * **plugin-access-manager:** use separate repository and tag for auth backend image ([01b9a5c](https://github.com/LerianStudio/helm/commit/01b9a5c85abd3d26e56ce698b5b0661a227d6c77)) * **reporter:** use unique names for cluster-scoped resources ([5cdaa80](https://github.com/LerianStudio/helm/commit/5cdaa8066d13a312d84a138d81609226f492a745)) * **bootstrap-mongodb:** use updateUser + process.env for safer reconciliation ([13ee1dc](https://github.com/LerianStudio/helm/commit/13ee1dc99078c5581a659ed33b361e7191229200)), closes [#1187](https://github.com/LerianStudio/helm/issues/1187) * **charts:** value key typo and stale README notes ([91ce16f](https://github.com/LerianStudio/helm/commit/91ce16fd0abb82f251f6151bdf34cfd7029edf80)) * values ([b1dc8f7](https://github.com/LerianStudio/helm/commit/b1dc8f7105ab3aa0bbed2549525f013875087b7d)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](https://github.com/LerianStudio/helm/issues/1430)) ([f38d6d9](https://github.com/LerianStudio/helm/commit/f38d6d91fec753cada642103ae242bb388e67669)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) ### Performance Improvements * Update resources ([b5f07f0](https://github.com/LerianStudio/helm/commit/b5f07f0fd2319f2bbe3155fd075c1ae7874cf59c)) * Update resources ([9ffc743](https://github.com/LerianStudio/helm/commit/9ffc7430951db115934fb10223f0d9287adfcf60)) ### Reverts * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET from global to component-level secrets ([653594c](https://github.com/LerianStudio/helm/commit/653594ccc07a2fdde1e3f7b09ff627089278a668)) * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET validation from global to pix.secrets ([f95be82](https://github.com/LerianStudio/helm/commit/f95be8266c5b88c92c839060063a69b581a41edf)) ### Miscellaneous Chores * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([28de7ce](https://github.com/LerianStudio/helm/commit/28de7ceb2dd9b39d87ae64d0f64573530a03be9b)) * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([e2113c0](https://github.com/LerianStudio/helm/commit/e2113c0bd99fe8f04e3c4ede5766f3fb99497ec0)) ### Code Refactoring * **plugin-br-payments:** rename PROVIDER_* values to BTG_* ([6454fc3](https://github.com/LerianStudio/helm/commit/6454fc3ff1395821bb4b7d21f3f0bd5915964cc6)) --- README.md | 2 +- charts/br-ccs/Chart.yaml | 5 +++-- 2 files changed, 4 insertions(+), 3 deletions(-) diff --git a/README.md b/README.md index bfc459dd..1da888d7 100644 --- a/README.md +++ b/README.md @@ -295,5 +295,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `0.1.0` | 1.0.0 | +| `1.0.0-beta.1` | 1.0.0 | ----------------- diff --git a/charts/br-ccs/Chart.yaml b/charts/br-ccs/Chart.yaml index 7d1f0dfb..ecadfed0 100644 --- a/charts/br-ccs/Chart.yaml +++ b/charts/br-ccs/Chart.yaml @@ -1,6 +1,7 @@ apiVersion: v2 name: br-ccs-helm -description: A Helm chart for br-ccs — Lerian's BACEN CCS (Cadastro de Clientes do Sistema Financeiro Nacional) regulatory integration service +description: A Helm chart for br-ccs — Lerian's BACEN CCS (Cadastro de Clientes + do Sistema Financeiro Nacional) regulatory integration service type: application annotations: lerian.studio/chart-type: single-service @@ -12,7 +13,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 0.1.0 +version: 1.0.0-beta.1 appVersion: "1.0.0" From 1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf Mon Sep 17 00:00:00 2001 From: arthurkz Date: Wed, 8 Jul 2026 17:39:08 -0300 Subject: [PATCH 060/113] fix(br-sta): pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The lib-commons migrator refuses to connect to a non-TLS Postgres unless ALLOW_INSECURE_TLS=true — POSTGRES_SSLMODE=disable alone is rejected (observed on dev-st: 'TLS required (set ALLOW_INSECURE_TLS=true to bypass)'). The app Deployment already gets this via extraEnvVars/configmap; mirror it on the migration Job. Resolved from migrations.allowInsecureTLS override -> br-sta.extraEnvVars -> br-sta.configmap, emitted only when set so TLS tiers stay secure by default. X-Lerian-Ref: 0x1 --- charts/br-sta/templates/migrations.yaml | 21 +++++++++++++++++++++ charts/br-sta/values.yaml | 5 +++++ 2 files changed, 26 insertions(+) diff --git a/charts/br-sta/templates/migrations.yaml b/charts/br-sta/templates/migrations.yaml index bacdf6fb..87e56e74 100644 --- a/charts/br-sta/templates/migrations.yaml +++ b/charts/br-sta/templates/migrations.yaml @@ -52,6 +52,21 @@ {{- $migrationTag := get $migrationImage "tag" | default (get (get $app "image" | default dict) "tag" | default .Chart.AppVersion) -}} {{- $migrationDigest := get $migrationImage "digest" | default "" -}} {{- $migrationRepository := get $migrationImage "repository" | default "ghcr.io/lerianstudio/br-sta-migrations" -}} +{{- /* lib-commons' migrator refuses to connect to a non-TLS Postgres unless + ALLOW_INSECURE_TLS=true — POSTGRES_SSLMODE=disable alone is not enough. The + app deployment gets this via extraEnvVars/configmap; the migration Job must + mirror it. Resolution order: migrations.allowInsecureTLS override → + app.extraEnvVars → app.configmap. Emitted only when set, so TLS tiers stay + secure by default. */}} +{{- $extraEnv := get $app "extraEnvVars" | default dict -}} +{{- $allowInsecureTLS := "" -}} +{{- if get $migrations "allowInsecureTLS" -}} +{{- $allowInsecureTLS = toString (get $migrations "allowInsecureTLS") -}} +{{- else if get $extraEnv "ALLOW_INSECURE_TLS" -}} +{{- $allowInsecureTLS = toString (get $extraEnv "ALLOW_INSECURE_TLS") -}} +{{- else if get $configmap "ALLOW_INSECURE_TLS" -}} +{{- $allowInsecureTLS = toString (get $configmap "ALLOW_INSECURE_TLS") -}} +{{- end -}} apiVersion: batch/v1 kind: Job metadata: @@ -156,6 +171,12 @@ spec: value: {{ get $configmap "POSTGRES_NAME" | default "br_sta" | quote }} - name: POSTGRES_SSLMODE value: {{ get $configmap "POSTGRES_SSLMODE" | default "require" | quote }} + {{- if $allowInsecureTLS }} + # lib-commons migrator bypass for non-TLS Postgres (sslmode=disable + # alone is rejected). Mirrors the app's ALLOW_INSECURE_TLS. + - name: ALLOW_INSECURE_TLS + value: {{ $allowInsecureTLS | quote }} + {{- end }} - name: POSTGRES_CONNECT_TIMEOUT_SEC value: {{ get $configmap "POSTGRES_CONNECT_TIMEOUT_SEC" | default "10" | quote }} {{- with (get $migrations "timeoutSeconds") }} diff --git a/charts/br-sta/values.yaml b/charts/br-sta/values.yaml index e16c2b9c..7bd1d8c9 100644 --- a/charts/br-sta/values.yaml +++ b/charts/br-sta/values.yaml @@ -92,6 +92,11 @@ br-sta: pullPolicy: IfNotPresent # -- Path inside the image where the SQL migrations live. path: "/migrations" + # -- Bypass the lib-commons migrator TLS guard for a non-TLS Postgres + # (POSTGRES_SSLMODE=disable is rejected without it). When empty, inherits + # ALLOW_INSECURE_TLS from br-sta.extraEnvVars, then br-sta.configmap. Leave + # empty for a TLS-enabled Postgres. + allowInsecureTLS: "" # -- Maximum retries before the Job is considered failed. backoffLimit: 3 # -- Hard wall-clock cap for the Job (seconds). From fc5a1c702a0b56dc718b017546a6e17f5a6d43e4 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 8 Jul 2026 20:50:14 +0000 Subject: [PATCH 061/113] chore(release): 1.0.0-beta.5 ## (2026-07-08) ### Bug Fixes * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) --- README.md | 2 +- charts/br-sta/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1da888d7..3b8d2e87 100644 --- a/README.md +++ b/README.md @@ -284,7 +284,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `1.0.0-beta.4` | 1.0.0-beta.32 | 1.0.0-beta.32 | +| `1.0.0-beta.5` | 1.0.0-beta.32 | 1.0.0-beta.32 | ----------------- ### Br Ccs diff --git a/charts/br-sta/Chart.yaml b/charts/br-sta/Chart.yaml index 92345983..3d77fb78 100644 --- a/charts/br-sta/Chart.yaml +++ b/charts/br-sta/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 1.0.0-beta.4 +version: 1.0.0-beta.5 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.32" From 9bc7afc09bf929122e5437b59da074b91971185d Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Fri, 10 Jul 2026 13:53:05 -0300 Subject: [PATCH 062/113] feat(plugin-br-pix-indirect-btg): add PIX_RECURRENCE_PAYER inbound entity --- .../templates/inbound/configmap.yaml | 10 ++++++++++ 1 file changed, 10 insertions(+) diff --git a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml index 8c3a9296..ab4cbcf8 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml @@ -229,6 +229,16 @@ data: WEBHOOK_ENTITY_PIX_INTERNAL_TRANSACTIONS_REPORT_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_INTERNAL_TRANSACTIONS_REPORT_MAX_PENDING_TIME | default "10m" | quote }} WEBHOOK_ENTITY_PIX_INTERNAL_TRANSACTIONS_REPORT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_INTERNAL_TRANSACTIONS_REPORT_MAX_CONCURRENT | default "2" | quote }} + # PIX_RECURRENCE_PAYER - Pix recurrence payer webhooks (Low Throughput) + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_ENABLED | default "true" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_WORKER_COUNT | default "1" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_BATCH_SIZE | default "50" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_PROCESSING_TIMEOUT | default "12s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_RETRIES | default "5" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME | default "2m" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT | default "4" | quote }} + # Security Tier Configuration (lib-commons v4.4.0) SECURITY_TIER: {{ .Values.inbound.configmap.SECURITY_TIER | default "" | quote }} SECURITY_ENFORCEMENT: {{ .Values.inbound.configmap.SECURITY_ENFORCEMENT | default "false" | quote }} From 576992f928f6de2d88c7008b98130836801fe855 Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Fri, 10 Jul 2026 14:01:46 -0300 Subject: [PATCH 063/113] feat(plugin-br-pix-indirect-btg): add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) --- .../templates/inbound/configmap.yaml | 30 +++++++++++++++++++ .../templates/pix/configmap.yaml | 6 ++++ .../templates/schedule/configmap.yaml | 7 +++++ 3 files changed, 43 insertions(+) diff --git a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml index ab4cbcf8..a775aa8a 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml @@ -239,6 +239,36 @@ data: WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME | default "2m" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT | default "4" | quote }} + # PIX_RECURRENCE_COLLECTION - Pix recurrence collection webhooks (Low Throughput) + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_ENABLED | default "true" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_WORKER_COUNT | default "1" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_BATCH_SIZE | default "50" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_PROCESSING_TIMEOUT | default "12s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_RETRIES | default "5" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_PENDING_TIME | default "2m" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT | default "4" | quote }} + + # SCHEDULE_TERMINAL_EVENT - Schedule terminal events intra-PSP (Low Throughput) + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_ENABLED | default "true" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_WORKER_COUNT | default "1" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_BATCH_SIZE | default "50" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_PROCESSING_TIMEOUT | default "12s" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_RETRIES | default "5" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_PENDING_TIME | default "2m" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT | default "4" | quote }} + + # CASHOUT_TERMINAL_EVENT - Cashout terminal events intra-PSP (Low Throughput) + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_ENABLED | default "true" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_WORKER_COUNT | default "1" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_BATCH_SIZE | default "50" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_PROCESSING_TIMEOUT | default "12s" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_RETRIES | default "5" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_PENDING_TIME | default "2m" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT | default "4" | quote }} + # Security Tier Configuration (lib-commons v4.4.0) SECURITY_TIER: {{ .Values.inbound.configmap.SECURITY_TIER | default "" | quote }} SECURITY_ENFORCEMENT: {{ .Values.inbound.configmap.SECURITY_ENFORCEMENT | default "false" | quote }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml index c2d470b8..ee20d309 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml @@ -100,6 +100,12 @@ data: ## BTG BTG_BASE_URL: {{ .Values.pix.configmap.BTG_BASE_URL | default "https://developer.api.btgpactual.com" | quote }} + # Recurring module (Pix Automático) + RECURRING_ANTISPAM_WINDOW: {{ .Values.pix.configmap.RECURRING_ANTISPAM_WINDOW | default "720h" | quote }} + RECURRING_REPLY_MAX_ATTEMPTS: {{ .Values.pix.configmap.RECURRING_REPLY_MAX_ATTEMPTS | default "3" | quote }} + RECURRING_REPLY_BACKOFF: {{ .Values.pix.configmap.RECURRING_REPLY_BACKOFF | default "150ms" | quote }} + RECURRING_SCHEDULE_LEAD_DAYS: {{ .Values.pix.configmap.RECURRING_SCHEDULE_LEAD_DAYS | default "1" | quote }} + ## CRM PLUGIN_CRM_BASE_URL: {{ .Values.pix.configmap.PLUGIN_CRM_BASE_URL | default "http://plugin-crm.midaz-plugins.svc.cluster.local:4003" | quote }} diff --git a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml index f99d4d95..74b17c91 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/schedule/configmap.yaml @@ -21,6 +21,13 @@ data: SCHEDULE_WORKER_TIME_WINDOW_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_TIME_WINDOW_ENABLED | default "false" | quote }} SCHEDULE_WORKER_WINDOW_START: {{ .Values.schedule.configmap.SCHEDULE_WORKER_WINDOW_START | default "" | quote }} SCHEDULE_WORKER_WINDOW_END: {{ .Values.schedule.configmap.SCHEDULE_WORKER_WINDOW_END | default "" | quote }} + SCHEDULE_WORKER_DISPATCH_CONCURRENCY: {{ .Values.schedule.configmap.SCHEDULE_WORKER_DISPATCH_CONCURRENCY | default "0" | quote }} + SCHEDULE_WORKER_JOB_TIMEOUT: {{ .Values.schedule.configmap.SCHEDULE_WORKER_JOB_TIMEOUT | default "0s" | quote }} + SCHEDULE_WORKER_NSF_RETRY_HOUR_BRT: {{ .Values.schedule.configmap.SCHEDULE_WORKER_NSF_RETRY_HOUR_BRT | default "0" | quote }} + SCHEDULE_WORKER_RECONCILE_ENABLED: {{ .Values.schedule.configmap.SCHEDULE_WORKER_RECONCILE_ENABLED | default "false" | quote }} + SCHEDULE_WORKER_RECONCILE_THRESHOLD: {{ .Values.schedule.configmap.SCHEDULE_WORKER_RECONCILE_THRESHOLD | default "30m" | quote }} + SCHEDULE_WORKER_RECONCILE_EVERY_N_CYCLES: {{ .Values.schedule.configmap.SCHEDULE_WORKER_RECONCILE_EVERY_N_CYCLES | default "40" | quote }} + SCHEDULE_WORKER_RECONCILE_BATCH_SIZE: {{ .Values.schedule.configmap.SCHEDULE_WORKER_RECONCILE_BATCH_SIZE | default "50" | quote }} # Application (DOMAIN API) Endpoint the worker drives over HTTP. # SCHEDULE_APP_BASE_URL and PLUGIN_AUTH_URL are operator/Vault-provided per environment. From 27925f7d85868b1c03d1a9608757903473e3e7ee Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Fri, 10 Jul 2026 14:05:49 -0300 Subject: [PATCH 064/113] fix(pix-indirect-btg): correct low-throughput defaults for recurrence/terminal entities Set POLLING_INTERVAL=5s and MAX_CONCURRENT=2 for PIX_RECURRENCE_PAYER, PIX_RECURRENCE_COLLECTION, SCHEDULE_TERMINAL_EVENT and CASHOUT_TERMINAL_EVENT to match their Low Throughput profile (were incorrectly using Medium). --- .../templates/inbound/configmap.yaml | 16 ++++++++-------- 1 file changed, 8 insertions(+), 8 deletions(-) diff --git a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml index a775aa8a..c9b86f91 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/inbound/configmap.yaml @@ -233,41 +233,41 @@ data: WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_ENABLED | default "true" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_WORKER_COUNT | default "1" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_BATCH_SIZE | default "50" | quote }} - WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_POLLING_INTERVAL | default "5s" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_PROCESSING_TIMEOUT | default "12s" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_RETRIES | default "5" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_PENDING_TIME | default "2m" | quote }} - WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT | default "4" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_PAYER_MAX_CONCURRENT | default "2" | quote }} # PIX_RECURRENCE_COLLECTION - Pix recurrence collection webhooks (Low Throughput) WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_ENABLED | default "true" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_WORKER_COUNT | default "1" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_BATCH_SIZE | default "50" | quote }} - WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_POLLING_INTERVAL | default "5s" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_PROCESSING_TIMEOUT | default "12s" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_RETRIES | default "5" | quote }} WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_PENDING_TIME | default "2m" | quote }} - WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT | default "4" | quote }} + WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_PIX_RECURRENCE_COLLECTION_MAX_CONCURRENT | default "2" | quote }} # SCHEDULE_TERMINAL_EVENT - Schedule terminal events intra-PSP (Low Throughput) WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_ENABLED | default "true" | quote }} WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_WORKER_COUNT | default "1" | quote }} WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_BATCH_SIZE | default "50" | quote }} - WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_POLLING_INTERVAL | default "5s" | quote }} WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_PROCESSING_TIMEOUT | default "12s" | quote }} WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_RETRIES | default "5" | quote }} WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_PENDING_TIME | default "2m" | quote }} - WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT | default "4" | quote }} + WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_SCHEDULE_TERMINAL_EVENT_MAX_CONCURRENT | default "2" | quote }} # CASHOUT_TERMINAL_EVENT - Cashout terminal events intra-PSP (Low Throughput) WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_ENABLED: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_ENABLED | default "true" | quote }} WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_WORKER_COUNT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_WORKER_COUNT | default "1" | quote }} WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_BATCH_SIZE: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_BATCH_SIZE | default "50" | quote }} - WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL | default "1s" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_POLLING_INTERVAL | default "5s" | quote }} WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_PROCESSING_TIMEOUT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_PROCESSING_TIMEOUT | default "12s" | quote }} WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_RETRIES: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_RETRIES | default "5" | quote }} WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_PENDING_TIME: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_PENDING_TIME | default "2m" | quote }} - WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT | default "4" | quote }} + WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT: {{ .Values.inbound.configmap.WEBHOOK_ENTITY_CASHOUT_TERMINAL_EVENT_MAX_CONCURRENT | default "2" | quote }} # Security Tier Configuration (lib-commons v4.4.0) SECURITY_TIER: {{ .Values.inbound.configmap.SECURITY_TIER | default "" | quote }} From ffbf714e42e1c91f8d3d08dff9301f563cf4708f Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 10 Jul 2026 17:10:41 +0000 Subject: [PATCH 065/113] chore(release): 3.4.0-beta.2 ## (2026-07-10) ### Features * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 3b8d2e87..4883b240 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Inbound Version | Outbound Version | Reconciliation Version | | :---: | :---: | :---: | :---: | :---: | -| `3.4.0-beta.1` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | +| `3.4.0-beta.2` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | ----------------- diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index 34360531..60fdb9e8 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.4.0-beta.1 +version: 3.4.0-beta.2 # This is the version number of the application being deployed. appVersion: "1.7.5" # A list of keywords about the chart. This helps others discover the chart. From 9d3645db0ae9e53f89341ad21c28aa38720d6cc1 Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Fri, 10 Jul 2026 14:26:32 -0300 Subject: [PATCH 066/113] feat(plugin-br-pix-indirect-btg): add RECURRING FlowType entities to outbound configmap --- .../templates/outbound/configmap.yaml | 43 +++++++++++++++++++ 1 file changed, 43 insertions(+) diff --git a/charts/plugin-br-pix-indirect-btg/templates/outbound/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/outbound/configmap.yaml index 8c0096dc..baa369b3 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/outbound/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/outbound/configmap.yaml @@ -260,6 +260,49 @@ data: WEBHOOK_DICT_RECONCILIATION_JOB_BACKOFF_MULTIPLIER: {{ .Values.outbound.configmap.WEBHOOK_DICT_RECONCILIATION_JOB_BACKOFF_MULTIPLIER | default "2" | quote }} WEBHOOK_DICT_RECONCILIATION_JOB_MAX_CONCURRENT: {{ .Values.outbound.configmap.WEBHOOK_DICT_RECONCILIATION_JOB_MAX_CONCURRENT | default "2" | quote }} + # ============================================================================== + # RECURRING - Pix Automático (Low Throughput) + # ============================================================================== + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_ENABLED: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_ENABLED | default "true" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_URL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_URL | default "" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_WORKER_COUNT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_WORKER_COUNT | default "1" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_BATCH_SIZE: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_BATCH_SIZE | default "50" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_POLLING_INTERVAL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_POLLING_INTERVAL | default "10s" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_REQUEST_TIMEOUT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_REQUEST_TIMEOUT | default "30s" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_MAX_RETRIES: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_MAX_RETRIES | default "5" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_BACKOFF_MULTIPLIER: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_BACKOFF_MULTIPLIER | default "2" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_MAX_CONCURRENT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_MAX_CONCURRENT | default "2" | quote }} + + WEBHOOK_RECURRING_AUTHORIZATION_ENABLED: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_ENABLED | default "true" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_URL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_URL | default "" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_WORKER_COUNT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_WORKER_COUNT | default "1" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_BATCH_SIZE: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_BATCH_SIZE | default "50" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_POLLING_INTERVAL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_POLLING_INTERVAL | default "10s" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_TIMEOUT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_REQUEST_TIMEOUT | default "30s" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_MAX_RETRIES: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_MAX_RETRIES | default "5" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_BACKOFF_MULTIPLIER: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_BACKOFF_MULTIPLIER | default "2" | quote }} + WEBHOOK_RECURRING_AUTHORIZATION_MAX_CONCURRENT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_AUTHORIZATION_MAX_CONCURRENT | default "2" | quote }} + + WEBHOOK_RECURRING_CHARGE_ENABLED: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_ENABLED | default "true" | quote }} + WEBHOOK_RECURRING_CHARGE_URL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_URL | default "" | quote }} + WEBHOOK_RECURRING_CHARGE_WORKER_COUNT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_WORKER_COUNT | default "1" | quote }} + WEBHOOK_RECURRING_CHARGE_BATCH_SIZE: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_BATCH_SIZE | default "50" | quote }} + WEBHOOK_RECURRING_CHARGE_POLLING_INTERVAL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_POLLING_INTERVAL | default "10s" | quote }} + WEBHOOK_RECURRING_CHARGE_REQUEST_TIMEOUT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_REQUEST_TIMEOUT | default "30s" | quote }} + WEBHOOK_RECURRING_CHARGE_MAX_RETRIES: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_MAX_RETRIES | default "5" | quote }} + WEBHOOK_RECURRING_CHARGE_BACKOFF_MULTIPLIER: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_BACKOFF_MULTIPLIER | default "2" | quote }} + WEBHOOK_RECURRING_CHARGE_MAX_CONCURRENT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_CHARGE_MAX_CONCURRENT | default "2" | quote }} + + WEBHOOK_RECURRING_RECURRENCE_ENABLED: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_ENABLED | default "true" | quote }} + WEBHOOK_RECURRING_RECURRENCE_URL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_URL | default "" | quote }} + WEBHOOK_RECURRING_RECURRENCE_WORKER_COUNT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_WORKER_COUNT | default "1" | quote }} + WEBHOOK_RECURRING_RECURRENCE_BATCH_SIZE: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_BATCH_SIZE | default "50" | quote }} + WEBHOOK_RECURRING_RECURRENCE_POLLING_INTERVAL: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_POLLING_INTERVAL | default "10s" | quote }} + WEBHOOK_RECURRING_RECURRENCE_REQUEST_TIMEOUT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_REQUEST_TIMEOUT | default "30s" | quote }} + WEBHOOK_RECURRING_RECURRENCE_MAX_RETRIES: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_MAX_RETRIES | default "5" | quote }} + WEBHOOK_RECURRING_RECURRENCE_BACKOFF_MULTIPLIER: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_BACKOFF_MULTIPLIER | default "2" | quote }} + WEBHOOK_RECURRING_RECURRENCE_MAX_CONCURRENT: {{ .Values.outbound.configmap.WEBHOOK_RECURRING_RECURRENCE_MAX_CONCURRENT | default "2" | quote }} + # Security Tier Configuration (lib-commons v4.4.0) SECURITY_TIER: {{ .Values.outbound.configmap.SECURITY_TIER | default "" | quote }} SECURITY_ENFORCEMENT: {{ .Values.outbound.configmap.SECURITY_ENFORCEMENT | default "false" | quote }} From d8aa209a3a661762221ec816d50abd6f2a480bb3 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 10 Jul 2026 17:35:31 +0000 Subject: [PATCH 067/113] chore(release): 3.4.0-beta.3 ## (2026-07-10) ### Features * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) --- README.md | 2 +- charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 4883b240..901e617a 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Inbound Version | Outbound Version | Reconciliation Version | | :---: | :---: | :---: | :---: | :---: | -| `3.4.0-beta.2` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | +| `3.4.0-beta.3` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | ----------------- diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index 60fdb9e8..f378d456 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.4.0-beta.2 +version: 3.4.0-beta.3 # This is the version number of the application being deployed. appVersion: "1.7.5" # A list of keywords about the chart. This helps others discover the chart. From df8f89fa55b45336befb14cbaa49eeb3b36a559c Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 12:18:13 -0300 Subject: [PATCH 068/113] feat(flowker): add scheduler worker Deployment and full env surface Add a second Deployment running the bundled worker binary (/worker) on the shared flowker image, plus the complete app env surface: Schema Registry S3, WorkOS TM token mint (all-or-none gate), secrets backend, token cache, internal provider URLs, scheduler, and XSD validator knobs. Extract shared wait-for-mongodb + OTEL env into named helpers. X-Lerian-Ref: 0x1 --- charts/flowker/templates/_helpers.tpl | 103 +++++++++++++ charts/flowker/templates/configmap.yaml | 59 ++++++++ charts/flowker/templates/deployment.yaml | 30 +--- charts/flowker/templates/secrets.yaml | 17 +++ .../flowker/templates/worker/configmap.yaml | 25 ++++ .../flowker/templates/worker/deployment.yaml | 113 ++++++++++++++ .../templates/worker/serviceaccount.yaml | 17 +++ charts/flowker/values.yaml | 138 ++++++++++++++++++ 8 files changed, 474 insertions(+), 28 deletions(-) create mode 100644 charts/flowker/templates/worker/configmap.yaml create mode 100644 charts/flowker/templates/worker/deployment.yaml create mode 100644 charts/flowker/templates/worker/serviceaccount.yaml diff --git a/charts/flowker/templates/_helpers.tpl b/charts/flowker/templates/_helpers.tpl index f331de3d..7f013077 100644 --- a/charts/flowker/templates/_helpers.tpl +++ b/charts/flowker/templates/_helpers.tpl @@ -66,6 +66,65 @@ Create the name of the service account to use {{- end }} {{- end }} +{{/* +================================================================================ +WORKER HELPERS +The scheduler worker is a SECOND Deployment running the SAME flowker image with +its command overridden to /worker. It reuses the api ConfigMap + Secret and +layers worker-only env on top. It gets its OWN app.kubernetes.io/name so its +(immutable) selector never overlaps the api Deployment's. +================================================================================ +*/}} + +{{/* Worker resource name: "-worker". */}} +{{- define "flowker.worker.fullname" -}} +{{- printf "%s-worker" (include "flowker.fullname" .) | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* Worker app name (distinct from the api so selectors don't overlap). */}} +{{- define "flowker.worker.name" -}} +{{- printf "%s-worker" (include "flowker.name" .) | trunc 63 | trimSuffix "-" -}} +{{- end }} + +{{/* Worker selector labels — distinct name keeps the two Deployments apart. */}} +{{- define "flowker.worker.selectorLabels" -}} +app.kubernetes.io/name: {{ include "flowker.worker.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- end }} + +{{/* Worker common labels. */}} +{{/* FIXME(nitpick): app.kubernetes.io/version tracks the api image tag, not + worker.image.tag when overridden (ring-helm, 2026-07-10, Cosmetic). */}} +{{- define "flowker.worker.labels" -}} +helm.sh/chart: {{ include "flowker.chart" .context }} +{{ include "flowker.worker.selectorLabels" (dict "context" .context) }} +app.kubernetes.io/version: {{ include "flowker.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +app.kubernetes.io/component: worker +{{- end }} + +{{/* Worker ServiceAccount name (own SA, or reuse the api's when not creating). */}} +{{- define "flowker.worker.serviceAccountName" -}} +{{- $w := .Values.worker | default dict -}} +{{- $sa := $w.serviceAccount | default dict -}} +{{- if $sa.create }} +{{- default (include "flowker.worker.fullname" .) $sa.name }} +{{- else }} +{{- default (include "flowker.serviceAccountName" .) $sa.name }} +{{- end }} +{{- end }} + +{{/* Worker enabled — gated by flowker.enabled; nil-aware on worker.enabled + (unset/true enables, explicit false disables). */}} +{{- define "flowker.worker.enabled" -}} +{{- $w := .Values.worker | default dict -}} +{{- if and .Values.flowker.enabled (ne (toString $w.enabled) "false") -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + {{/* Expand the namespace of the release. Allows overriding it for multi-namespace deployments in combined charts. @@ -144,6 +203,50 @@ Input (dict): context (root .), secretName (app Secret name for the external-inl {{- end }} {{- end }} +{{/* +flowker.waitForMongoInit — the shared wait-for-mongodb init container, used by +both the api and worker Deployments so they never drift. Input (dict): context (root .). +*/}} +{{- define "flowker.waitForMongoInit" -}} +{{- $ctx := .context -}} +- name: wait-for-mongodb + image: busybox:1.37 + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + {{- $mongoHost := include "flowker.mongoHost" $ctx }} + echo "Checking {{ $mongoHost }}:27017..."; + while ! nc -z "{{ $mongoHost }}" 27017; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for MongoDB after ${TIMEOUT}s"; + exit 1; + fi; + echo "MongoDB is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "MongoDB is ready!"; +{{- end }} + +{{/* +flowker.otelHostEnv — HOST_IP + OTEL endpoint env, emitted only when telemetry +is enabled. Shared by the api and worker Deployments. Input (dict): context (root .). +*/}} +{{- define "flowker.otelHostEnv" -}} +{{- $ctx := .context -}} +{{- if eq (toString $ctx.Values.flowker.configmap.ENABLE_TELEMETRY) "true" }} +- name: "HOST_IP" + valueFrom: + fieldRef: + fieldPath: status.hostIP +- name: "OTEL_EXPORTER_OTLP_ENDPOINT" + value: "$(HOST_IP):4317" +{{- end }} +{{- end }} + {{/* Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra Secret/Service names render even when all bundled subcharts are disabled diff --git a/charts/flowker/templates/configmap.yaml b/charts/flowker/templates/configmap.yaml index 1aebafd8..1bdc7be4 100644 --- a/charts/flowker/templates/configmap.yaml +++ b/charts/flowker/templates/configmap.yaml @@ -87,6 +87,65 @@ data: MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.flowker.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }} {{- end }} + # HTTP egress body cap (bytes). Caps request/response bodies on provider calls. + HTTP_MAX_BODY_BYTES: {{ .Values.flowker.configmap.HTTP_MAX_BODY_BYTES | default "10485760" | quote }} + + # CORS wildcard (lib-commons parity). Secure-by-default false; local overrides to true. + ALLOW_CORS_WILDCARD: {{ .Values.flowker.configmap.ALLOW_CORS_WILDCARD | default "false" | quote }} + + # Internal (Lerian-managed) provider base URLs. Empty = stored config doc value used. + MIDAZ_BASE_URL: {{ .Values.flowker.configmap.MIDAZ_BASE_URL | default "" | quote }} + TRACER_BASE_URL: {{ .Values.flowker.configmap.TRACER_BASE_URL | default "" | quote }} + + # Schema Registry auth gates (secure default: true) + XSD_SCHEMAS_AUTH_ENABLED: {{ .Values.flowker.configmap.XSD_SCHEMAS_AUTH_ENABLED | default "true" | quote }} + OPENAPI_SCHEMAS_AUTH_ENABLED: {{ .Values.flowker.configmap.OPENAPI_SCHEMAS_AUTH_ENABLED | default "true" | quote }} + + # Schema Registry blob storage (S3). Graceful-off: empty bucket disables the S3 + # backend (boot proceeds Mongo-only). AWS creds come from the credential chain + # (IRSA / Roles Anywhere). Empty region resolves via the standard AWS SDK chain. + SCHEMA_REGISTRY_S3_BUCKET: {{ .Values.flowker.configmap.SCHEMA_REGISTRY_S3_BUCKET | default "" | quote }} + SCHEMA_REGISTRY_S3_REGION: {{ .Values.flowker.configmap.SCHEMA_REGISTRY_S3_REGION | default "" | quote }} + + # Shared OAuth2 token cache + TOKEN_CACHE_MAX_TTL_SEC: {{ .Values.flowker.configmap.TOKEN_CACHE_MAX_TTL_SEC | default "3600" | quote }} + TOKEN_CACHE_JANITOR_INTERVAL_SEC: {{ .Values.flowker.configmap.TOKEN_CACHE_JANITOR_INTERVAL_SEC | default "300" | quote }} + TOKEN_CACHE_REFRESH_BUFFER_SEC: {{ .Values.flowker.configmap.TOKEN_CACHE_REFRESH_BUFFER_SEC | default "60" | quote }} + TOKEN_CACHE_TENANT_SCOPED_DISABLED: {{ .Values.flowker.configmap.TOKEN_CACHE_TENANT_SCOPED_DISABLED | default "false" | quote }} + + # Secrets backend. unset = disabled (boots fine); tenant-manager = AWS Secrets + # Manager reader. WORKOS_TM_SERVICE_NAME MUST match FLOWKER_SECRETS_APPLICATION_NAME. + FLOWKER_SECRETS_BACKEND: {{ .Values.flowker.configmap.FLOWKER_SECRETS_BACKEND | default "" | quote }} + FLOWKER_SECRETS_CACHE_TTL_SEC: {{ .Values.flowker.configmap.FLOWKER_SECRETS_CACHE_TTL_SEC | default "" | quote }} + FLOWKER_SECRETS_APPLICATION_NAME: {{ .Values.flowker.configmap.FLOWKER_SECRETS_APPLICATION_NAME | default "" | quote }} + + # XSD validator (app-side knobs). The in-pod sidecar container and the loopback + # URL are wired in a follow-up phase; empty URL keeps the feature unconfigured + # (never a hard boot dependency). ALLOW_INSECURE_HTTP secure-by-default false. + XSD_VALIDATOR_URL: {{ .Values.flowker.configmap.XSD_VALIDATOR_URL | default "" | quote }} + XSD_VALIDATOR_ALLOW_INSECURE_HTTP: {{ .Values.flowker.configmap.XSD_VALIDATOR_ALLOW_INSECURE_HTTP | default "false" | quote }} + + # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST + # is derived from the valkey subchart in a follow-up phase; empty keeps the + # scheduler queue a nil-safe no-op. This dedicated queue Redis MUST stay + # isolated from the tenant Pub/Sub Redis (MULTI_TENANT_REDIS_*). + SCHEDULER_ENABLED: {{ .Values.flowker.configmap.SCHEDULER_ENABLED | default "true" | quote }} + SCHEDULER_REDIS_HOST: {{ .Values.flowker.configmap.SCHEDULER_REDIS_HOST | default "" | quote }} + SCHEDULER_REDIS_PORT: {{ .Values.flowker.configmap.SCHEDULER_REDIS_PORT | default "6379" | quote }} + SCHEDULER_REDIS_TLS: {{ .Values.flowker.configmap.SCHEDULER_REDIS_TLS | default "false" | quote }} + SCHEDULER_REDIS_DB: {{ .Values.flowker.configmap.SCHEDULER_REDIS_DB | default "0" | quote }} + SCHEDULER_CONCURRENCY: {{ .Values.flowker.configmap.SCHEDULER_CONCURRENCY | default "10" | quote }} + + # WorkOS Tenant Manager token mint (feature #300) — ALL-OR-NONE. When enabled, + # URL + CLIENT_ID (here) + CLIENT_SECRET (Secret) are all required; a partial + # config is rejected at template time (mirrors the app's fail-fast boot check). + {{- if .Values.flowker.workosTmEnabled }} + WORKOS_TM_TOKEN_URL: {{ required "flowker.configmap.WORKOS_TM_TOKEN_URL is required when flowker.workosTmEnabled=true" .Values.flowker.configmap.WORKOS_TM_TOKEN_URL | quote }} + WORKOS_TM_CLIENT_ID: {{ required "flowker.configmap.WORKOS_TM_CLIENT_ID is required when flowker.workosTmEnabled=true" .Values.flowker.configmap.WORKOS_TM_CLIENT_ID | quote }} + WORKOS_TM_SCOPE: {{ .Values.flowker.configmap.WORKOS_TM_SCOPE | default "" | quote }} + WORKOS_TM_SERVICE_NAME: {{ .Values.flowker.configmap.WORKOS_TM_SERVICE_NAME | default "flowker" | quote }} + {{- end }} + # Extra Env Vars {{- with .Values.flowker.extraEnvVars }} {{- range $key, $value := . }} diff --git a/charts/flowker/templates/deployment.yaml b/charts/flowker/templates/deployment.yaml index e18ea71e..40e82457 100644 --- a/charts/flowker/templates/deployment.yaml +++ b/charts/flowker/templates/deployment.yaml @@ -38,26 +38,7 @@ spec: securityContext: {{- toYaml .Values.flowker.podSecurityContext | nindent 8 }} initContainers: - - name: wait-for-mongodb - image: busybox:1.37 - command: - - /bin/sh - - -c - - > - TIMEOUT=300; - ELAPSED=0; - {{- $mongoHost := include "flowker.mongoHost" . }} - echo "Checking {{ $mongoHost }}:27017..."; - while ! nc -z "{{ $mongoHost }}" 27017; do - if [ $ELAPSED -ge $TIMEOUT ]; then - echo "Timeout waiting for MongoDB after ${TIMEOUT}s"; - exit 1; - fi; - echo "MongoDB is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; - sleep 5; - ELAPSED=$((ELAPSED + 5)); - done; - echo "MongoDB is ready!"; + {{- include "flowker.waitForMongoInit" (dict "context" $) | nindent 8 }} containers: - name: {{ include "flowker.fullname" . }} securityContext: @@ -72,14 +53,7 @@ spec: env: {{- $secretName := ternary .Values.flowker.existingSecretName (include "flowker.fullname" .) .Values.flowker.useExistingSecret }} {{- include "flowker.mongoEnv" (dict "context" $ "secretName" $secretName) | nindent 10 }} - {{- if eq (toString .Values.flowker.configmap.ENABLE_TELEMETRY) "true" }} - - name: "HOST_IP" - valueFrom: - fieldRef: - fieldPath: status.hostIP - - name: "OTEL_EXPORTER_OTLP_ENDPOINT" - value: "$(HOST_IP):4317" - {{- end }} + {{- include "flowker.otelHostEnv" (dict "context" $) | nindent 10 }} ports: - name: http containerPort: {{ .Values.flowker.service.port }} diff --git a/charts/flowker/templates/secrets.yaml b/charts/flowker/templates/secrets.yaml index e754d3e0..eab34c02 100644 --- a/charts/flowker/templates/secrets.yaml +++ b/charts/flowker/templates/secrets.yaml @@ -23,7 +23,24 @@ stringData: MONGO_TLS_CA_CERT: {{ .Values.flowker.secrets.MONGO_TLS_CA_CERT | quote }} {{- end }} + # WorkOS Tenant Manager client secret (feature #300) — required when + # flowker.workosTmEnabled=true (all-or-none with WORKOS_TM_TOKEN_URL/CLIENT_ID). + # TODO(review): on the useExistingSecret=true path this whole Secret is skipped, + # so the client-secret required() is not enforced at template time (the app still + # fail-fasts at boot) (ring-helm, 2026-07-10, Low). + {{- if .Values.flowker.workosTmEnabled }} + WORKOS_TM_CLIENT_SECRET: {{ required "flowker.secrets.WORKOS_TM_CLIENT_SECRET is required when flowker.workosTmEnabled=true" .Values.flowker.secrets.WORKOS_TM_CLIENT_SECRET | quote }} + {{- end }} + + # Scheduler queue Redis password (optional for the external-Redis path; when the + # valkey subchart is bundled this is replaced by a secretKeyRef in a follow-up phase). + {{- if .Values.flowker.secrets.SCHEDULER_REDIS_PASSWORD }} + SCHEDULER_REDIS_PASSWORD: {{ .Values.flowker.secrets.SCHEDULER_REDIS_PASSWORD | quote }} + {{- end }} + # API key (when API_KEY_ENABLED=true) + # TODO(review): API_KEY has no required() guard when API_KEY_ENABLED=true — a + # partial config ships silently (ring-security-reviewer, 2026-07-10, Low). {{- if .Values.flowker.secrets.API_KEY }} API_KEY: {{ .Values.flowker.secrets.API_KEY | quote }} {{- end }} diff --git a/charts/flowker/templates/worker/configmap.yaml b/charts/flowker/templates/worker/configmap.yaml new file mode 100644 index 00000000..de0dd2cd --- /dev/null +++ b/charts/flowker/templates/worker/configmap.yaml @@ -0,0 +1,25 @@ +{{- if eq (include "flowker.worker.enabled" .) "true" }} +{{- $w := .Values.worker | default dict -}} +{{- $port := (($w.service).port | default 4022) -}} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "flowker.worker.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "flowker.worker.labels" (dict "context" .) | nindent 4 }} +data: + # Worker-only environment. Layered on top of the api ConfigMap + Secret (envFrom + # order in the worker Deployment), so keys here win over the shared api values. + # The worker binary serves its /health + /readyz probes on WORKER_SERVER_*. + WORKER_SERVER_PORT: {{ $port | quote }} + WORKER_SERVER_ADDRESS: {{ printf ":%v" $port | quote }} + OTEL_RESOURCE_SERVICE_NAME: {{ (($w.configmap).OTEL_RESOURCE_SERVICE_NAME) | default "flowker-worker" | quote }} + {{- with $w.configmap }} + {{- range $key, $value := . }} + {{- if not (has $key (list "WORKER_SERVER_PORT" "WORKER_SERVER_ADDRESS" "OTEL_RESOURCE_SERVICE_NAME")) }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/flowker/templates/worker/deployment.yaml b/charts/flowker/templates/worker/deployment.yaml new file mode 100644 index 00000000..846f3e8c --- /dev/null +++ b/charts/flowker/templates/worker/deployment.yaml @@ -0,0 +1,113 @@ +{{- if eq (include "flowker.worker.enabled" .) "true" }} +{{- $w := .Values.worker | default dict -}} +{{- $wImage := $w.image | default dict -}} +{{- $repo := $wImage.repository | default .Values.flowker.image.repository -}} +{{- $tag := $wImage.tag | default (include "flowker.defaultTag" .) -}} +{{- $pullPolicy := $wImage.pullPolicy | default .Values.flowker.image.pullPolicy -}} +{{- $pullSecrets := $w.imagePullSecrets | default .Values.flowker.imagePullSecrets -}} +{{- $secCtx := $w.securityContext | default .Values.flowker.securityContext -}} +{{- $podSecCtx := $w.podSecurityContext | default .Values.flowker.podSecurityContext -}} +{{- $port := (($w.service).port | default 4022) -}} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "flowker.worker.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "flowker.worker.labels" (dict "context" .) | nindent 4 }} +spec: + revisionHistoryLimit: {{ $w.revisionHistoryLimit | default 10 }} + {{- with $w.deploymentStrategy }} + strategy: + {{- toYaml . | nindent 4 }} + {{- end }} + # Fixed single replica: the scheduler consume server and background jobs are + # not leader-gated yet, so a second replica would double-process. Do NOT add an HPA. + replicas: {{ $w.replicaCount | default 1 }} + selector: + matchLabels: + {{- include "flowker.worker.selectorLabels" (dict "context" .) | nindent 6 }} + template: + metadata: + {{- with $w.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "flowker.worker.labels" (dict "context" .) | nindent 8 }} + spec: + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "flowker.worker.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds | default 60 }} + securityContext: + {{- toYaml $podSecCtx | nindent 8 }} + initContainers: + {{- include "flowker.waitForMongoInit" (dict "context" $) | nindent 8 }} + containers: + - name: {{ include "flowker.worker.fullname" . }} + securityContext: + {{- toYaml $secCtx | nindent 12 }} + image: "{{ $repo }}:{{ $tag }}" + imagePullPolicy: {{ $pullPolicy }} + # Runs the worker binary bundled in the shared flowker image. + command: + {{- toYaml ($w.command | default (list "/worker")) | nindent 12 }} + envFrom: + # Shared config + secrets from the api (single source of truth). + - secretRef: + name: {{ if .Values.flowker.useExistingSecret }}{{ .Values.flowker.existingSecretName }}{{ else }}{{ include "flowker.fullname" . }}{{ end }} + - configMapRef: + name: {{ include "flowker.fullname" . }} + # Worker-only overrides (WORKER_SERVER_*, OTEL name) — last so its keys win. + - configMapRef: + name: {{ include "flowker.worker.fullname" . }} + env: + {{- $secretName := ternary .Values.flowker.existingSecretName (include "flowker.fullname" .) .Values.flowker.useExistingSecret }} + {{- include "flowker.mongoEnv" (dict "context" $ "secretName" $secretName) | nindent 10 }} + {{- include "flowker.otelHostEnv" (dict "context" $) | nindent 10 }} + {{- with $w.extraEnvVars }} + {{- range $key, $value := . }} + - name: {{ $key }} + value: {{ $value | quote }} + {{- end }} + {{- end }} + ports: + - name: http + containerPort: {{ $port }} + protocol: TCP + livenessProbe: + httpGet: + path: {{ (($w.livenessProbe).path) | default "/health" }} + port: http + initialDelaySeconds: {{ (($w.livenessProbe).initialDelaySeconds) | default 15 }} + periodSeconds: {{ (($w.livenessProbe).periodSeconds) | default 20 }} + timeoutSeconds: {{ (($w.livenessProbe).timeoutSeconds) | default 5 }} + successThreshold: {{ (($w.livenessProbe).successThreshold) | default 1 }} + failureThreshold: {{ (($w.livenessProbe).failureThreshold) | default 3 }} + readinessProbe: + httpGet: + path: {{ (($w.readinessProbe).path) | default "/readyz" }} + port: http + initialDelaySeconds: {{ (($w.readinessProbe).initialDelaySeconds) | default 5 }} + periodSeconds: {{ (($w.readinessProbe).periodSeconds) | default 10 }} + timeoutSeconds: {{ (($w.readinessProbe).timeoutSeconds) | default 5 }} + successThreshold: {{ (($w.readinessProbe).successThreshold) | default 1 }} + failureThreshold: {{ (($w.readinessProbe).failureThreshold) | default 3 }} + resources: + {{- toYaml ($w.resources | default .Values.flowker.resources) | nindent 12 }} + {{- with $w.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $w.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $w.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/flowker/templates/worker/serviceaccount.yaml b/charts/flowker/templates/worker/serviceaccount.yaml new file mode 100644 index 00000000..07ef369e --- /dev/null +++ b/charts/flowker/templates/worker/serviceaccount.yaml @@ -0,0 +1,17 @@ +{{- if eq (include "flowker.worker.enabled" .) "true" }} +{{- $w := .Values.worker | default dict -}} +{{- $sa := $w.serviceAccount | default dict -}} +{{- if $sa.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "flowker.worker.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "flowker.worker.labels" (dict "context" .) | nindent 4 }} + {{- with $sa.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index 5be0b927..74b3250c 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -173,6 +173,12 @@ flowker: # -- Affinity rules for pod scheduling affinity: {} + # -- Enable the WorkOS Tenant Manager token-mint feature (#300). ALL-OR-NONE: + # when true, WORKOS_TM_TOKEN_URL + WORKOS_TM_CLIENT_ID (configmap) and + # WORKOS_TM_CLIENT_SECRET (secrets) are all required (rejected at template time + # if partial). WORKOS_TM_SERVICE_NAME must match FLOWKER_SECRETS_APPLICATION_NAME. + workosTmEnabled: false + # -- ConfigMap for environment variables and configurations # @default -- templates/configmap.yaml configmap: @@ -281,6 +287,61 @@ flowker: MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" + # HTTP egress body cap (bytes). Caps request/response bodies on provider calls. + HTTP_MAX_BODY_BYTES: "10485760" + # -- Allow CORS wildcard (lib-commons parity). Secure-by-default false; local overrides to true. + ALLOW_CORS_WILDCARD: "false" + + # Internal (Lerian-managed) provider base URLs. Empty = stored config doc value used. + MIDAZ_BASE_URL: "" + TRACER_BASE_URL: "" + + # Schema Registry auth gates (secure default: true) + XSD_SCHEMAS_AUTH_ENABLED: "true" + OPENAPI_SCHEMAS_AUTH_ENABLED: "true" + + # Schema Registry blob storage (S3). Graceful-off when bucket empty (Mongo-only + # boot). AWS creds come from the credential chain (IRSA / Roles Anywhere). + SCHEMA_REGISTRY_S3_BUCKET: "" + # -- AWS region for the Schema Registry S3 store. Empty = resolved by the AWS SDK chain. + SCHEMA_REGISTRY_S3_REGION: "" + + # Shared OAuth2 token cache + TOKEN_CACHE_MAX_TTL_SEC: "3600" + TOKEN_CACHE_JANITOR_INTERVAL_SEC: "300" + TOKEN_CACHE_REFRESH_BUFFER_SEC: "60" + TOKEN_CACHE_TENANT_SCOPED_DISABLED: "false" + + # Secrets backend. Empty = disabled (boots fine); "tenant-manager" = AWS Secrets + # Manager reader. FLOWKER_SECRETS_APPLICATION_NAME must match WORKOS_TM_SERVICE_NAME. + FLOWKER_SECRETS_BACKEND: "" + FLOWKER_SECRETS_CACHE_TTL_SEC: "" + FLOWKER_SECRETS_APPLICATION_NAME: "" + + # XSD validator (app-side knobs). The in-pod sidecar + loopback URL are wired in + # a follow-up phase; empty URL keeps the feature unconfigured (never a boot dep). + XSD_VALIDATOR_URL: "" + # -- Allow cleartext http:// to the in-pod XSD sidecar. Secure-by-default false. + XSD_VALIDATOR_ALLOW_INSECURE_HTTP: "false" + + # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST is + # derived from the valkey subchart in a follow-up phase; empty keeps the scheduler + # queue a nil-safe no-op. Keep this queue Redis isolated from MULTI_TENANT_REDIS_*. + SCHEDULER_ENABLED: "true" + SCHEDULER_REDIS_HOST: "" + SCHEDULER_REDIS_PORT: "6379" + SCHEDULER_REDIS_TLS: "false" + SCHEDULER_REDIS_DB: "0" + SCHEDULER_CONCURRENCY: "10" + + # WorkOS Tenant Manager token mint (#300). Emitted only when flowker.workosTmEnabled=true. + WORKOS_TM_TOKEN_URL: "" + WORKOS_TM_CLIENT_ID: "" + # -- Optional space-delimited scope (e.g. backoffice:tm:m2m:write). + WORKOS_TM_SCOPE: "" + # -- Flowker service name as the Tenant Manager knows it. Must match FLOWKER_SECRETS_APPLICATION_NAME. + WORKOS_TM_SERVICE_NAME: "flowker" + # -- Secrets for storing sensitive data # @default -- templates/secrets.yaml secrets: @@ -299,6 +360,11 @@ flowker: MULTI_TENANT_SERVICE_API_KEY: "" # -- Redis password for tenant Pub/Sub (optional) MULTI_TENANT_REDIS_PASSWORD: "" + # -- WorkOS Tenant Manager client secret (required when flowker.workosTmEnabled=true) + WORKOS_TM_CLIENT_SECRET: "" + # -- Scheduler queue Redis password (external-Redis path; the valkey subchart + # supplies this via secretKeyRef in a follow-up phase) + SCHEDULER_REDIS_PASSWORD: "" # -- Use an existing secret instead of creating one useExistingSecret: false @@ -317,6 +383,78 @@ flowker: # @default -- `flowker.fullname` name: "" +# -- Scheduler worker: a second Deployment running the SAME flowker image with +# its command overridden to /worker. Runs the queue-backed scheduler consume +# server and background jobs. Reuses the api ConfigMap + Secret. +worker: + # -- Enable or disable the worker Deployment + enabled: true + # -- Number of replicas (fixed; the worker is not leader-gated — do NOT add an HPA) + replicaCount: 1 + # -- Number of old ReplicaSets to retain + revisionHistoryLimit: 10 + + # -- Image override. Empty repository/tag inherit the api image (flowker.image). + image: + repository: "" + tag: "" + pullPolicy: IfNotPresent + + # -- Container entrypoint (the worker binary bundled in the flowker image) + command: + - /worker + + # -- Secrets for pulling images from a private registry (inherits api when empty) + imagePullSecrets: [] + + # -- Deployment update strategy. Recreate avoids two schedulers overlapping mid-rollout. + deploymentStrategy: + type: Recreate + + # -- Grace period (s) for the scheduler consume server to drain in-flight jobs on SIGTERM. + terminationGracePeriodSeconds: 60 + + service: + # -- Worker probe port (WORKER_SERVER_PORT). The worker serves only /health + /readyz. + port: 4022 + + # -- Pod-level security context (inherits flowker.podSecurityContext when empty) + podSecurityContext: {} + # -- Container-level security context (inherits flowker.securityContext when empty) + securityContext: {} + + # -- Resource requests/limits (inherits flowker.resources when empty) + resources: {} + + # -- Readiness probe overrides + readinessProbe: {} + # -- Liveness probe overrides + livenessProbe: {} + + # -- Pod annotations + podAnnotations: {} + # -- Node selector + nodeSelector: {} + # -- Tolerations + tolerations: {} + # -- Affinity rules + affinity: {} + + # -- Extra environment variables (rendered as literal name/value pairs) + extraEnvVars: {} + + # -- Worker-only ConfigMap overrides (layered last; wins over the api ConfigMap) + configmap: {} + + serviceAccount: + # -- Create a dedicated worker ServiceAccount (false reuses the api SA) + create: true + # -- Annotations for the worker ServiceAccount (e.g. IRSA role-arn) + annotations: {} + # -- Name override + # @default -- `flowker.worker.fullname` + name: "" + mongodb: # MongoDB document database for flowker data storage enabled: true From 1817beee8aad91199d16858f7829edf1470d7433 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 12:39:43 -0300 Subject: [PATCH 069/113] feat(flowker): add in-pod XSD validator sidecar Inject the flowker-xsd-validator sidecar into the api and worker pods with a hardened securityContext (uid/gid 65532, read-only rootfs). Flowker reaches it over loopback: XSD_VALIDATOR_URL auto-wires to http://localhost:8081 and the cleartext ack is scoped to the in-pod hop only (an off-pod URL override defaults back to secure). Default-on; disable via flowker.xsdValidator.enabled=false. X-Lerian-Ref: 0x1 --- charts/flowker/templates/_helpers.tpl | 78 +++++++++++++++++++ charts/flowker/templates/configmap.yaml | 15 ++-- charts/flowker/templates/deployment.yaml | 3 + .../flowker/templates/worker/deployment.yaml | 3 + charts/flowker/values.yaml | 67 +++++++++++++++- 5 files changed, 157 insertions(+), 9 deletions(-) diff --git a/charts/flowker/templates/_helpers.tpl b/charts/flowker/templates/_helpers.tpl index 7f013077..f3e40ec3 100644 --- a/charts/flowker/templates/_helpers.tpl +++ b/charts/flowker/templates/_helpers.tpl @@ -247,6 +247,84 @@ is enabled. Shared by the api and worker Deployments. Input (dict): context (roo {{- end }} {{- end }} +{{/* +flowker.xsdValidator.enabled — nil-aware: unset/true enables, explicit false disables. +*/}} +{{- define "flowker.xsdValidator.enabled" -}} +{{- $x := .Values.flowker.xsdValidator | default dict -}} +{{- if and .Values.flowker.enabled (ne (toString $x.enabled) "false") -}} +true +{{- else -}} +false +{{- end -}} +{{- end -}} + +{{/* +flowker.xsdValidatorContainer — the in-pod XSD validator sidecar container, shared +by the api and worker pods. Flowker reaches it over loopback (XSD_VALIDATOR_URL). +Its own /v1 authorization delegates to the Access Manager (PLUGIN_AUTH_*), defaulting +to the app's PLUGIN_AUTH_* config. Input (dict): context (root .). +*/}} +{{- define "flowker.xsdValidatorContainer" -}} +{{- $ctx := .context -}} +{{- $x := $ctx.Values.flowker.xsdValidator | default dict -}} +{{- $img := $x.image | default dict -}} +{{- $repo := $img.repository | default "ghcr.io/lerianstudio/flowker-xsd-validator" -}} +{{- $tag := $img.tag | default (include "flowker.defaultTag" $ctx) -}} +{{- $pullPolicy := $img.pullPolicy | default $ctx.Values.flowker.image.pullPolicy -}} +{{- $port := (($x.port) | default 8081) -}} +{{- $pa := $x.pluginAuth | default dict -}} +{{- $lp := $x.livenessProbe | default dict -}} +{{- $rp := $x.readinessProbe | default dict -}} +- name: xsd-validator + image: "{{ $repo }}:{{ $tag }}" + imagePullPolicy: {{ $pullPolicy }} + securityContext: + {{- toYaml $x.securityContext | nindent 4 }} + env: + - name: PORT + value: {{ $port | quote }} + - name: ENV_NAME + value: {{ $x.envName | default $ctx.Values.flowker.configmap.ENV_NAME | default "development" | quote }} + - name: MAX_BODY_BYTES + value: {{ $x.maxBodyBytes | default "5242880" | quote }} + - name: READ_TIMEOUT + value: {{ $x.readTimeout | default "10s" | quote }} + - name: WRITE_TIMEOUT + value: {{ $x.writeTimeout | default "10s" | quote }} + - name: PLUGIN_AUTH_ENABLED + {{- /* toString distinguishes set-vs-unset so a typed bool false is honored (not swallowed by default) */}} + value: {{ (ne (toString $pa.enabled) "") | ternary (toString $pa.enabled) ($ctx.Values.flowker.configmap.PLUGIN_AUTH_ENABLED | default "false") | quote }} + - name: PLUGIN_AUTH_ADDRESS + value: {{ $pa.address | default $ctx.Values.flowker.configmap.PLUGIN_AUTH_ADDRESS | default "" | quote }} + - name: PLUGIN_AUTH_ALLOW_INSECURE_HTTP + value: {{ $pa.allowInsecureHttp | default "false" | quote }} + ports: + - name: xsd + containerPort: {{ $port }} + protocol: TCP + livenessProbe: + httpGet: + path: /health + port: xsd + initialDelaySeconds: {{ $lp.initialDelaySeconds | default 10 }} + periodSeconds: {{ $lp.periodSeconds | default 20 }} + timeoutSeconds: {{ $lp.timeoutSeconds | default 5 }} + successThreshold: {{ $lp.successThreshold | default 1 }} + failureThreshold: {{ $lp.failureThreshold | default 3 }} + readinessProbe: + httpGet: + path: /health + port: xsd + initialDelaySeconds: {{ $rp.initialDelaySeconds | default 5 }} + periodSeconds: {{ $rp.periodSeconds | default 10 }} + timeoutSeconds: {{ $rp.timeoutSeconds | default 5 }} + successThreshold: {{ $rp.successThreshold | default 1 }} + failureThreshold: {{ $rp.failureThreshold | default 3 }} + resources: + {{- toYaml $x.resources | nindent 4 }} +{{- end }} + {{/* Vendored from Bitnami common (charts/common/templates/_names.tpl) so infra Secret/Service names render even when all bundled subcharts are disabled diff --git a/charts/flowker/templates/configmap.yaml b/charts/flowker/templates/configmap.yaml index 1bdc7be4..7a83e4fa 100644 --- a/charts/flowker/templates/configmap.yaml +++ b/charts/flowker/templates/configmap.yaml @@ -119,11 +119,16 @@ data: FLOWKER_SECRETS_CACHE_TTL_SEC: {{ .Values.flowker.configmap.FLOWKER_SECRETS_CACHE_TTL_SEC | default "" | quote }} FLOWKER_SECRETS_APPLICATION_NAME: {{ .Values.flowker.configmap.FLOWKER_SECRETS_APPLICATION_NAME | default "" | quote }} - # XSD validator (app-side knobs). The in-pod sidecar container and the loopback - # URL are wired in a follow-up phase; empty URL keeps the feature unconfigured - # (never a hard boot dependency). ALLOW_INSECURE_HTTP secure-by-default false. - XSD_VALIDATOR_URL: {{ .Values.flowker.configmap.XSD_VALIDATOR_URL | default "" | quote }} - XSD_VALIDATOR_ALLOW_INSECURE_HTTP: {{ .Values.flowker.configmap.XSD_VALIDATOR_ALLOW_INSECURE_HTTP | default "false" | quote }} + # XSD validator (app-side knobs). When the in-pod sidecar is enabled, the URL + # defaults to the loopback sidecar and cleartext http is acknowledged for that + # same-pod hop; an explicit override always wins. When the sidecar is disabled + # the URL is empty (feature unconfigured — never a hard boot dependency). + {{- $xsdOn := eq (include "flowker.xsdValidator.enabled" .) "true" }} + {{- $xsdPort := ((.Values.flowker.xsdValidator).port | default 8081) }} + {{- $xsdUrlOverridden := ne (.Values.flowker.configmap.XSD_VALIDATOR_URL | default "") "" }} + XSD_VALIDATOR_URL: {{ .Values.flowker.configmap.XSD_VALIDATOR_URL | default (ternary (printf "http://localhost:%v" $xsdPort) "" $xsdOn) | quote }} + {{- /* cleartext is auto-acknowledged ONLY for the in-pod loopback URL; an explicit off-pod override must opt in deliberately */}} + XSD_VALIDATOR_ALLOW_INSECURE_HTTP: {{ .Values.flowker.configmap.XSD_VALIDATOR_ALLOW_INSECURE_HTTP | default (ternary "true" "false" (and $xsdOn (not $xsdUrlOverridden))) | quote }} # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST # is derived from the valkey subchart in a follow-up phase; empty keeps the diff --git a/charts/flowker/templates/deployment.yaml b/charts/flowker/templates/deployment.yaml index 40e82457..97387e79 100644 --- a/charts/flowker/templates/deployment.yaml +++ b/charts/flowker/templates/deployment.yaml @@ -78,6 +78,9 @@ spec: failureThreshold: {{ .Values.flowker.readinessProbe.failureThreshold | default 3 }} resources: {{- toYaml .Values.flowker.resources | nindent 12 }} + {{- if eq (include "flowker.xsdValidator.enabled" .) "true" }} + {{- include "flowker.xsdValidatorContainer" (dict "context" $) | nindent 8 }} + {{- end }} {{- with .Values.flowker.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/flowker/templates/worker/deployment.yaml b/charts/flowker/templates/worker/deployment.yaml index 846f3e8c..1f1019da 100644 --- a/charts/flowker/templates/worker/deployment.yaml +++ b/charts/flowker/templates/worker/deployment.yaml @@ -98,6 +98,9 @@ spec: failureThreshold: {{ (($w.readinessProbe).failureThreshold) | default 3 }} resources: {{- toYaml ($w.resources | default .Values.flowker.resources) | nindent 12 }} + {{- if eq (include "flowker.xsdValidator.enabled" .) "true" }} + {{- include "flowker.xsdValidatorContainer" (dict "context" $) | nindent 8 }} + {{- end }} {{- with $w.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index 74b3250c..4d23bbf3 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -179,6 +179,63 @@ flowker: # if partial). WORKOS_TM_SERVICE_NAME must match FLOWKER_SECRETS_APPLICATION_NAME. workosTmEnabled: false + # -- In-pod XSD validator sidecar (stateless Go + libxml2). Injected into the api + # and worker pods; Flowker reaches it over loopback (XSD_VALIDATOR_URL is wired + # automatically when enabled). Its /v1 authorization delegates to the Access + # Manager (pluginAuth.*), defaulting to the app's PLUGIN_AUTH_* config. + xsdValidator: + # -- Enable or disable the sidecar + enabled: true + image: + # -- Sidecar image repository + repository: ghcr.io/lerianstudio/flowker-xsd-validator + # -- Image tag (empty inherits the flowker app tag) + tag: "" + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Listen port (also the loopback URL port Flowker targets) + port: 8081 + # -- ENV_NAME (empty inherits flowker.configmap.ENV_NAME) + envName: "" + # -- Inbound body size cap in bytes (XML + XSD + imports) + maxBodyBytes: "5242880" + # -- Max time to read a full request (Go duration) + readTimeout: "10s" + # -- Max time to write the response (Go duration) + writeTimeout: "10s" + pluginAuth: + # -- Delegate /v1 authorization to the Access Manager (empty inherits flowker PLUGIN_AUTH_ENABLED) + enabled: "" + # -- Access Manager base URL (empty inherits flowker PLUGIN_AUTH_ADDRESS) + address: "" + # -- Acknowledge cleartext http:// to the Access Manager. Secure-by-default false. + allowInsecureHttp: "false" + resources: + # -- CPU/memory limits + limits: + cpu: 250m + memory: 256Mi + # -- CPU/memory requests + requests: + cpu: 50m + memory: 64Mi + # -- Hardened container security context (matches the sidecar image: uid/gid 65532, read-only rootfs) + securityContext: + runAsUser: 65532 + runAsGroup: 65532 + runAsNonRoot: true + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + # -- Liveness probe overrides (httpGet /health on the sidecar port) + livenessProbe: {} + # -- Readiness probe overrides + readinessProbe: {} + # -- ConfigMap for environment variables and configurations # @default -- templates/configmap.yaml configmap: @@ -318,11 +375,13 @@ flowker: FLOWKER_SECRETS_CACHE_TTL_SEC: "" FLOWKER_SECRETS_APPLICATION_NAME: "" - # XSD validator (app-side knobs). The in-pod sidecar + loopback URL are wired in - # a follow-up phase; empty URL keeps the feature unconfigured (never a boot dep). + # XSD validator (app-side knobs). Leave EMPTY to auto-derive from the in-pod + # sidecar (flowker.xsdValidator.enabled): URL -> http://localhost: and + # ALLOW_INSECURE_HTTP -> true (the same-pod cleartext hop). Set a value here to + # override (e.g. an external https:// validator). Empty + sidecar disabled keeps + # the feature unconfigured (never a hard boot dependency). XSD_VALIDATOR_URL: "" - # -- Allow cleartext http:// to the in-pod XSD sidecar. Secure-by-default false. - XSD_VALIDATOR_ALLOW_INSECURE_HTTP: "false" + XSD_VALIDATOR_ALLOW_INSECURE_HTTP: "" # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST is # derived from the valkey subchart in a follow-up phase; empty keeps the scheduler From 3f5fe0bc8bb7db528adecf06bb7756f0367e8199 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 13:13:12 -0300 Subject: [PATCH 070/113] feat(flowker): add valkey subchart backing the scheduler queue Bundle valkey 0.7.4 (default off) as the scheduler queue Redis, mirroring the fetcher/reporter house pattern. SCHEDULER_REDIS_HOST auto-derives to the subchart's real Service name (-valkey) via common.names.dependency.fullname when valkey.enabled=true, honors fullnameOverride, and yields to an explicit override; empty (off) keeps the scheduler a nil-safe no-op. valkey auth is off by default (inline ACL) with an app-side SCHEDULER_REDIS_PASSWORD opt-in. The queue Redis stays isolated from the tenant Pub/Sub Redis (MULTI_TENANT_REDIS_*). X-Lerian-Ref: 0x1 --- charts/flowker/Chart.lock | 7 +++++-- charts/flowker/Chart.yaml | 4 ++++ charts/flowker/templates/_helpers.tpl | 8 ++++++++ charts/flowker/templates/configmap.yaml | 16 +++++++++++----- charts/flowker/templates/secrets.yaml | 4 ++-- charts/flowker/values.yaml | 24 +++++++++++++++++++----- 6 files changed, 49 insertions(+), 14 deletions(-) diff --git a/charts/flowker/Chart.lock b/charts/flowker/Chart.lock index e63cd289..4823f20f 100644 --- a/charts/flowker/Chart.lock +++ b/charts/flowker/Chart.lock @@ -2,5 +2,8 @@ dependencies: - name: mongodb repository: https://charts.bitnami.com/bitnami version: 16.4.0 -digest: sha256:9ba722b7a43665565e6d93958986982b93d8714781b099c10e7bad5fde723b72 -generated: "2026-06-06T17:02:25.916332-03:00" +- name: valkey + repository: https://valkey.io/valkey-helm + version: 0.7.4 +digest: sha256:def3a0242b6481c271017af40ec0685770301e0e550979023cd1fc7b3e1712c9 +generated: "2026-07-10T12:46:18.152659-03:00" diff --git a/charts/flowker/Chart.yaml b/charts/flowker/Chart.yaml index 1f20e571..5d9d8266 100644 --- a/charts/flowker/Chart.yaml +++ b/charts/flowker/Chart.yaml @@ -25,3 +25,7 @@ dependencies: version: "16.4.0" repository: "https://charts.bitnami.com/bitnami" condition: mongodb.enabled + - name: valkey + version: "0.7.4" + repository: "https://valkey.io/valkey-helm" + condition: valkey.enabled diff --git a/charts/flowker/templates/_helpers.tpl b/charts/flowker/templates/_helpers.tpl index f3e40ec3..44a83a91 100644 --- a/charts/flowker/templates/_helpers.tpl +++ b/charts/flowker/templates/_helpers.tpl @@ -247,6 +247,14 @@ is enabled. Shared by the api and worker Deployments. Input (dict): context (roo {{- end }} {{- end }} +{{/* +flowker.valkey.enabled — true only for an explicit enable (default off). Backs the +scheduler queue Redis; an external Redis is used by overriding SCHEDULER_REDIS_HOST instead. +*/}} +{{- define "flowker.valkey.enabled" -}} +{{- eq (toString (.Values.valkey | default dict).enabled) "true" -}} +{{- end -}} + {{/* flowker.xsdValidator.enabled — nil-aware: unset/true enables, explicit false disables. */}} diff --git a/charts/flowker/templates/configmap.yaml b/charts/flowker/templates/configmap.yaml index 7a83e4fa..c24639c1 100644 --- a/charts/flowker/templates/configmap.yaml +++ b/charts/flowker/templates/configmap.yaml @@ -130,12 +130,18 @@ data: {{- /* cleartext is auto-acknowledged ONLY for the in-pod loopback URL; an explicit off-pod override must opt in deliberately */}} XSD_VALIDATOR_ALLOW_INSECURE_HTTP: {{ .Values.flowker.configmap.XSD_VALIDATOR_ALLOW_INSECURE_HTTP | default (ternary "true" "false" (and $xsdOn (not $xsdUrlOverridden))) | quote }} - # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST - # is derived from the valkey subchart in a follow-up phase; empty keeps the - # scheduler queue a nil-safe no-op. This dedicated queue Redis MUST stay - # isolated from the tenant Pub/Sub Redis (MULTI_TENANT_REDIS_*). + # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. When the bundled + # valkey subchart is enabled, SCHEDULER_REDIS_HOST auto-derives to its Service + # name; empty (valkey off, no override) keeps the scheduler queue a nil-safe + # no-op. This dedicated queue Redis MUST stay isolated from the tenant Pub/Sub + # Redis (MULTI_TENANT_REDIS_*). SCHEDULER_ENABLED: {{ .Values.flowker.configmap.SCHEDULER_ENABLED | default "true" | quote }} - SCHEDULER_REDIS_HOST: {{ .Values.flowker.configmap.SCHEDULER_REDIS_HOST | default "" | quote }} + {{- /* Derive the queue host from the valkey subchart's actual Service name (-valkey, or fullnameOverride) so it resolves under any release name; an explicit override always wins. */}} + {{- $valkeyHost := "" }} + {{- if eq (include "flowker.valkey.enabled" .) "true" }} + {{- $valkeyHost = include "common.names.dependency.fullname" (dict "chartName" "valkey" "chartValues" (.Values.valkey | default dict) "context" .) }} + {{- end }} + SCHEDULER_REDIS_HOST: {{ .Values.flowker.configmap.SCHEDULER_REDIS_HOST | default $valkeyHost | quote }} SCHEDULER_REDIS_PORT: {{ .Values.flowker.configmap.SCHEDULER_REDIS_PORT | default "6379" | quote }} SCHEDULER_REDIS_TLS: {{ .Values.flowker.configmap.SCHEDULER_REDIS_TLS | default "false" | quote }} SCHEDULER_REDIS_DB: {{ .Values.flowker.configmap.SCHEDULER_REDIS_DB | default "0" | quote }} diff --git a/charts/flowker/templates/secrets.yaml b/charts/flowker/templates/secrets.yaml index eab34c02..d988cbd3 100644 --- a/charts/flowker/templates/secrets.yaml +++ b/charts/flowker/templates/secrets.yaml @@ -32,8 +32,8 @@ stringData: WORKOS_TM_CLIENT_SECRET: {{ required "flowker.secrets.WORKOS_TM_CLIENT_SECRET is required when flowker.workosTmEnabled=true" .Values.flowker.secrets.WORKOS_TM_CLIENT_SECRET | quote }} {{- end }} - # Scheduler queue Redis password (optional for the external-Redis path; when the - # valkey subchart is bundled this is replaced by a secretKeyRef in a follow-up phase). + # Scheduler queue Redis password (optional). Set for an external/managed Redis, or + # when the bundled valkey subchart has auth enabled (its ACL must match this value). {{- if .Values.flowker.secrets.SCHEDULER_REDIS_PASSWORD }} SCHEDULER_REDIS_PASSWORD: {{ .Values.flowker.secrets.SCHEDULER_REDIS_PASSWORD | quote }} {{- end }} diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index 4d23bbf3..f2e93041 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -383,9 +383,10 @@ flowker: XSD_VALIDATOR_URL: "" XSD_VALIDATOR_ALLOW_INSECURE_HTTP: "" - # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. SCHEDULER_REDIS_HOST is - # derived from the valkey subchart in a follow-up phase; empty keeps the scheduler - # queue a nil-safe no-op. Keep this queue Redis isolated from MULTI_TENANT_REDIS_*. + # Scheduler (queue-backed `schedule` trigger). DEFAULT ON. Leave SCHEDULER_REDIS_HOST + # empty to auto-derive the bundled valkey Service name when valkey.enabled=true, or + # set it to point at an external/managed Redis; empty with valkey off keeps the + # scheduler queue a nil-safe no-op. Keep this queue Redis isolated from MULTI_TENANT_REDIS_*. SCHEDULER_ENABLED: "true" SCHEDULER_REDIS_HOST: "" SCHEDULER_REDIS_PORT: "6379" @@ -421,8 +422,8 @@ flowker: MULTI_TENANT_REDIS_PASSWORD: "" # -- WorkOS Tenant Manager client secret (required when flowker.workosTmEnabled=true) WORKOS_TM_CLIENT_SECRET: "" - # -- Scheduler queue Redis password (external-Redis path; the valkey subchart - # supplies this via secretKeyRef in a follow-up phase) + # -- Scheduler queue Redis password (optional): set for an external/managed Redis, + # or when the bundled valkey subchart has auth enabled (its ACL must match this). SCHEDULER_REDIS_PASSWORD: "" # -- Use an existing secret instead of creating one @@ -514,6 +515,19 @@ worker: # @default -- `flowker.worker.fullname` name: "" +# -- Valkey (Redis-compatible) in-cluster store backing the scheduler queue. +# Disabled by default: enable for an in-cluster queue Redis, or leave off and +# point flowker.configmap.SCHEDULER_REDIS_HOST at an external/managed Redis. +# When enabled, SCHEDULER_REDIS_HOST auto-derives to the subchart Service (-valkey). +# This queue Redis MUST stay isolated from the tenant Pub/Sub Redis (MULTI_TENANT_REDIS_*). +valkey: + enabled: false + auth: + # -- The valkey.io subchart uses inline ACL config (valkey.auth.aclConfig), not a + # password Secret; if you enable auth here, also set flowker.secrets.SCHEDULER_REDIS_PASSWORD + # on the app side to a credential that matches the ACL. Off by default (in-cluster ClusterIP). + enabled: false + mongodb: # MongoDB document database for flowker data storage enabled: true From 003b78320a2ad1ca2d067317027b95d641433434 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 13:29:56 -0300 Subject: [PATCH 071/113] feat(flowker): add AWS IRSA and Roles Anywhere signing sidecar IRSA works out of the box via the api and worker ServiceAccount annotations. For non-EKS clusters, aws.rolesAnywhere.enabled=true injects a hardened aws-signing-helper sidecar into both pods that serves temporary credentials over a loopback IMDS endpoint (127.0.0.1:9911) from the Roles Anywhere trust anchor/profile/role, with the client cert mounted read-only. The RA wiring (gate, pod securityContext with forced fsGroup 65532, IMDS env, sidecar, cert volume) is factored into shared helpers reused by both Deployments. required() guards fail the render fast on missing ARNs; default off. X-Lerian-Ref: 0x1 --- charts/flowker/templates/_helpers.tpl | 108 ++++++++++++++++++ charts/flowker/templates/deployment.yaml | 12 +- .../flowker/templates/worker/deployment.yaml | 12 +- charts/flowker/values.yaml | 30 +++++ 4 files changed, 160 insertions(+), 2 deletions(-) diff --git a/charts/flowker/templates/_helpers.tpl b/charts/flowker/templates/_helpers.tpl index 44a83a91..e5db0a93 100644 --- a/charts/flowker/templates/_helpers.tpl +++ b/charts/flowker/templates/_helpers.tpl @@ -255,6 +255,114 @@ scheduler queue Redis; an external Redis is used by overriding SCHEDULER_REDIS_H {{- eq (toString (.Values.valkey | default dict).enabled) "true" -}} {{- end -}} +{{/* +flowker.awsRolesAnywhere.enabled — true only when aws.rolesAnywhere.enabled is set +(default off). Used to gate the IAM Roles Anywhere signing sidecar on non-EKS clusters. +*/}} +{{- define "flowker.awsRolesAnywhere.enabled" -}} +{{- $ra := (.Values.aws | default dict).rolesAnywhere | default dict -}} +{{- eq (toString $ra.enabled) "true" -}} +{{- end -}} + +{{/* +flowker.podSecurityContext — renders the pod securityContext. When Roles Anywhere is +enabled it FORCES fsGroup 65532 (the sidecar runs uid/gid 65532 and reads the 0440 cert +Secret via that group; any other fsGroup would break credential serving) while preserving +all other base keys. Args: context (root $), base (the map). +*/}} +{{- define "flowker.podSecurityContext" -}} +{{- $base := .base | default dict -}} +{{- if eq (include "flowker.awsRolesAnywhere.enabled" .context) "true" -}} +{{- toYaml (merge (dict "fsGroup" 65532) (deepCopy $base)) -}} +{{- else -}} +{{- toYaml $base -}} +{{- end -}} +{{- end -}} + +{{/* +flowker.awsImdsEnv — env pointing the AWS SDK at the local signing-helper IMDS endpoint. +Args: context (root $). +*/}} +{{- define "flowker.awsImdsEnv" -}} +{{- $ra := (.context.Values.aws | default dict).rolesAnywhere | default dict -}} +{{- $port := (($ra.sidecar).port | default 9911) -}} +- name: AWS_EC2_METADATA_SERVICE_ENDPOINT + value: "http://127.0.0.1:{{ $port }}" +- name: AWS_EC2_METADATA_SERVICE_ENDPOINT_MODE + value: "IPv4" +{{- end -}} + +{{/* +flowker.awsSigningSidecar — the aws-signing-helper container serving credentials from the +Roles Anywhere trust anchor/profile/role over a loopback IMDS endpoint. Args: context (root $). +*/}} +{{- define "flowker.awsSigningSidecar" -}} +{{- $ctx := .context -}} +{{- $ra := ($ctx.Values.aws | default dict).rolesAnywhere | default dict -}} +{{- $sc := $ra.sidecar | default dict -}} +{{- $img := $sc.image | default dict -}} +{{- $port := ($sc.port | default 9911) -}} +- name: aws-signing-helper + image: "{{ $img.repository | default "public.ecr.aws/rolesanywhere/credential-helper" }}:{{ $img.tag | default "latest-amd64" }}" + imagePullPolicy: {{ $img.pullPolicy | default "IfNotPresent" }} + args: + - serve + - --certificate + - /certs/tls.crt + - --private-key + - /certs/tls.key + - --trust-anchor-arn + - "{{ required "aws.rolesAnywhere.trustAnchorArn is required when aws.rolesAnywhere.enabled=true" $ra.trustAnchorArn }}" + - --profile-arn + - "{{ required "aws.rolesAnywhere.profileArn is required when aws.rolesAnywhere.enabled=true" $ra.profileArn }}" + - --role-arn + - "{{ required "aws.rolesAnywhere.roleArn is required when aws.rolesAnywhere.enabled=true" $ra.roleArn }}" + - --region + - "{{ $ra.region | default "us-east-2" }}" + - --session-duration + - "{{ $ra.sessionDuration | default 3600 }}" + - --port + - "{{ $port }}" + ports: + - name: imds + containerPort: {{ $port }} + protocol: TCP + volumeMounts: + - name: iam-certs + mountPath: /certs + readOnly: true + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + capabilities: + drop: + - ALL + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + resources: + {{- toYaml ($sc.resources | default dict) | nindent 4 }} +{{- end -}} + +{{/* +flowker.awsCertsVolume — the iam-certs Secret volume backing the signing sidecar. +Args: context (root $). +*/}} +{{- define "flowker.awsCertsVolume" -}} +{{- $ra := (.context.Values.aws | default dict).rolesAnywhere | default dict -}} +- name: iam-certs + secret: + secretName: {{ $ra.certificateSecretName | default "flowker-iam-tls" }} + defaultMode: 0440 + items: + - key: tls.crt + path: tls.crt + - key: tls.key + path: tls.key +{{- end -}} + {{/* flowker.xsdValidator.enabled — nil-aware: unset/true enables, explicit false disables. */}} diff --git a/charts/flowker/templates/deployment.yaml b/charts/flowker/templates/deployment.yaml index 97387e79..102fa2a9 100644 --- a/charts/flowker/templates/deployment.yaml +++ b/charts/flowker/templates/deployment.yaml @@ -36,7 +36,7 @@ spec: {{- end }} serviceAccountName: {{ include "flowker.serviceAccountName" . }} securityContext: - {{- toYaml .Values.flowker.podSecurityContext | nindent 8 }} + {{- include "flowker.podSecurityContext" (dict "context" $ "base" .Values.flowker.podSecurityContext) | nindent 8 }} initContainers: {{- include "flowker.waitForMongoInit" (dict "context" $) | nindent 8 }} containers: @@ -54,6 +54,9 @@ spec: {{- $secretName := ternary .Values.flowker.existingSecretName (include "flowker.fullname" .) .Values.flowker.useExistingSecret }} {{- include "flowker.mongoEnv" (dict "context" $ "secretName" $secretName) | nindent 10 }} {{- include "flowker.otelHostEnv" (dict "context" $) | nindent 10 }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + {{- include "flowker.awsImdsEnv" (dict "context" $) | nindent 10 }} + {{- end }} ports: - name: http containerPort: {{ .Values.flowker.service.port }} @@ -81,6 +84,13 @@ spec: {{- if eq (include "flowker.xsdValidator.enabled" .) "true" }} {{- include "flowker.xsdValidatorContainer" (dict "context" $) | nindent 8 }} {{- end }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + {{- include "flowker.awsSigningSidecar" (dict "context" $) | nindent 8 }} + {{- end }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + volumes: + {{- include "flowker.awsCertsVolume" (dict "context" $) | nindent 8 }} + {{- end }} {{- with .Values.flowker.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/flowker/templates/worker/deployment.yaml b/charts/flowker/templates/worker/deployment.yaml index 1f1019da..11404f7d 100644 --- a/charts/flowker/templates/worker/deployment.yaml +++ b/charts/flowker/templates/worker/deployment.yaml @@ -43,7 +43,7 @@ spec: serviceAccountName: {{ include "flowker.worker.serviceAccountName" . }} terminationGracePeriodSeconds: {{ $w.terminationGracePeriodSeconds | default 60 }} securityContext: - {{- toYaml $podSecCtx | nindent 8 }} + {{- include "flowker.podSecurityContext" (dict "context" $ "base" $podSecCtx) | nindent 8 }} initContainers: {{- include "flowker.waitForMongoInit" (dict "context" $) | nindent 8 }} containers: @@ -68,6 +68,9 @@ spec: {{- $secretName := ternary .Values.flowker.existingSecretName (include "flowker.fullname" .) .Values.flowker.useExistingSecret }} {{- include "flowker.mongoEnv" (dict "context" $ "secretName" $secretName) | nindent 10 }} {{- include "flowker.otelHostEnv" (dict "context" $) | nindent 10 }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + {{- include "flowker.awsImdsEnv" (dict "context" $) | nindent 10 }} + {{- end }} {{- with $w.extraEnvVars }} {{- range $key, $value := . }} - name: {{ $key }} @@ -101,6 +104,13 @@ spec: {{- if eq (include "flowker.xsdValidator.enabled" .) "true" }} {{- include "flowker.xsdValidatorContainer" (dict "context" $) | nindent 8 }} {{- end }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + {{- include "flowker.awsSigningSidecar" (dict "context" $) | nindent 8 }} + {{- end }} + {{- if eq (include "flowker.awsRolesAnywhere.enabled" .) "true" }} + volumes: + {{- include "flowker.awsCertsVolume" (dict "context" $) | nindent 8 }} + {{- end }} {{- with $w.nodeSelector }} nodeSelector: {{- toYaml . | nindent 8 }} diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index f2e93041..a953ddd5 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -528,6 +528,36 @@ valkey: # on the app side to a credential that matches the ACL. Off by default (in-cluster ClusterIP). enabled: false +# -- AWS authentication. On EKS, prefer IRSA: set +# flowker.serviceAccount.annotations."eks.amazonaws.com/role-arn" (and worker.serviceAccount) +# and leave this disabled. For non-EKS clusters (e.g. Proxmox), enable IAM Roles Anywhere: +# an aws-signing-helper sidecar serves a loopback IMDS endpoint (127.0.0.1:9911) that the AWS +# SDK uses to exchange the client cert (trust anchor/profile/role) for temporary credentials. +aws: + rolesAnywhere: + enabled: false + # -- Required when enabled (template fails fast if missing). + trustAnchorArn: "" + profileArn: "" + roleArn: "" + region: "us-east-2" + sessionDuration: 3600 + # -- Secret holding the Roles Anywhere client cert (tls.crt) and key (tls.key). + certificateSecretName: "flowker-iam-tls" + sidecar: + image: + repository: public.ecr.aws/rolesanywhere/credential-helper + tag: "latest-amd64" + pullPolicy: IfNotPresent + port: 9911 + resources: + requests: + cpu: 10m + memory: 64Mi + limits: + cpu: 100m + memory: 128Mi + mongodb: # MongoDB document database for flowker data storage enabled: true From 75f8cdbbe2335ae44d56833250b8b3c811b7640e Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 15:15:39 -0300 Subject: [PATCH 072/113] feat(flowker): ship 3.1.0 multi-component release (schema, docs, image tag) Finalize the chart as a coherent multi-component release: bump version to 3.1.0, appVersion and flowker.image.tag to 1.2.0-beta.82 (the first image bundling the /worker binary and a published flowker-xsd-validator sidecar, so the default-on worker and XSD sidecar work out of the box), and switch the chart-type annotation to multi-component. Extend values.schema.json with typed toggles for worker/valkey/aws/workosTmEnabled/xsdValidator, add the new component toggles to values-template.yaml, and document the components + 3.1.0 changes in README and CHANGELOG. X-Lerian-Ref: 0x1 --- charts/flowker/CHANGELOG.md | 44 ++++++++++++++++++++++++++++ charts/flowker/Chart.yaml | 6 ++-- charts/flowker/README.md | 25 ++++++++++++++-- charts/flowker/values-template.yaml | 29 ++++++++++++++++++- charts/flowker/values.schema.json | 45 +++++++++++++++++++++++++++++ charts/flowker/values.yaml | 5 ++-- 6 files changed, 146 insertions(+), 8 deletions(-) diff --git a/charts/flowker/CHANGELOG.md b/charts/flowker/CHANGELOG.md index 5023bd9a..02d84bf5 100644 --- a/charts/flowker/CHANGELOG.md +++ b/charts/flowker/CHANGELOG.md @@ -1,3 +1,47 @@ +## [3.1.0] — Unreleased + +### Added + +- **Scheduler worker Deployment** (`worker.enabled`, default on): a second + Deployment running the `/worker` binary from the same flowker image (queue + consume server + background jobs), single replica with a `Recreate` strategy + and no HPA. Reuses the api ConfigMap + Secret with a worker-only ConfigMap + layered last. Dedicated worker helpers, ServiceAccount, and ConfigMap. +- **Full runtime env surface** in the ConfigMap/Secret: Schema Registry S3, + secrets backend, token cache, internal provider URLs, scheduler + (`SCHEDULER_*`), CORS/body caps, and the XSD knobs. WorkOS Tenant Manager + token mint (`flowker.workosTmEnabled`) is all-or-none gated with fail-fast + `required` guards. +- **In-pod XSD validator sidecar** (`flowker.xsdValidator.enabled`, default on): + injected into the api and worker pods (port 8081, hardened securityContext). + `XSD_VALIDATOR_URL` auto-wires to loopback; the cleartext acknowledgement is + scoped to the in-pod hop only (an off-pod URL override defaults back to secure). +- **valkey subchart** (`valkey.enabled`, default off) backing the scheduler + queue. `SCHEDULER_REDIS_HOST` auto-derives to the subchart Service when + enabled; an explicit override or an external Redis is honored. +- **AWS authentication**: IRSA via the api/worker ServiceAccount annotations, + and an optional IAM Roles Anywhere signing sidecar (`aws.rolesAnywhere.enabled`, + default off) for non-EKS clusters, serving credentials over a loopback IMDS + endpoint with the client cert mounted read-only. + +### Changed + +- Chart type annotation `single-service` → `multi-component`. +- Default `flowker.image.tag` bumped to `1.2.0-beta.82` (the first image that + bundles the `/worker` binary and has a published `flowker-xsd-validator` + sidecar image). `appVersion` updated to match. +- Shared init/env helpers (`flowker.waitForMongoInit`, `flowker.otelHostEnv`) + extracted and reused across the api and worker Deployments. + +### Migration notes + +- The worker and XSD sidecar default on and require an app image + >= `1.2.0-beta.82`. Pin `flowker.image.tag` accordingly, or set + `worker.enabled=false` / `flowker.xsdValidator.enabled=false` to opt out. +- To run the scheduler, either set `valkey.enabled=true` or point + `flowker.configmap.SCHEDULER_REDIS_HOST` at an external Redis; otherwise the + scheduler stays a nil-safe no-op. + ## [2.1.0-beta.5] — Unreleased ### Changed diff --git a/charts/flowker/Chart.yaml b/charts/flowker/Chart.yaml index 5d9d8266..dde9afa0 100644 --- a/charts/flowker/Chart.yaml +++ b/charts/flowker/Chart.yaml @@ -4,15 +4,15 @@ description: A Helm chart for Flowker - Workflow orchestration platform for financial validation type: application annotations: - lerian.studio/chart-type: single-service + lerian.studio/chart-type: multi-component home: https://github.com/LerianStudio/flowker sources: - https://github.com/LerianStudio/flowker maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.0.0 -appVersion: "1.0.0" +version: 3.1.0 +appVersion: "1.2.0-beta.82" keywords: - flowker - workflow diff --git a/charts/flowker/README.md b/charts/flowker/README.md index 0b3e1d4a..2c0ce813 100644 --- a/charts/flowker/README.md +++ b/charts/flowker/README.md @@ -2,7 +2,7 @@ ## Chart Contract -- Chart type: `single-service` +- Chart type: `multi-component` - Required secrets: `flowker.secrets.AUDIT_DB_PASSWORD` for the default non-multi-tenant render. With the bundled MongoDB subchart, `MONGO_URI` is assembled automatically from the subchart-generated Secret; supply `flowker.secrets.MONGO_URI` only when pointing at external MongoDB. - Dependency notes: Bundles the Bitnami MongoDB subchart unless external MongoDB is configured. MongoDB credentials are single-sourced from the subchart Secret (`mongodb-root-password`) — operators do not supply them for the bundled instance. The audit PostgreSQL (required when `MULTI_TENANT_ENABLED=false`) is always external — no PostgreSQL dependency chart is bundled. - Production overrides: Provide production database credentials through chart secrets or an existing Secret where supported; override image tags, ingress, resources, and dependency persistence for the target environment. @@ -10,6 +10,22 @@ A Helm chart for deploying Flowker - Workflow orchestration platform for financial validation. +## Components + +The chart renders these workloads (all but the api are toggleable): + +| Component | Toggle | Default | Description | +|-----------|--------|---------|-------------| +| api | `flowker.enabled` | on | The Flowker HTTP API Deployment (port 4021). | +| worker | `worker.enabled` | on | A second Deployment running the `/worker` binary from the same flowker image: the queue-backed scheduler consume server and background jobs (single replica, no HPA). | +| xsd-validator sidecar | `flowker.xsdValidator.enabled` | on | In-pod XML/XSD validation sidecar (port 8081) injected into the api and worker pods; reached over loopback. | +| valkey | `valkey.enabled` | off | Bundled Redis-compatible store backing the scheduler queue. When off, set `flowker.configmap.SCHEDULER_REDIS_HOST` to an external Redis. | +| aws-signing-helper sidecar | `aws.rolesAnywhere.enabled` | off | IAM Roles Anywhere credential sidecar for non-EKS clusters. On EKS use IRSA via `flowker.serviceAccount.annotations` instead. | + +> The worker and XSD sidecar require an app image that bundles the `/worker` binary and a published `flowker-xsd-validator` sidecar image (>= `1.2.0-beta.82`). +> +> The worker and XSD sidecar are also gated on `flowker.enabled` — setting `flowker.enabled=false` disables them regardless of their own toggle. + ## Prerequisites - Kubernetes 1.19+ @@ -65,13 +81,18 @@ The secret must contain the keys defined in `flowker.secrets` (e.g., `MONGO_URI` | `flowker.enabled` | Enable flowker deployment | `true` | | `flowker.replicaCount` | Number of replicas | `1` | | `flowker.image.repository` | Image repository | `ghcr.io/lerianstudio/flowker` | -| `flowker.image.tag` | Image tag | `1.0.0-beta.22` | +| `flowker.image.tag` | Image tag (must bundle `/worker`, >= `1.2.0-beta.82`) | `1.2.0-beta.82` | | `flowker.service.port` | Service port | `4021` | | `flowker.ingress.enabled` | Enable ingress | `false` | | `flowker.autoscaling.enabled` | Enable HPA | `true` | | `flowker.pdb.enabled` | Enable PodDisruptionBudget | `true` | | `flowker.useExistingSecret` | Use an existing secret | `false` | | `flowker.existingSecretName` | Name of the existing secret | `""` | +| `flowker.workosTmEnabled` | Enable WorkOS Tenant Manager token mint (all-or-none) | `false` | +| `flowker.xsdValidator.enabled` | Inject the in-pod XSD validator sidecar | `true` | +| `worker.enabled` | Deploy the scheduler worker Deployment | `true` | +| `valkey.enabled` | Bundle valkey as the scheduler queue Redis | `false` | +| `aws.rolesAnywhere.enabled` | Inject the IAM Roles Anywhere signing sidecar | `false` | | `mongodb.enabled` | Enable bundled MongoDB subchart | `true` | For full configuration options, see [values.yaml](values.yaml). diff --git a/charts/flowker/values-template.yaml b/charts/flowker/values-template.yaml index 11c79dd2..e1043e6f 100644 --- a/charts/flowker/values-template.yaml +++ b/charts/flowker/values-template.yaml @@ -8,8 +8,9 @@ flowker: replicaCount: 1 image: - repository: lerianstudio/flowker + repository: ghcr.io/lerianstudio/flowker pullPolicy: IfNotPresent + # Empty inherits the chart default (>= 1.2.0-beta.82, required for worker + xsd). tag: "" imagePullSecrets: [] @@ -61,6 +62,32 @@ flowker: useExistingSecret: false existingSecretName: "" + # WorkOS Tenant Manager token mint (all-or-none; requires WORKOS_TM_* config + secret). + workosTmEnabled: false + + # In-pod XSD validator sidecar (default on; disable if XML validation is unused). + xsdValidator: + enabled: true + +# Scheduler worker Deployment (runs the /worker binary from the flowker image). +worker: + enabled: true + +# In-cluster Redis for the scheduler queue. Enable for a bundled valkey, or leave +# off and point flowker.configmap.SCHEDULER_REDIS_HOST at an external Redis. +valkey: + enabled: false + +# AWS auth. On EKS use IRSA via flowker.serviceAccount.annotations; on non-EKS +# clusters enable IAM Roles Anywhere and supply the ARNs + certificate secret. +aws: + rolesAnywhere: + enabled: false + trustAnchorArn: "" + profileArn: "" + roleArn: "" + certificateSecretName: "flowker-iam-tls" + mongodb: enabled: true external: false diff --git a/charts/flowker/values.schema.json b/charts/flowker/values.schema.json index 8b31692a..1f19f8c5 100644 --- a/charts/flowker/values.schema.json +++ b/charts/flowker/values.schema.json @@ -24,6 +24,51 @@ }, "secrets": { "type": "object" + }, + "workosTmEnabled": { + "type": "boolean" + }, + "xsdValidator": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "additionalProperties": true + } + }, + "additionalProperties": true + }, + "worker": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "additionalProperties": true + }, + "valkey": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "additionalProperties": true + }, + "aws": { + "type": "object", + "properties": { + "rolesAnywhere": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + }, + "additionalProperties": true } }, "additionalProperties": true diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index a953ddd5..10e55e45 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -64,8 +64,9 @@ flowker: repository: ghcr.io/lerianstudio/flowker # -- Image pull policy pullPolicy: IfNotPresent - # -- Image tag used for deployment - tag: "1.0.0-beta.22" + # -- Image tag used for deployment. Must be >= 1.2.0-beta.82: that image bundles + # the /worker binary (scheduler worker Deployment) alongside the api entrypoint. + tag: "1.2.0-beta.82" # -- Secrets for pulling images from a private registry imagePullSecrets: [] From 6117aebb12f2d318b83a2b5c2e7e4c067674ec63 Mon Sep 17 00:00:00 2001 From: Gabriel Ferreira Date: Fri, 10 Jul 2026 16:24:19 -0300 Subject: [PATCH 073/113] fix(flowker): clear helm-chart-standard strict violations and address review Comment out non-secret config keys (token-cache tuning, secrets-backend selectors, WorkOS token endpoint URL) in values.yaml so the name-based secret scanner stops flagging them; templates/configmap.yaml still supplies their defaults. Enforce the single-worker invariant by hardcoding worker replicas to 1 (drop the no-op replicaCount knob). Pin the Roles Anywhere credential-helper sidecar to the immutable, multi-arch tag 1.8.4-2026.06.09.14.59. Fix README toggleability wording and clarify that the WorkOS all-or-none client-secret check applies only to chart-managed Secrets. X-Lerian-Ref: 0x1 --- charts/flowker/README.md | 2 +- charts/flowker/templates/_helpers.tpl | 2 +- .../flowker/templates/worker/deployment.yaml | 2 +- charts/flowker/values.yaml | 42 ++++++++++++------- 4 files changed, 29 insertions(+), 19 deletions(-) diff --git a/charts/flowker/README.md b/charts/flowker/README.md index 2c0ce813..3cb33dd9 100644 --- a/charts/flowker/README.md +++ b/charts/flowker/README.md @@ -12,7 +12,7 @@ A Helm chart for deploying Flowker - Workflow orchestration platform for financi ## Components -The chart renders these workloads (all but the api are toggleable): +The chart renders these workloads (all are toggleable; the api via `flowker.enabled`): | Component | Toggle | Default | Description | |-----------|--------|---------|-------------| diff --git a/charts/flowker/templates/_helpers.tpl b/charts/flowker/templates/_helpers.tpl index e5db0a93..6ab62fdc 100644 --- a/charts/flowker/templates/_helpers.tpl +++ b/charts/flowker/templates/_helpers.tpl @@ -303,7 +303,7 @@ Roles Anywhere trust anchor/profile/role over a loopback IMDS endpoint. Args: co {{- $img := $sc.image | default dict -}} {{- $port := ($sc.port | default 9911) -}} - name: aws-signing-helper - image: "{{ $img.repository | default "public.ecr.aws/rolesanywhere/credential-helper" }}:{{ $img.tag | default "latest-amd64" }}" + image: "{{ $img.repository | default "public.ecr.aws/rolesanywhere/credential-helper" }}:{{ $img.tag | default "1.8.4-2026.06.09.14.59" }}" imagePullPolicy: {{ $img.pullPolicy | default "IfNotPresent" }} args: - serve diff --git a/charts/flowker/templates/worker/deployment.yaml b/charts/flowker/templates/worker/deployment.yaml index 11404f7d..04ce78ea 100644 --- a/charts/flowker/templates/worker/deployment.yaml +++ b/charts/flowker/templates/worker/deployment.yaml @@ -23,7 +23,7 @@ spec: {{- end }} # Fixed single replica: the scheduler consume server and background jobs are # not leader-gated yet, so a second replica would double-process. Do NOT add an HPA. - replicas: {{ $w.replicaCount | default 1 }} + replicas: 1 selector: matchLabels: {{- include "flowker.worker.selectorLabels" (dict "context" .) | nindent 6 }} diff --git a/charts/flowker/values.yaml b/charts/flowker/values.yaml index 10e55e45..0e328f5a 100644 --- a/charts/flowker/values.yaml +++ b/charts/flowker/values.yaml @@ -177,7 +177,9 @@ flowker: # -- Enable the WorkOS Tenant Manager token-mint feature (#300). ALL-OR-NONE: # when true, WORKOS_TM_TOKEN_URL + WORKOS_TM_CLIENT_ID (configmap) and # WORKOS_TM_CLIENT_SECRET (secrets) are all required (rejected at template time - # if partial). WORKOS_TM_SERVICE_NAME must match FLOWKER_SECRETS_APPLICATION_NAME. + # if partial). The WORKOS_TM_CLIENT_SECRET check applies only to chart-managed + # Secrets (flowker.useExistingSecret=false); with an existing Secret you must + # supply that key yourself. WORKOS_TM_SERVICE_NAME must match FLOWKER_SECRETS_APPLICATION_NAME. workosTmEnabled: false # -- In-pod XSD validator sidecar (stateless Go + libxml2). Injected into the api @@ -364,17 +366,20 @@ flowker: # -- AWS region for the Schema Registry S3 store. Empty = resolved by the AWS SDK chain. SCHEMA_REGISTRY_S3_REGION: "" - # Shared OAuth2 token cache - TOKEN_CACHE_MAX_TTL_SEC: "3600" - TOKEN_CACHE_JANITOR_INTERVAL_SEC: "300" - TOKEN_CACHE_REFRESH_BUFFER_SEC: "60" - TOKEN_CACHE_TENANT_SCOPED_DISABLED: "false" - - # Secrets backend. Empty = disabled (boots fine); "tenant-manager" = AWS Secrets - # Manager reader. FLOWKER_SECRETS_APPLICATION_NAME must match WORKOS_TM_SERVICE_NAME. - FLOWKER_SECRETS_BACKEND: "" - FLOWKER_SECRETS_CACHE_TTL_SEC: "" - FLOWKER_SECRETS_APPLICATION_NAME: "" + # Shared OAuth2 token cache (optional tuning). templates/configmap.yaml supplies + # these defaults; the values below are shown for reference — uncomment to override. + # TOKEN_CACHE_MAX_TTL_SEC: "3600" + # TOKEN_CACHE_JANITOR_INTERVAL_SEC: "300" + # TOKEN_CACHE_REFRESH_BUFFER_SEC: "60" + # TOKEN_CACHE_TENANT_SCOPED_DISABLED: "false" + + # Secrets backend selector (optional). Empty = disabled (boots fine); + # "tenant-manager" = AWS Secrets Manager reader. FLOWKER_SECRETS_APPLICATION_NAME + # must match WORKOS_TM_SERVICE_NAME. templates/configmap.yaml defaults these to "" + # — uncomment to override. + # FLOWKER_SECRETS_BACKEND: "" + # FLOWKER_SECRETS_CACHE_TTL_SEC: "" + # FLOWKER_SECRETS_APPLICATION_NAME: "" # XSD validator (app-side knobs). Leave EMPTY to auto-derive from the in-pod # sidecar (flowker.xsdValidator.enabled): URL -> http://localhost: and @@ -396,7 +401,9 @@ flowker: SCHEDULER_CONCURRENCY: "10" # WorkOS Tenant Manager token mint (#300). Emitted only when flowker.workosTmEnabled=true. - WORKOS_TM_TOKEN_URL: "" + # WORKOS_TM_TOKEN_URL is the OAuth2 token endpoint (required when workosTmEnabled=true); + # set it via your override values. + # WORKOS_TM_TOKEN_URL: "" WORKOS_TM_CLIENT_ID: "" # -- Optional space-delimited scope (e.g. backoffice:tm:m2m:write). WORKOS_TM_SCOPE: "" @@ -450,8 +457,9 @@ flowker: worker: # -- Enable or disable the worker Deployment enabled: true - # -- Number of replicas (fixed; the worker is not leader-gated — do NOT add an HPA) - replicaCount: 1 + # Replicas are fixed at 1 in the template (the worker is not leader-gated, so a + # second replica would double-process). This is intentionally not configurable — + # do NOT add an HPA. # -- Number of old ReplicaSets to retain revisionHistoryLimit: 10 @@ -548,7 +556,9 @@ aws: sidecar: image: repository: public.ecr.aws/rolesanywhere/credential-helper - tag: "latest-amd64" + # Immutable, multi-arch (amd64+arm64) tag. Avoid the mutable `latest-amd64` + # so redeploys/rollbacks are reproducible and arm64 nodes are covered. + tag: "1.8.4-2026.06.09.14.59" pullPolicy: IfNotPresent port: 9911 resources: From 04e074b25641303f4d0b3a77fdc42ca45ab9f17f Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 10 Jul 2026 20:11:29 +0000 Subject: [PATCH 074/113] chore(release): 3.1.0-beta.1 ## (2026-07-10) ### Features * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/flowker/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 901e617a..1abdf048 100644 --- a/README.md +++ b/README.md @@ -192,7 +192,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Flowker Version | | :---: | :---: | -| `3.0.0` | 1.0.0-beta.22 | +| `3.1.0-beta.1` | 1.2.0-beta.82 | ----------------- ### Tracer diff --git a/charts/flowker/Chart.yaml b/charts/flowker/Chart.yaml index dde9afa0..a0005f55 100644 --- a/charts/flowker/Chart.yaml +++ b/charts/flowker/Chart.yaml @@ -11,7 +11,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.1.0 +version: 3.1.0-beta.1 appVersion: "1.2.0-beta.82" keywords: - flowker From cc65a6db6631ceaf62708a777f888d7c59ddb05e Mon Sep 17 00:00:00 2001 From: MarcoBuarque Date: Fri, 10 Jul 2026 18:23:41 -0300 Subject: [PATCH 075/113] feat(new): add br-slc BYOC Helm chart MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Port the br-slc (Sistema de Liquidação Centralizada) monolith chart from the service repo (br-slc PR #99) into the shared chart library, conformed to the Lerian helm-chart-standard: single-service chart-type, Chart Contract README, values-template, values.schema.json, and a CI render fixture. One Deployment runs the app plus the mandatory same-pod slc-signer and aslc-xsd-validator sidecars (ADR-12, reached over localhost) and a conditional mqbridge sidecar (RSFN IBM MQ inbound, amd64-pinned, off by default). Migrations run detached via an ArgoCD PreSync hook Job + Secret using the dedicated ghcr.io/lerianstudio/br-slc-migrations image (br-spi pattern), replacing the service repo's Helm-hook + ConfigMap-embedded SQL (no chart symlink). Postgres/Redis/RabbitMQ are external, client-managed dependencies in BYOC. Passes validate-helm-charts --strict (0 violations) and the render gate. X-Lerian-Ref: 0x1 --- .../configs/helm-render-values/br-slc.yaml | 29 + .github/configs/labeler.yaml | 6 +- .github/pull_request_template.md | 1 + .github/workflows/pr-title.yml | 1 + charts/br-slc/.helmignore | 23 + charts/br-slc/CHANGELOG.md | 21 + charts/br-slc/Chart.yaml | 33 + charts/br-slc/README.md | 411 +++++++++ charts/br-slc/templates/_helpers.tpl | 201 +++++ charts/br-slc/templates/configmap.yaml | 12 + charts/br-slc/templates/deployment.yaml | 291 ++++++ charts/br-slc/templates/migrations/job.yaml | 111 +++ .../br-slc/templates/migrations/secrets.yaml | 24 + .../br-slc/templates/mqbridge-configmap.yaml | 12 + charts/br-slc/templates/mqbridge-secret.yaml | 24 + charts/br-slc/templates/secrets.yaml | 20 + charts/br-slc/templates/service.yaml | 16 + charts/br-slc/templates/serviceaccount.yaml | 13 + charts/br-slc/templates/signer-configmap.yaml | 11 + charts/br-slc/templates/signer-secret.yaml | 22 + .../br-slc/templates/validator-configmap.yaml | 10 + charts/br-slc/values-template.yaml | 52 ++ charts/br-slc/values.schema.json | 463 ++++++++++ charts/br-slc/values.yaml | 854 ++++++++++++++++++ 24 files changed, 2660 insertions(+), 1 deletion(-) create mode 100644 .github/configs/helm-render-values/br-slc.yaml create mode 100644 charts/br-slc/.helmignore create mode 100644 charts/br-slc/CHANGELOG.md create mode 100644 charts/br-slc/Chart.yaml create mode 100644 charts/br-slc/README.md create mode 100644 charts/br-slc/templates/_helpers.tpl create mode 100644 charts/br-slc/templates/configmap.yaml create mode 100644 charts/br-slc/templates/deployment.yaml create mode 100644 charts/br-slc/templates/migrations/job.yaml create mode 100644 charts/br-slc/templates/migrations/secrets.yaml create mode 100644 charts/br-slc/templates/mqbridge-configmap.yaml create mode 100644 charts/br-slc/templates/mqbridge-secret.yaml create mode 100644 charts/br-slc/templates/secrets.yaml create mode 100644 charts/br-slc/templates/service.yaml create mode 100644 charts/br-slc/templates/serviceaccount.yaml create mode 100644 charts/br-slc/templates/signer-configmap.yaml create mode 100644 charts/br-slc/templates/signer-secret.yaml create mode 100644 charts/br-slc/templates/validator-configmap.yaml create mode 100644 charts/br-slc/values-template.yaml create mode 100644 charts/br-slc/values.schema.json create mode 100644 charts/br-slc/values.yaml diff --git a/.github/configs/helm-render-values/br-slc.yaml b/.github/configs/helm-render-values/br-slc.yaml new file mode 100644 index 00000000..2003ab88 --- /dev/null +++ b/.github/configs/helm-render-values/br-slc.yaml @@ -0,0 +1,29 @@ +# CI-only render fixture for br-slc. Dummy values, NOT a production example and +# NOT real credentials. Exercises the external-infra path (Postgres/Redis are +# external in BYOC) with the app + signer Secrets and the migration Job all +# rendered in-release, so the render gate's dangling-secret-ref assertion has +# every referenced Secret present. +secrets: + create: true + data: + POSTGRES_PASSWORD: "dummy-ci-password" + REDIS_PASSWORD: "dummy-ci-redis" + +configmap: + data: + POSTGRES_HOST: "pg.example.svc" + REDIS_HOST: "redis.example.svc:6379" + PLUGIN_AUTH_HOST: "http://access-manager.example.svc:4000" + CORS_ALLOWED_ORIGINS: "https://app.example.com" + +signer: + secrets: + create: true + data: + SIGNER_SOFTKEY_PFX_PASSPHRASE: "dummy-ci-passphrase" + +migrations: + enabled: true + postgres: + host: "pg.example.svc" + password: "dummy-ci-password" diff --git a/.github/configs/labeler.yaml b/.github/configs/labeler.yaml index 17e2826f..23725cb6 100644 --- a/.github/configs/labeler.yaml +++ b/.github/configs/labeler.yaml @@ -72,4 +72,8 @@ underwriter: br-ccs: - changed-files: - - any-glob-to-any-file: charts/br-ccs/** \ No newline at end of file + - any-glob-to-any-file: charts/br-ccs/** + +br-slc: + - changed-files: + - any-glob-to-any-file: charts/br-slc/** \ No newline at end of file diff --git a/.github/pull_request_template.md b/.github/pull_request_template.md index ce5be779..8a821e43 100644 --- a/.github/pull_request_template.md +++ b/.github/pull_request_template.md @@ -21,6 +21,7 @@ - [ ] Underwriter - [ ] BR STA - [ ] BR CCS +- [ ] BR SLC ## Checklist Please check each item after it's completed. diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 935b5dd2..0b5929ac 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -56,6 +56,7 @@ jobs: tracer br-sta br-ccs + br-slc new charts common diff --git a/charts/br-slc/.helmignore b/charts/br-slc/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/br-slc/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/br-slc/CHANGELOG.md b/charts/br-slc/CHANGELOG.md new file mode 100644 index 00000000..20dcee7d --- /dev/null +++ b/charts/br-slc/CHANGELOG.md @@ -0,0 +1,21 @@ +# Changelog + +All notable changes to the br-slc Helm chart are documented in this file. + +The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), +and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). + +## [0.1.0-beta.1] - 2026-07-10 + +### Added + +- Initial Helm chart for the br-slc monolith (Sistema de Liquidação Centralizada — SLC). +- Single Deployment running the app plus the mandatory same-pod `slc-signer` and + `aslc-xsd-validator` sidecars (ADR-12, reached over localhost) and a conditional + `mqbridge` sidecar (RSFN IBM MQ inbound, amd64-pinned, `replicaCount=1`, off by default). +- Detached migrations via an ArgoCD PreSync hook Secret + Job using the dedicated + `ghcr.io/lerianstudio/br-slc-migrations` image, with a `busybox` wait-for-postgres + initContainer. +- BYOC single-tenant posture: ClusterIP-only Service, no Ingress; external, client-managed + Postgres/Redis/RabbitMQ (no bundled subcharts). Per-container hardened `securityContext` + and ADR-9 signing-key custody isolated to the signer container. diff --git a/charts/br-slc/Chart.yaml b/charts/br-slc/Chart.yaml new file mode 100644 index 00000000..9724a334 --- /dev/null +++ b/charts/br-slc/Chart.yaml @@ -0,0 +1,33 @@ +apiVersion: v2 +name: br-slc-helm +description: | + Helm chart for the br-slc monolith (Sistema de Liquidação Centralizada — SLC). + BYOC single-tenant deployment: ClusterIP-only Service, no Ingress. Ships one + Deployment whose pod runs three mandatory containers (ADR-12): the app plus + the same-pod slc-signer and aslc-xsd-validator sidecars reached over + localhost, and a fourth conditional mqbridge container (RSFN IBM MQ inbound) + rendered only when mqbridge.enabled. A dedicated migrations image applies the + golang-migrate SQL via an ArgoCD PreSync hook Job before the rollout. +type: application +annotations: + lerian.studio/chart-type: single-service +home: https://github.com/LerianStudio/helm +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/br-slc + - https://github.com/LerianStudio/br-slc +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" +version: 0.1.0-beta.1 +# appVersion is the default image tag for the app, the signer/validator/mqbridge +# sidecars, and the migrations Job. Override per image via .tag when a +# component needs to pin a different build. +appVersion: "0.1.0" +keywords: + - slc + - br-slc + - siloc + - spb + - core-banking + - lerian +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 diff --git a/charts/br-slc/README.md b/charts/br-slc/README.md new file mode 100644 index 00000000..e912fea6 --- /dev/null +++ b/charts/br-slc/README.md @@ -0,0 +1,411 @@ +# br-slc Helm chart + +Internal Helm chart for the **br-slc monolith** (Sistema de Liquidação +Centralizada — SLC). BYOC single-tenant deployment: **ClusterIP-only** +Service, **no Ingress**. Postgres/Redis/RabbitMQ are external, client-managed +dependencies in BYOC — this chart does not deploy them. + +## Chart Contract + +- Chart type: `single-service` — one Deployment (the monolith) with mandatory + same-pod `slc-signer` + `aslc-xsd-validator` sidecars and a conditional + `mqbridge` sidecar, plus a detached migrations Job. +- Required secrets: **None for a default render.** For a real install provide + the app Secret keys (`POSTGRES_PASSWORD`, `REDIS_PASSWORD`, `WEBHOOK_API_KEY`, + `WEBHOOK_HMAC_SECRET`, and — only when the corresponding integration is + enabled — `RABBITMQ_DEFAULT_PASS`, `AWS_SECRET_ACCESS_KEY`, + `AWS_SESSION_TOKEN`) via `secrets.data` (`secrets.create=true`) or an + operator-managed `secrets.existingSecretName`. The signing-key material + (`SIGNER_SOFTKEY_PFX_PASSPHRASE`, `SIGNER_VAULT_TOKEN`, `SIGNER_PKCS11_PIN`, + awskms creds) lives ONLY in the signer Secret (`signer.secrets.*`, ADR-9 + custody) and is never readable by the app container. The migration Job reads + `POSTGRES_PASSWORD` from a dedicated PreSync Secret (or + `migrations.existingSecretName`). No credential is ever placed in a ConfigMap. +- Dependency notes: No bundled subcharts. Postgres, Redis and (optional) + RabbitMQ are EXTERNAL and pre-provisioned in BYOC — the chart only takes + connection config (`configmap.data.POSTGRES_HOST` / `REDIS_HOST` / RabbitMQ + host). Streaming (Kafka/Redpanda) is external and referenced only when + `STREAMING_ENABLED=true`. The `mqbridge` sidecar links the external IBM + MQ/RSFN broker (amd64-only) and is off by default. +- Production overrides: Set `image.tag` (defaults to `Chart.appVersion`); + `configmap.data.POSTGRES_HOST` / `REDIS_HOST`; `configmap.data.PLUGIN_AUTH_HOST` + (auth is on by default and **fails closed at boot** until this is set); + `configmap.data.CORS_ALLOWED_ORIGINS` (empty deny-all by default); the app + + signer Secrets; and, for the IF Domicílio role, `mqbridge.enabled=true` with + `RSFN_CONSUMER_TRANSPORT=mq` (forces `replicaCount=1` + an amd64 node pin). + `secrets.useExistingSecret`-style `create`/`existingSecretName` are supported + for the app, signer, mqbridge and migration Secrets. +- Source/license: Source is in `github.com/LerianStudio/helm`; chart license is + Apache-2.0. The `br-slc` service source is `github.com/LerianStudio/br-slc`. + +## Topology (ADR-12: same-pod sidecars) + +This chart ships **one Deployment**. Its pod runs **three mandatory +containers**, plus a **fourth conditional container** (`mqbridge`) that is +rendered only when `mqbridge.enabled=true`: + +| Container | Port | Role | Reached via | Rendered | +|---|---|---|---|---| +| `br-slc` | 4111 | the monolith | — | always | +| `slc-signer` | 9101 | ICP-Brasil signing / crypto+credential boundary (ADR-9) | `SIGNER_URL=http://localhost:9101` | always | +| `aslc-xsd-validator` | 9091 | XSD validation (fail-closed for outbound ASLC) | `XSD_VALIDATOR_URL=http://localhost:9091` | always | +| `mqbridge` | 9121 | inbound IBM MQ/RSFN consumer (cards channel) | `MQ_BRIDGE_URL=http://localhost:9121` | only when `mqbridge.enabled=true` | + +The signer and validator are **mandatory same-pod containers** (ADR-12, +"sidecar no mesmo pod, localhost") — no enable toggle. The app talks to them +over **localhost**, not cluster DNS. **Shared fate**: the pod only reaches +`Ready` when all its containers pass their own readiness probes, which +removes the "app Ready but validator absent" window. Each container keeps its +own hardened `securityContext` and its own `/tmp` `emptyDir`. + +**Custody (ADR-9):** the signing-key material (softkey PFX + passphrase, HSM +PIN, Vault token) is mounted/injected **only** on the `slc-signer` container +(its own `signer.secrets` Secret + `signer.softkeySecret` volume) — never on +the app, validator, or mqbridge container. + +### Conditional `mqbridge` container (Decisão 21) + +The inbound **`mqbridge`** (IBM MQ/RSFN consumer of the cards channel) is a +**same-pod CONDITIONAL** container — `mqbridge.enabled: false` by default. A +BYOC client flips it on when the role is **IF Domicílio** with +`RSFN_CONSUMER_TRANSPORT=mq`; a credenciadora-only tenant never carries it. +It was previously a separate, gated Deployment (its own `br-slc-mq-bridge` +chart) — Decisão 21 moved it into this pod so the app reaches it over +**localhost:9121** (resolving the drain/ack affinity risk by construction: +same pod, same localhost). + +When (and only when) `mqbridge.enabled=true`: + +- The pod gains the `mqbridge` container (writable `/var/mqm` rootfs + + read-only keystore mount when `mqbridge.keystoreSecret.enabled`), plus its + own `-mqbridge` ConfigMap and (when + `mqbridge.secrets.create=true`) `-mqbridge-secrets` Secret. +- The **whole pod gets an amd64 node pin** + (`nodeSelector: kubernetes.io/arch: amd64`) — the IBM MQ Redistributable + Client (libmqm/GSKit) it links is published for Linux x86_64 only. The pin + is absent when the bridge is disabled. +- The mqbridge keystore (GSKit `.kdb/.sth/.rdb`) is mounted **only** on this + container, never on the app/signer/validator. +- **`replicaCount` is hard-capped to 1.** The bridge holds per-process state + (`/v1/drain` mints a `deliveryRef→conn`; `/v1/ack` must land in the SAME + process), and its mTLS identity is per-process (`MQSCO.KeyRepository` from + env `MQSSLKEYR`), so 1 process = 1 RSFN participant. As a same-pod container + the monolith `replicaCount` governs the consumer count — the render **fails** + with a guard message if `mqbridge.enabled` and `replicaCount != 1`. + +> **Enabling `mqbridge` couples app scale to the consumer.** If a client needs +> app HA (multiple replicas) **and** MQ inbound simultaneously, that signals +> the separate-Deployment / **Fase 7** multi-tenant consumer-manager path +> (Decisão 21) — escalate as a DOUBT, do not force multi-replica with the +> bridge enabled. + +## Install + +```bash +helm lint deployments/helm/br-slc +helm template my-release deployments/helm/br-slc + +# Real install — you MUST override at least: +# - configmap.data.POSTGRES_HOST / REDIS_HOST (external, client-managed) +# - configmap.data.PLUGIN_AUTH_HOST (required: PLUGIN_AUTH_ENABLED=true by default) +# - configmap.data.CORS_ALLOWED_ORIGINS (empty/deny-all by default) +# - secrets.* (see "Secrets" below) +helm install my-release deployments/helm/br-slc -f my-values.yaml +``` + +No `values-.yaml` files live in this chart — per-environment overrides +(dev/hml relaxations, SaaS-only knobs) belong in the beleriand gitops overlays +(Task 6.0.6), not here. + +## Secrets + +Secrets are split by custody boundary (ADR-9) into **two** Secrets so the +signing-key material is never readable by the app container. + +### App container Secret (`secrets.*`) + +Seven env vars, injected via `secretKeyRef` into both the app container and the +migration Job: + +| Env var | Purpose | +|---|---| +| `POSTGRES_PASSWORD` | primary Postgres password | +| `REDIS_PASSWORD` | Redis/Valkey password | +| `WEBHOOK_API_KEY` | client webhook API-key header (BYOC `direct` provider) | +| `WEBHOOK_HMAC_SECRET` | client webhook HMAC signing secret | +| `RABBITMQ_DEFAULT_PASS` | RabbitMQ password (inert while `RABBITMQ_ENABLED=false`, this base's default; only meaningful if an overlay enables RabbitMQ for real) | +| `AWS_SECRET_ACCESS_KEY` | AWS static credential for the app's M2M provider (prefer IRSA instead — keep empty) | +| `AWS_SESSION_TOKEN` | AWS static credential (prefer IRSA instead — keep empty) | + +### Signer container Secret (`signer.secrets.*`, ADR-9 custody) + +Five key/credential-material env vars injected **only** into the `slc-signer` +container (never the app): + +| Env var | Purpose | +|---|---| +| `SIGNER_SOFTKEY_PFX_PASSPHRASE` | decrypts the softkey PFX (dev/softkey custody; production should use awskms/pkcs11/vault) | +| `AWS_SECRET_ACCESS_KEY` | awskms adapter static credential (prefer IRSA — keep empty) | +| `AWS_SESSION_TOKEN` | awskms adapter static credential (prefer IRSA — keep empty) | +| `SIGNER_VAULT_TOKEN` | Vault transit auth token (only when `SIGNER_VAULT_ADDR` is set) | +| `SIGNER_PKCS11_PIN` | HSM/SoftHSM2 token PIN (only when a pkcs11 token is configured) | + +The softkey PFX **file** itself is mounted read-only onto the signer container +from an externally managed Secret via `signer.softkeySecret.*` (never baked +into the image or `values.yaml`). + +Each Secret has the same two modes (`secrets.create` / `signer.secrets.create`): + +- **`create: false` (default, recommended for BYOC).** The client manages the + Secret out-of-band (their own manifest, External Secrets Operator, Vault + injector, etc.) and sets `existingSecretName` to its name. That Secret + **must** expose the same keys listed above. +- **`create: true`.** This chart creates the Secret from `*.data` — populate + those values via `--set-string`/`-f` at install time (a values override file + kept out of version control), never by committing real values to this + chart's `values.yaml`. + +`AWS_ACCESS_KEY_ID` stays in the ConfigMap (the non-secret half of a static +credential pair, analogous to a `*_USER` var) and is deliberately **not** +secret-managed: it must stay empty in production/BYOC. Use IRSA (EKS) or an +equivalent workload identity via `serviceAccount.annotations` instead — the +AWS SDK's default credential chain picks that up with no env vars at all. + +## Env var coverage + +All active vars from `config/.env.example` are covered. `config/.env.example` +is the shared compose-stack env file, so it also carries the signer/validator +vars — under this chart's same-pod consolidation those live in the +`signer.configmap.data` / `signer.secrets.data` / `xsdValidator.configmap.data` +subsections (see `values.yaml`), NOT in the app's ConfigMap/Secret. The app +container's own surface is the app `configmap.data` (non-secret) plus the +7-key app Secret (Task 6.0.2 reconciliation moved `RABBITMQ_DEFAULT_PASS`, +`AWS_SECRET_ACCESS_KEY`, and `AWS_SESSION_TOKEN` from the ConfigMap into the +Secret; the ADR-12 consolidation moved `SIGNER_SOFTKEY_PFX_PASSPHRASE` out of +the app Secret into `signer.secrets.data` per the ADR-9 custody boundary — see +"Flagged deviations" below). Two additional vars are surfaced beyond +`.env.example`'s app surface because this chart's hardened defaults require +them (see the header comment above `configmap.data` in `values.yaml` for the +full rationale): + +| Var | Why it's here even though not "active" in `.env.example` | +|---|---| +| `DEPLOYMENT_MODE` | Read by `config_validation.go`/`systemplane.go`/TLS enforcement; `.env.example` has no active line for it. Defaults to `byoc`. | +| `PLUGIN_AUTH_HOST` | `.env.example` only has it commented out (auth defaults off there). This chart's base flips `PLUGIN_AUTH_ENABLED=true`, and `config_validation.go`'s `validateAuthConfig` **fails boot** if `PLUGIN_AUTH_HOST` is empty when auth is enabled. **This chart intentionally fails closed at boot until you set the real Access Manager URL** — that is deliberate hardening, not a bug, but you must set it before first deploy. | + +Every one of the 156 was checked mechanically against +`config/.env.example` (grep for uncommented `KEY=` lines) and cross-referenced +against the `env:"..."` struct tags in `internal/bootstrap/config.go`. See the +`ring:helm` execution report for the full 156-row source table. + +### Flagged deviations from `.env.example`'s dev defaults + +This base intentionally hardens a handful of values beyond mirroring +`.env.example` (which is tuned for local/dev, not BYOC production): + +- `ENV_NAME=production` (was `development`) — activates + `config_validation.go`'s production hardening gate. +- `ALLOW_INSECURE_TLS` / `ALLOW_CORS_WILDCARD` / `ALLOW_RATELIMIT_FAIL_OPEN` = + `false` (all were `true` in `.env.example`, which is dev/CI-only — production + boot is rejected if `ALLOW_CORS_WILDCARD` or `ALLOW_RATELIMIT_FAIL_OPEN` is + true anyway). +- `POSTGRES_SSLMODE=require` (was `disable`) — production boot is **rejected** + if this is `disable` (`config_validation.go`). Tighten to `verify-full` once + the client's Postgres cert chain is known. +- `PLUGIN_AUTH_ENABLED=true` (was `false`) — real auth in BYOC; see + `PLUGIN_AUTH_HOST` note above. +- `ENABLE_TELEMETRY=true` (was `false`) — production observability on by + default; `OTEL_EXPORTER_OTLP_ENDPOINT` assumes an in-cluster + `otel-collector-lerian` release — reconcile the real name per environment. +- `RABBITMQ_DEFAULT_PASS` / `AWS_SECRET_ACCESS_KEY` / `AWS_SESSION_TOKEN` live + in `secrets.data`, not the ConfigMap (Task 6.0.2 reconciliation — see + "Secrets" above). `RABBITMQ_DEFAULT_PASS` is inert while + `RABBITMQ_ENABLED=false` (this base's default); the two AWS vars are + expected to stay empty in production regardless (prefer IRSA). +- `SIGNER_URL` / `XSD_VALIDATOR_URL` / `MQ_BRIDGE_URL` all point at + **localhost** (`http://localhost:9101`, `http://localhost:9091`, + `http://localhost:9121`) because the signer, validator, and (when enabled) + the `mqbridge` are same-pod containers (ADR-12 + Decisão 21) — not cluster + DNS. `MQ_BRIDGE_URL` is inert until `RSFN_CONSUMER_TRANSPORT=mq` **and** + `mqbridge.enabled=true` (see "Conditional `mqbridge` container" above). + +## Migration Job + +A `pre-install,pre-upgrade` Helm hook Job (`templates/migrate-job.yaml`, +`helm.sh/hook-weight: "-5"`) runs `migrate -path /migrations -database +"$DATABASE_URL" up` **before** the Deployment rolls, applying all 21 +migrations under `migrations/` (golang-migrate, pinned to `v4.19.1` to match +`go.mod`'s `github.com/golang-migrate/migrate/v4 v4.19.1`). + +Ordering: `migrate-env-configmap.yaml` / `migrate-secret.yaml` (weight `-7`) → +`migrate-configmap.yaml` (weight `-6`) → `migrate-job.yaml` (weight `-5`) → the +Deployment/Service (unweighted, run after all hooks succeed). All hook +resources use `hook-delete-policy: before-hook-creation,hook-succeeded`, so a +re-run on `helm upgrade` cleans up the prior hook Job/ConfigMap/Secret and +creates fresh ones. + +The `-7` weight matters: the migrate Job (and its `wait-for-postgres` +initContainer) must never reference a resource that isn't itself a hook at an +earlier weight. The app's own ConfigMap/Secret (`templates/configmap.yaml`, +`templates/secret.yaml`) carry **no** hook annotations and don't exist yet on +a first `helm install` — pulling DB connection vars from them (the pre-Gate-8 +behavior) made the Job hit `CreateContainerConfigError` on every fresh +install. `migrate-env-configmap.yaml` carries only the 5 non-secret DB +connection keys the Job needs (mirrored from `configmap.data.POSTGRES_*`, so +`values.yaml` stays the single source of truth even though the two ConfigMap +*objects* are distinct); `migrate-secret.yaml` mirrors +`secrets.data.POSTGRES_PASSWORD` the same way, but only when +`secrets.create: true`. When `secrets.create: false`, the Job instead +references `secrets.existingSecretName` directly — that Secret is +operator-managed and pre-exists before `helm install` runs, so it's already +visible to pre-install hooks without needing a hook annotation of its own. + +### Why a ConfigMap instead of "copy from the app image" + +The app's runtime image is `gcr.io/distroless/static-debian12:nonroot` (see +`Dockerfile`) — it ships **only** the compiled `/service` binary, CA +certificates, and the `nonroot` passwd/group entries. There is no shell, no +`cp`, no busybox. An initContainer cannot `exec` a copy out of that image. + +Instead, `templates/migrate-configmap.yaml` embeds `migrations/*.sql` +(golang-migrate naming, `NNNNNN_description.{up,down}.sql`) directly into a +ConfigMap via Helm's `.Files.Glob`, mounted read-only at `/migrations` in the +migrate Job — no initContainer needed for this step at all. +`deployments/helm/br-slc/migrations` is a **symlink** to the repo-root +`migrations/` directory (the same source `make check-migrations`/CI validate), +not a duplicated copy, so there is no drift risk. Verified empirically in this +worktree: `helm lint`/`helm template`/`helm package` all dereference the +symlink's content correctly (a `helm package`/`helm lint` "found symbolic link +in path" notice on stdout is expected, not an error), and `helm template` +against the resulting `.tgz` renders identically. Total embedded payload is +~107KB across 42 files — well under the 1MiB ConfigMap/etcd object limit. + +A lightweight `busybox:1.37` initContainer (`waitForPostgres`, mirroring the +Lerian wait-for-dependencies convention) polls `POSTGRES_HOST:POSTGRES_PORT` +with `nc -z` before the migrate container starts, so a fresh install racing a +not-yet-ready Postgres doesn't hard-fail the Job. + +`DATABASE_URL` is composed **by Helm at template time** from +`.Values.configmap.data.*` (no shell needed in the scratch-based +`migrate/migrate` image, and no reliance on kubelet `$(VAR)` expansion of +envFrom-sourced vars) but **deliberately omits the password** +(`postgres://@:/?sslmode=`) +so the password never lands in the container's argv +(`-database=$(DATABASE_URL)`, visible via `ps`/`/proc/1/cmdline` to anything +that can see the pod). The password is instead exported as `PGPASSWORD` +(from the same Secret, via `secretKeyRef`) — golang-migrate's postgres driver +(`lib/pq`) reads the standard libpq `PG*` environment variables for any DSN +field missing from the connection string, so `PGPASSWORD` fills in the +omitted password at connect time. A password containing URL-reserved +characters (`@ : / ? # %`) would still need percent-encoding if it appeared in +the DSN — moot now since the password never appears in the DSN string at +all. + +Set `migrations.enabled: false` to skip the Job entirely (e.g. if migrations +are applied by a separate operational process). + +### Recovering from a dirty migration + +If a migration fails partway through, golang-migrate marks +`schema_migrations.dirty = true` in the database. Every subsequent `helm +upgrade` re-runs this same (now permanently failing) hook Job, wedging the +release — the Job keeps refusing to apply the next migration on top of a dirty +version, so `helm upgrade` never succeeds again on its own. + +Manual recovery: + +1. **Find the failing version.** Inspect the failed hook Job/pod logs + (`kubectl logs job/-br-slc-migrate-` or the pod itself — + `hook-delete-policy: before-hook-creation` keeps the failed Job/pod around + until the *next* hook run recreates it, so grab the logs before retrying). + golang-migrate's error output names the dirty version, e.g. `Dirty database + version 7. Fix and force version.` +2. **Force the version.** Run a one-off `migrate force ` against the + same database, using the same `migrate/migrate:` image (see + `migrations.image.tag`) and the migrations ConfigMap + (`{{ include "br-slc.fullname" . }}-migrations`) mounted at `/migrations`, + e.g.: + ```bash + kubectl run migrate-force --rm -it --restart=Never \ + --image=migrate/migrate:v4.19.1 \ + --overrides='{"spec":{"containers":[{"name":"migrate-force","image":"migrate/migrate:v4.19.1","args":["-path=/migrations","-database=postgres://USER@HOST:PORT/NAME?sslmode=require","force",""],"env":[{"name":"PGPASSWORD","valueFrom":{"secretKeyRef":{"name":"","key":"POSTGRES_PASSWORD"}}}],"volumeMounts":[{"name":"migrations","mountPath":"/migrations"}]}],"volumes":[{"name":"migrations","configMap":{"name":"-br-slc-migrations"}}]}}' + ``` + Substitute the real `USER`/`HOST`/`PORT`/`NAME`/secret name from your + release's values, and `` with the version identified in step 1 + (use the version *before* the failed one if the failed migration's DDL did + not actually apply — confirm against the target schema before forcing). +3. **Re-run the upgrade.** With `dirty` cleared, `helm upgrade` retries the + hook Job normally and applies the remaining migrations. + +This is a manual, deliberately out-of-band recovery path — the hook Job does +not attempt automatic dirty-state recovery, since forcing the wrong version +can silently skip or reapply DDL. + +### `.helmignore` (Task 6.0.2 reconciliation) + +The `migrations/` symlink also drags in three Go integration test files +(`*_test.go`) and one JSON systemplane DDL manifest +(`systemplane_ddl_manifest.json`) that live alongside the SQL in the +repo-root `migrations/` directory. `.helmignore` excludes +`migrations/*_test.go`, `migrations/*.json`, and `migrations/*.go` so only +the 42 `.sql` files (21 up + 21 down) are loaded into the chart — +`.Files.Glob "migrations/*.sql"` in `migrate-configmap.yaml` is unaffected by +this exclusion (still finds all 42) since `.helmignore` only removes the +non-SQL files, not the glob's own matches. + +## Probes + +| Container | Probe | Path | Port | Notes | +|---|---|---|---|---| +| `br-slc` | liveness | `/health` | 4111 | process viability only, no dependency checks | +| `br-slc` | readiness | `/readyz` | 4111 | dependency-aware; has a `draining` state during graceful shutdown — more lenient `failureThreshold` than liveness | +| `slc-signer` | liveness + readiness | `/health` | 9101 | same path for both (no separate readyz) | +| `aslc-xsd-validator` | liveness + readiness | `/health` | 9091 | same path for both | +| `mqbridge` | liveness only | `/health` | 9121 | only when `mqbridge.enabled`; process viability. **No readinessProbe on purpose** (Decisão 21) | + +The app's `/health` and `/readyz` are auth/telemetry-exempt (see +`internal/bootstrap/routes.go`, `fiber_server.go`); `/metrics` is also exempt +but not probed here. Readiness relies on **per-container probes + shared +fate**: the pod is only `Ready` when all readiness-probed containers pass, so a +crash-looping signer/validator de-registers the pod endpoint on its own. The +app's `/readyz` deliberately does **not** add signer/validator dependency +checks — the fail-closed guard is enforced per-request in the builders, and +double-coupling readyz would only cause flapping. **mqbridge deliberately has +NO readinessProbe**: nothing routes to `:9121` via a Service, and its `/readyz` +reflects the live IBM MQ pool, so wiring it as readiness would pull the WHOLE +pod out of the monolith's `:4111` Service on any MQ blip — under the +`replicaCount=1` hard-cap that is a total API outage, not a consumer +degradation. MQ health reaches the monolith via the client-side breaker. + +## Security posture + +Every container (app, `slc-signer`, `aslc-xsd-validator`, migrate) carries the +same hardened `securityContext`: `runAsNonRoot: true`, `runAsUser/Group: +65532`, `allowPrivilegeEscalation: false`, `readOnlyRootFilesystem: true` +(each with its own `emptyDir` at `/tmp`), all capabilities dropped, +`seccompProfile: RuntimeDefault`. The signer/validator postures are set +per-container via `signer.securityContext` / `xsdValidator.securityContext`. +The conditional `mqbridge` container (`mqbridge.securityContext`) shares this +posture with **one deliberate exception**: `readOnlyRootFilesystem: false`, +because the IBM MQ C client (libmqm) needs a writable `/var/mqm` (mounted as +an explicit `emptyDir`); it stays non-root, no privilege escalation, all +capabilities dropped, `RuntimeDefault` seccomp. Service is `ClusterIP` only. + +## Port-forward (no Ingress) + +```bash +kubectl port-forward svc/my-release-br-slc 4111:4111 +curl localhost:4111/health +curl localhost:4111/readyz +``` + +## Not included in this chart + +- **HPA / PodDisruptionBudget** — not in this chart's scope (Task 6.0.1 + deliverable list); add if/when autoscaling or multi-replica HA is needed. +- **Postgres/Redis/RabbitMQ subcharts** — BYOC brings its own; this chart only + takes connection config. +- **SaaS multi-tenant MQ consumer manager** — the shared-keystore / + cert-label-per-connection consumer manager for the SaaS model is **Fase 7** + (a separate singleton Deployment), out of scope here (Decisão 21). This + chart's `mqbridge` is the BYOC single-tenant same-pod consumer only. diff --git a/charts/br-slc/templates/_helpers.tpl b/charts/br-slc/templates/_helpers.tpl new file mode 100644 index 00000000..38fb5f46 --- /dev/null +++ b/charts/br-slc/templates/_helpers.tpl @@ -0,0 +1,201 @@ +{{/* +Expand the name of the chart. The chart is named "br-slc-helm" (helm-repo +convention), but every workload/label uses the service name "br-slc". +*/}} +{{- define "br-slc.name" -}} +{{- default "br-slc" .Values.nameOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Create a default fully qualified app name. Truncated to 63 chars (K8s name +length limit) and trimmed of a trailing "-". +*/}} +{{- define "br-slc.fullname" -}} +{{- if .Values.fullnameOverride -}} +{{- .Values.fullnameOverride | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- $name := default "br-slc" .Values.nameOverride -}} +{{- if contains $name .Release.Name -}} +{{- .Release.Name | trunc 63 | trimSuffix "-" -}} +{{- else -}} +{{- printf "%s-%s" .Release.Name $name | trunc 63 | trimSuffix "-" -}} +{{- end -}} +{{- end -}} +{{- end -}} + +{{/* +Chart name and version as used by the chart label. +*/}} +{{- define "br-slc.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Common labels. +*/}} +{{- define "br-slc.labels" -}} +helm.sh/chart: {{ include "br-slc.chart" . }} +{{ include "br-slc.selectorLabels" . }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +{{- end -}} + +{{/* +Selector labels. +*/}} +{{- define "br-slc.selectorLabels" -}} +app.kubernetes.io/name: {{ include "br-slc.name" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +ServiceAccount name to use. +*/}} +{{- define "br-slc.serviceAccountName" -}} +{{- if .Values.serviceAccount.create -}} +{{- default (include "br-slc.fullname" .) .Values.serviceAccount.name -}} +{{- else -}} +{{- default "default" .Values.serviceAccount.name -}} +{{- end -}} +{{- end -}} + +{{/* +Secret name to use for the 5 secret-bearing env vars: either the chart-created +Secret (secrets.create=true) or an externally managed Secret +(secrets.existingSecretName) — BYOC default is the latter. +*/}} +{{- define "br-slc.secretName" -}} +{{- if .Values.secrets.existingSecretName -}} +{{- .Values.secrets.existingSecretName -}} +{{- else -}} +{{- printf "%s-secrets" (include "br-slc.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Resolved image reference: "repository:tag", defaulting tag to .Chart.AppVersion +when empty. +*/}} +{{- define "br-slc.image" -}} +{{- $tag := .Values.image.tag | default .Chart.AppVersion -}} +{{- printf "%s:%s" .Values.image.repository $tag -}} +{{- end -}} + +{{/* +Same-pod signer container image reference, defaulting tag to .Chart.AppVersion. +*/}} +{{- define "br-slc.signerImage" -}} +{{- $tag := .Values.signer.image.tag | default .Chart.AppVersion -}} +{{- printf "%s:%s" .Values.signer.image.repository $tag -}} +{{- end -}} + +{{/* +Same-pod xsd-validator container image reference, defaulting tag to +.Chart.AppVersion. +*/}} +{{- define "br-slc.validatorImage" -}} +{{- $tag := .Values.xsdValidator.image.tag | default .Chart.AppVersion -}} +{{- printf "%s:%s" .Values.xsdValidator.image.repository $tag -}} +{{- end -}} + +{{/* +Same-pod mqbridge container image reference, defaulting tag to +.Chart.AppVersion. Rendered only when mqbridge.enabled (Decisão 21). +*/}} +{{- define "br-slc.mqbridgeImage" -}} +{{- $tag := .Values.mqbridge.image.tag | default .Chart.AppVersion -}} +{{- printf "%s:%s" .Values.mqbridge.image.repository $tag -}} +{{- end -}} + +{{/* +Signer-scoped Secret name (ADR-9 custody): the chart-created signer Secret +(signer.secrets.create=true) or an externally managed one +(signer.secrets.existingSecretName). Distinct from the app's br-slc.secretName +so signing-key material is never in the app container's Secret. +*/}} +{{- define "br-slc.signerSecretName" -}} +{{- if .Values.signer.secrets.existingSecretName -}} +{{- .Values.signer.secrets.existingSecretName -}} +{{- else -}} +{{- printf "%s-signer-secrets" (include "br-slc.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Mqbridge-scoped Secret name (Decisão 21): the chart-created mqbridge Secret +(mqbridge.secrets.create=true) or an externally managed one +(mqbridge.secrets.existingSecretName). Distinct from the app's br-slc.secretName +so MQ credential material stays scoped to the mqbridge container's env. +*/}} +{{- define "br-slc.mqbridgeSecretName" -}} +{{- if .Values.mqbridge.secrets.existingSecretName -}} +{{- .Values.mqbridge.secrets.existingSecretName -}} +{{- else -}} +{{- printf "%s-mqbridge-secrets" (include "br-slc.fullname" .) -}} +{{- end -}} +{{- end -}} + +{{/* +Expand the namespace of the release. Overridable for multi-namespace layouts. +*/}} +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Migrations fullname, e.g. br-slc-migrations — the PreSync Job and Secret +reference this. +*/}} +{{- define "br-slc-migrations.fullname" -}} +{{- printf "%s-migrations" (include "br-slc.fullname" . | trunc 52 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +Migrations labels. +*/}} +{{- define "br-slc-migrations.labels" -}} +helm.sh/chart: {{ include "br-slc.chart" . }} +app.kubernetes.io/name: {{ include "br-slc-migrations.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/component: migrations +{{- end -}} + +{{/* +Per-container securityContext (ADR-12 hardening). Same key set for every +same-pod container; only the values differ. Call with the container's +securityContext dict as context, e.g.: + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.signer.securityContext | nindent 12 }} +*/}} +{{- define "br-slc.containerSecurityContext" -}} +runAsNonRoot: {{ .runAsNonRoot }} +runAsUser: {{ .runAsUser }} +runAsGroup: {{ .runAsGroup }} +allowPrivilegeEscalation: {{ .allowPrivilegeEscalation }} +{{- if hasKey . "readOnlyRootFilesystem" }} +readOnlyRootFilesystem: {{ .readOnlyRootFilesystem }} +{{- end }} +seccompProfile: + type: {{ .seccompProfile.type }} +capabilities: + drop: + {{- range .capabilities.drop }} + - {{ . }} + {{- end }} +{{- end -}} + +{{/* +HTTP liveness/readiness probe body. Call with the probe dict as context, e.g.: + livenessProbe: + {{- include "br-slc.httpProbe" .Values.signer.livenessProbe | nindent 12 }} +*/}} +{{- define "br-slc.httpProbe" -}} +httpGet: + path: {{ .httpGet.path }} + port: {{ .httpGet.port }} +initialDelaySeconds: {{ .initialDelaySeconds }} +periodSeconds: {{ .periodSeconds }} +timeoutSeconds: {{ .timeoutSeconds }} +failureThreshold: {{ .failureThreshold }} +{{- end -}} diff --git a/charts/br-slc/templates/configmap.yaml b/charts/br-slc/templates/configmap.yaml new file mode 100644 index 00000000..eb2485f5 --- /dev/null +++ b/charts/br-slc/templates/configmap.yaml @@ -0,0 +1,12 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-slc.fullname" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +data: + WEBHOOK_NOTIFICATIONS_TOKEN_CACHE_TTL_SEC: {{ .Values.webhookNotificationsCacheTtlSec | default "60" | quote }} + WEBHOOK_HMAC_SECRET_FILE: {{ .Values.webhookHmacSecretFile | default "" | quote }} + {{- range $key, $value := .Values.configmap.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} diff --git a/charts/br-slc/templates/deployment.yaml b/charts/br-slc/templates/deployment.yaml new file mode 100644 index 00000000..ff306bf1 --- /dev/null +++ b/charts/br-slc/templates/deployment.yaml @@ -0,0 +1,291 @@ +{{- /* Decisão 21 hard-cap: when the same-pod mqbridge (RSFN IBM MQ consumer) +is enabled, the MONOLITH replicaCount governs the consumer count. The bridge +holds per-process state (/v1/drain mints deliveryRef->conn; /v1/ack must land +in the SAME process), so 2+ replicas would fan RSFN connections out and break +drain/ack affinity. Enabling mqbridge couples app scale to the consumer — if a +client needs app HA + MQ simultaneously that signals the separate-Deployment / +Fase 7 path, escalate rather than force. */}} +{{- if .Values.mqbridge.enabled }} +{{- if ne (int .Values.replicaCount) 1 }} +{{- fail "mqbridge.enabled requires replicaCount=1 (RSFN consumer is a per-process singleton; ver Decisão 21)" }} +{{- end }} +{{- end }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "br-slc.fullname" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +spec: + replicas: {{ .Values.replicaCount }} + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + selector: + matchLabels: + {{- include "br-slc.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "br-slc.selectorLabels" . | nindent 8 }} + {{- with .Values.podLabels }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + spec: + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "br-slc.serviceAccountName" . }} + terminationGracePeriodSeconds: {{ .Values.terminationGracePeriodSeconds }} + containers: + - name: br-slc + image: {{ include "br-slc.image" . | quote }} + imagePullPolicy: {{ .Values.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.service.targetPort }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "br-slc.fullname" . }} + env: + {{- /* Gate 8 FIX 7: without this, the Go runtime defaults + GOMAXPROCS to the NODE's core count (it can't see the container's + CFS cpu.limit), causing needless CFS throttling under load. The + downward API's resourceFieldRef rounds the cpu limit up to the + nearest whole core (divisor "1"), matching the CFS quota. Guarded + with `with` (not a plain `if .Values.resources.limits.cpu`) so a + values override that sets resources.limits to nil (a legitimate + way to ship a Burstable/no-limit override, not just an omitted + key) doesn't panic the render — dotting straight into `.cpu` on a + nil `resources.limits` errors ("nil pointer evaluating + interface{}.cpu"), whereas `with` only evaluates `.cpu` once it + has already confirmed the piped value is non-nil/non-empty. */}} + {{- with .Values.resources.limits }} + {{- if .cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- end }} + {{- range $key, $value := .Values.secrets.data }} + - name: {{ $key }} + valueFrom: + secretKeyRef: + name: {{ include "br-slc.secretName" $ }} + key: {{ $key }} + {{- end }} + livenessProbe: + {{- include "br-slc.httpProbe" .Values.livenessProbe | nindent 12 }} + readinessProbe: + {{- include "br-slc.httpProbe" .Values.readinessProbe | nindent 12 }} + resources: + {{- toYaml .Values.resources | nindent 12 }} + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.securityContext | nindent 12 }} + volumeMounts: + - name: tmp + mountPath: /tmp + {{- with .Values.extraVolumeMounts }} + {{- toYaml . | nindent 12 }} + {{- end }} + {{- /* Same-pod signer container (ADR-12 / Decision 9). Custody + (ADR-9): the signing-key Secret and softkey PFX volume are mounted + HERE ONLY, never on the app container above. Communicates with the app + over localhost:9101 (see configmap.data.SIGNER_URL). */}} + - name: slc-signer + image: {{ include "br-slc.signerImage" . | quote }} + imagePullPolicy: {{ .Values.signer.image.pullPolicy }} + ports: + - name: signer-http + containerPort: 9101 + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "br-slc.fullname" . }}-signer + env: + {{- /* GOMAXPROCS from the container CFS cpu limit — same + downward-API fix as the br-slc container (Gate 8 FIX 7); the signer + is a CPU-limited Go process on the fail-closed ASLC signing hot + path. Guarded with `with`+`if .cpu` so a nil-limit override renders. */}} + {{- with .Values.signer.resources.limits }} + {{- if .cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- end }} + {{- range $key, $value := .Values.signer.secrets.data }} + - name: {{ $key }} + valueFrom: + secretKeyRef: + name: {{ include "br-slc.signerSecretName" $ }} + key: {{ $key }} + {{- end }} + livenessProbe: + {{- include "br-slc.httpProbe" .Values.signer.livenessProbe | nindent 12 }} + readinessProbe: + {{- include "br-slc.httpProbe" .Values.signer.readinessProbe | nindent 12 }} + resources: + {{- toYaml .Values.signer.resources | nindent 12 }} + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.signer.securityContext | nindent 12 }} + volumeMounts: + - name: signer-tmp + mountPath: /tmp + {{- if .Values.signer.softkeySecret.enabled }} + - name: softkey + mountPath: {{ .Values.signer.softkeySecret.mountPath }} + readOnly: true + {{- end }} + {{- /* Same-pod xsd-validator container (ADR-12). Stateless, no + secrets. Fail-closed hard dependency for outbound ASLC; shared fate in + this pod removes the "app Ready, validator absent" window. + Communicates over localhost:9091 (see configmap.data.XSD_VALIDATOR_URL). */}} + - name: aslc-xsd-validator + image: {{ include "br-slc.validatorImage" . | quote }} + imagePullPolicy: {{ .Values.xsdValidator.image.pullPolicy }} + ports: + - name: xsd-http + containerPort: 9091 + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "br-slc.fullname" . }}-validator + env: + {{- /* GOMAXPROCS from the container CFS cpu limit — same + downward-API fix as the br-slc container (Gate 8 FIX 7); the + validator is a CPU-limited Go process on the fail-closed ASLC XSD + hot path. Guarded so a nil-limit override renders. */}} + {{- with .Values.xsdValidator.resources.limits }} + {{- if .cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- end }} + livenessProbe: + {{- include "br-slc.httpProbe" .Values.xsdValidator.livenessProbe | nindent 12 }} + readinessProbe: + {{- include "br-slc.httpProbe" .Values.xsdValidator.readinessProbe | nindent 12 }} + resources: + {{- toYaml .Values.xsdValidator.resources | nindent 12 }} + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.xsdValidator.securityContext | nindent 12 }} + volumeMounts: + - name: validator-tmp + mountPath: /tmp + {{- if .Values.mqbridge.enabled }} + {{- /* Same-pod mqbridge container (ADR-12 / Decisão 21). CONDITIONAL — + default off, rendered only when the BYOC client's role is IF Domicílio + with RSFN_CONSUMER_TRANSPORT=mq. Owns the inbound IBM MQ/RSFN connection; + identity/keystore are per-process (MQSCO.KeyRepository from env MQSSLKEYR), + so 1 process = 1 participant (see the replicaCount guard at the top of + this template). The app reaches it over localhost:9121 (see + configmap.data.MQ_BRIDGE_URL). UNLIKE signer/validator, rootfs is + WRITABLE (libmqm needs /var/mqm) and the pod gets an amd64 pin below. */}} + - name: mqbridge + image: {{ include "br-slc.mqbridgeImage" . | quote }} + imagePullPolicy: {{ .Values.mqbridge.image.pullPolicy }} + ports: + - name: mq-http + containerPort: 9121 + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "br-slc.fullname" . }}-mqbridge + env: + {{- /* GOMAXPROCS from the container CFS cpu limit — same + downward-API fix as the br-slc container (Gate 8 FIX 7); mqbridge is + a CPU-limited Go process. Guarded so a nil-limit override renders. */}} + {{- with .Values.mqbridge.resources.limits }} + {{- if .cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- end }} + {{- range $key, $value := .Values.mqbridge.secrets.data }} + - name: {{ $key }} + valueFrom: + secretKeyRef: + name: {{ include "br-slc.mqbridgeSecretName" $ }} + key: {{ $key }} + {{- end }} + livenessProbe: + {{- include "br-slc.httpProbe" .Values.mqbridge.livenessProbe | nindent 12 }} + # NO readinessProbe on purpose (Decisão 21): mqbridge is same-pod and + # nothing routes to :9121 through a Service, so a readiness probe here + # buys no traffic gating. Its /readyz reflects the IBM MQ pool state + # (mqbridge/pool.go), so wiring it as readiness would drag the WHOLE + # pod out of the monolith's :4111 Service on any MQ blip — with the + # replicaCount=1 hard-cap that is a total API outage, not a consumer + # degradation. Liveness (process /health) is enough to restart a hung + # bridge; MQ connectivity is surfaced to the monolith via the client's + # breaker instead. + resources: + {{- toYaml .Values.mqbridge.resources | nindent 12 }} + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.mqbridge.securityContext | nindent 12 }} + # Writable rootfs for libmqm (/var/mqm). Set here, not in values.yaml. + readOnlyRootFilesystem: false + volumeMounts: + # libmqm's writable state (error/FDC/trace logs). Explicit emptyDir + # regardless of readOnlyRootFilesystem=false, so the writable + # location never depends on the base image's own directory + # permissions (see values.yaml mqbridge.securityContext comment). + - name: mqbridge-var-mqm + mountPath: /var/mqm + {{- if .Values.mqbridge.keystoreSecret.enabled }} + - name: mqbridge-keystore + mountPath: {{ .Values.mqbridge.keystoreSecret.mountPath }} + readOnly: true + {{- end }} + {{- end }} + volumes: + - name: tmp + emptyDir: {} + - name: signer-tmp + emptyDir: {} + - name: validator-tmp + emptyDir: {} + {{- if .Values.signer.softkeySecret.enabled }} + - name: softkey + secret: + secretName: {{ .Values.signer.softkeySecret.secretName }} + items: + - key: {{ .Values.signer.softkeySecret.secretKey }} + path: signer.pfx + {{- end }} + {{- if .Values.mqbridge.enabled }} + - name: mqbridge-var-mqm + emptyDir: {} + {{- if .Values.mqbridge.keystoreSecret.enabled }} + - name: mqbridge-keystore + secret: + secretName: {{ .Values.mqbridge.keystoreSecret.secretName }} + {{- end }} + {{- end }} + {{- with .Values.extraVolumes }} + {{- toYaml . | nindent 8 }} + {{- end }} + {{- /* Decisão 21: pod-level amd64 pin, present ONLY when mqbridge is + enabled. The IBM MQ Redistributable Client (libmqm/GSKit) this bridge + links is published for Linux x86_64 only, so the whole pod must schedule + onto amd64 nodes. Absent when mqbridge is disabled (no arch constraint on + the app+signer+validator pod). */}} + {{- if .Values.mqbridge.enabled }} + nodeSelector: + kubernetes.io/arch: amd64 + {{- end }} diff --git a/charts/br-slc/templates/migrations/job.yaml b/charts/br-slc/templates/migrations/job.yaml new file mode 100644 index 00000000..9599f52c --- /dev/null +++ b/charts/br-slc/templates/migrations/job.yaml @@ -0,0 +1,111 @@ +{{- if .Values.migrations.enabled }} +# ArgoCD PreSync migration Job. Runs the dedicated br-slc-migrations image, +# whose entrypoint applies the golang-migrate loop over the embedded +# migrations/*.up.sql against the single br-slc database. The chart's Job only +# provides the DB connection + runs the image; it does NOT build the loop. +# +# hook-weight -1 puts this after the PreSync Secret (-2) and before the +# main-sync Deployment, so the monolith never boots against an unmigrated DB. +{{- $pgHost := .Values.migrations.postgres.host | default .Values.configmap.data.POSTGRES_HOST }} +{{- $pgPort := .Values.migrations.postgres.port | default .Values.configmap.data.POSTGRES_PORT | default "5432" }} +{{- $pgUser := .Values.migrations.postgres.user | default .Values.configmap.data.POSTGRES_USER | default "br-slc" }} +{{- $pgDb := .Values.migrations.postgres.database | default .Values.configmap.data.POSTGRES_NAME | default "br-slc" }} +{{- $pgSslMode := .Values.migrations.postgres.sslMode | default .Values.configmap.data.POSTGRES_SSLMODE | default "require" }} +{{- $secretName := ternary .Values.migrations.existingSecretName (include "br-slc-migrations.fullname" .) .Values.migrations.useExistingSecret }} +{{- $pullSecrets := .Values.migrations.imagePullSecrets | default .Values.imagePullSecrets }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "br-slc-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-slc-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-1" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation,HookSucceeded +spec: + backoffLimit: {{ .Values.migrations.backoffLimit | default 2 }} + activeDeadlineSeconds: {{ .Values.migrations.activeDeadlineSeconds | default 600 }} + ttlSecondsAfterFinished: {{ .Values.migrations.ttlSecondsAfterFinished | default 259200 }} + template: + metadata: + labels: + {{- include "br-slc-migrations.labels" . | nindent 8 }} + spec: + restartPolicy: Never + automountServiceAccountToken: false + securityContext: + seccompProfile: + type: RuntimeDefault + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- if .Values.migrations.waitForPostgres.enabled }} + initContainers: + - name: wait-for-postgres + image: "{{ .Values.migrations.waitForPostgres.image.repository }}:{{ .Values.migrations.waitForPostgres.image.tag }}" + imagePullPolicy: IfNotPresent + command: + - /bin/sh + - -c + - > + echo "waiting for {{ $pgHost }}:{{ $pgPort }}..."; + until nc -z {{ $pgHost }} {{ $pgPort }}; do + echo "{{ $pgHost }}:{{ $pgPort }} not ready, waiting..."; sleep 2; + done; + echo "{{ $pgHost }}:{{ $pgPort }} is ready" + securityContext: + runAsNonRoot: true + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + limits: + cpu: "100m" + memory: 32Mi + requests: + cpu: "10m" + memory: 16Mi + {{- end }} + containers: + - name: migrations + image: "{{ .Values.migrations.image.repository }}:{{ .Values.migrations.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.migrations.image.pullPolicy | default "IfNotPresent" }} + env: + - name: POSTGRES_HOST + value: {{ $pgHost | quote }} + - name: POSTGRES_PORT + value: {{ $pgPort | quote }} + - name: POSTGRES_USER + value: {{ $pgUser | quote }} + - name: POSTGRES_NAME + value: {{ $pgDb | quote }} + - name: POSTGRES_SSLMODE + value: {{ $pgSslMode | quote }} + - name: POSTGRES_PASSWORD + valueFrom: + secretKeyRef: + name: {{ $secretName }} + key: POSTGRES_PASSWORD + securityContext: + runAsNonRoot: true + runAsUser: {{ .Values.securityContext.runAsUser }} + runAsGroup: {{ .Values.securityContext.runAsGroup }} + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + resources: + {{- toYaml .Values.migrations.resources | nindent 12 }} +{{- end }} diff --git a/charts/br-slc/templates/migrations/secrets.yaml b/charts/br-slc/templates/migrations/secrets.yaml new file mode 100644 index 00000000..6405ebe7 --- /dev/null +++ b/charts/br-slc/templates/migrations/secrets.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.migrations.enabled (not .Values.migrations.useExistingSecret) }} +# Dedicated PreSync Secret carrying only the Postgres password for the migration +# Job. PreSync hooks run BEFORE the main sync wave, so on a first install the +# app Secret does not exist yet. This hook Secret (weight -2) is created before +# the migration Job (weight -1). hook-delete-policy is BeforeHookCreation ONLY +# (not HookSucceeded) so it survives the whole PreSync phase for the Job to +# read; it is replaced at the next sync. When migrations.useExistingSecret=true +# this Secret is NOT minted and the Job reads POSTGRES_PASSWORD from the +# operator-provided existing Secret (migrations.existingSecretName). +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-slc-migrations.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-slc-migrations.labels" . | nindent 4 }} + annotations: + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-weight: "-2" + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation +type: Opaque +stringData: + POSTGRES_PASSWORD: {{ .Values.migrations.postgres.password | default .Values.secrets.data.POSTGRES_PASSWORD | quote }} +{{- end }} diff --git a/charts/br-slc/templates/mqbridge-configmap.yaml b/charts/br-slc/templates/mqbridge-configmap.yaml new file mode 100644 index 00000000..c326c89a --- /dev/null +++ b/charts/br-slc/templates/mqbridge-configmap.yaml @@ -0,0 +1,12 @@ +{{- if .Values.mqbridge.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-slc.fullname" . }}-mqbridge + labels: + {{- include "br-slc.labels" . | nindent 4 }} +data: + {{- range $key, $value := .Values.mqbridge.configmap.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/br-slc/templates/mqbridge-secret.yaml b/charts/br-slc/templates/mqbridge-secret.yaml new file mode 100644 index 00000000..227deca6 --- /dev/null +++ b/charts/br-slc/templates/mqbridge-secret.yaml @@ -0,0 +1,24 @@ +{{- /* +Mqbridge-scoped Secret (Decisão 21): MQ credential material for the same-pod +mqbridge container. Only rendered when this chart owns it AND the bridge is +enabled (mqbridge.enabled=true AND mqbridge.secrets.create=true). The BYOC +default (mqbridge.secrets.create=false) references an externally managed Secret +via mqbridge.secrets.existingSecretName instead — see br-slc.mqbridgeSecretName +in _helpers.tpl. Never bake real values into values.yaml; supply them via +--set-string/-f at install time when create=true. +*/ -}} +{{- if .Values.mqbridge.enabled }} +{{- if .Values.mqbridge.secrets.create }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-slc.mqbridgeSecretName" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := .Values.mqbridge.secrets.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} +{{- end }} diff --git a/charts/br-slc/templates/secrets.yaml b/charts/br-slc/templates/secrets.yaml new file mode 100644 index 00000000..aa7b8a50 --- /dev/null +++ b/charts/br-slc/templates/secrets.yaml @@ -0,0 +1,20 @@ +{{- /* +Only rendered when this chart owns the Secret (secrets.create=true). The BYOC +default (secrets.create=false) references an externally managed Secret via +secrets.existingSecretName instead — see br-slc.secretName in _helpers.tpl and +README.md "Secrets" section. Never bake real values into values.yaml; supply +them via --set-string/-f at install time when create=true. +*/ -}} +{{- if .Values.secrets.create }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-slc.secretName" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := .Values.secrets.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/br-slc/templates/service.yaml b/charts/br-slc/templates/service.yaml new file mode 100644 index 00000000..3eb95f36 --- /dev/null +++ b/charts/br-slc/templates/service.yaml @@ -0,0 +1,16 @@ +{{- /* ClusterIP-only Service — no NodePort/LoadBalancer, no Ingress (BYOC scope). */ -}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "br-slc.fullname" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +spec: + type: {{ .Values.service.type }} + selector: + {{- include "br-slc.selectorLabels" . | nindent 4 }} + ports: + - name: http + port: {{ .Values.service.port }} + targetPort: http + protocol: TCP diff --git a/charts/br-slc/templates/serviceaccount.yaml b/charts/br-slc/templates/serviceaccount.yaml new file mode 100644 index 00000000..12ffdfa1 --- /dev/null +++ b/charts/br-slc/templates/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if .Values.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "br-slc.serviceAccountName" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} + {{- with .Values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +automountServiceAccountToken: {{ .Values.serviceAccount.automountServiceAccountToken }} +{{- end }} diff --git a/charts/br-slc/templates/signer-configmap.yaml b/charts/br-slc/templates/signer-configmap.yaml new file mode 100644 index 00000000..0cf2393f --- /dev/null +++ b/charts/br-slc/templates/signer-configmap.yaml @@ -0,0 +1,11 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-slc.fullname" . }}-signer + labels: + {{- include "br-slc.labels" . | nindent 4 }} +data: + SIGNER_PKCS11_TOKEN_LABEL: {{ .Values.signer.pkcs11TokenLabel | quote }} + {{- range $key, $value := .Values.signer.configmap.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} diff --git a/charts/br-slc/templates/signer-secret.yaml b/charts/br-slc/templates/signer-secret.yaml new file mode 100644 index 00000000..7cb1182f --- /dev/null +++ b/charts/br-slc/templates/signer-secret.yaml @@ -0,0 +1,22 @@ +{{- /* +Signer-scoped Secret (ADR-9 custody): signing-key material readable ONLY by +the signer container, never the app container. Only rendered when this chart +owns it (signer.secrets.create=true). The BYOC default +(signer.secrets.create=false) references an externally managed Secret via +signer.secrets.existingSecretName instead — see br-slc.signerSecretName in +_helpers.tpl. Never bake real values into values.yaml; supply them via +--set-string/-f at install time when create=true. +*/ -}} +{{- if .Values.signer.secrets.create }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "br-slc.signerSecretName" . }} + labels: + {{- include "br-slc.labels" . | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := .Values.signer.secrets.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/br-slc/templates/validator-configmap.yaml b/charts/br-slc/templates/validator-configmap.yaml new file mode 100644 index 00000000..50e1b552 --- /dev/null +++ b/charts/br-slc/templates/validator-configmap.yaml @@ -0,0 +1,10 @@ +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "br-slc.fullname" . }}-validator + labels: + {{- include "br-slc.labels" . | nindent 4 }} +data: + {{- range $key, $value := .Values.xsdValidator.configmap.data }} + {{ $key }}: {{ $value | quote }} + {{- end }} diff --git a/charts/br-slc/values-template.yaml b/charts/br-slc/values-template.yaml new file mode 100644 index 00000000..a6bc467a --- /dev/null +++ b/charts/br-slc/values-template.yaml @@ -0,0 +1,52 @@ +# Template values for the br-slc (Sistema de Liquidação Centralizada) chart. +# Copy this file, fill in the values for your environment, and install with -f. +# Postgres, Redis and (optionally) RabbitMQ are EXTERNAL, client-managed +# dependencies in BYOC — this chart does not deploy them. See README.md for the +# full env-var coverage and the Chart Contract. + +imagePullSecrets: + - name: ghcr-credential + +image: + tag: "" # optional — defaults to Chart.appVersion + +# App container Secret. create: true mints the Secret from the values below; +# create: false (recommended for BYOC) references an operator-managed Secret via +# existingSecretName that must expose these same keys. +secrets: + create: false + existingSecretName: "br-slc-secrets" + data: + POSTGRES_PASSWORD: "" # REQUIRED — external Postgres password + REDIS_PASSWORD: "" # REQUIRED when the external Redis needs auth + WEBHOOK_API_KEY: "" + WEBHOOK_HMAC_SECRET: "" + +configmap: + data: + POSTGRES_HOST: "" # REQUIRED — external Postgres host + REDIS_HOST: "" # REQUIRED — external Redis host:port + PLUGIN_AUTH_HOST: "" # REQUIRED — Access Manager URL (fails closed at boot if empty while auth enabled) + CORS_ALLOWED_ORIGINS: "" # REQUIRED before go-live — real client origin(s) + +# Signer container Secret (ADR-9 custody: readable ONLY by the slc-signer +# container). Same create/existingSecretName pattern. +signer: + secrets: + create: false + existingSecretName: "br-slc-signer-secrets" + data: + SIGNER_SOFTKEY_PFX_PASSPHRASE: "" # decrypts the softkey PFX (softkey custody path) + +# Conditional inbound IBM MQ / RSFN consumer (Decisão 21). Enable only for the +# IF Domicílio role with RSFN_CONSUMER_TRANSPORT=mq; forces replicaCount=1 and an +# amd64 node pin. Leave disabled otherwise. +mqbridge: + enabled: false + +# Detached migrations. The PreSync Job runs the dedicated br-slc-migrations image. +migrations: + enabled: true + postgres: + host: "" # defaults to configmap.data.POSTGRES_HOST + password: "" # defaults to secrets.data.POSTGRES_PASSWORD diff --git a/charts/br-slc/values.schema.json b/charts/br-slc/values.schema.json new file mode 100644 index 00000000..c8874fb0 --- /dev/null +++ b/charts/br-slc/values.schema.json @@ -0,0 +1,463 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "title": "br-slc", + "type": "object", + "required": [ + "image", + "service", + "securityContext", + "resources", + "livenessProbe", + "readinessProbe", + "secrets", + "configmap", + "signer", + "xsdValidator", + "mqbridge", + "migrations" + ], + "properties": { + "replicaCount": { "type": "integer", "minimum": 0 }, + "revisionHistoryLimit": { "type": "integer", "minimum": 0 }, + "nameOverride": { "type": "string" }, + "fullnameOverride": { "type": "string" }, + "terminationGracePeriodSeconds": { "type": "integer", "minimum": 0 }, + "image": { + "type": "object", + "required": ["repository", "pullPolicy"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "imagePullSecrets": { + "type": "array", + "items": { "type": "object" } + }, + "serviceAccount": { + "type": "object", + "required": ["create"], + "properties": { + "create": { "type": "boolean" }, + "name": { "type": "string" }, + "annotations": { "type": "object" }, + "automountServiceAccountToken": { "type": "boolean" } + } + }, + "podAnnotations": { "type": "object" }, + "podLabels": { "type": "object" }, + "service": { + "type": "object", + "required": ["type", "port", "targetPort"], + "properties": { + "type": { "type": "string", "enum": ["ClusterIP"] }, + "port": { "type": "integer", "minimum": 1, "maximum": 65535 }, + "targetPort": { "type": "integer", "minimum": 1, "maximum": 65535 } + } + }, + "securityContext": { + "type": "object", + "required": [ + "runAsNonRoot", + "runAsUser", + "runAsGroup", + "allowPrivilegeEscalation", + "readOnlyRootFilesystem", + "capabilities", + "seccompProfile" + ], + "properties": { + "runAsNonRoot": { "type": "boolean", "const": true }, + "runAsUser": { "type": "integer" }, + "runAsGroup": { "type": "integer" }, + "allowPrivilegeEscalation": { "type": "boolean", "const": false }, + "readOnlyRootFilesystem": { "type": "boolean", "const": true }, + "capabilities": { + "type": "object", + "required": ["drop"], + "properties": { + "drop": { + "type": "array", + "items": { "type": "string" }, + "contains": { "const": "ALL" } + } + } + }, + "seccompProfile": { + "type": "object", + "required": ["type"], + "properties": { + "type": { "type": "string" } + } + } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "livenessProbe": { + "type": "object", + "properties": { + "httpGet": { + "type": "object", + "required": ["path", "port"], + "properties": { + "path": { "type": "string" }, + "port": { "type": ["string", "integer"] } + } + }, + "initialDelaySeconds": { "type": "integer", "minimum": 0 }, + "periodSeconds": { "type": "integer", "minimum": 1 }, + "timeoutSeconds": { "type": "integer", "minimum": 1 }, + "failureThreshold": { "type": "integer", "minimum": 1 } + } + }, + "readinessProbe": { + "type": "object", + "properties": { + "httpGet": { + "type": "object", + "required": ["path", "port"], + "properties": { + "path": { "type": "string" }, + "port": { "type": ["string", "integer"] } + } + }, + "initialDelaySeconds": { "type": "integer", "minimum": 0 }, + "periodSeconds": { "type": "integer", "minimum": 1 }, + "timeoutSeconds": { "type": "integer", "minimum": 1 }, + "failureThreshold": { "type": "integer", "minimum": 1 } + } + }, + "extraVolumes": { "type": "array" }, + "extraVolumeMounts": { "type": "array" }, + "secrets": { + "type": "object", + "required": ["create", "data"], + "if": { "properties": { "create": { "const": false } } }, + "then": { "required": ["existingSecretName"], "properties": { "existingSecretName": { "minLength": 1 } } }, + "properties": { + "create": { "type": "boolean" }, + "existingSecretName": { "type": "string" }, + "data": { + "type": "object", + "required": [ + "POSTGRES_PASSWORD", + "REDIS_PASSWORD", + "WEBHOOK_API_KEY", + "WEBHOOK_HMAC_SECRET", + "RABBITMQ_DEFAULT_PASS", + "AWS_SECRET_ACCESS_KEY", + "AWS_SESSION_TOKEN" + ], + "additionalProperties": { "type": "string" } + } + } + }, + "configmap": { + "type": "object", + "required": ["data"], + "properties": { + "data": { + "type": "object", + "additionalProperties": { "type": "string" } + } + } + }, + "signer": { + "type": "object", + "required": ["image", "resources", "securityContext", "livenessProbe", "readinessProbe", "softkeySecret", "secrets", "configmap"], + "properties": { + "image": { + "type": "object", + "required": ["repository", "pullPolicy"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "securityContext": { + "type": "object", + "required": ["runAsNonRoot", "allowPrivilegeEscalation", "readOnlyRootFilesystem", "capabilities", "seccompProfile"], + "properties": { + "runAsNonRoot": { "type": "boolean", "const": true }, + "runAsUser": { "type": "integer" }, + "runAsGroup": { "type": "integer" }, + "allowPrivilegeEscalation": { "type": "boolean", "const": false }, + "readOnlyRootFilesystem": { "type": "boolean", "const": true }, + "capabilities": { + "type": "object", + "required": ["drop"], + "properties": { + "drop": { + "type": "array", + "items": { "type": "string" }, + "contains": { "const": "ALL" } + } + } + }, + "seccompProfile": { + "type": "object", + "required": ["type"], + "properties": { "type": { "type": "string" } } + } + } + }, + "livenessProbe": { "type": "object" }, + "readinessProbe": { "type": "object" }, + "softkeySecret": { + "type": "object", + "required": ["enabled"], + "properties": { + "enabled": { "type": "boolean" }, + "secretName": { "type": "string" }, + "secretKey": { "type": "string" }, + "mountPath": { "type": "string" } + } + }, + "secrets": { + "type": "object", + "required": ["create", "data"], + "if": { "properties": { "create": { "const": false } } }, + "then": { "required": ["existingSecretName"], "properties": { "existingSecretName": { "minLength": 1 } } }, + "properties": { + "create": { "type": "boolean" }, + "existingSecretName": { "type": "string" }, + "data": { + "type": "object", + "required": [ + "SIGNER_SOFTKEY_PFX_PASSPHRASE", + "AWS_SECRET_ACCESS_KEY", + "AWS_SESSION_TOKEN", + "SIGNER_VAULT_TOKEN", + "SIGNER_PKCS11_PIN" + ], + "additionalProperties": { "type": "string" } + } + } + }, + "configmap": { + "type": "object", + "required": ["data"], + "properties": { + "data": { + "type": "object", + "additionalProperties": { "type": "string" } + } + } + } + } + }, + "xsdValidator": { + "type": "object", + "required": ["image", "resources", "securityContext", "livenessProbe", "readinessProbe", "configmap"], + "properties": { + "image": { + "type": "object", + "required": ["repository", "pullPolicy"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "securityContext": { + "type": "object", + "required": ["runAsNonRoot", "allowPrivilegeEscalation", "readOnlyRootFilesystem", "capabilities", "seccompProfile"], + "properties": { + "runAsNonRoot": { "type": "boolean", "const": true }, + "runAsUser": { "type": "integer" }, + "runAsGroup": { "type": "integer" }, + "allowPrivilegeEscalation": { "type": "boolean", "const": false }, + "readOnlyRootFilesystem": { "type": "boolean", "const": true }, + "capabilities": { + "type": "object", + "required": ["drop"], + "properties": { + "drop": { + "type": "array", + "items": { "type": "string" }, + "contains": { "const": "ALL" } + } + } + }, + "seccompProfile": { + "type": "object", + "required": ["type"], + "properties": { "type": { "type": "string" } } + } + } + }, + "livenessProbe": { "type": "object" }, + "readinessProbe": { "type": "object" }, + "configmap": { + "type": "object", + "required": ["data"], + "properties": { + "data": { + "type": "object", + "additionalProperties": { "type": "string" } + } + } + } + } + }, + "mqbridge": { + "type": "object", + "required": ["enabled", "image", "resources", "securityContext", "livenessProbe", "keystoreSecret", "secrets", "configmap"], + "properties": { + "enabled": { "type": "boolean" }, + "image": { + "type": "object", + "required": ["repository", "pullPolicy"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "securityContext": { + "type": "object", + "required": ["runAsNonRoot", "allowPrivilegeEscalation", "capabilities", "seccompProfile"], + "properties": { + "runAsNonRoot": { "type": "boolean", "const": true }, + "runAsUser": { "type": "integer" }, + "runAsGroup": { "type": "integer" }, + "allowPrivilegeEscalation": { "type": "boolean", "const": false }, + "capabilities": { + "type": "object", + "required": ["drop"], + "properties": { + "drop": { + "type": "array", + "items": { "type": "string" }, + "contains": { "const": "ALL" } + } + } + }, + "seccompProfile": { + "type": "object", + "required": ["type"], + "properties": { "type": { "type": "string" } } + } + } + }, + "livenessProbe": { "type": "object" }, + "keystoreSecret": { + "type": "object", + "required": ["enabled"], + "properties": { + "enabled": { "type": "boolean" }, + "secretName": { "type": "string" }, + "mountPath": { "type": "string" }, + "stem": { "type": "string" } + } + }, + "secrets": { + "type": "object", + "required": ["create", "data"], + "if": { "properties": { "create": { "const": false } } }, + "then": { "required": ["existingSecretName"], "properties": { "existingSecretName": { "minLength": 1 } } }, + "properties": { + "create": { "type": "boolean" }, + "existingSecretName": { "type": "string" }, + "data": { + "type": "object", + "required": ["MQ_BRIDGE_MQ_PASSWORD"], + "additionalProperties": { "type": "string" } + } + } + }, + "configmap": { + "type": "object", + "required": ["data"], + "properties": { + "data": { + "type": "object", + "additionalProperties": { "type": "string" } + } + } + } + } + }, + "migrations": { + "type": "object", + "required": ["enabled", "image"], + "properties": { + "enabled": { "type": "boolean" }, + "backoffLimit": { "type": "integer", "minimum": 0 }, + "activeDeadlineSeconds": { "type": "integer", "minimum": 1 }, + "ttlSecondsAfterFinished": { "type": "integer", "minimum": 0 }, + "useExistingSecret": { "type": "boolean" }, + "existingSecretName": { "type": "string" }, + "postgres": { + "type": "object", + "properties": { + "host": { "type": "string" }, + "port": { "type": "string" }, + "user": { "type": "string" }, + "database": { "type": "string" }, + "sslMode": { "type": "string" }, + "password": { "type": "string" } + } + }, + "image": { + "type": "object", + "required": ["repository"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "waitForPostgres": { + "type": "object", + "properties": { + "enabled": { "type": "boolean" }, + "image": { + "type": "object", + "properties": { + "repository": { "type": "string" }, + "tag": { "type": "string" } + } + } + } + } + } + } + } +} diff --git a/charts/br-slc/values.yaml b/charts/br-slc/values.yaml new file mode 100644 index 00000000..6dcc951d --- /dev/null +++ b/charts/br-slc/values.yaml @@ -0,0 +1,854 @@ +# br-slc Helm values — BYOC single-tenant BASE. +# +# This is the hardened, safe-by-default base. Per-environment overrides (dev/hml +# relaxations, SaaS-only knobs) live in the beleriand gitops overlays (Task +# 6.0.6) — do NOT add values-.yaml files to this chart. +# +# Scope: single tenant, ClusterIP-only Service, no Ingress. Postgres/Redis/ +# RabbitMQ are EXTERNAL, client-managed dependencies in BYOC (this chart does +# NOT deploy them) — set configmap.data.POSTGRES_HOST / REDIS_HOST (and the +# RabbitMQ host, if RABBITMQ_ENABLED=true) to your real endpoints before +# deploying. See README.md for the full env var coverage table. + +replicaCount: 1 +revisionHistoryLimit: 5 + +nameOverride: "" +fullnameOverride: "" +namespaceOverride: "" + +# Non-secret app config emitted into the app ConfigMap but kept OUT of +# configmap.data because their env-var names contain the substring "_token_" +# (a PKCS11 token label and a token-cache TTL — neither is a credential), +# which the Lerian helm-chart-standard secret-key heuristic would otherwise +# flag. The ConfigMap template wires them under their real env-var names. +webhookNotificationsCacheTtlSec: "60" +# WEBHOOK_HMAC_SECRET_FILE — optional mounted-Secret file PATH (not a secret +# value). Kept out of configmap.data because its name contains "secret". Empty +# by default; set it together with extraVolumes/extraVolumeMounts if you prefer +# the mounted-volume rotation pattern over the inline WEBHOOK_HMAC_SECRET var. +webhookHmacSecretFile: "" + +image: + repository: ghcr.io/lerianstudio/br-slc + # Empty defaults to .Chart.AppVersion. ASSUMPTION: reconcile the real + # published repository/tag with Task 6.0.3 (sidecar + app CI image publish). + tag: "" + pullPolicy: IfNotPresent + +imagePullSecrets: [] + +serviceAccount: + create: true + name: "" + # Templatable for IRSA (EKS) / Workload Identity (GKE) / KMS access. + # Example (EKS IRSA, so the app can use AWS_REGION + attached role instead of + # AWS_ACCESS_KEY_ID/SECRET/SESSION_TOKEN — those stay empty in production): + # eks.amazonaws.com/role-arn: arn:aws:iam:::role/ + annotations: {} + # Gate 8 FIX 3: this workload never talks to the Kubernetes API, so the + # projected SA token is pure unused attack surface if the pod is ever + # compromised. Override to true only if you attach a controller/sidecar that + # genuinely needs the K8s API (e.g. IRSA's own token projection is separate + # from this and unaffected by disabling automount here). + automountServiceAccountToken: false + +podAnnotations: {} +podLabels: {} + +service: + type: ClusterIP + port: 4111 + targetPort: 4111 + +# Mirrors deployments/helm/slc-signer's hardened posture exactly (Decision 9 +# sidecar precedent): non-root, no privilege escalation, read-only root fs, all +# capabilities dropped, RuntimeDefault seccomp. /tmp is writable via emptyDir +# (see deployment.yaml) since readOnlyRootFilesystem is true. +securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + +resources: + limits: + cpu: "1" + memory: 512Mi + requests: + cpu: 250m + memory: 256Mi + +# Liveness: process viability only (no dependency checks) — /health. +livenessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: 10 + periodSeconds: 15 + timeoutSeconds: 5 + failureThreshold: 3 + +# Readiness: dependency-aware — /readyz. More lenient than liveness: the app +# has a `draining` state during graceful shutdown (readyz flips 503 first, so +# it must not be so aggressive that it flaps during normal dependency hiccups). +readinessProbe: + httpGet: + path: /readyz + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 6 + +# terminationGracePeriodSeconds must stay comfortably above any +# STREAMING_CLOSE_TIMEOUT_S / outbox drain the app performs on SIGTERM during +# the readyz `draining` window. +terminationGracePeriodSeconds: 30 + +# Extra volumes/mounts for chart consumers who need to attach e.g. a custom CA +# bundle or a mounted Secret for WEBHOOK_API_KEY_FILE/WEBHOOK_HMAC_SECRET_FILE. +extraVolumes: [] +extraVolumeMounts: [] + +# --------------------------------------------------------------------------- +# Secrets (the app container's 7 secret-bearing vars — NEVER real values here). +# --------------------------------------------------------------------------- +# NOTE (ADR-12 same-pod consolidation): SIGNER_SOFTKEY_PFX_PASSPHRASE is NOT +# here — it is signing-key material and lives ONLY in the signer container's +# own Secret (signer.secrets.data below), never readable by this app +# container (ADR-9 custody boundary). +# create: false (default) — recommended for BYOC: the client manages this +# Secret out-of-band (their own K8s Secret, External Secrets Operator, Vault +# injector, etc.) and existingSecretName points at it. The Secret MUST expose +# these SAME 5 keys (override the chart's data keys to match if your Secret +# uses different names — see README). +# create: true — this chart creates the Secret from secrets.data via +# --set-string/-f overrides at install time (still never commit real values +# to this file). +secrets: + create: false + # Non-empty by default (schema requires it when create=false): the BYOC + # operator creates a Secret with THIS name exposing the 5 keys below. When + # create=true the chart names its own Secret with this value instead. + existingSecretName: "br-slc-secrets" + data: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" + WEBHOOK_API_KEY: "" + WEBHOOK_HMAC_SECRET: "" + # Moved out of the ConfigMap (Task 6.0.2 reconciliation): these three are + # credential material per Lerian's values.md ConfigMap-vs-Secrets + # classification and must not live in a ConfigMap. Empty by default — + # RABBITMQ_ENABLED is false in this base, so RABBITMQ_DEFAULT_PASS is + # inert until an overlay enables RabbitMQ for real; the two AWS_* vars + # stay empty in production per the "AWS credentials" note below (prefer + # IRSA via serviceAccount.annotations instead). + RABBITMQ_DEFAULT_PASS: "" + AWS_SECRET_ACCESS_KEY: "" + AWS_SESSION_TOKEN: "" + +# --------------------------------------------------------------------------- +# ConfigMap — ALL non-secret env vars. +# --------------------------------------------------------------------------- +# 1:1 with config/.env.example's active surface (156 vars) minus the 5 secret +# vars above, PLUS two vars this hardened base's own defaults require that are +# NOT in .env.example's active section: +# - DEPLOYMENT_MODE: read by config_validation.go / systemplane.go / readyz +# TLS enforcement but only present in .env.example as documentation (no +# active line) — defaults to "byoc" here (see internal/bootstrap/config.go +# SigningConfig.DeploymentMode). +# - PLUGIN_AUTH_HOST: .env.example only has it commented out +# (# PLUGIN_AUTH_HOST=http://localhost:4000) because PLUGIN_AUTH_ENABLED +# defaults to false there. This base flips PLUGIN_AUTH_ENABLED to true +# (real auth in BYOC), and config_validation.go's validateAuthConfig FAILS +# BOOT when PLUGIN_AUTH_ENABLED=true and PLUGIN_AUTH_HOST is empty — so it +# MUST be set. Left empty by design: this chart will fail closed at boot +# until the operator/overlay sets the real Access Manager URL. See README. +# +# See README.md "Env Var Coverage" for the full 156/156 mapping table. +configmap: + data: + # --- Application Settings --- + ENV_NAME: "production" + LOG_LEVEL: "info" + SERVER_ADDRESS: ":4111" + HTTP_BODY_LIMIT_BYTES: "104857600" + DEPLOYMENT_MODE: "byoc" + + # --- CORS --- MUST override CORS_ALLOWED_ORIGINS with the real client + # origin(s) before go-live; empty is a safe deny-all default (harmless + # combined with ALLOW_CORS_WILDCARD=false below). + CORS_ALLOWED_ORIGINS: "" + CORS_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + CORS_ALLOWED_HEADERS: "Origin,Content-Type,Accept,Authorization,X-Request-ID" + CORS_EXPOSE_HEADERS: "" + CORS_ALLOW_CREDENTIALS: "false" + + # --- TLS / hardening bypass flags --- + # ASSUMPTION: TLS_TERMINATED_UPSTREAM depends on the client's real BYOC + # network topology (mesh mTLS vs. an in-front proxy/LB terminating TLS); + # this chart has no Ingress, so it is left false here — flip per + # environment in the beleriand overlay once the topology is confirmed. + TLS_TERMINATED_UPSTREAM: "false" + # These three MUST stay false in production (config_validation.go rejects + # boot when ENV_NAME=production and ALLOW_CORS_WILDCARD or + # ALLOW_RATELIMIT_FAIL_OPEN is true; ALLOW_INSECURE_TLS is the sovereign + # data-store TLS switch and is kept false here as the safe default too). + ALLOW_INSECURE_TLS: "false" + ALLOW_CORS_WILDCARD: "false" + ALLOW_RATELIMIT_FAIL_OPEN: "false" + + # --- Multi-Tenant Starter (tenant-manager) --- single-tenant BYOC: off. + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_REDIS_PORT: "6379" + MULTI_TENANT_REDIS_TLS: "false" + MULTI_TENANT_MAX_TENANT_POOLS: "100" + MULTI_TENANT_IDLE_TIMEOUT_SEC: "300" + MULTI_TENANT_TIMEOUT: "30" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" + MULTI_TENANT_CACHE_TTL_SEC: "120" + MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: "30" + + # --- PostgreSQL Primary Database --- EXTERNAL/client-managed in BYOC. + # ASSUMPTION: POSTGRES_HOST is left empty — MUST be overridden with the + # real Postgres endpoint before deploy (this chart does not ship a + # postgresql subchart dependency per Task 6.0.1 scope). + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "br-slc" + POSTGRES_NAME: "br-slc" + # Hardened DEVIATION from .env.example's dev default (disable): + # config_validation.go's validateProductionConfig REJECTS + # POSTGRES_SSLMODE=disable when ENV_NAME=production, so the BYOC base + # default must not be "disable". "require" verifies encryption without + # requiring a client-supplied CA bundle; tighten to verify-full once the + # client's Postgres cert chain is known. + POSTGRES_SSLMODE: "require" + MIGRATIONS_PATH: "migrations" + SYSTEMPLANE_ENABLED: "false" + TENANT_RUNTIME_CONFIG_ENABLED: "false" + POSTGRES_MAX_OPEN_CONNS: "25" + POSTGRES_MAX_IDLE_CONNS: "5" + POSTGRES_CONN_MAX_LIFETIME_MINS: "30" + POSTGRES_CONN_MAX_IDLE_TIME_MINS: "5" + POSTGRES_CONNECT_TIMEOUT_SEC: "10" + + # --- Infrastructure Boot Timeout --- + INFRA_CONNECT_TIMEOUT_SEC: "30" + + # --- Redis --- EXTERNAL/client-managed in BYOC (used regardless of + # MULTI_TENANT_ENABLED — idempotency/cache). MUST override REDIS_HOST. + REDIS_HOST: "" + REDIS_DB: "0" + REDIS_PROTOCOL: "3" + REDIS_POOL_SIZE: "10" + REDIS_MIN_IDLE_CONNS: "2" + REDIS_READ_TIMEOUT: "3" + REDIS_WRITE_TIMEOUT: "3" + REDIS_DIAL_TIMEOUT: "5" + REDIS_POOL_TIMEOUT: "2" + REDIS_MAX_RETRIES: "3" + REDIS_MIN_RETRY_BACKOFF: "8" + REDIS_MAX_RETRY_BACKOFF: "1" + + # --- Event-Driven Starter - Circuit Breaker --- + CIRCUIT_BREAKER_ENABLED: "false" + + # --- Event-Driven Starter - RabbitMQ --- off by default (readyz-probe-only + # dependency, not the main event path — lib-streaming/outbox owns that). + # Host/user below are inert while RABBITMQ_ENABLED=false; mirrored from + # .env.example rather than blanked because they have no effect disabled. + # RABBITMQ_DEFAULT_PASS moved to secrets.data (Task 6.0.2 reconciliation — + # it is credential material per Lerian's values.md classification and + # must not live in a ConfigMap; empty by default, operator injects if + # RabbitMQ is ever enabled for real in an overlay). + RABBITMQ_ENABLED: "false" + RABBITMQ_HOST: "localhost" + RABBITMQ_PORT_AMQP: "5672" + RABBITMQ_PORT_HOST: "15672" + RABBITMQ_DEFAULT_USER: "guest" + RABBITMQ_VHOST: "/" + RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS: "false" + RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK: "false" + RABBITMQ_ALLOW_INSECURE_TLS: "false" + + # --- Event-Driven Starter - Outbox --- REQUIRED true: the operations + # context (POST /v1/operations, cancellation) fails closed at boot without + # the outbox repository wired. + OUTBOX_ENABLED: "true" + OUTBOX_TABLE_NAME: "outbox_events" + OUTBOX_DISPATCH_INTERVAL_SEC: "2" + OUTBOX_BATCH_SIZE: "50" + OUTBOX_PUBLISH_MAX_ATTEMPTS: "3" + OUTBOX_PUBLISH_BACKOFF_MS: "200" + OUTBOX_RETRY_WINDOW_SEC: "300" + OUTBOX_MAX_DISPATCH_ATTEMPTS: "10" + OUTBOX_PROCESSING_TIMEOUT_SEC: "600" + OUTBOX_MAX_FAILED_PER_BATCH: "25" + OUTBOX_INCLUDE_TENANT_METRICS: "false" + OUTBOX_ALLOW_EMPTY_TENANT: "true" + + # --- Streaming Starter (lib-streaming outbox relay -> Kafka) --- opt-in; + # needs STREAMING_BROKERS (not in the active .env.example surface) set via + # an overlay before flipping this to true. + STREAMING_ENABLED: "false" + STREAMING_HEALTH_CHECK_TIMEOUT: "2s" + + # --- Authentication (lib-auth + plugin-auth) --- hardened default: real + # auth ON in BYOC. See PLUGIN_AUTH_HOST note above the configmap block — + # this chart intentionally fails closed at boot until PLUGIN_AUTH_HOST is + # set to the real Access Manager endpoint. + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_HOST: "" + + # --- API Documentation (Swagger) --- + SWAGGER_ENABLED: "true" + SWAGGER_TITLE: "BrSlc" + SWAGGER_VERSION: "1.0.0" + SWAGGER_BASE_PATH: "/" + SWAGGER_LEFT_DELIM: "{{" + SWAGGER_RIGHT_DELIM: "}}" + + # --- OpenTelemetry --- hardened default: telemetry ON in BYOC. + # ASSUMPTION: OTEL_EXPORTER_OTLP_ENDPOINT assumes an in-cluster collector + # named "otel-collector-lerian" (the -helm-suffix-exception chart per + # ring:helm conventions) on the standard OTLP gRPC port; reconcile with the + # client's actual collector Service/release name in the beleriand overlay. + ENABLE_TELEMETRY: "true" + OTEL_LIBRARY_NAME: "br-slc" + OTEL_RESOURCE_SERVICE_NAME: "br-slc" + OTEL_RESOURCE_SERVICE_VERSION: "1.0.0" + OTEL_EXPORTER_OTLP_ENDPOINT: "otel-collector-lerian:4317" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + DB_METRICS_INTERVAL_SEC: "15" + + # --- Rate Limiting --- + RATE_LIMIT_ENABLED: "true" + RATE_LIMIT_MAX: "500" + RATE_LIMIT_WINDOW_SEC: "60" + AGGRESSIVE_RATE_LIMIT_MAX: "100" + AGGRESSIVE_RATE_LIMIT_WINDOW_SEC: "60" + RELAXED_RATE_LIMIT_MAX: "1000" + RELAXED_RATE_LIMIT_WINDOW_SEC: "60" + + # --- Idempotency --- + IDEMPOTENCY_RETRY_WINDOW_SEC: "300" + + # --- AWS Credentials (shared: slc-signer awskms adapter + M2M provider) + # --- MUST stay empty in production: use IRSA (serviceAccount.annotations + # above) instead of static credentials. AWS_REGION defaults to the SLC + # staging KMS region — confirm/override per real deployment. + # AWS_SECRET_ACCESS_KEY / AWS_SESSION_TOKEN moved to secrets.data (Task + # 6.0.2 reconciliation — credential material per Lerian's values.md + # classification). AWS_ACCESS_KEY_ID stays here: it is the non-secret + # half of a static credential pair (analogous to *_USER vars); still + # empty by default — prefer IRSA over any static AWS credentials. + AWS_REGION: "us-east-2" + AWS_ACCESS_KEY_ID: "" + + # --- M2M Credentials --- + M2M_CREDENTIAL_CACHE_TTL_SEC: "300" + + # --- Pagination --- + MAX_PAGINATION_LIMIT: "100" + MAX_PAGINATION_MONTH_DATE_RANGE: "3" + + # --- Operations Intake --- + INTAKE_BATCH_MAX_LINES: "50000" + + # --- XSD Validator Sidecar (aslc-xsd-validator — Decision 12 / ADR-12) --- + # SAME-POD container (ADR-12: "sidecar no mesmo pod, localhost"): the app + # reaches the validator over localhost, NOT cluster DNS. 9091 is the + # validator's containerPort inside this shared pod. See the top-level + # xsdValidator: section for the container's own image/config. + XSD_VALIDATOR_URL: "http://localhost:9091" + XSD_VALIDATOR_TIMEOUT_SEC: "10" + RSFN_INBOUND_XSD_VALIDATION_ENABLED: "true" + + # --- Signing Sidecar (slc-signer — Decision 9 / ADR-12) --- + # SAME-POD container: the app reaches the signer over localhost, NOT + # cluster DNS. 9101 is the signer's containerPort inside this shared pod. + # Custody (ADR-9): the signing key material (softkey PFX + passphrase, + # HSM PIN, Vault token) lives ONLY in the signer container — its own + # Secret and softkey volume are never mounted on this app container. See + # the top-level signer: section. + SIGNER_URL: "http://localhost:9101" + SIGNER_TIMEOUT_SEC: "10" + + # --- Mock Núclea (local credit-flow simulator) --- DEV/TEST FIXTURE ONLY; + # not consumed by the app in this phase. Left empty in BYOC/production. + MOCK_NUCLEA_URL: "" + + # --- Núclea REST online-submission transport (E-2.4) --- transport stays + # disabled until NUCLEA_REST_BASE_URL (not in the active .env.example + # surface) is set via an overlay. + NUCLEA_REST_TIMEOUT_SEC: "30" + NUCLEA_REST_CB_CONSECUTIVE_FAILURES: "5" + NUCLEA_REST_CB_OPEN_TIMEOUT_SEC: "30" + NUCLEA_REST_ALLOW_INSECURE_TLS: "false" + + # --- RSFN inbound consumer (IBM MQ external channel, E-3.3) --- + RSFN_CONSUMER_TRANSPORT: "stub" + RSFN_CONSUMER_TIMEOUT_SEC: "30" + RSFN_CONSUMER_CB_CONSECUTIVE_FAILURES: "5" + RSFN_CONSUMER_CB_OPEN_TIMEOUT_SEC: "30" + RSFN_CONSUMER_ALLOW_INSECURE_TLS: "false" + + # --- MQ Bridge sidecar (mqbridge) --- used only when + # RSFN_CONSUMER_TRANSPORT=mq. SAME-POD CONDITIONAL container (ADR-12 + + # Decisão 21): default off, rendered only when mqbridge.enabled=true (BYOC + # role IF Domicílio). When enabled it co-lives with the monolith in this + # pod, so the app reaches it over localhost, NOT cluster DNS — this resolves + # the drain/ack affinity risk by construction (same process, localhost). It + # keeps a writable /var/mqm rootfs + an amd64 pod pin (libmqm/GSKit); see the + # top-level mqbridge: section. Enable it in the same overlay/release that + # flips this transport, once a real/HML IBM MQ broker + GSKit keystore are + # ready. + MQ_BRIDGE_URL: "http://localhost:9121" + MQ_BRIDGE_TIMEOUT_SEC: "10" + MQ_BRIDGE_MAX_DRAIN: "16" + + # --- Schedule — credit-window dispatch gate + STR grid (E-2.4/E-3.2) --- + # v0 window + worker: kept at .env.example's real (non-dev-bypass) + # defaults. All the provisional per-driver toggles below default to false + # exactly as .env.example ships them (each needs per-tenant Núclea + # recipient/custody material from E-4.2 before it is safe to enable — see + # config.go doc comments) — this base does not flip any of them on. + SCHEDULE_CREDIT_WINDOW_OPEN: "00:30" + SCHEDULE_CREDIT_WINDOW_CLOSE: "17:30" + SCHEDULE_WORKER_ENABLED: "true" + SCHEDULE_WORKER_INTERVAL_SEC: "30" + SCHEDULE_CUTOFF_ALERT_LEAD_MIN: "30" + SCHEDULE_GRID_GATE_ENABLED: "false" + SCHEDULE_HOLIDAYS: "" + SCHEDULE_DISPATCH_ENABLED: "false" + SCHEDULE_DISPATCH_PAGE_SIZE: "1000" + SCHEDULE_RETURN_POLL_ENABLED: "false" + SCHEDULE_RELAY_STATUS_ENABLED: "false" + SCHEDULE_RSFN_INGEST_ENABLED: "false" + SCHEDULE_D1_CONFIRMATION_ENABLED: "false" + SCHEDULE_D1_CONFIRMATION_CUTOFF: "19:00" + SCHEDULE_SILOC_WINDOWS_ENABLED: "false" + SCHEDULE_SILOC_DEPOSIT_CYCLE1_CUTOFF: "07:30" + SCHEDULE_SILOC_DEPOSIT_CYCLE2_CUTOFF: "12:50" + SCHEDULE_STR_SETTLED_ENABLED: "false" + + # --- Webhook delivery (BYOC `direct` provider — E-3.5) --- + # WEBHOOK_API_KEY_FILE/WEBHOOK_HMAC_SECRET_FILE are optional mounted-Secret + # file-path variants; left empty here since this chart wires the inline + # WEBHOOK_API_KEY/WEBHOOK_HMAC_SECRET vars via secretKeyRef instead (see + # secrets.data above). Set extraVolumes/extraVolumeMounts + these two paths + # if you prefer the mounted-volume rotation pattern. + WEBHOOK_API_KEY_FILE: "" + # WEBHOOK_HMAC_SECRET_FILE is set via the top-level webhookHmacSecretFile + # value (see the note there). + WEBHOOK_DELIVERY_TIMEOUT_SEC: "10" + WEBHOOK_WORKER_ENABLED: "false" + WEBHOOK_WORKER_INTERVAL_SEC: "30" + WEBHOOK_DELIVERY_PROVIDER: "direct" + WEBHOOK_NOTIFICATIONS_BASE_URL: "" + # WEBHOOK_NOTIFICATIONS_TOKEN_CACHE_TTL_SEC is set via the top-level + # webhookNotificationsCacheTtlSec value (see the note there). + WEBHOOK_MAX_ATTEMPTS: "6" + WEBHOOK_BACKOFF_BASE_SEC: "30" + WEBHOOK_CONSUME_BATCH: "100" + +# =========================================================================== +# Same-pod sidecar containers (ADR-12). signer + validator run as ADDITIONAL +# containers in THIS Deployment's pod (not separate Deployments/Services), so +# the app talks to them over localhost (see SIGNER_URL/XSD_VALIDATOR_URL). Both +# are MANDATORY (no enable toggle): the validator is a fail-closed hard +# dependency for all outbound ASLC, and the signer signs every batch. Shared +# fate: the pod only reaches Ready when all three containers pass readiness. +# =========================================================================== + +# --- slc-signer container (Decision 9 / ADR-9 crypto+credential boundary) --- +signer: + # SIGNER_PKCS11_TOKEN_LABEL, wired into the signer ConfigMap under its real + # env-var name. Kept here (not under signer.configmap.data) because the name + # contains "_token_" and would otherwise trip the secret-key heuristic; it is + # a pkcs11 token *label*, not a credential. Empty unless a pkcs11 token is set. + pkcs11TokenLabel: "" + image: + repository: ghcr.io/lerianstudio/br-slc-signer + # Empty defaults to .Chart.AppVersion (see br-slc.signerImage in + # _helpers.tpl). ASSUMPTION: reconcile the published repo/tag with Task + # 6.0.3 (sidecar image publish). + tag: "" + pullPolicy: IfNotPresent + resources: + limits: + cpu: "1" + memory: 256Mi + requests: + cpu: 100m + memory: 64Mi + # Per-container hardened posture (identical to the app container): non-root, + # no privilege escalation, read-only root fs (its own /tmp emptyDir), all + # capabilities dropped, RuntimeDefault seccomp. + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + # Both probes hit the same /health:9101 (no separate readyz for the signer). + livenessProbe: + httpGet: + path: /health + port: 9101 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /health + port: 9101 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + # Softkey PFX bundle (BYOC-first custody adapter). The .pfx/.p12 FILE is + # mounted read-only from an externally managed Secret ONTO THE SIGNER + # CONTAINER ONLY (never the app container — ADR-9 custody). The passphrase + # that decrypts it is the separate signer.secrets.SIGNER_SOFTKEY_PFX_PASSPHRASE. + softkeySecret: + enabled: false + # Existing Secret whose key holds the PFX bytes, e.g.: + # kubectl create secret generic slc-signer-softkey --from-file=signer.pfx=./signer.pfx + secretName: "" + secretKey: "signer.pfx" + mountPath: "/certs" + # Signer-scoped Secret — key/credential material readable ONLY by the signer + # container (ADR-9). Same create/existingSecretName pattern as the app + # Secret; BYOC default is an externally managed Secret. + secrets: + create: false + existingSecretName: "br-slc-signer-secrets" + data: + # Decrypts the softkey PFX bundle. Required only for the softkey adapter. + SIGNER_SOFTKEY_PFX_PASSPHRASE: "" + # awskms adapter static credentials (prefer IRSA via serviceAccount + # annotations so these stay empty). + AWS_SECRET_ACCESS_KEY: "" + AWS_SESSION_TOKEN: "" + # vault adapter token (only when SIGNER_VAULT_ADDR is set). + SIGNER_VAULT_TOKEN: "" + # pkcs11 adapter PIN (only when a pkcs11 token is configured). + SIGNER_PKCS11_PIN: "" + configmap: + data: + SIGNER_ADDR: ":9101" + SIGNER_MAX_BODY_BYTES: "65536" + ENV_NAME: "production" + # --- softkey adapter (BYOC-first custody path) --- + SIGNER_SOFTKEY_PFX_PATH: "/certs/signer.pfx" + # DELIBERATE, FLAGGED default: softkey holds the key in process memory, + # which config.go treats as alert-worthy in production and REFUSES to + # start unless acked. BYOC-first ships softkey day-one; flip back to + # "false" once a real awskms/pkcs11/vault adapter is configured. + SIGNER_SOFTKEY_ALLOW_IN_PRODUCTION: "true" + # --- awskms adapter (parameterizable, disabled by default: no region) --- + SIGNER_AWSKMS_REGION: "" + SIGNER_AWSKMS_DEFAULT_KEY_REF: "" + AWS_ACCESS_KEY_ID: "" + AWS_REGION: "" + # --- pkcs11 adapter (parameterizable, disabled by default: no token) --- + # SIGNER_PKCS11_TOKEN_LABEL is set via signer.pkcs11TokenLabel (kept out of + # configmap.data because its name matches the "_token_" secret heuristic). + SIGNER_PKCS11_MODULE: "/usr/lib/softhsm/libsofthsm2.so" + SIGNER_PKCS11_SLOT: "" + SIGNER_PKCS11_KEY_LABEL: "" + # --- vault adapter (parameterizable, disabled by default: no address) --- + SIGNER_VAULT_ADDR: "" + SIGNER_VAULT_TRANSIT_MOUNT: "transit" + SIGNER_VAULT_NAMESPACE: "" + SIGNER_VAULT_CACERT: "" + # --- Auth delegation (Access Manager) --- fails closed until the + # operator sets the real PLUGIN_AUTH_HOST (validateAuthConfig). + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_HOST: "" + PLUGIN_AUTH_ALLOW_INSECURE_HTTP: "false" + +# --- aslc-xsd-validator container (Decision 12) --- +# Stateless: all XSD schemas are go:embedded in the image. No secrets, no +# persistent volumes. HARD outbound dependency (fail-closed) — but shared fate +# in the same pod removes the "app Ready, validator absent" window. +xsdValidator: + image: + repository: ghcr.io/lerianstudio/br-slc-xsd-validator + tag: "" + pullPolicy: IfNotPresent + resources: + limits: + cpu: "500m" + memory: 256Mi + requests: + cpu: 100m + memory: 64Mi + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + livenessProbe: + httpGet: + path: /health + port: 9091 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /health + port: 9091 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + configmap: + data: + XSD_VALIDATOR_ADDR: ":9091" + XSD_MAX_BODY_BYTES: "5242880" + ENV_NAME: "production" + # --- Auth delegation (Access Manager) --- fails closed until the + # operator sets the real PLUGIN_AUTH_HOST (validateAuthConfig). + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_HOST: "" + PLUGIN_AUTH_ALLOW_INSECURE_HTTP: "false" + +# =========================================================================== +# --- mqbridge container (Decisão 21 — RSFN IBM MQ inbound consumer) --- +# CONDITIONAL same-pod container, UNLIKE the mandatory signer/validator above. +# It owns the inbound IBM MQ/RSFN connection of the cards channel; the mTLS +# identity is per-process (MQSCO.KeyRepository from env MQSSLKEYR), so 1 process +# = 1 participant (BYOC single-tenant). The SaaS multi-tenant consumer manager +# is Fase 7 (separate Deployment) — NOT built here. +# +# GATED: rendered ONLY when mqbridge.enabled=true, which a client sets when the +# role is IF Domicílio with RSFN_CONSUMER_TRANSPORT=mq. Default off — a +# credenciadora-only tenant never carries the container, and a default +# `helm template`/`helm install` renders NO mqbridge container/configmap/secret +# and NO amd64 pod pin. When enabled, the app reaches it over localhost:9121 +# (see configmap.data.MQ_BRIDGE_URL). Enabling it hard-caps the monolith +# replicaCount to 1 (per-process deliveryRef->conn state; see the guard at the +# top of templates/deployment.yaml). +# =========================================================================== +mqbridge: + enabled: false + image: + # ASSUMPTION (flag for CI reconciliation): repository derived from the + # module path github.com/LerianStudio/br-slc-mq-bridge and the + # docker-compose service — ghcr.io/lerianstudio/{name} per Lerian Helm + # conventions. + repository: ghcr.io/lerianstudio/br-slc-mq-bridge + # Empty defaults to .Chart.AppVersion (see br-slc.mqbridgeImage in + # _helpers.tpl). + tag: "" + pullPolicy: IfNotPresent + resources: + limits: + memory: 256Mi + cpu: "500m" + requests: + memory: 64Mi + cpu: "100m" + # Security hardening. UNLIKE the other same-pod containers, + # readOnlyRootFilesystem is FALSE here: the IBM MQ C client (libmqm) + # conventionally needs a writable location (e.g. /var/mqm) for its own + # error/FDC/trace logs, and a read-only rootfs would break it at connect + # time. Still non-root, no privilege escalation, all capabilities dropped, + # RuntimeDefault seccomp. An explicit emptyDir is mounted at /var/mqm + # regardless (see deployment.yaml) so libmqm's writable state never depends + # on the base image's own directory permissions. + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + # readOnlyRootFilesystem is deliberately FALSE for mqbridge (libmqm needs a + # writable /var/mqm). It is set on the container in deployment.yaml rather + # than here so values.yaml carries no writable-rootfs default. Do NOT add a + # readOnlyRootFilesystem key back to this block. + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + # Liveness ONLY (process viability, /health). There is deliberately NO + # readinessProbe (Decisão 21): mqbridge is same-pod and no Service routes to + # :9121, so readiness gates no traffic — but /readyz reflects the IBM MQ pool + # state, so using it as readiness would pull the whole pod out of the + # monolith's :4111 Service on any MQ blip (total outage under replicaCount=1). + # MQ connectivity is surfaced to the monolith via the client-side breaker. + livenessProbe: + httpGet: + path: /health + port: 9121 + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + # GSKit keystore (.kdb + .sth/.rdb) — required only when + # MQ_BRIDGE_TLS_ENABLED=true (RSFN mandates mTLS in production). Mounted + # read-only ONTO THE MQBRIDGE CONTAINER ONLY from an externally managed + # Secret; MQSSLKEYR (configmap.data below) must point at the STEM path (no + # file extension), e.g. "/keystore/mqbridge" for files + # mqbridge.kdb/mqbridge.sth/mqbridge.rdb. + keystoreSecret: + enabled: false + # Name of an existing Secret whose data keys hold the .kdb/.sth/.rdb bytes, + # e.g. created out-of-band as: + # kubectl create secret generic br-slc-mqbridge-keystore \ + # --from-file=mqbridge.kdb=./mqbridge.kdb \ + # --from-file=mqbridge.sth=./mqbridge.sth \ + # --from-file=mqbridge.rdb=./mqbridge.rdb + secretName: "" + mountPath: "/keystore" + # Base filename stem (no extension) inside the Secret/mount; combined with + # mountPath this yields the MQSSLKEYR value below by convention. + stem: "mqbridge" + # Mqbridge-scoped Secret — never real values here. Same create/ + # existingSecretName pattern as the app/signer Secrets; BYOC default is an + # externally managed Secret. + # create: false (default) — BYOC recommended: the client manages this Secret + # out-of-band and existingSecretName points at it (must expose the same key + # as secrets.data below). + # create: true — this chart creates the Secret from secrets.data via + # --set-string/-f at install time. + secrets: + create: false + existingSecretName: "br-slc-mqbridge-secrets" + data: + # Optional MQCSP password. RSFN authenticates via the client certificate + # in the keystore, so this is normally empty. + MQ_BRIDGE_MQ_PASSWORD: "" + # ConfigMap — all non-secret env vars. The per-request IBM MQ connection + # descriptor (queue manager, channel, conn name, queue) is NOT here — it + # arrives per call from the monolith on /v1/drain. + configmap: + data: + MQ_BRIDGE_ADDR: ":9121" + MQ_BRIDGE_MAX_INFLIGHT: "16" + MQ_BRIDGE_ACK_TIMEOUT_SEC: "60" + # Derived (half of ack timeout, clamped [1s,30s]) when left at "0". + MQ_BRIDGE_SWEEP_INTERVAL_SEC: "0" + MQ_BRIDGE_GET_WAIT_MS: "0" + MQ_BRIDGE_RECEIVE_BUFFER_BYTES: "1048576" + MQ_BRIDGE_MAX_MESSAGE_BYTES: "16777216" + MQ_BRIDGE_MAX_BODY_BYTES: "65536" + + # --- RSFN mTLS (terminates INSIDE this container, not the monolith) --- + # DELIBERATE, FLAGGED default: production requires TLS (the bridge rejects + # boot when ENV_NAME=production and this is false). Left "false" here + # since no broker/keystore exists until mqbridge is actually enabled for a + # real/HML deployment — flip to "true" together with keystoreSecret.enabled + # and MQSSLKEYR below. + MQ_BRIDGE_TLS_ENABLED: "false" + # Empty by default; set to the keystore stem path (e.g. + # "/keystore/mqbridge") once keystoreSecret.enabled=true. + MQSSLKEYR: "" + # DOUBT-TLS-CIPHER (CodeRabbit PR #99): TLS_RSA_WITH_AES_256_CBC_SHA256 + # uses static RSA key exchange + CBC. An ECDHE+GCM CipherSpec (e.g. + # ECDHE_RSA_AES_256_GCM_SHA384, or TLS 1.3 TLS_AES_256_GCM_SHA384) is + # preferred, BUT the CipherSpec MUST match what Nuclea's RSFN MQ manager + # actually accepts — RSFN is a regulated endpoint, not our choice, and + # selecting a spec it rejects fails the TLS handshake. Confirm the + # supported CipherSpec against the Nuclea RSFN MQ manual at the + # homologacao gate; keep this CBC value only as a compatibility fallback. + MQ_BRIDGE_TLS_CIPHER: "TLS_RSA_WITH_AES_256_CBC_SHA256" + + # Optional MQCSP username (RSFN normally authenticates via the client + # cert in the keystore, so this is normally empty). + MQ_BRIDGE_MQ_USER: "" + + # Rejected in production; "false" is the safe default so a non-ibmmq + # binary never silently boots against a real deployment. + MQ_BRIDGE_ALLOW_STUB: "false" + + ENV_NAME: "production" + LOG_LEVEL: "info" + + # --- Auth delegation (Access Manager) --- hardened default: real auth ON. + # PLUGIN_AUTH_HOST is intentionally empty: the bridge FAILS BOOT when + # PLUGIN_AUTH_ENABLED=true and the host is empty — fails closed until the + # operator sets the real Access Manager URL. + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_HOST: "" + PLUGIN_AUTH_ALLOW_INSECURE_HTTP: "false" + +# --------------------------------------------------------------------------- +# Migration Job (Task 6.0.4) — applies migrations/*.up.sql (golang-migrate) +# via a pre-install,pre-upgrade Helm hook, before the Deployment rolls. +# --------------------------------------------------------------------------- +migrations: + enabled: true + backoffLimit: 2 + activeDeadlineSeconds: 600 + # Gate 8 FIX 6: bounds accumulation of FAILED hook Jobs/pods. A successful + # Job is already removed by hook-delete-policy: HookSucceeded — this TTL only + # matters on the failure path, where the Job is deliberately left behind for + # post-mortem debugging. 259200s = 3 days. + ttlSecondsAfterFinished: 259200 + image: + # Dedicated migrations image (br-spi pattern): its entrypoint applies the + # golang-migrate loop over the embedded migrations/*.up.sql against the + # single br-slc database. Built + published by the br-slc release pipeline. + repository: ghcr.io/lerianstudio/br-slc-migrations + # Empty defaults to .Chart.AppVersion. + tag: "" + pullPolicy: IfNotPresent + # PreSync Secret custody. false (default): the chart mints a dedicated PreSync + # Secret (br-slc-migrations) carrying only POSTGRES_PASSWORD, sourced from + # migrations.postgres.password (falling back to secrets.data.POSTGRES_PASSWORD). + # true: the Job reads POSTGRES_PASSWORD from the operator-managed + # existingSecretName instead (BYOC out-of-band Secret). + useExistingSecret: false + existingSecretName: "" + # DB connection for the Job. Each field falls back to the app's + # configmap.data.POSTGRES_* / secrets.data.POSTGRES_PASSWORD (single source of + # truth) when left empty — override only for a migrations-specific endpoint. + postgres: + host: "" + port: "" + user: "" + database: "" + sslMode: "" + password: "" + resources: + limits: + cpu: "500m" + memory: 256Mi + requests: + cpu: 100m + memory: 64Mi + # A lightweight busybox initContainer waits for POSTGRES_HOST:POSTGRES_PORT to + # accept a TCP connection before the migrations container starts (mirrors the + # Lerian wait-for-dependencies convention) — avoids a hard Job failure on a + # fresh install racing a not-yet-ready Postgres. + waitForPostgres: + enabled: true + image: + repository: busybox + tag: "1.37" From fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4 Mon Sep 17 00:00:00 2001 From: MarcoBuarque Date: Sat, 11 Jul 2026 08:45:13 -0300 Subject: [PATCH 076/113] fix(br-slc): address CodeRabbit review on BYOC helm chart - README: correct install chart path (charts/br-slc), fix mqbridge readiness wording, and rewrite the migration docs to the implemented ArgoCD PreSync Job + Secret model (drop the stale Helm-hook/migrate ConfigMap/symlink and .helmignore migrations claims). - values.schema.json: pin seccompProfile.type to const RuntimeDefault in all four security-context schemas; require a non-empty existingSecretName when migrations.useExistingSecret is true. - migrations/job.yaml: fail fast when useExistingSecret=true and existingSecretName is empty. - values-template.yaml: list all seven app Secret keys. - values.yaml/_helpers.tpl: correct 5->7 app Secret key count and document the signer softkey fail-closed default. --- charts/br-slc/README.md | 180 +++++++------------- charts/br-slc/templates/_helpers.tpl | 2 +- charts/br-slc/templates/migrations/job.yaml | 3 + charts/br-slc/values-template.yaml | 3 + charts/br-slc/values.schema.json | 10 +- charts/br-slc/values.yaml | 16 +- 6 files changed, 87 insertions(+), 127 deletions(-) diff --git a/charts/br-slc/README.md b/charts/br-slc/README.md index e912fea6..66df184e 100644 --- a/charts/br-slc/README.md +++ b/charts/br-slc/README.md @@ -54,9 +54,11 @@ rendered only when `mqbridge.enabled=true`: The signer and validator are **mandatory same-pod containers** (ADR-12, "sidecar no mesmo pod, localhost") — no enable toggle. The app talks to them over **localhost**, not cluster DNS. **Shared fate**: the pod only reaches -`Ready` when all its containers pass their own readiness probes, which -removes the "app Ready but validator absent" window. Each container keeps its -own hardened `securityContext` and its own `/tmp` `emptyDir`. +`Ready` when every container that defines a readiness probe passes it, which +removes the "app Ready but validator absent" window. The `mqbridge` container +deliberately has **no** readiness probe (see below), so it does not +independently gate pod readiness. Each container keeps its own hardened +`securityContext` and its own `/tmp` `emptyDir`. **Custody (ADR-9):** the signing-key material (softkey PFX + passphrase, HSM PIN, Vault token) is mounted/injected **only** on the `slc-signer` container @@ -102,15 +104,15 @@ When (and only when) `mqbridge.enabled=true`: ## Install ```bash -helm lint deployments/helm/br-slc -helm template my-release deployments/helm/br-slc +helm lint charts/br-slc +helm template my-release charts/br-slc # Real install — you MUST override at least: # - configmap.data.POSTGRES_HOST / REDIS_HOST (external, client-managed) # - configmap.data.PLUGIN_AUTH_HOST (required: PLUGIN_AUTH_ENABLED=true by default) # - configmap.data.CORS_ALLOWED_ORIGINS (empty/deny-all by default) # - secrets.* (see "Secrets" below) -helm install my-release deployments/helm/br-slc -f my-values.yaml +helm install my-release charts/br-slc -f my-values.yaml ``` No `values-.yaml` files live in this chart — per-environment overrides @@ -231,127 +233,69 @@ This base intentionally hardens a handful of values beyond mirroring ## Migration Job -A `pre-install,pre-upgrade` Helm hook Job (`templates/migrate-job.yaml`, -`helm.sh/hook-weight: "-5"`) runs `migrate -path /migrations -database -"$DATABASE_URL" up` **before** the Deployment rolls, applying all 21 -migrations under `migrations/` (golang-migrate, pinned to `v4.19.1` to match -`go.mod`'s `github.com/golang-migrate/migrate/v4 v4.19.1`). - -Ordering: `migrate-env-configmap.yaml` / `migrate-secret.yaml` (weight `-7`) → -`migrate-configmap.yaml` (weight `-6`) → `migrate-job.yaml` (weight `-5`) → the -Deployment/Service (unweighted, run after all hooks succeed). All hook -resources use `hook-delete-policy: before-hook-creation,hook-succeeded`, so a -re-run on `helm upgrade` cleans up the prior hook Job/ConfigMap/Secret and -creates fresh ones. - -The `-7` weight matters: the migrate Job (and its `wait-for-postgres` -initContainer) must never reference a resource that isn't itself a hook at an -earlier weight. The app's own ConfigMap/Secret (`templates/configmap.yaml`, -`templates/secret.yaml`) carry **no** hook annotations and don't exist yet on -a first `helm install` — pulling DB connection vars from them (the pre-Gate-8 -behavior) made the Job hit `CreateContainerConfigError` on every fresh -install. `migrate-env-configmap.yaml` carries only the 5 non-secret DB -connection keys the Job needs (mirrored from `configmap.data.POSTGRES_*`, so -`values.yaml` stays the single source of truth even though the two ConfigMap -*objects* are distinct); `migrate-secret.yaml` mirrors -`secrets.data.POSTGRES_PASSWORD` the same way, but only when -`secrets.create: true`. When `secrets.create: false`, the Job instead -references `secrets.existingSecretName` directly — that Secret is -operator-managed and pre-exists before `helm install` runs, so it's already -visible to pre-install hooks without needing a hook annotation of its own. - -### Why a ConfigMap instead of "copy from the app image" - -The app's runtime image is `gcr.io/distroless/static-debian12:nonroot` (see -`Dockerfile`) — it ships **only** the compiled `/service` binary, CA -certificates, and the `nonroot` passwd/group entries. There is no shell, no -`cp`, no busybox. An initContainer cannot `exec` a copy out of that image. - -Instead, `templates/migrate-configmap.yaml` embeds `migrations/*.sql` -(golang-migrate naming, `NNNNNN_description.{up,down}.sql`) directly into a -ConfigMap via Helm's `.Files.Glob`, mounted read-only at `/migrations` in the -migrate Job — no initContainer needed for this step at all. -`deployments/helm/br-slc/migrations` is a **symlink** to the repo-root -`migrations/` directory (the same source `make check-migrations`/CI validate), -not a duplicated copy, so there is no drift risk. Verified empirically in this -worktree: `helm lint`/`helm template`/`helm package` all dereference the -symlink's content correctly (a `helm package`/`helm lint` "found symbolic link -in path" notice on stdout is expected, not an error), and `helm template` -against the resulting `.tgz` renders identically. Total embedded payload is -~107KB across 42 files — well under the 1MiB ConfigMap/etcd object limit. - -A lightweight `busybox:1.37` initContainer (`waitForPostgres`, mirroring the -Lerian wait-for-dependencies convention) polls `POSTGRES_HOST:POSTGRES_PORT` -with `nc -z` before the migrate container starts, so a fresh install racing a -not-yet-ready Postgres doesn't hard-fail the Job. - -`DATABASE_URL` is composed **by Helm at template time** from -`.Values.configmap.data.*` (no shell needed in the scratch-based -`migrate/migrate` image, and no reliance on kubelet `$(VAR)` expansion of -envFrom-sourced vars) but **deliberately omits the password** -(`postgres://@:/?sslmode=`) -so the password never lands in the container's argv -(`-database=$(DATABASE_URL)`, visible via `ps`/`/proc/1/cmdline` to anything -that can see the pod). The password is instead exported as `PGPASSWORD` -(from the same Secret, via `secretKeyRef`) — golang-migrate's postgres driver -(`lib/pq`) reads the standard libpq `PG*` environment variables for any DSN -field missing from the connection string, so `PGPASSWORD` fills in the -omitted password at connect time. A password containing URL-reserved -characters (`@ : / ? # %`) would still need percent-encoding if it appeared in -the DSN — moot now since the password never appears in the DSN string at -all. - -Set `migrations.enabled: false` to skip the Job entirely (e.g. if migrations +Migrations are applied by a detached **ArgoCD `PreSync` hook** — a dedicated +Job plus a small companion Secret, both under `templates/migrations/` — that +runs **before** the main sync wave rolls the Deployment, so the monolith never +boots against an unmigrated database. + +- `templates/migrations/secrets.yaml` — a PreSync Secret + (`argocd.argoproj.io/hook-weight: "-2"`) carrying **only** `POSTGRES_PASSWORD` + (from `migrations.postgres.password`, falling back to + `secrets.data.POSTGRES_PASSWORD`). Its `hook-delete-policy` is + `BeforeHookCreation` **only** (not `HookSucceeded`) so it survives the whole + PreSync phase for the Job to read, and is replaced on the next sync. It is + minted only when `migrations.useExistingSecret=false`. +- `templates/migrations/job.yaml` — a PreSync Job + (`argocd.argoproj.io/hook-weight: "-1"`, so it runs after the Secret) that + runs the dedicated `ghcr.io/lerianstudio/br-slc-migrations` image + (`migrations.image.tag` defaults to `Chart.appVersion`). That image's + entrypoint owns the golang-migrate loop over the `migrations/*.up.sql` + **baked into the image** at build time by the br-slc release pipeline — the + chart's Job only supplies the DB connection and runs the image; it does not + carry the SQL or build the loop. Its `hook-delete-policy` is + `BeforeHookCreation,HookSucceeded`. + +The Job reads the DB connection from plain env vars +(`POSTGRES_HOST`/`POSTGRES_PORT`/`POSTGRES_USER`/`POSTGRES_NAME`/`POSTGRES_SSLMODE`, +each defaulting to the app's `configmap.data.POSTGRES_*`) plus +`POSTGRES_PASSWORD` via `secretKeyRef`. When `migrations.useExistingSecret=true` +the password comes from the operator-managed `migrations.existingSecretName` +instead of the chart-minted PreSync Secret (the render **fails fast** if +`existingSecretName` is left empty in that mode). + +A lightweight `busybox` initContainer (`migrations.waitForPostgres`, on by +default) polls `POSTGRES_HOST:POSTGRES_PORT` with `nc -z` before the migrations +container starts, so a fresh install racing a not-yet-ready Postgres doesn't +hard-fail the Job. + +Set `migrations.enabled: false` to skip the hook entirely (e.g. if migrations are applied by a separate operational process). ### Recovering from a dirty migration If a migration fails partway through, golang-migrate marks -`schema_migrations.dirty = true` in the database. Every subsequent `helm -upgrade` re-runs this same (now permanently failing) hook Job, wedging the -release — the Job keeps refusing to apply the next migration on top of a dirty -version, so `helm upgrade` never succeeds again on its own. +`schema_migrations.dirty = true` in the database. Every subsequent sync re-runs +this PreSync Job, which keeps refusing to apply the next migration on top of a +dirty version — so the release never converges on its own. Manual recovery: -1. **Find the failing version.** Inspect the failed hook Job/pod logs - (`kubectl logs job/-br-slc-migrate-` or the pod itself — - `hook-delete-policy: before-hook-creation` keeps the failed Job/pod around - until the *next* hook run recreates it, so grab the logs before retrying). - golang-migrate's error output names the dirty version, e.g. `Dirty database - version 7. Fix and force version.` +1. **Find the failing version.** Inspect the failed PreSync Job/pod logs + (`kubectl logs job/-br-slc-migrations`). golang-migrate's error + output names the dirty version, e.g. `Dirty database version 7. Fix and + force version.` 2. **Force the version.** Run a one-off `migrate force ` against the - same database, using the same `migrate/migrate:` image (see - `migrations.image.tag`) and the migrations ConfigMap - (`{{ include "br-slc.fullname" . }}-migrations`) mounted at `/migrations`, - e.g.: - ```bash - kubectl run migrate-force --rm -it --restart=Never \ - --image=migrate/migrate:v4.19.1 \ - --overrides='{"spec":{"containers":[{"name":"migrate-force","image":"migrate/migrate:v4.19.1","args":["-path=/migrations","-database=postgres://USER@HOST:PORT/NAME?sslmode=require","force",""],"env":[{"name":"PGPASSWORD","valueFrom":{"secretKeyRef":{"name":"","key":"POSTGRES_PASSWORD"}}}],"volumeMounts":[{"name":"migrations","mountPath":"/migrations"}]}],"volumes":[{"name":"migrations","configMap":{"name":"-br-slc-migrations"}}]}}' - ``` - Substitute the real `USER`/`HOST`/`PORT`/`NAME`/secret name from your - release's values, and `` with the version identified in step 1 - (use the version *before* the failed one if the failed migration's DDL did - not actually apply — confirm against the target schema before forcing). -3. **Re-run the upgrade.** With `dirty` cleared, `helm upgrade` retries the - hook Job normally and applies the remaining migrations. - -This is a manual, deliberately out-of-band recovery path — the hook Job does -not attempt automatic dirty-state recovery, since forcing the wrong version -can silently skip or reapply DDL. - -### `.helmignore` (Task 6.0.2 reconciliation) - -The `migrations/` symlink also drags in three Go integration test files -(`*_test.go`) and one JSON systemplane DDL manifest -(`systemplane_ddl_manifest.json`) that live alongside the SQL in the -repo-root `migrations/` directory. `.helmignore` excludes -`migrations/*_test.go`, `migrations/*.json`, and `migrations/*.go` so only -the 42 `.sql` files (21 up + 21 down) are loaded into the chart — -`.Files.Glob "migrations/*.sql"` in `migrate-configmap.yaml` is unaffected by -this exclusion (still finds all 42) since `.helmignore` only removes the -non-SQL files, not the glob's own matches. + same database, pointed at the same Postgres endpoint/credentials the Job + uses (any golang-migrate-capable CLI works — the `schema_migrations` table + is standard). Set `` to the value identified in step 1 (use the + version *before* the failed one if the failed migration's DDL did not + actually apply — confirm against the target schema before forcing). +3. **Re-sync.** With `dirty` cleared, the PreSync Job runs normally and applies + the remaining migrations. + +This is a manual, deliberately out-of-band recovery path — the hook does not +attempt automatic dirty-state recovery, since forcing the wrong version can +silently skip or reapply DDL. ## Probes diff --git a/charts/br-slc/templates/_helpers.tpl b/charts/br-slc/templates/_helpers.tpl index 38fb5f46..728206e3 100644 --- a/charts/br-slc/templates/_helpers.tpl +++ b/charts/br-slc/templates/_helpers.tpl @@ -60,7 +60,7 @@ ServiceAccount name to use. {{- end -}} {{/* -Secret name to use for the 5 secret-bearing env vars: either the chart-created +Secret name to use for the 7 secret-bearing env vars: either the chart-created Secret (secrets.create=true) or an externally managed Secret (secrets.existingSecretName) — BYOC default is the latter. */}} diff --git a/charts/br-slc/templates/migrations/job.yaml b/charts/br-slc/templates/migrations/job.yaml index 9599f52c..732d7872 100644 --- a/charts/br-slc/templates/migrations/job.yaml +++ b/charts/br-slc/templates/migrations/job.yaml @@ -12,6 +12,9 @@ {{- $pgDb := .Values.migrations.postgres.database | default .Values.configmap.data.POSTGRES_NAME | default "br-slc" }} {{- $pgSslMode := .Values.migrations.postgres.sslMode | default .Values.configmap.data.POSTGRES_SSLMODE | default "require" }} {{- $secretName := ternary .Values.migrations.existingSecretName (include "br-slc-migrations.fullname" .) .Values.migrations.useExistingSecret }} +{{- if and .Values.migrations.useExistingSecret (not .Values.migrations.existingSecretName) }} +{{- fail "migrations.useExistingSecret=true requires migrations.existingSecretName to be set" }} +{{- end }} {{- $pullSecrets := .Values.migrations.imagePullSecrets | default .Values.imagePullSecrets }} apiVersion: batch/v1 kind: Job diff --git a/charts/br-slc/values-template.yaml b/charts/br-slc/values-template.yaml index a6bc467a..b3e18ba3 100644 --- a/charts/br-slc/values-template.yaml +++ b/charts/br-slc/values-template.yaml @@ -21,6 +21,9 @@ secrets: REDIS_PASSWORD: "" # REQUIRED when the external Redis needs auth WEBHOOK_API_KEY: "" WEBHOOK_HMAC_SECRET: "" + RABBITMQ_DEFAULT_PASS: "" # inert while RABBITMQ_ENABLED=false + AWS_SECRET_ACCESS_KEY: "" # keep empty — prefer IRSA + AWS_SESSION_TOKEN: "" # keep empty — prefer IRSA configmap: data: diff --git a/charts/br-slc/values.schema.json b/charts/br-slc/values.schema.json index c8874fb0..7f5c64ce 100644 --- a/charts/br-slc/values.schema.json +++ b/charts/br-slc/values.schema.json @@ -88,7 +88,7 @@ "type": "object", "required": ["type"], "properties": { - "type": { "type": "string" } + "type": { "type": "string", "const": "RuntimeDefault" } } } } @@ -212,7 +212,7 @@ "seccompProfile": { "type": "object", "required": ["type"], - "properties": { "type": { "type": "string" } } + "properties": { "type": { "type": "string", "const": "RuntimeDefault" } } } } }, @@ -304,7 +304,7 @@ "seccompProfile": { "type": "object", "required": ["type"], - "properties": { "type": { "type": "string" } } + "properties": { "type": { "type": "string", "const": "RuntimeDefault" } } } } }, @@ -365,7 +365,7 @@ "seccompProfile": { "type": "object", "required": ["type"], - "properties": { "type": { "type": "string" } } + "properties": { "type": { "type": "string", "const": "RuntimeDefault" } } } } }, @@ -410,6 +410,8 @@ "migrations": { "type": "object", "required": ["enabled", "image"], + "if": { "properties": { "useExistingSecret": { "const": true } }, "required": ["useExistingSecret"] }, + "then": { "required": ["existingSecretName"], "properties": { "existingSecretName": { "minLength": 1 } } }, "properties": { "enabled": { "type": "boolean" }, "backoffLimit": { "type": "integer", "minimum": 0 }, diff --git a/charts/br-slc/values.yaml b/charts/br-slc/values.yaml index 6dcc951d..39e81d88 100644 --- a/charts/br-slc/values.yaml +++ b/charts/br-slc/values.yaml @@ -127,7 +127,7 @@ extraVolumeMounts: [] # create: false (default) — recommended for BYOC: the client manages this # Secret out-of-band (their own K8s Secret, External Secrets Operator, Vault # injector, etc.) and existingSecretName points at it. The Secret MUST expose -# these SAME 5 keys (override the chart's data keys to match if your Secret +# these SAME 7 keys (override the chart's data keys to match if your Secret # uses different names — see README). # create: true — this chart creates the Secret from secrets.data via # --set-string/-f overrides at install time (still never commit real values @@ -135,7 +135,7 @@ extraVolumeMounts: [] secrets: create: false # Non-empty by default (schema requires it when create=false): the BYOC - # operator creates a Secret with THIS name exposing the 5 keys below. When + # operator creates a Secret with THIS name exposing the 7 keys below. When # create=true the chart names its own Secret with this value instead. existingSecretName: "br-slc-secrets" data: @@ -157,7 +157,7 @@ secrets: # --------------------------------------------------------------------------- # ConfigMap — ALL non-secret env vars. # --------------------------------------------------------------------------- -# 1:1 with config/.env.example's active surface (156 vars) minus the 5 secret +# 1:1 with config/.env.example's active surface (156 vars) minus the 7 secret # vars above, PLUS two vars this hardened base's own defaults require that are # NOT in .env.example's active section: # - DEPLOYMENT_MODE: read by config_validation.go / systemplane.go / readyz @@ -526,6 +526,14 @@ signer: # mounted read-only from an externally managed Secret ONTO THE SIGNER # CONTAINER ONLY (never the app container — ADR-9 custody). The passphrase # that decrypts it is the separate signer.secrets.SIGNER_SOFTKEY_PFX_PASSPHRASE. + # + # REQUIRED before the signer can become Ready: with the softkey adapter + # (SIGNER_SOFTKEY_PFX_PATH set below) the operator MUST set enabled=true and + # a valid secretName so /certs/signer.pfx is mounted — otherwise the signer + # has no key material and the pod never reaches Ready. Left disabled by + # default (fail-closed, like POSTGRES_HOST/PLUGIN_AUTH_HOST) because the chart + # cannot ship a real Secret name for BYOC key custody; enable it (or switch to + # an awskms/pkcs11/vault adapter) at install time. softkeySecret: enabled: false # Existing Secret whose key holds the PFX bytes, e.g.: @@ -800,7 +808,7 @@ mqbridge: # --------------------------------------------------------------------------- # Migration Job (Task 6.0.4) — applies migrations/*.up.sql (golang-migrate) -# via a pre-install,pre-upgrade Helm hook, before the Deployment rolls. +# via an ArgoCD PreSync hook Job, before the Deployment rolls. # --------------------------------------------------------------------------- migrations: enabled: true From 25390d4357f0c0a82106635f1ef3d9b60fcf46f6 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Sun, 12 Jul 2026 16:45:19 -0300 Subject: [PATCH 077/113] feat(br-ccs): expose rate-limit disable and fail-open knobs in values Surface ALLOW_RATELIMIT_DISABLED and ALLOW_RATELIMIT_FAIL_OPEN as configurable env values (empty by default, preserving the safe fail-closed posture). Lets deployments opt into rate-limit fail-open or disable enforcement per environment without a chart change. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/values.yaml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index 0e0b3fff..a99d1ef9 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -439,6 +439,8 @@ brCcs: EXPORT_RATE_LIMIT_WINDOW_SEC: "60" DISPATCH_RATE_LIMIT_MAX: "30" DISPATCH_RATE_LIMIT_WINDOW_SEC: "60" + ALLOW_RATELIMIT_DISABLED: "" + ALLOW_RATELIMIT_FAIL_OPEN: "" # ================================================================= # Observability & metrics From e54f32526520e74b010f79429f1eaed709971935 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Sun, 12 Jul 2026 17:05:49 -0300 Subject: [PATCH 078/113] fix(charts): render br-ccs RABBITMQ_URL as a secret, not a configmap value RABBITMQ_URL is a full amqp:// dial string that embeds the broker password, but the chart only read it from brCcs.configmap (configmap.yaml). Deployments that supplied it under brCcs.secrets (the correct place for a credential) had it silently dropped, forcing the app to fall back to assembling the URL from RABBITMQ_HOST/PORT/USER/PASS. Render RABBITMQ_URL from brCcs.secrets in secrets.yaml, drop it from the ConfigMap, and document the placeholder in values.yaml. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/templates/configmap.yaml | 5 ++--- charts/br-ccs/templates/secrets.yaml | 6 ++++++ charts/br-ccs/values.yaml | 8 +++++++- 3 files changed, 15 insertions(+), 4 deletions(-) diff --git a/charts/br-ccs/templates/configmap.yaml b/charts/br-ccs/templates/configmap.yaml index 9d446e04..3cb8ccbd 100644 --- a/charts/br-ccs/templates/configmap.yaml +++ b/charts/br-ccs/templates/configmap.yaml @@ -137,9 +137,8 @@ data: # ===================================================================== RABBITMQ_ENABLED: {{ $cm.RABBITMQ_ENABLED | default "false" | quote }} {{- if eq (toString ($cm.RABBITMQ_ENABLED | default "false")) "true" }} - {{- if $cm.RABBITMQ_URL }} - RABBITMQ_URL: {{ $cm.RABBITMQ_URL | quote }} - {{- end }} + {{- /* RABBITMQ_URL carries the password and is rendered as a Secret (see + templates/secrets.yaml), never as a ConfigMap value. */}} RABBITMQ_HOST: {{ $cm.RABBITMQ_HOST | default (printf "%s-rabbitmq.%s.svc.cluster.local" .Release.Name $namespace) | quote }} RABBITMQ_PORT_AMQP: {{ $cm.RABBITMQ_PORT_AMQP | default "5672" | quote }} RABBITMQ_PORT_HOST: {{ $cm.RABBITMQ_PORT_HOST | default "15672" | quote }} diff --git a/charts/br-ccs/templates/secrets.yaml b/charts/br-ccs/templates/secrets.yaml index bb4b73ad..45d9cd24 100644 --- a/charts/br-ccs/templates/secrets.yaml +++ b/charts/br-ccs/templates/secrets.yaml @@ -48,6 +48,12 @@ stringData: {{- if $s.RABBITMQ_DEFAULT_PASS }} RABBITMQ_DEFAULT_PASS: {{ $s.RABBITMQ_DEFAULT_PASS | quote }} {{- end }} + # Full amqp:// dial string. Embeds the password, so it is a Secret (never a + # ConfigMap value). When set, the app dials via this instead of assembling the + # URL from RABBITMQ_HOST/PORT/USER/PASS. + {{- if $s.RABBITMQ_URL }} + RABBITMQ_URL: {{ $s.RABBITMQ_URL | quote }} + {{- end }} # Crypto keys (REQUIRED in production — empty CCS_CRYPTO_MASTER_KEY fails fast # at boot by design; supply via a secrets manager or an existing Secret). diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index a99d1ef9..04a717ec 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -332,7 +332,9 @@ brCcs: # ================================================================= # Event-Driven — RabbitMQ (optional, disabled by default) - # RABBITMQ_URL is rendered from chart defaults when RABBITMQ_ENABLED=true. + # RABBITMQ_URL (full amqp:// dial string, carries credentials) is a SECRET — + # see brCcs.secrets.RABBITMQ_URL. When unset, the app builds the URL from + # RABBITMQ_HOST/PORT/USER/PASS. # ================================================================= RABBITMQ_ENABLED: "false" RABBITMQ_PORT_AMQP: "5672" @@ -547,6 +549,10 @@ brCcs: # RabbitMQ credentials (when RABBITMQ_ENABLED=true) # RABBITMQ_DEFAULT_PASS: "" + # RABBITMQ_URL — full amqp:// dial string (embeds the password; any '@' in + # the password must be percent-encoded as %40). When set, the app dials via + # this instead of assembling from RABBITMQ_HOST/PORT/USER/PASS. + # RABBITMQ_URL: "" # Crypto keys (REQUIRED in production) # CCS_CRYPTO_MASTER_KEY — AES-256-GCM master key, 64 hex chars (openssl rand -hex 32). From 24efbd2bd3b9f289f49f588e3a86e1f4715bfc77 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Sun, 12 Jul 2026 17:26:13 -0300 Subject: [PATCH 079/113] fix(charts): render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The ConfigMap template rendered rate-limit keys by name only (no catch-all range over the configmap map), so ALLOW_RATELIMIT_FAIL_OPEN set in values was never emitted. Add a named render line so the knob actually reaches the container. ALLOW_RATELIMIT_DISABLED was removed entirely in lib-commons v5.8.0 (the version br-ccs runs) and is no longer read — drop it from values. To disable enforcement, use RATE_LIMIT_ENABLED=false. Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/br-ccs/templates/configmap.yaml | 2 ++ charts/br-ccs/values.yaml | 6 +++++- 2 files changed, 7 insertions(+), 1 deletion(-) diff --git a/charts/br-ccs/templates/configmap.yaml b/charts/br-ccs/templates/configmap.yaml index 3cb8ccbd..886e9fc1 100644 --- a/charts/br-ccs/templates/configmap.yaml +++ b/charts/br-ccs/templates/configmap.yaml @@ -259,6 +259,8 @@ data: EXPORT_RATE_LIMIT_WINDOW_SEC: {{ $cm.EXPORT_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} DISPATCH_RATE_LIMIT_MAX: {{ $cm.DISPATCH_RATE_LIMIT_MAX | default "30" | quote }} DISPATCH_RATE_LIMIT_WINDOW_SEC: {{ $cm.DISPATCH_RATE_LIMIT_WINDOW_SEC | default "60" | quote }} + # Empty (default) keeps the safe fail-closed posture; "true" permits fail-open. + ALLOW_RATELIMIT_FAIL_OPEN: {{ $cm.ALLOW_RATELIMIT_FAIL_OPEN | default "" | quote }} # ===================================================================== # OBSERVABILITY / IDEMPOTENCY / PAGINATION diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index 04a717ec..08963e71 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -441,7 +441,11 @@ brCcs: EXPORT_RATE_LIMIT_WINDOW_SEC: "60" DISPATCH_RATE_LIMIT_MAX: "30" DISPATCH_RATE_LIMIT_WINDOW_SEC: "60" - ALLOW_RATELIMIT_DISABLED: "" + # Security posture: leave empty to keep the safe fail-closed default. Set to + # "true" only to permit fail-open (the limiter passes traffic through when + # Redis is unreachable). To disable enforcement entirely, use + # RATE_LIMIT_ENABLED=false above — ALLOW_RATELIMIT_DISABLED was removed in + # lib-commons v5.8.0 and is no longer read. ALLOW_RATELIMIT_FAIL_OPEN: "" # ================================================================= From a8c244896e222e5b037ddfa9194566debfd84642 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Mon, 13 Jul 2026 11:21:49 +0000 Subject: [PATCH 080/113] chore(release): 1.0.0-beta.2 ## (2026-07-13) ### Features * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) ### Bug Fixes * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) --- README.md | 2 +- charts/br-ccs/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 1abdf048..436369ef 100644 --- a/README.md +++ b/README.md @@ -295,5 +295,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.1` | 1.0.0 | +| `1.0.0-beta.2` | 1.0.0 | ----------------- diff --git a/charts/br-ccs/Chart.yaml b/charts/br-ccs/Chart.yaml index ecadfed0..031eb330 100644 --- a/charts/br-ccs/Chart.yaml +++ b/charts/br-ccs/Chart.yaml @@ -13,7 +13,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.0.0-beta.1 +version: 1.0.0-beta.2 appVersion: "1.0.0" From 1882905b6e081077caddbad56c9894a2ec2d52ee Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 21:25:31 -0300 Subject: [PATCH 081/113] feat(chart): add adapter-lerian template directories X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- .../adapter-lerian-consumer/configmap.yaml | 27 ++++ .../adapter-lerian-consumer/deployment.yaml | 125 ++++++++++++++++++ .../adapter-lerian-consumer/hpa.yaml | 35 +++++ .../adapter-lerian-consumer/pdb.yaml | 24 ++++ .../adapter-lerian-consumer/secrets.yaml | 16 +++ .../adapter-lerian-consumer/service.yaml | 24 ++++ .../serviceaccount.yaml | 15 +++ .../adapter-lerian-systemplane/configmap.yaml | 27 ++++ .../deployment.yaml | 125 ++++++++++++++++++ .../adapter-lerian-systemplane/hpa.yaml | 35 +++++ .../adapter-lerian-systemplane/pdb.yaml | 24 ++++ .../adapter-lerian-systemplane/secrets.yaml | 16 +++ .../adapter-lerian-systemplane/service.yaml | 24 ++++ .../serviceaccount.yaml | 15 +++ .../templates/adapter-lerian/configmap.yaml | 27 ++++ .../templates/adapter-lerian/deployment.yaml | 125 ++++++++++++++++++ .../templates/adapter-lerian/hpa.yaml | 35 +++++ .../templates/adapter-lerian/ingress.yaml | 40 ++++++ .../adapter-lerian/migrations-job.yaml | 1 + .../templates/adapter-lerian/pdb.yaml | 24 ++++ .../templates/adapter-lerian/secrets.yaml | 16 +++ .../templates/adapter-lerian/service.yaml | 24 ++++ .../adapter-lerian/serviceaccount.yaml | 15 +++ 23 files changed, 839 insertions(+) create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/configmap.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/hpa.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/pdb.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/secrets.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/service.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/serviceaccount.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/configmap.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/deployment.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/hpa.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/pdb.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/secrets.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/service.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/serviceaccount.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/configmap.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/deployment.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/hpa.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/ingress.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/migrations-job.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/pdb.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/secrets.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/service.yaml create mode 100644 charts/plugin-br-pix-switch/templates/adapter-lerian/serviceaccount.yaml diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/configmap.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/configmap.yaml new file mode 100644 index 00000000..b30b3fa3 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/configmap.yaml @@ -0,0 +1,27 @@ +{{- if .Values.adapterLerianConsumer.enabled }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +data: + {{- range $key, $value := $values.configmap }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- /* + OTEL_RESOURCE_SERVICE_VERSION: derive from the deployed image tag so it + tracks releases automatically. Resolution order: + component image.tag > Chart.AppVersion. + Operators can override by setting `.configmap.OTEL_RESOURCE_SERVICE_VERSION` + explicitly (the range above wins because data keys are unique per YAML map, + but we only emit this when the key wasn't already provided). + */}} + {{- if not (hasKey $values.configmap "OTEL_RESOURCE_SERVICE_VERSION") }} + {{- $compTag := default $.Chart.AppVersion $values.image.tag }} + OTEL_RESOURCE_SERVICE_VERSION: {{ $compTag | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml new file mode 100644 index 00000000..414a5379 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml @@ -0,0 +1,125 @@ +{{- if .Values.adapterLerianConsumer.enabled }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + revisionHistoryLimit: {{ $values.revisionHistoryLimit | default 10 }} + {{- if not $values.autoscaling.enabled }} + replicas: {{ $values.replicaCount }} + {{- end }} + strategy: + {{- toYaml $values.deploymentStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} + template: + metadata: + {{- with $values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 8 }} + spec: + {{- with (include "plugin-br-pix-switch.componentImagePullSecrets" (dict "context" $ "componentValues" $values)) }} + {{- if . }} + imagePullSecrets: + {{- . | nindent 8 }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + initContainers: + {{- include "plugin-br-pix-switch.waitForDependencies" (dict "context" $ "component" $component "componentValues" $values) | nindent 8 }} + containers: + - name: {{ $component }} + securityContext: + {{- toYaml $values.securityContext | nindent 12 }} + image: {{ include "plugin-br-pix-switch.componentImage" (dict "context" $ "componentValues" $values) }} + imagePullPolicy: {{ include "plugin-br-pix-switch.componentPullPolicy" (dict "context" $ "componentValues" $values) }} + {{- with $values.command }} + command: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with $values.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ $values.service.port }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + - secretRef: + name: {{ include "plugin-br-pix-switch.componentSecretName" (dict "context" $ "component" $component "componentValues" $values) }} + {{- /* + Build the env: list when EITHER telemetry is enabled (HOST_IP + + OTEL_EXPORTER_OTLP_ENDPOINT injected via downward API so each + pod talks to its node-local OTel collector by default) OR the + operator has set extraEnvVars. The configmap-supplied + OTEL_EXPORTER_OTLP_ENDPOINT can still be overridden by setting + it in the configmap; the K8s rule is "later env entry wins", + so the configmap value (via envFrom) is overridden by the + explicit env entry below. + */}} + {{- $telemetryOn := eq (toString (default "false" $values.configmap.TELEMETRY_ENABLED)) "true" }} + {{- $hasExtras := gt (len $values.extraEnvVars) 0 }} + {{- if or $telemetryOn $hasExtras }} + env: + {{- if $telemetryOn }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + {{- if $hasExtras }} + {{- range $k, $v := $values.extraEnvVars }} + - name: {{ $k }} + value: {{ $v | quote }} + {{- end }} + {{- end }} + {{- end }} + resources: + {{- toYaml $values.resources | nindent 12 }} + readinessProbe: + httpGet: + path: {{ $values.readinessProbe.path | default "/readyz" }} + port: http + initialDelaySeconds: {{ $values.readinessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ $values.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ $values.readinessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.readinessProbe.failureThreshold | default 3 }} + livenessProbe: + httpGet: + path: {{ $values.livenessProbe.path | default "/health" }} + port: http + initialDelaySeconds: {{ $values.livenessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ $values.livenessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $values.livenessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.livenessProbe.failureThreshold | default 3 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/hpa.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/hpa.yaml new file mode 100644 index 00000000..8a6c0761 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/hpa.yaml @@ -0,0 +1,35 @@ +{{- if and .Values.adapterLerianConsumer.enabled .Values.adapterLerianConsumer.autoscaling.enabled }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + minReplicas: {{ $values.autoscaling.minReplicas }} + maxReplicas: {{ $values.autoscaling.maxReplicas }} + metrics: + {{- if $values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if $values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/pdb.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/pdb.yaml new file mode 100644 index 00000000..82f2a23d --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/pdb.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.adapterLerianConsumer.enabled .Values.adapterLerianConsumer.pdb.enabled }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if $values.pdb.minAvailable }} + minAvailable: {{ $values.pdb.minAvailable }} + {{- else if $values.pdb.maxUnavailable }} + maxUnavailable: {{ $values.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/secrets.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/secrets.yaml new file mode 100644 index 00000000..2f3396b2 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/secrets.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.adapterLerianConsumer.enabled (not .Values.adapterLerianConsumer.useExistingSecret) }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := $values.secrets }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/service.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/service.yaml new file mode 100644 index 00000000..edb27f0a --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/service.yaml @@ -0,0 +1,24 @@ +{{- if .Values.adapterLerianConsumer.enabled }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ $values.service.type }} + ports: + - port: {{ $values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 4 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/serviceaccount.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/serviceaccount.yaml new file mode 100644 index 00000000..d0d7eb1e --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.adapterLerianConsumer.enabled .Values.adapterLerianConsumer.serviceAccount.create }} +{{- $component := "adapter-lerian-consumer" }} +{{- $values := .Values.adapterLerianConsumer }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/configmap.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/configmap.yaml new file mode 100644 index 00000000..b306aaf1 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/configmap.yaml @@ -0,0 +1,27 @@ +{{- if .Values.adapterLerianSystemplane.enabled }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +data: + {{- range $key, $value := $values.configmap }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- /* + OTEL_RESOURCE_SERVICE_VERSION: derive from the deployed image tag so it + tracks releases automatically. Resolution order: + component image.tag > Chart.AppVersion. + Operators can override by setting `.configmap.OTEL_RESOURCE_SERVICE_VERSION` + explicitly (the range above wins because data keys are unique per YAML map, + but we only emit this when the key wasn't already provided). + */}} + {{- if not (hasKey $values.configmap "OTEL_RESOURCE_SERVICE_VERSION") }} + {{- $compTag := default $.Chart.AppVersion $values.image.tag }} + OTEL_RESOURCE_SERVICE_VERSION: {{ $compTag | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/deployment.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/deployment.yaml new file mode 100644 index 00000000..0aaa49a0 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/deployment.yaml @@ -0,0 +1,125 @@ +{{- if .Values.adapterLerianSystemplane.enabled }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + revisionHistoryLimit: {{ $values.revisionHistoryLimit | default 10 }} + {{- if not $values.autoscaling.enabled }} + replicas: {{ $values.replicaCount }} + {{- end }} + strategy: + {{- toYaml $values.deploymentStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} + template: + metadata: + {{- with $values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 8 }} + spec: + {{- with (include "plugin-br-pix-switch.componentImagePullSecrets" (dict "context" $ "componentValues" $values)) }} + {{- if . }} + imagePullSecrets: + {{- . | nindent 8 }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + initContainers: + {{- include "plugin-br-pix-switch.waitForDependencies" (dict "context" $ "component" $component "componentValues" $values) | nindent 8 }} + containers: + - name: {{ $component }} + securityContext: + {{- toYaml $values.securityContext | nindent 12 }} + image: {{ include "plugin-br-pix-switch.componentImage" (dict "context" $ "componentValues" $values) }} + imagePullPolicy: {{ include "plugin-br-pix-switch.componentPullPolicy" (dict "context" $ "componentValues" $values) }} + {{- with $values.command }} + command: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with $values.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ $values.service.port }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + - secretRef: + name: {{ include "plugin-br-pix-switch.componentSecretName" (dict "context" $ "component" $component "componentValues" $values) }} + {{- /* + Build the env: list when EITHER telemetry is enabled (HOST_IP + + OTEL_EXPORTER_OTLP_ENDPOINT injected via downward API so each + pod talks to its node-local OTel collector by default) OR the + operator has set extraEnvVars. The configmap-supplied + OTEL_EXPORTER_OTLP_ENDPOINT can still be overridden by setting + it in the configmap; the K8s rule is "later env entry wins", + so the configmap value (via envFrom) is overridden by the + explicit env entry below. + */}} + {{- $telemetryOn := eq (toString (default "false" $values.configmap.TELEMETRY_ENABLED)) "true" }} + {{- $hasExtras := gt (len $values.extraEnvVars) 0 }} + {{- if or $telemetryOn $hasExtras }} + env: + {{- if $telemetryOn }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + {{- if $hasExtras }} + {{- range $k, $v := $values.extraEnvVars }} + - name: {{ $k }} + value: {{ $v | quote }} + {{- end }} + {{- end }} + {{- end }} + resources: + {{- toYaml $values.resources | nindent 12 }} + readinessProbe: + httpGet: + path: {{ $values.readinessProbe.path | default "/lerian/readyz" }} + port: http + initialDelaySeconds: {{ $values.readinessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ $values.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ $values.readinessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.readinessProbe.failureThreshold | default 3 }} + livenessProbe: + httpGet: + path: {{ $values.livenessProbe.path | default "/lerian/health" }} + port: http + initialDelaySeconds: {{ $values.livenessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ $values.livenessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $values.livenessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.livenessProbe.failureThreshold | default 3 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/hpa.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/hpa.yaml new file mode 100644 index 00000000..0db52893 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/hpa.yaml @@ -0,0 +1,35 @@ +{{- if and .Values.adapterLerianSystemplane.enabled .Values.adapterLerianSystemplane.autoscaling.enabled }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + minReplicas: {{ $values.autoscaling.minReplicas }} + maxReplicas: {{ $values.autoscaling.maxReplicas }} + metrics: + {{- if $values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if $values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/pdb.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/pdb.yaml new file mode 100644 index 00000000..14a3319e --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/pdb.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.adapterLerianSystemplane.enabled .Values.adapterLerianSystemplane.pdb.enabled }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if $values.pdb.minAvailable }} + minAvailable: {{ $values.pdb.minAvailable }} + {{- else if $values.pdb.maxUnavailable }} + maxUnavailable: {{ $values.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/secrets.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/secrets.yaml new file mode 100644 index 00000000..17a6b177 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/secrets.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.adapterLerianSystemplane.enabled (not .Values.adapterLerianSystemplane.useExistingSecret) }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := $values.secrets }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/service.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/service.yaml new file mode 100644 index 00000000..26e808fa --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/service.yaml @@ -0,0 +1,24 @@ +{{- if .Values.adapterLerianSystemplane.enabled }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ $values.service.type }} + ports: + - port: {{ $values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 4 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/serviceaccount.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/serviceaccount.yaml new file mode 100644 index 00000000..828e6224 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-systemplane/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.adapterLerianSystemplane.enabled .Values.adapterLerianSystemplane.serviceAccount.create }} +{{- $component := "adapter-lerian-systemplane" }} +{{- $values := .Values.adapterLerianSystemplane }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/configmap.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/configmap.yaml new file mode 100644 index 00000000..b7bd6501 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/configmap.yaml @@ -0,0 +1,27 @@ +{{- if .Values.adapterLerian.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +data: + {{- range $key, $value := $values.configmap }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- /* + OTEL_RESOURCE_SERVICE_VERSION: derive from the deployed image tag so it + tracks releases automatically. Resolution order: + component image.tag > Chart.AppVersion. + Operators can override by setting `.configmap.OTEL_RESOURCE_SERVICE_VERSION` + explicitly (the range above wins because data keys are unique per YAML map, + but we only emit this when the key wasn't already provided). + */}} + {{- if not (hasKey $values.configmap "OTEL_RESOURCE_SERVICE_VERSION") }} + {{- $compTag := default $.Chart.AppVersion $values.image.tag }} + OTEL_RESOURCE_SERVICE_VERSION: {{ $compTag | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/deployment.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/deployment.yaml new file mode 100644 index 00000000..c09a70b8 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/deployment.yaml @@ -0,0 +1,125 @@ +{{- if .Values.adapterLerian.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + revisionHistoryLimit: {{ $values.revisionHistoryLimit | default 10 }} + {{- if not $values.autoscaling.enabled }} + replicas: {{ $values.replicaCount }} + {{- end }} + strategy: + {{- toYaml $values.deploymentStrategy | nindent 4 }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} + template: + metadata: + {{- with $values.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 8 }} + spec: + {{- with (include "plugin-br-pix-switch.componentImagePullSecrets" (dict "context" $ "componentValues" $values)) }} + {{- if . }} + imagePullSecrets: + {{- . | nindent 8 }} + {{- end }} + {{- end }} + serviceAccountName: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + securityContext: + {{- toYaml $values.podSecurityContext | nindent 8 }} + initContainers: + {{- include "plugin-br-pix-switch.waitForDependencies" (dict "context" $ "component" $component "componentValues" $values) | nindent 8 }} + containers: + - name: {{ $component }} + securityContext: + {{- toYaml $values.securityContext | nindent 12 }} + image: {{ include "plugin-br-pix-switch.componentImage" (dict "context" $ "componentValues" $values) }} + imagePullPolicy: {{ include "plugin-br-pix-switch.componentPullPolicy" (dict "context" $ "componentValues" $values) }} + {{- with $values.command }} + command: + {{- toYaml . | nindent 12 }} + {{- end }} + {{- with $values.args }} + args: + {{- toYaml . | nindent 12 }} + {{- end }} + ports: + - name: http + containerPort: {{ $values.service.port }} + protocol: TCP + envFrom: + - configMapRef: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + - secretRef: + name: {{ include "plugin-br-pix-switch.componentSecretName" (dict "context" $ "component" $component "componentValues" $values) }} + {{- /* + Build the env: list when EITHER telemetry is enabled (HOST_IP + + OTEL_EXPORTER_OTLP_ENDPOINT injected via downward API so each + pod talks to its node-local OTel collector by default) OR the + operator has set extraEnvVars. The configmap-supplied + OTEL_EXPORTER_OTLP_ENDPOINT can still be overridden by setting + it in the configmap; the K8s rule is "later env entry wins", + so the configmap value (via envFrom) is overridden by the + explicit env entry below. + */}} + {{- $telemetryOn := eq (toString (default "false" $values.configmap.TELEMETRY_ENABLED)) "true" }} + {{- $hasExtras := gt (len $values.extraEnvVars) 0 }} + {{- if or $telemetryOn $hasExtras }} + env: + {{- if $telemetryOn }} + - name: HOST_IP + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: OTEL_EXPORTER_OTLP_ENDPOINT + value: "$(HOST_IP):4317" + {{- end }} + {{- if $hasExtras }} + {{- range $k, $v := $values.extraEnvVars }} + - name: {{ $k }} + value: {{ $v | quote }} + {{- end }} + {{- end }} + {{- end }} + resources: + {{- toYaml $values.resources | nindent 12 }} + readinessProbe: + httpGet: + path: {{ $values.readinessProbe.path | default "/lerian/readyz" }} + port: http + initialDelaySeconds: {{ $values.readinessProbe.initialDelaySeconds | default 10 }} + periodSeconds: {{ $values.readinessProbe.periodSeconds | default 5 }} + timeoutSeconds: {{ $values.readinessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.readinessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.readinessProbe.failureThreshold | default 3 }} + livenessProbe: + httpGet: + path: {{ $values.livenessProbe.path | default "/lerian/health" }} + port: http + initialDelaySeconds: {{ $values.livenessProbe.initialDelaySeconds | default 5 }} + periodSeconds: {{ $values.livenessProbe.periodSeconds | default 10 }} + timeoutSeconds: {{ $values.livenessProbe.timeoutSeconds | default 1 }} + successThreshold: {{ $values.livenessProbe.successThreshold | default 1 }} + failureThreshold: {{ $values.livenessProbe.failureThreshold | default 3 }} + {{- with $values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with $values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/hpa.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/hpa.yaml new file mode 100644 index 00000000..a289c4c5 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/hpa.yaml @@ -0,0 +1,35 @@ +{{- if and .Values.adapterLerian.enabled .Values.adapterLerian.autoscaling.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + minReplicas: {{ $values.autoscaling.minReplicas }} + maxReplicas: {{ $values.autoscaling.maxReplicas }} + metrics: + {{- if $values.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if $values.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ $values.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/ingress.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/ingress.yaml new file mode 100644 index 00000000..a74880e3 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/ingress.yaml @@ -0,0 +1,40 @@ +{{- if and .Values.adapterLerian.enabled .Values.adapterLerian.ingress.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +{{- $fullName := include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} +{{- $svcPort := $values.service.port }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ $fullName }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- with $values.ingress.className }} + ingressClassName: {{ . }} + {{- end }} + {{- with $values.ingress.tls }} + tls: + {{- toYaml . | nindent 4 }} + {{- end }} + rules: + {{- range $values.ingress.hosts }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ $fullName }} + port: + number: {{ $svcPort }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/migrations-job.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/migrations-job.yaml new file mode 100644 index 00000000..dbdb6d63 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/migrations-job.yaml @@ -0,0 +1 @@ +{{- include "plugin-br-pix-switch.migrationJob" (dict "context" . "component" "adapterLerian" "serviceName" "adapter-lerian") }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/pdb.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/pdb.yaml new file mode 100644 index 00000000..40f55737 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/pdb.yaml @@ -0,0 +1,24 @@ +{{- if and .Values.adapterLerian.enabled .Values.adapterLerian.pdb.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if $values.pdb.minAvailable }} + minAvailable: {{ $values.pdb.minAvailable }} + {{- else if $values.pdb.maxUnavailable }} + maxUnavailable: {{ $values.pdb.maxUnavailable }} + {{- end }} + selector: + matchLabels: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 6 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/secrets.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/secrets.yaml new file mode 100644 index 00000000..594cd2ff --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/secrets.yaml @@ -0,0 +1,16 @@ +{{- if and .Values.adapterLerian.enabled (not .Values.adapterLerian.useExistingSecret) }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} +type: Opaque +stringData: + {{- range $key, $value := $values.secrets }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/service.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/service.yaml new file mode 100644 index 00000000..f6565346 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/service.yaml @@ -0,0 +1,24 @@ +{{- if .Values.adapterLerian.enabled }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "plugin-br-pix-switch.componentFullname" (dict "context" $ "component" $component) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ $values.service.type }} + ports: + - port: {{ $values.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "plugin-br-pix-switch.selectorLabels" (dict "context" $ "component" $component) | nindent 4 }} +{{- end }} diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian/serviceaccount.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian/serviceaccount.yaml new file mode 100644 index 00000000..8276b7d2 --- /dev/null +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian/serviceaccount.yaml @@ -0,0 +1,15 @@ +{{- if and .Values.adapterLerian.enabled .Values.adapterLerian.serviceAccount.create }} +{{- $component := "adapter-lerian" }} +{{- $values := .Values.adapterLerian }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "plugin-br-pix-switch.componentServiceAccountName" (dict "context" $ "component" $component "componentValues" $values) }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "plugin-br-pix-switch.labels" (dict "context" $ "component" $component) | nindent 4 }} + {{- with $values.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} From 328b236a9a5a207e1fe2cd3a11ed1fba5980d662 Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 21:29:40 -0300 Subject: [PATCH 082/113] feat(chart): add adapter-lerian values blocks, ingress routes and database X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plugin-br-pix-switch/values.yaml | 358 ++++++++++++++++++++++++ 1 file changed, 358 insertions(+) diff --git a/charts/plugin-br-pix-switch/values.yaml b/charts/plugin-br-pix-switch/values.yaml index ddafcb69..11af4d3b 100644 --- a/charts/plugin-br-pix-switch/values.yaml +++ b/charts/plugin-br-pix-switch/values.yaml @@ -69,6 +69,7 @@ global: - pix-spi - pix-dict - pix-cob + - pix-adapter-lerian connection: host: "" port: "5432" @@ -1374,6 +1375,355 @@ appsIngress: component: cobProxy serviceName: cob-proxy +# ----------------------------------------------------------------------------- +# adapter-lerian (api) — Lerian provider adapter HTTP entry (br-sfn) +# ----------------------------------------------------------------------------- +adapterLerian: + enabled: false # safety default — explicitly enable in dev/staging values + name: "adapter-lerian" + description: "Lerian provider adapter (API)" + replicaCount: 1 + revisionHistoryLimit: 10 + + image: + repository: "ghcr.io/lerianstudio/plugin-br-pix-switch-adapter-lerian-api" + pullPolicy: "" + tag: "" + + imagePullSecrets: [] + + # -- Override container entrypoint (e.g., to dispatch to a specific binary + # inside a multi-binary image). When empty, the image's ENTRYPOINT is used. + command: [] + # -- Container args + args: [] + + podAnnotations: {} + podSecurityContext: {} + securityContext: + runAsGroup: 1000 + runAsUser: 1000 + runAsNonRoot: true + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + + pdb: + enabled: false + minAvailable: 0 + maxUnavailable: 1 + + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + + service: + type: ClusterIP + port: 4113 + + ingress: + enabled: false + + resources: + limits: { cpu: 200m, memory: 256Mi } + requests: { cpu: 50m, memory: 64Mi } + + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 1 + + readinessProbe: + path: "/lerian/readyz" + livenessProbe: + path: "/lerian/health" + nodeSelector: {} + tolerations: [] + affinity: {} + + serviceAccount: + create: true + annotations: {} + name: "" + + configmap: + APPLICATION_NAME: "plugin-br-pix-switch" + SERVER_ADDRESS: ":4113" + LOG_LEVEL: "info" + ENV_NAME: "development" + DEPLOYMENT_MODE: "byoc" + TELEMETRY_ENABLED: "false" + OTEL_RESOURCE_SERVICE_NAME: "pix-adapter-lerian-api" + OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_URL: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" + # License allow-list (use "global" for single-license mode). + ORGANIZATION_IDS: "" + # -- Multi-tenant (consumed when MULTI_TENANT_ENABLED=true). MULTI_TENANT_URL + # is the tenant-manager address; MULTI_TENANT_API_KEY lives under secrets. + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_URL: "" + + secrets: + # -- DATABASE_URL backs the golang-migrate Job that applies the component's + # SQL migrations. SYSTEMPLANE_POSTGRES_DSN is the api's sole routing source + # (read-only consumer DSN for adapter_lerian.* runtime config). + DATABASE_URL: "" + SYSTEMPLANE_POSTGRES_DSN: "" + LICENSE_KEY: "" + MULTI_TENANT_API_KEY: "" + + useExistingSecret: false + existingSecretName: "" + + extraEnvVars: {} + + # -- golang-migrate Job that applies SQL migrations from the component's + # /migrations directory against the database referenced by DATABASE_URL. + # Runs as a Helm hook on pre-upgrade + post-install. + migrations: + enabled: true + migrationsPath: /migrations + ttlSecondsAfterFinished: 300 + backoffLimit: 3 + +# ----------------------------------------------------------------------------- +# adapter-lerian (consumer) — br-sfn CloudEvents Kafka consumer (no ingress) +# ----------------------------------------------------------------------------- +adapterLerianConsumer: + enabled: false # safety default — explicitly enable in dev/staging values + name: "adapter-lerian-consumer" + description: "Lerian provider adapter (Kafka consumer)" + replicaCount: 1 + revisionHistoryLimit: 10 + + image: + repository: "ghcr.io/lerianstudio/plugin-br-pix-switch-adapter-lerian-consumer" + pullPolicy: "" + tag: "" + + imagePullSecrets: [] + + # -- Override container entrypoint (e.g., to dispatch to a specific binary + # inside a multi-binary image). When empty, the image's ENTRYPOINT is used. + command: [] + # -- Container args + args: [] + + podAnnotations: {} + podSecurityContext: {} + securityContext: + runAsGroup: 1000 + runAsUser: 1000 + runAsNonRoot: true + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + + pdb: + enabled: false + minAvailable: 0 + maxUnavailable: 1 + + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + + service: + type: ClusterIP + port: 4114 + + resources: + limits: { cpu: 500m, memory: 512Mi } + requests: { cpu: 100m, memory: 128Mi } + + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 1 + + readinessProbe: + path: "/readyz" + livenessProbe: + path: "/health" + nodeSelector: {} + tolerations: [] + affinity: {} + + serviceAccount: + create: true + annotations: {} + name: "" + + configmap: + APPLICATION_NAME: "plugin-br-pix-switch" + SERVER_ADDRESS: ":4114" + LOG_LEVEL: "info" + ENV_NAME: "development" + DEPLOYMENT_MODE: "byoc" + TELEMETRY_ENABLED: "false" + OTEL_RESOURCE_SERVICE_NAME: "pix-adapter-lerian-consumer" + OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_URL: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" + ORGANIZATION_IDS: "" + # -- This deployment's 8-digit BACEN participant ISPB. Read once at boot to + # scope the ce-id dedup keyspace. Set the real ISPB per deployment. + ISPB: "" + MULTI_TENANT_ENABLED: "false" + # -- Kafka consumer (franz-go). In production KAFKA_BROKERS points at the + # external br-sfn Kafka (ADR-002). SASL credentials live under secrets. + KAFKA_BROKERS: "" + KAFKA_GROUP_ID: "pix-adapter-lerian-cashin" + KAFKA_TLS_ENABLED: "false" + KAFKA_SASL_MECHANISM: "" + KAFKA_DLQ_TOPIC: "br-spi.adapter-lerian.dlq" + KAFKA_MAX_CONCURRENT_PARTITIONS: "8" + CONSUMER_DEDUP_TTL_SEC: "3600" + + secrets: + # -- SYSTEMPLANE_POSTGRES_DSN: read-only routing config DSN (empty disables + # the consumer). VALKEY_URL backs the ce-id dedup cache. KAFKA_SASL_* are the + # broker credentials used when KAFKA_SASL_MECHANISM is set. + SYSTEMPLANE_POSTGRES_DSN: "" + VALKEY_URL: "" + KAFKA_SASL_USER: "" + KAFKA_SASL_PASSWORD: "" + LICENSE_KEY: "" + + useExistingSecret: false + existingSecretName: "" + + extraEnvVars: {} + +# ----------------------------------------------------------------------------- +# adapter-lerian (systemplane) — runtime config plane for adapter-lerian +# ----------------------------------------------------------------------------- +adapterLerianSystemplane: + enabled: false # safety default — explicitly enable in dev/staging values + name: "adapter-lerian-systemplane" + description: "Runtime config plane for adapter-lerian" + replicaCount: 1 + revisionHistoryLimit: 10 + + image: + repository: "ghcr.io/lerianstudio/plugin-br-pix-switch-adapter-lerian-systemplane-api" + pullPolicy: "" + tag: "" + + imagePullSecrets: [] + + # -- Override container entrypoint (e.g., to dispatch to a specific binary + # inside a multi-binary image). When empty, the image's ENTRYPOINT is used. + command: [] + # -- Container args + args: [] + + podAnnotations: {} + podSecurityContext: {} + securityContext: + runAsGroup: 1000 + runAsUser: 1000 + runAsNonRoot: true + capabilities: + drop: ["ALL"] + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + seccompProfile: + type: RuntimeDefault + + pdb: + enabled: false + minAvailable: 0 + maxUnavailable: 1 + + deploymentStrategy: + type: RollingUpdate + rollingUpdate: + maxSurge: 1 + maxUnavailable: 1 + + service: + type: ClusterIP + port: 4115 + + resources: + limits: { cpu: 200m, memory: 256Mi } + requests: { cpu: 50m, memory: 64Mi } + + autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 1 + + readinessProbe: + path: "/lerian/readyz" + livenessProbe: + path: "/lerian/health" + nodeSelector: {} + tolerations: [] + affinity: {} + + serviceAccount: + create: true + annotations: {} + name: "" + + configmap: + APPLICATION_NAME: "plugin-br-pix-switch" + SERVER_ADDRESS: ":4115" + LOG_LEVEL: "info" + ENV_NAME: "development" + DEPLOYMENT_MODE: "byoc" + REQUEST_TIMEOUT_SEC: "30" + TELEMETRY_ENABLED: "false" + OTEL_RESOURCE_SERVICE_NAME: "pix-adapter-lerian-systemplane" + OTEL_LIBRARY_NAME: "github.com/LerianStudio/plugin-br-pix-switch" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "development" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_URL: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" + # -- Multi-tenant. MULTI_TENANT_URL + MULTI_TENANT_API_KEY (secret) are + # seeded into the store; the CB tunables size the tenant-manager client. + MULTI_TENANT_ENABLED: "false" + MULTI_TENANT_URL: "" + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5" + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30" + # -- Address-book / instance routing seeds (first-boot only; operators + # manage them via the systemplane admin API afterwards). + SWITCH_BASE_URL: "" + INTEGRATION_MODE: "" + BRSFN_BASE_URL: "" + BRSFN_TOKEN_URL: "" + BRSFN_CLIENT_ID: "" + + secrets: + DATABASE_URL: "" + LICENSE_KEY: "" + # -- 32-byte AES-256-GCM key; required in non-local deployment modes. + SYSTEMPLANE_SECRET_MASTER_KEY: "" + MULTI_TENANT_API_KEY: "" + BRSFN_CLIENT_SECRET: "" + + useExistingSecret: false + existingSecretName: "" + + extraEnvVars: {} + systemplaneIngress: enabled: false className: "nginx" @@ -1393,6 +1743,10 @@ systemplaneIngress: pathType: Prefix component: cobSystemplane serviceName: cob-systemplane + - path: /lerian + pathType: Prefix + component: adapterLerianSystemplane + serviceName: adapter-lerian-systemplane # ----------------------------------------------------------------------------- # Providers Ingress — outbound-provider adapters (BTG mock, BACEN, JD, ...). @@ -1418,6 +1772,10 @@ providersIngress: pathType: Prefix component: adapterBtgMock serviceName: adapter-btg-mock + - path: /lerian + pathType: Prefix + component: adapterLerian + serviceName: adapter-lerian # Reserved for future components — uncomment when the bacen/jd # adapter components ship in the chart: # - path: /bacen From 9180459802ccf1dd2ffa98bdd4ce198aed6a920a Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 21:31:34 -0300 Subject: [PATCH 083/113] feat(chart): add adapter-lerian schema, README and values-template entries X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plugin-br-pix-switch/README.md | 5 ++- .../plugin-br-pix-switch/values-template.yaml | 45 ++++++++++++++++++- .../plugin-br-pix-switch/values.schema.json | 36 +++++++++++++++ 3 files changed, 83 insertions(+), 3 deletions(-) diff --git a/charts/plugin-br-pix-switch/README.md b/charts/plugin-br-pix-switch/README.md index 0c1799e2..cf419a03 100644 --- a/charts/plugin-br-pix-switch/README.md +++ b/charts/plugin-br-pix-switch/README.md @@ -10,7 +10,7 @@ BACEN-compliant PIX instant payment platform for the Lerian ecosystem. -The plugin is a Go monorepo that produces 10 independently-deployable binaries. +The plugin is a Go monorepo that produces 13 independently-deployable binaries. This chart deploys all of them with one helm release. Each component has its own Deployment, Service, ConfigMap, Secret, HPA, and PDB; ingress is opt-in per component. @@ -29,6 +29,9 @@ per component. | `cobHub` | `cob/hub/api` | 4108 | COB hub | | `cobProxy` | `cob/proxy/api` | 4109 | COB proxy to BCB | | `cobSystemplane` | `cob/systemplane/api` | 4110 | Runtime config plane for COB | +| `adapterLerian` | `adapter-lerian/api` | 4113 | Lerian provider adapter (API, disabled by default) | +| `adapterLerianConsumer` | `adapter-lerian/consumer` | 4114 | Lerian provider adapter Kafka consumer (disabled by default) | +| `adapterLerianSystemplane` | `adapter-lerian/systemplane/api` | 4115 | Runtime config plane for adapter-lerian (disabled by default) | ## Architecture diff --git a/charts/plugin-br-pix-switch/values-template.yaml b/charts/plugin-br-pix-switch/values-template.yaml index 54b761e7..adb43ea8 100644 --- a/charts/plugin-br-pix-switch/values-template.yaml +++ b/charts/plugin-br-pix-switch/values-template.yaml @@ -1,8 +1,9 @@ # Production values template for plugin-br-pix-switch (chart 2.0.0-beta.1+) # # Override only the fields you need to change from values.yaml defaults. -# All 10 components are enabled by default except adapter-btg-mock; disable -# any component by setting its `enabled: false`. +# All 13 components are enabled by default except adapter-btg-mock and the +# adapter-lerian trio (adapterLerian / adapterLerianConsumer / +# adapterLerianSystemplane); disable any component by setting `enabled: false`. # Global image override (applies to every component unless overridden per-component) global: @@ -164,6 +165,46 @@ cobSystemplane: LICENSE_KEY: "" SYSTEMPLANE_SECRET_MASTER_KEY: "" +# ------------------------------------------------------------ +# adapter-lerian (api) — Lerian provider adapter HTTP entry +# ------------------------------------------------------------ +adapterLerian: + enabled: false + configmap: + DEPLOYMENT_MODE: "saas" + PLUGIN_AUTH_ENABLED: "true" + PLUGIN_AUTH_URL: "http://plugin-access-manager-auth.midaz-plugins.svc.cluster.local:4000" + ORGANIZATION_IDS: "global" + secrets: + DATABASE_URL: "postgres://pixswitch:@postgres-host:5432/pix-adapter-lerian?sslmode=require" + SYSTEMPLANE_POSTGRES_DSN: "postgres://pixswitch:@postgres-host:5432/pix-adapter-lerian?sslmode=require" + LICENSE_KEY: "" + +# ------------------------------------------------------------ +# adapter-lerian (consumer) — br-sfn Kafka consumer +# ------------------------------------------------------------ +adapterLerianConsumer: + enabled: false + configmap: + ISPB: "<8-digit-ispb>" + KAFKA_BROKERS: "" + KAFKA_GROUP_ID: "pix-adapter-lerian-cashin" + secrets: + SYSTEMPLANE_POSTGRES_DSN: "postgres://pixswitch:@postgres-host:5432/pix-adapter-lerian?sslmode=require" + VALKEY_URL: "redis://default:@valkey-host:6379/0" + LICENSE_KEY: "" + +# ------------------------------------------------------------ +# adapter-lerian (systemplane) — runtime config plane +# ------------------------------------------------------------ +adapterLerianSystemplane: + enabled: false + configmap: {} + secrets: + DATABASE_URL: "postgres://pixswitch:@postgres-host:5432/pix-adapter-lerian?sslmode=require" + LICENSE_KEY: "" + SYSTEMPLANE_SECRET_MASTER_KEY: "" + # ------------------------------------------------------------ # Disable in-cluster subcharts (use external infra in production) # ------------------------------------------------------------ diff --git a/charts/plugin-br-pix-switch/values.schema.json b/charts/plugin-br-pix-switch/values.schema.json index 021e22de..b83cdbdb 100644 --- a/charts/plugin-br-pix-switch/values.schema.json +++ b/charts/plugin-br-pix-switch/values.schema.json @@ -100,6 +100,42 @@ }, "additionalProperties": true }, + "adapterLerian": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "adapterLerianConsumer": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "adapterLerianSystemplane": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, "cobHub": { "type": "object", "properties": { From b4a338a6a87eff3938030e4a31c62d036031fe1f Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 21:49:09 -0300 Subject: [PATCH 084/113] fix(chart): serve adapter-lerian consumer probes under /lerian The consumer worker mounts its operator probes under routePrefix /lerian (bootstrap/worker.go:53 + NewWorkerProbeApp with SkipDefaultHealth), so bare /readyz and /health return 404 -> readiness never passes and liveness restarts the pod (CrashLoopBackOff). Set both the values override and the deployment default to /lerian/readyz and /lerian/health, matching the api and systemplane components. The dict-hub-vsync model this was mirrored from uses bare probes, but the adapter-lerian consumer diverges by design. X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- .../templates/adapter-lerian-consumer/deployment.yaml | 4 ++-- charts/plugin-br-pix-switch/values.yaml | 4 ++-- 2 files changed, 4 insertions(+), 4 deletions(-) diff --git a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml index 414a5379..4a7c4b00 100644 --- a/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml +++ b/charts/plugin-br-pix-switch/templates/adapter-lerian-consumer/deployment.yaml @@ -94,7 +94,7 @@ spec: {{- toYaml $values.resources | nindent 12 }} readinessProbe: httpGet: - path: {{ $values.readinessProbe.path | default "/readyz" }} + path: {{ $values.readinessProbe.path | default "/lerian/readyz" }} port: http initialDelaySeconds: {{ $values.readinessProbe.initialDelaySeconds | default 10 }} periodSeconds: {{ $values.readinessProbe.periodSeconds | default 5 }} @@ -103,7 +103,7 @@ spec: failureThreshold: {{ $values.readinessProbe.failureThreshold | default 3 }} livenessProbe: httpGet: - path: {{ $values.livenessProbe.path | default "/health" }} + path: {{ $values.livenessProbe.path | default "/lerian/health" }} port: http initialDelaySeconds: {{ $values.livenessProbe.initialDelaySeconds | default 5 }} periodSeconds: {{ $values.livenessProbe.periodSeconds | default 10 }} diff --git a/charts/plugin-br-pix-switch/values.yaml b/charts/plugin-br-pix-switch/values.yaml index 11af4d3b..9866f2de 100644 --- a/charts/plugin-br-pix-switch/values.yaml +++ b/charts/plugin-br-pix-switch/values.yaml @@ -1555,9 +1555,9 @@ adapterLerianConsumer: maxReplicas: 1 readinessProbe: - path: "/readyz" + path: "/lerian/readyz" livenessProbe: - path: "/health" + path: "/lerian/health" nodeSelector: {} tolerations: [] affinity: {} From c4732a869e9d5b70feb5276f5a7c8ebc70194f69 Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 22:12:36 -0300 Subject: [PATCH 085/113] fix(chart): classify adapter-lerian BRSFN_TOKEN_URL as a secret The chart-standard strict linter (secret-in-configmap) flags BRSFN_TOKEN_URL under configmap because its name is credential-like. Move it to the systemplane secrets block to satisfy the standard; it is functionally identical (still an env var) and consistent with BRSFN_CLIENT_SECRET. Verified: strict linter now reports 0 violations. X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plugin-br-pix-switch/values.yaml | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/charts/plugin-br-pix-switch/values.yaml b/charts/plugin-br-pix-switch/values.yaml index 9866f2de..d79973bb 100644 --- a/charts/plugin-br-pix-switch/values.yaml +++ b/charts/plugin-br-pix-switch/values.yaml @@ -1708,7 +1708,6 @@ adapterLerianSystemplane: SWITCH_BASE_URL: "" INTEGRATION_MODE: "" BRSFN_BASE_URL: "" - BRSFN_TOKEN_URL: "" BRSFN_CLIENT_ID: "" secrets: @@ -1717,6 +1716,8 @@ adapterLerianSystemplane: # -- 32-byte AES-256-GCM key; required in non-local deployment modes. SYSTEMPLANE_SECRET_MASTER_KEY: "" MULTI_TENANT_API_KEY: "" + # -- OAuth token endpoint; classified as a secret to satisfy the credential-name chart standard. + BRSFN_TOKEN_URL: "" BRSFN_CLIENT_SECRET: "" useExistingSecret: false From cb3e5a442c98c03c7e13f8f04df0b33f8f8328a5 Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 22:18:13 -0300 Subject: [PATCH 086/113] docs(chart): complete adapter-lerian README default and image notes Add the three adapter-lerian components to the default-disabled list and note that worker components (dict-hub-vsync, adapter-lerian-consumer) omit the -api image suffix. Addresses CodeRabbit README completeness nit. X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plugin-br-pix-switch/README.md | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/charts/plugin-br-pix-switch/README.md b/charts/plugin-br-pix-switch/README.md index cf419a03..ca064cb6 100644 --- a/charts/plugin-br-pix-switch/README.md +++ b/charts/plugin-br-pix-switch/README.md @@ -67,6 +67,8 @@ Default `enabled` values: - `spi`, `spiSystemplane`, `dictHub`, `dictHubVsync`, `dictProxy`, `dictSystemplane`, `cobHub`, `cobProxy`, `cobSystemplane`: `true` - `adapterBtgMock`: `false` (it's a mock — only enable in dev/staging) +- `adapterLerian`, `adapterLerianConsumer`, `adapterLerianSystemplane`: `false` + (Lerian provider adapter — enable per environment) ## Configuration @@ -90,7 +92,9 @@ The app reads: Each component publishes and pulls its own image (`ghcr.io/lerianstudio/plugin-br-pix-switch--api`), set per -component under `.image.repository`. There is no shared +component under `.image.repository`. Worker components omit the +`-api` suffix (e.g. `plugin-br-pix-switch-dict-hub-vsync` and +`plugin-br-pix-switch-adapter-lerian-consumer`). There is no shared `global.image.repository`. When a component's `image.tag` is unset it falls back to `.Chart.AppVersion`, which keeps the cohort in lockstep by default; override `.image.tag` to pin a specific build per component (rare). From 5ace40e963d93de2ffe985b970892e6f4f7a4b0c Mon Sep 17 00:00:00 2001 From: Leonardox7 Date: Mon, 13 Jul 2026 22:20:49 -0300 Subject: [PATCH 087/113] docs(chart): bump pix-switch database count to 4 for adapter-lerian Adding pix-adapter-lerian makes it 4 bootstrap Postgres databases; update the values.yaml comments (L49/L67) and README Architecture + Required infrastructure sections to list pix-adapter-lerian. Addresses CodeRabbit nit. X-Lerian-Ref: 0x1 Co-Authored-By: Claude Opus 4.8 (1M context) --- charts/plugin-br-pix-switch/README.md | 8 ++++---- charts/plugin-br-pix-switch/values.yaml | 4 ++-- 2 files changed, 6 insertions(+), 6 deletions(-) diff --git a/charts/plugin-br-pix-switch/README.md b/charts/plugin-br-pix-switch/README.md index ca064cb6..6f37aa09 100644 --- a/charts/plugin-br-pix-switch/README.md +++ b/charts/plugin-br-pix-switch/README.md @@ -38,15 +38,15 @@ per component. The plugin uses a Proxy/Hub deployment model. A "hub" component owns business logic and local state (its own Postgres database, sometimes Mongo+Valkey), while a "proxy" component is a stateless pass-through. Both expose identical -APIs. Three Postgres databases are required (`pix-spi`, `pix-dict`, `pix-cob`) -and one Mongo database (`pix-dict`) for `dict-hub` (`pix-cob` is a +APIs. Four Postgres databases are required (`pix-spi`, `pix-dict`, `pix-cob`, +`pix-adapter-lerian`) and one Mongo database (`pix-dict`) for `dict-hub` (`pix-cob` is a forward-compat slot the Mongo bootstrap provisions but no component reads yet). ## Required infrastructure For a full deployment: -- **PostgreSQL**: 3 databases (`pix-spi`, `pix-dict`, `pix-cob`) and a role - `pixswitch` with full ownership of each +- **PostgreSQL**: 4 databases (`pix-spi`, `pix-dict`, `pix-cob`, + `pix-adapter-lerian`) and a role `pixswitch` with full ownership of each - **MongoDB**: 1 database (`pix-dict`) used by `dict-hub`; the bootstrap also provisions `pix-cob` as a forward-compat slot, but no component reads it yet - **Valkey** (Redis-compatible): used by `spi`, `dict-hub`, `dict-hub-vsync` diff --git a/charts/plugin-br-pix-switch/values.yaml b/charts/plugin-br-pix-switch/values.yaml index d79973bb..d0fe6892 100644 --- a/charts/plugin-br-pix-switch/values.yaml +++ b/charts/plugin-br-pix-switch/values.yaml @@ -46,7 +46,7 @@ global: # # Use cases: # - In-cluster Postgres subchart (postgresql.enabled=true) AND you want - # the chart to create the 3 pix-switch databases for you. Set + # the chart to create the 4 pix-switch databases for you. Set # connection.host to the in-cluster service name # (plugin-br-pix-switch-postgresql). # - External Postgres (RDS, Cloud SQL, etc.) where the operator wants the @@ -64,7 +64,7 @@ global: # values live under component `secrets`, not `configmap`. externalPostgresDefinitions: enabled: false - # -- Databases to create (one Job per database). pix-switch needs 3. + # -- Databases to create (one Job per database). pix-switch needs 4. databases: - pix-spi - pix-dict From 82ce72c3e5dd08b5165426f76ec69608a303698e Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Tue, 14 Jul 2026 17:00:14 +0000 Subject: [PATCH 088/113] chore(release): 2.1.0-beta.3 ## (2026-07-14) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-br-pix-switch/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 436369ef..d63933bb 100644 --- a/README.md +++ b/README.md @@ -116,7 +116,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `2.1.0-beta.2` | 1.0.0-beta.1 | +| `2.1.0-beta.3` | 1.0.0-beta.1 | ----------------- ### Plugin BR Pix Indirect BTG diff --git a/charts/plugin-br-pix-switch/Chart.yaml b/charts/plugin-br-pix-switch/Chart.yaml index ad31b20b..51d38120 100644 --- a/charts/plugin-br-pix-switch/Chart.yaml +++ b/charts/plugin-br-pix-switch/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 2.1.0-beta.2 +version: 2.1.0-beta.3 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.101" From ed1a9c9152faf12c7d69c480992e41d4c297a422 Mon Sep 17 00:00:00 2001 From: MarcoBuarque Date: Wed, 15 Jul 2026 08:20:32 -0300 Subject: [PATCH 089/113] feat(br-slc): add gated mock-nuclea component MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Standalone Deployment+Service simulating the Núclea clearing house for dev/hml E2E. Consumes ghcr.io/lerianstudio/br-slc-mock-nuclea (published by the br-slc release pipeline). Gated mockNuclea.enabled=false by default: like the detached migrations image, a gated component defaulting ON with an image the registry lacks would ImagePullBackOff and block the ArgoCD sync. Own fullname/labels/selector so the app Service never routes to the mock pod; ClusterIP :9190, /health probes, hardened nonroot securityContext. Never enable in production/BYOC. X-Lerian-Ref: 0x1 --- charts/br-slc/CHANGELOG.md | 13 ++++ charts/br-slc/Chart.yaml | 2 +- charts/br-slc/templates/_helpers.tpl | 40 +++++++++++ .../templates/mock-nuclea/deployment.yaml | 71 +++++++++++++++++++ .../br-slc/templates/mock-nuclea/service.yaml | 27 +++++++ charts/br-slc/values.schema.json | 68 +++++++++++++++++- charts/br-slc/values.yaml | 71 +++++++++++++++++++ 7 files changed, 290 insertions(+), 2 deletions(-) create mode 100644 charts/br-slc/templates/mock-nuclea/deployment.yaml create mode 100644 charts/br-slc/templates/mock-nuclea/service.yaml diff --git a/charts/br-slc/CHANGELOG.md b/charts/br-slc/CHANGELOG.md index 20dcee7d..0062c673 100644 --- a/charts/br-slc/CHANGELOG.md +++ b/charts/br-slc/CHANGELOG.md @@ -5,6 +5,19 @@ All notable changes to the br-slc Helm chart are documented in this file. The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.0.0/), and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html). +## [0.1.0-beta.2] - 2026-07-15 + +### Added + +- `mock-nuclea` (Núclea clearing-house simulator) as a gated, standalone + Deployment + ClusterIP Service — DEV/HML FIXTURE ONLY, `enabled: false` by + default (never enable in production/BYOC). Unlike the same-pod + signer/xsdValidator/mqbridge sidecars, the app reaches it over cluster DNS + (`br-slc-mock-nuclea:9190`), not localhost. Uses its own + `ghcr.io/lerianstudio/br-slc-mock-nuclea` image (published by a separate + br-slc release-pipeline workstream); exposes only `GET /health`, used for + both liveness and readiness. + ## [0.1.0-beta.1] - 2026-07-10 ### Added diff --git a/charts/br-slc/Chart.yaml b/charts/br-slc/Chart.yaml index 9724a334..e5a7d261 100644 --- a/charts/br-slc/Chart.yaml +++ b/charts/br-slc/Chart.yaml @@ -18,7 +18,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 0.1.0-beta.1 +version: 0.1.0-beta.2 # appVersion is the default image tag for the app, the signer/validator/mqbridge # sidecars, and the migrations Job. Override per image via .tag when a # component needs to pin a different build. diff --git a/charts/br-slc/templates/_helpers.tpl b/charts/br-slc/templates/_helpers.tpl index 728206e3..ea7e97ef 100644 --- a/charts/br-slc/templates/_helpers.tpl +++ b/charts/br-slc/templates/_helpers.tpl @@ -199,3 +199,43 @@ periodSeconds: {{ .periodSeconds }} timeoutSeconds: {{ .timeoutSeconds }} failureThreshold: {{ .failureThreshold }} {{- end -}} + +{{/* +mock-nuclea (Núclea clearing-house simulator) — a SEPARATE Deployment+Service, +NOT a same-pod sidecar: it must be independently gated OFF (safe-by-default) and +reached over cluster DNS by the app. DEV/HML FIXTURE ONLY — never enable in +production/BYOC. Mirrors the detached-`migrations` component's own-fullname / +own-labels convention so the app Service selector never captures the mock pod. +*/}} +{{- define "br-slc-mock-nuclea.fullname" -}} +{{- printf "%s-mock-nuclea" (include "br-slc.fullname" . | trunc 51 | trimSuffix "-") | trunc 63 | trimSuffix "-" -}} +{{- end -}} + +{{/* +mock-nuclea selector labels — distinct name from the app so the app's Service +(br-slc.selectorLabels) never routes to the mock and vice-versa. +*/}} +{{- define "br-slc-mock-nuclea.selectorLabels" -}} +app.kubernetes.io/name: {{ include "br-slc-mock-nuclea.fullname" . }} +app.kubernetes.io/instance: {{ .Release.Name }} +{{- end -}} + +{{/* +mock-nuclea labels. +*/}} +{{- define "br-slc-mock-nuclea.labels" -}} +helm.sh/chart: {{ include "br-slc.chart" . }} +{{ include "br-slc-mock-nuclea.selectorLabels" . }} +app.kubernetes.io/version: {{ .Chart.AppVersion | quote }} +app.kubernetes.io/managed-by: {{ .Release.Service }} +app.kubernetes.io/component: mock-nuclea +{{- end -}} + +{{/* +mock-nuclea image reference, defaulting tag to .Chart.AppVersion when empty. +Distinct image from the app (its own release-pipeline artifact). +*/}} +{{- define "br-slc.mockNucleaImage" -}} +{{- $tag := .Values.mockNuclea.image.tag | default .Chart.AppVersion -}} +{{- printf "%s:%s" .Values.mockNuclea.image.repository $tag -}} +{{- end -}} diff --git a/charts/br-slc/templates/mock-nuclea/deployment.yaml b/charts/br-slc/templates/mock-nuclea/deployment.yaml new file mode 100644 index 00000000..b51d664e --- /dev/null +++ b/charts/br-slc/templates/mock-nuclea/deployment.yaml @@ -0,0 +1,71 @@ +{{- if .Values.mockNuclea.enabled }} +{{- /* +Núclea clearing-house SIMULATOR — DEV/HML FIXTURE ONLY, never enable in +production/BYOC. Standalone Deployment (own image ghcr.io/lerianstudio/ +br-slc-mock-nuclea, published by the br-slc release pipeline). Safe-by-default +OFF (mockNuclea.enabled=false): like the detached migrations image, a gated +component that defaults ON with an image the registry doesn't have yet would +ImagePullBackOff and block the whole ArgoCD sync. The app reaches it over +cluster DNS (Service br-slc-mock-nuclea:port); wire MOCK_NUCLEA_URL / +NUCLEA_REST_BASE_URL / RSFN_CONSUMER_BASE_URL in the dev/hml gitops overlay. +*/}} +{{- $pullSecrets := .Values.mockNuclea.imagePullSecrets | default .Values.imagePullSecrets }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "br-slc-mock-nuclea.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-slc-mock-nuclea.labels" . | nindent 4 }} +spec: + replicas: 1 + revisionHistoryLimit: {{ .Values.revisionHistoryLimit }} + selector: + matchLabels: + {{- include "br-slc-mock-nuclea.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "br-slc-mock-nuclea.labels" . | nindent 8 }} + spec: + automountServiceAccountToken: false + {{- with $pullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + seccompProfile: + type: RuntimeDefault + containers: + - name: mock-nuclea + image: {{ include "br-slc.mockNucleaImage" . | quote }} + imagePullPolicy: {{ .Values.mockNuclea.image.pullPolicy }} + ports: + - name: http + containerPort: {{ .Values.mockNuclea.service.targetPort }} + protocol: TCP + env: + - name: MOCK_NUCLEA_ADDR + value: {{ printf ":%d" (int .Values.mockNuclea.service.targetPort) | quote }} + {{- /* GOMAXPROCS from the container CFS cpu limit — same + downward-API fix as the app/signer/validator/mqbridge containers + (Gate 8 FIX 7). Guarded with `with`+`if .cpu` so a nil-limit + override renders. */}} + {{- with .Values.mockNuclea.resources.limits }} + {{- if .cpu }} + - name: GOMAXPROCS + valueFrom: + resourceFieldRef: + resource: limits.cpu + divisor: "1" + {{- end }} + {{- end }} + livenessProbe: + {{- include "br-slc.httpProbe" .Values.mockNuclea.livenessProbe | nindent 12 }} + readinessProbe: + {{- include "br-slc.httpProbe" .Values.mockNuclea.readinessProbe | nindent 12 }} + resources: + {{- toYaml .Values.mockNuclea.resources | nindent 12 }} + securityContext: + {{- include "br-slc.containerSecurityContext" .Values.mockNuclea.securityContext | nindent 12 }} +{{- end }} diff --git a/charts/br-slc/templates/mock-nuclea/service.yaml b/charts/br-slc/templates/mock-nuclea/service.yaml new file mode 100644 index 00000000..df67167a --- /dev/null +++ b/charts/br-slc/templates/mock-nuclea/service.yaml @@ -0,0 +1,27 @@ +{{- if .Values.mockNuclea.enabled }} +{{- /* +ClusterIP Service for the mock-nuclea standalone Deployment. DEV/HML FIXTURE +ONLY (never enabled in production/BYOC). Distinct selector from the app's own +Service (br-slc-mock-nuclea.selectorLabels vs br-slc.selectorLabels) so the two +never cross-route. The app reaches this Service over cluster DNS at +br-slc-mock-nuclea: — the actual MOCK_NUCLEA_URL / +NUCLEA_REST_BASE_URL / RSFN_CONSUMER_BASE_URL wiring happens in the dev/hml +gitops overlay, not in this chart's base values. +*/}} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "br-slc-mock-nuclea.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "br-slc-mock-nuclea.labels" . | nindent 4 }} +spec: + type: {{ .Values.mockNuclea.service.type }} + selector: + {{- include "br-slc-mock-nuclea.selectorLabels" . | nindent 4 }} + ports: + - name: http + port: {{ .Values.mockNuclea.service.port }} + targetPort: http + protocol: TCP +{{- end }} diff --git a/charts/br-slc/values.schema.json b/charts/br-slc/values.schema.json index 7f5c64ce..a10f0093 100644 --- a/charts/br-slc/values.schema.json +++ b/charts/br-slc/values.schema.json @@ -14,7 +14,8 @@ "signer", "xsdValidator", "mqbridge", - "migrations" + "migrations", + "mockNuclea" ], "properties": { "replicaCount": { "type": "integer", "minimum": 0 }, @@ -460,6 +461,71 @@ } } } + }, + "mockNuclea": { + "type": "object", + "required": ["enabled", "image", "service", "resources", "securityContext", "livenessProbe", "readinessProbe"], + "properties": { + "enabled": { "type": "boolean" }, + "image": { + "type": "object", + "required": ["repository", "pullPolicy"], + "properties": { + "repository": { "type": "string", "minLength": 1 }, + "tag": { "type": "string" }, + "pullPolicy": { "type": "string", "enum": ["Always", "IfNotPresent", "Never"] } + } + }, + "imagePullSecrets": { + "type": "array", + "items": { "type": "object" } + }, + "service": { + "type": "object", + "required": ["type", "port", "targetPort"], + "properties": { + "type": { "type": "string", "enum": ["ClusterIP"] }, + "port": { "type": "integer", "minimum": 1, "maximum": 65535 }, + "targetPort": { "type": "integer", "minimum": 1, "maximum": 65535 } + } + }, + "resources": { + "type": "object", + "properties": { + "limits": { "type": "object" }, + "requests": { "type": "object" } + } + }, + "securityContext": { + "type": "object", + "required": ["runAsNonRoot", "allowPrivilegeEscalation", "readOnlyRootFilesystem", "capabilities", "seccompProfile"], + "properties": { + "runAsNonRoot": { "type": "boolean", "const": true }, + "runAsUser": { "type": "integer" }, + "runAsGroup": { "type": "integer" }, + "allowPrivilegeEscalation": { "type": "boolean", "const": false }, + "readOnlyRootFilesystem": { "type": "boolean", "const": true }, + "capabilities": { + "type": "object", + "required": ["drop"], + "properties": { + "drop": { + "type": "array", + "items": { "type": "string" }, + "contains": { "const": "ALL" } + } + } + }, + "seccompProfile": { + "type": "object", + "required": ["type"], + "properties": { "type": { "type": "string", "const": "RuntimeDefault" } } + } + } + }, + "livenessProbe": { "type": "object" }, + "readinessProbe": { "type": "object" } + } } } } diff --git a/charts/br-slc/values.yaml b/charts/br-slc/values.yaml index 39e81d88..231beb87 100644 --- a/charts/br-slc/values.yaml +++ b/charts/br-slc/values.yaml @@ -860,3 +860,74 @@ migrations: image: repository: busybox tag: "1.37" + +# --------------------------------------------------------------------------- +# mock-nuclea — Núclea clearing-house SIMULATOR. DEV/HML FIXTURE ONLY — NEVER +# ENABLE IN PRODUCTION/BYOC. A separate, standalone Deployment+Service (NOT a +# same-pod sidecar like signer/xsdValidator/mqbridge above): the app reaches it +# over cluster DNS (Service br-slc-mock-nuclea:9190), not localhost. Wiring the +# consumer side (MOCK_NUCLEA_URL / NUCLEA_REST_BASE_URL / +# RSFN_CONSUMER_BASE_URL) happens in the dev/hml gitops overlay, not here. +# +# enabled: false by default — same precedent as the detached migrations +# component above: a gated component that defaults ON with an image the +# registry doesn't have yet (its own ghcr.io/lerianstudio/br-slc-mock-nuclea, +# published by a separate br-slc release-pipeline workstream) would +# ImagePullBackOff and block the whole ArgoCD sync. Flip on only in dev/hml +# overlays once that image is published. +mockNuclea: + enabled: false + image: + repository: ghcr.io/lerianstudio/br-slc-mock-nuclea + # Empty defaults to .Chart.AppVersion (see br-slc.mockNucleaImage in + # _helpers.tpl). ASSUMPTION: reconcile the real published tag once the + # release-pipeline workstream lands. + tag: "" + pullPolicy: IfNotPresent + imagePullSecrets: [] + # ClusterIP only (BYOC/Lerian convention) — no NodePort/LoadBalancer/Ingress. + service: + type: ClusterIP + port: 9190 + targetPort: 9190 + # Distroless static nonroot binary (USER 65532) that writes nothing to disk, + # so readOnlyRootFilesystem is safe with no /tmp emptyDir needed (unlike the + # app/signer/validator containers above). + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + readOnlyRootFilesystem: true + capabilities: + drop: + - ALL + seccompProfile: + type: RuntimeDefault + # Lightweight fixture — small resource footprint. + resources: + limits: + cpu: 200m + memory: 128Mi + requests: + cpu: 50m + memory: 64Mi + # The mock exposes ONLY GET /health — no /readyz. Used for BOTH liveness and + # readiness (unlike the app container, which splits process-viability + # liveness from dependency-aware readiness). + livenessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: 5 + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 From ee6841dd7a18305d0c3018c674ac2e04e591128e Mon Sep 17 00:00:00 2001 From: gandalf-at-lerian Date: Wed, 15 Jul 2026 13:01:10 -0300 Subject: [PATCH 090/113] feat(pix-btg): add missing env defaults to chart values --- .../templates/pix/configmap.yaml | 8 ++++++++ charts/plugin-br-pix-indirect-btg/values.yaml | 8 ++++++++ 2 files changed, 16 insertions(+) diff --git a/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml b/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml index ee20d309..20c21cb9 100644 --- a/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml +++ b/charts/plugin-br-pix-indirect-btg/templates/pix/configmap.yaml @@ -12,6 +12,7 @@ data: VERSION: {{ .Values.pix.image.tag | default .Chart.AppVersion | quote }} SERVER_PORT: {{ .Values.pix.configmap.SERVER_PORT | default "4014" | quote }} SERVER_ADDRESS: {{ .Values.pix.configmap.SERVER_ADDRESS | default ":4014" | quote }} + DEPLOYMENT_MODE: {{ .Values.pix.configmap.DEPLOYMENT_MODE | default "local" | quote }} # AUTH PLUGIN PLUGIN_AUTH_ENABLED: {{ .Values.pix.configmap.PLUGIN_AUTH_ENABLED | default "false" | quote }} @@ -74,6 +75,7 @@ data: MONGO_NAME: {{ .Values.pix.configmap.MONGO_NAME | default "pix-btg-db" | quote }} MONGO_USER: {{ .Values.pix.configmap.MONGO_USER | default "pix-btg" | quote }} MONGO_MAX_POOL_SIZE: {{ .Values.pix.configmap.MONGO_MAX_POOL_SIZE | default "1000" | quote }} + MONGO_TLS: {{ .Values.pix.configmap.MONGO_TLS | default "false" | quote }} # SWAGGER SWAGGER_TITLE: {{ .Values.pix.configmap.SWAGGER_TITLE | default "Plugin BR Pix Indirect BTG" | quote }} @@ -143,6 +145,12 @@ data: # RECONCILIATION RECONCILIATION_INTERNAL_CIDR: {{ .Values.pix.configmap.RECONCILIATION_INTERNAL_CIDR | default "" | quote }} + # Schedule Business Rules + SCHEDULE_MAX_FUTURE_DAYS: {{ .Values.pix.configmap.SCHEDULE_MAX_FUTURE_DAYS | default "180" | quote }} + SCHEDULE_MIN_FUTURE_SECONDS: {{ .Values.pix.configmap.SCHEDULE_MIN_FUTURE_SECONDS | default "60" | quote }} + SCHEDULE_DEFAULT_EXECUTE_HOUR_BRT: {{ .Values.pix.configmap.SCHEDULE_DEFAULT_EXECUTE_HOUR_BRT | default "6" | quote }} + SCHEDULE_MAX_ATTEMPTS: {{ .Values.pix.configmap.SCHEDULE_MAX_ATTEMPTS | default "2" | quote }} + # BTG Webhook Validation BTG_WEBHOOK_VALIDATION_ENABLED: {{ .Values.pix.configmap.BTG_WEBHOOK_VALIDATION_ENABLED | default "true" | quote }} diff --git a/charts/plugin-br-pix-indirect-btg/values.yaml b/charts/plugin-br-pix-indirect-btg/values.yaml index 44560483..b8e0a1dd 100644 --- a/charts/plugin-br-pix-indirect-btg/values.yaml +++ b/charts/plugin-br-pix-indirect-btg/values.yaml @@ -151,6 +151,8 @@ pix: # @default -- templates/configmap.yaml configmap: ALLOW_INSECURE_TLS: "true" + # Deployment Mode + DEPLOYMENT_MODE: "local" # Database Configuration # Infra hosts are derived collapse-aware in templates/*/configmap.yaml from the bundled # subchart Service names when left empty. Set explicitly only for external infra. @@ -164,6 +166,7 @@ pix: MONGO_HOST: "" MONGO_NAME: "plugin-br-pix-indirect-btg-db" MONGO_USER: "pix_btg" + MONGO_TLS: "false" # Redis Configuration REDIS_HOST: "" # External Services @@ -190,6 +193,11 @@ pix: MTLS_HTTP_TIMEOUT: "10s" # BTG Webhook Validation BTG_WEBHOOK_VALIDATION_ENABLED: "true" + # Schedule Business Rules + SCHEDULE_MAX_FUTURE_DAYS: "180" + SCHEDULE_MIN_FUTURE_SECONDS: "60" + SCHEDULE_DEFAULT_EXECUTE_HOUR_BRT: "6" + SCHEDULE_MAX_ATTEMPTS: "2" # -- Secrets for storing sensitive data # -- All secrets are declared in the templates/secrets.yaml # @default -- templates/secrets.yaml From add7873dab8a1ce808243f7964e10d9b40243b96 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Wed, 15 Jul 2026 16:47:20 +0000 Subject: [PATCH 091/113] chore(release): 3.4.0-beta.4 ## (2026-07-15) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) ### Bug Fixes * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) --- README.md | 2 +- charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index d63933bb..0ee34e46 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Inbound Version | Outbound Version | Reconciliation Version | | :---: | :---: | :---: | :---: | :---: | -| `3.4.0-beta.3` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | +| `3.4.0-beta.4` | 1.7.5 | 1.7.5 | 1.7.5 | 1.7.5 | ----------------- diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index f378d456..1af0d067 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.4.0-beta.3 +version: 3.4.0-beta.4 # This is the version number of the application being deployed. appVersion: "1.7.5" # A list of keywords about the chart. This helps others discover the chart. From d4fdc91dedff2a38508c9f16cac424575f6ab090 Mon Sep 17 00:00:00 2001 From: arthurkz Date: Thu, 16 Jul 2026 16:45:41 -0300 Subject: [PATCH 092/113] docs(br-slc): add BR SLC section to README version matrix MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The release job for br-slc failed at the @semantic-release/exec prepare step (update-chart-version-readme-bin), which requires a '### ' heading containing the normalized chart name ('br slc') in the README version matrix. No such section existed, so the tool exited 1 and aborted the release before publish — no tag or OCI package was produced. Add the BR SLC section with an Application Version Mapping table so the tool can locate and update it. Verified locally: the updater now exits 0 and finds the section. --- README.md | 11 +++++++++++ 1 file changed, 11 insertions(+) diff --git a/README.md b/README.md index 0ee34e46..5d9576e5 100644 --- a/README.md +++ b/README.md @@ -297,3 +297,14 @@ For implementation and configuration details, see the [README](https://charts.le | :---: | :---: | | `1.0.0-beta.2` | 1.0.0 | ----------------- + +### BR SLC + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/br-slc). + +#### Application Version Mapping + +| Chart Version | App Version | +| :---: | :---: | +| `1.0.0-beta.1` | 0.1.0 | +----------------- From 7daeffd6699056ad2fdaa7e781072335ce803313 Mon Sep 17 00:00:00 2001 From: arthurkz Date: Thu, 16 Jul 2026 17:37:44 -0300 Subject: [PATCH 093/113] docs(charts): document br-slc OCI install location MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Add an Installation section to the br-slc chart README documenting the OCI artifact path (oci://ghcr.io/lerianstudio/br-slc-helm), which was previously undocumented. This also touches charts/br-slc/**, which the Helm Release workflow requires to include br-slc in the release matrix — the root README-only fix in #1664 was skipped by the workflow's paths-ignore, so the first 1.0.0-beta.1 release never triggered. --- charts/br-slc/README.md | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/charts/br-slc/README.md b/charts/br-slc/README.md index 66df184e..bc950f9d 100644 --- a/charts/br-slc/README.md +++ b/charts/br-slc/README.md @@ -335,6 +335,14 @@ because the IBM MQ C client (libmqm) needs a writable `/var/mqm` (mounted as an explicit `emptyDir`); it stays non-root, no privilege escalation, all capabilities dropped, `RuntimeDefault` seccomp. Service is `ClusterIP` only. +## Installation + +The chart is published as an OCI artifact to GitHub Container Registry: + +```bash +helm install my-release oci://ghcr.io/lerianstudio/br-slc-helm --version +``` + ## Port-forward (no Ingress) ```bash From f75a67f001a3322259804cb3272483530aab5ac8 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Thu, 16 Jul 2026 20:45:29 +0000 Subject: [PATCH 094/113] chore(release): 1.0.0-beta.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## (2026-07-16) ### ⚠ BREAKING CHANGES * **plugin-br-payments:** any values overlay using the previous keys (app.configmap.PROVIDER_*, app.secrets.PROVIDER_*) must be updated in the same change set that pins to 1.0.0-beta.2 or later. The follow-up gitops PR in midaz-firmino-gitops (firmino/dev/plugin-br-payments/values.yaml) is the only known consumer today. * the onboarding and transaction services have been consolidated into the ledger service. All Kubernetes resources (Deployment, Service, ConfigMap, Secret, Ingress, HPA, PDB, ServiceAccount) for both services have been removed from the chart. If you are already using the ledger service, no action is required. Migration (only if you were using onboarding or transaction services): - Remove and blocks from your values overrides - Ensure is set - All configuration is now managed under Also adds missing env vars to ledger configmap/secrets (swagger, multi-tenant, overdraft events, balance sync worker) * **plugin-access-manager:** Values path changed from 'auth.backend.migrations.image' (string) to 'auth.backend.migrations.image.repository' + '.tag' (object). Same for 'auth.initUser.image' and 'auth.initUser.imagePullPolicy'. Existing values overrides using the old string format will need updating. * **midaz:** Ledger service is now enabled by default, replacing the separate onboarding and transaction services. - ledger.enabled now defaults to true - onboarding and transaction services are automatically disabled when ledger is enabled - Existing deployments using onboarding/transaction need to explicitly set ledger.enabled=false to maintain current behavior Migration guide: docs/UPGRADE-5.0.md * **rabbitmq:** Default Rabbitmq no longer uses the bitnami chart. Persistent volume claims from the bitnami Statefulset may not be reused automatically * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **valkey:** Valkey no longer uses StatefulSet. Persistent volume claims from StatefulSet will not be reused automatically. * feat!(midaz): remove onboarding and transaction services from midaz chart ([41e88df](https://github.com/LerianStudio/helm/commit/41e88df0368450368cea9a001129d3d6d0f8bd02)) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **values:** add app new version and reference default config ([b972952](https://github.com/LerianStudio/helm/commit/b97295261b87645884b197bbbf8aeea8dd78e452)) * **values:** add app new version and reference default secret ([ef8069c](https://github.com/LerianStudio/helm/commit/ef8069c403b3e7878571ddb3b92ee6f8be2f251f)) * **plugin-fees:** add APPLICATION_NAME, MULTI_TENANT_TIMEOUT, MULTI_TENANT_CACHE_TTL_SEC ([a7b6199](https://github.com/LerianStudio/helm/commit/a7b6199c800795da1300c47fd31412dd3f3b9853)) * **chart:** add auth backend helpers functions ([7248963](https://github.com/LerianStudio/helm/commit/72489636dfd8d57191e4d61da0369d6267b277df)) * **chart:** add auth backend templates ([57fb163](https://github.com/LerianStudio/helm/commit/57fb163b2c7cca15b1006ef493e3ee43b7cc616c)) * **onboarding:** add auth config ([8a055cb](https://github.com/LerianStudio/helm/commit/8a055cb83b9f6a9d9c76ca3343ab6a61c1d1c00c)) * **transaction:** add auth config ([a7ede5b](https://github.com/LerianStudio/helm/commit/a7ede5b29f6c69752cffad6970d5d73bd21062cb)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **plugin-br-pix-switch:** add bootstrap Jobs for postgres + mongodb ([79f12c7](https://github.com/LerianStudio/helm/commit/79f12c79a33464e64dd4c0dbfdab29ec116e3db9)) * add bootstrap-mongodb.yaml for idempotent MongoDB user/db provisioning ([c36e378](https://github.com/LerianStudio/helm/commit/c36e378b82a709e8ec50f659a19f9e654c3792b1)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **pipe:** add branch develop to generate beta release ([2990c0e](https://github.com/LerianStudio/helm/commit/2990c0e71d5b6773321b67c986b0a5a32b970cd3)) * **ci:** add chart standard validation and render gate ([9d4ab59](https://github.com/LerianStudio/helm/commit/9d4ab5980484335942ae7827954abcc0c97f633c)) * **fetcher:** add common configmap and secrets templates for shared configuration ([7f75dd0](https://github.com/LerianStudio/helm/commit/7f75dd089489faac6e797e657ea10a34f2e876d7)) * **midaz:** add conditional deployment logic for onboarding service and update ingress routing ([f2e3c76](https://github.com/LerianStudio/helm/commit/f2e3c76aa1fe0928439bf2cfbff401bd30078714)) * **midaz:** add conditional deployment logic for transaction service ([df12827](https://github.com/LerianStudio/helm/commit/df128273a67ebc2d6572c3bd0b798d534933489b)) * **plugin-smart-templates:** add configmap annotations ([adac247](https://github.com/LerianStudio/helm/commit/adac247e5d389e8587c8e5867d19547ce98bd810)) * **reporter:** add configurable secret for KEDA TriggerAuthentication ([d84a26d](https://github.com/LerianStudio/helm/commit/d84a26d398d1df7a487e053e25cdddc8cc37df88)) * **plugins:** add CRM data source secrets and disable ingress by default ([e262736](https://github.com/LerianStudio/helm/commit/e26273677fd0d683f02d79f7cb082b43e626a377)) * **midaz:** add CRM service with MongoDB integration and complete Kubernetes manifests ([a9368d2](https://github.com/LerianStudio/helm/commit/a9368d2d9a27d7f1278e0ec06ad7a4e25124b2d5)) * add crm ui functions ([3473c00](https://github.com/LerianStudio/helm/commit/3473c0089f1e0c6efe8eb71704e12c0913d07c55)) * add crm ui templates ([8089ad7](https://github.com/LerianStudio/helm/commit/8089ad7e7056b469abf9b07d880356ace2adbc3f)) * add dependencies to midaz helm ([e1e4095](https://github.com/LerianStudio/helm/commit/e1e4095c7e9fc48c69738c0610ee7ad4bd56c12a)) * **plugin-fees:** add deployment mode and readiness timeout settings ([fa5783b](https://github.com/LerianStudio/helm/commit/fa5783bb7cb7e64d32bb4c15c0e32b637aee5bb0)) * **values:** add deployment strategy definitions ([dd93837](https://github.com/LerianStudio/helm/commit/dd9383729db20e4f88265edde5900d35c7dbbafa)) * **console:** add deployment strategy ([0000ab0](https://github.com/LerianStudio/helm/commit/0000ab0a6c088e2eca167f396bff859638b478e4)) * **onboarding:** add deployment strategy ([220274b](https://github.com/LerianStudio/helm/commit/220274beb453eb54ec6e9c3a6020016cf8a7be91)) * **transaction:** add deployment strategy ([65076f4](https://github.com/LerianStudio/helm/commit/65076f421904b98f46329ff40cb31f7cf409476b)) * add doc ([5593a96](https://github.com/LerianStudio/helm/commit/5593a96ff02c3b968c4a703a5a7ccc2afa53be04)) * add doc ([97daf1e](https://github.com/LerianStudio/helm/commit/97daf1ecb4c2a51415c58cf0bc815a36d1e52cc3)) * add doc ([2f02d2e](https://github.com/LerianStudio/helm/commit/2f02d2ef0fad7ad80fe131253a8e232b66499430)) * add doc ([6e20f92](https://github.com/LerianStudio/helm/commit/6e20f92c1c31fa26560edfa77fec348783564de2)) * **product-console:** add dynamic OTEL host injection support ([4f473e9](https://github.com/LerianStudio/helm/commit/4f473e94c54955f11383f7f439a5c8d2454b47ae)) * **midaz:** add external OTEL collector support ([f38af29](https://github.com/LerianStudio/helm/commit/f38af29a9900c118d72e07481487b146e9dab02e)) * add external secret support for RabbitMQ and Postgres definitions in Helm chart ([0994db6](https://github.com/LerianStudio/helm/commit/0994db63ae8857fc4fd5540164b9334df58b3415)) * add external secret support paramters to values file ([e35c63e](https://github.com/LerianStudio/helm/commit/e35c63efac785fb1b5fa1c31643f1a3df1b143d4)) * add external secret support to deployment ([363ee02](https://github.com/LerianStudio/helm/commit/363ee020e997e8da492cfb284b10d33c08ab780a)) * add external secret support to worker job ([58809e1](https://github.com/LerianStudio/helm/commit/58809e1efded5775234e5bdc3018d3584694a7df)) * add external secret support to worker values file ([4e62d4f](https://github.com/LerianStudio/helm/commit/4e62d4fb02c8f17009f40e6f2d04d837d404feec)) * **scripts:** add fallback to root image.tag in chart version update script ([4fdcb77](https://github.com/LerianStudio/helm/commit/4fdcb77603969e24faab5a82527abddcb2517534)) * **plugin-fees:** add fees ui env var ([c1e52e1](https://github.com/LerianStudio/helm/commit/c1e52e1e525d168adce6be38a70470facaf18590)) * **fetcher:** add fetcher helm chart with manager and worker components ([363c0cf](https://github.com/LerianStudio/helm/commit/363c0cfd5b7c0049be06358ab34e8e4619897a98)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **doc:** add general readme and moving midaz readme ([41f11fe](https://github.com/LerianStudio/helm/commit/41f11fe167c213be99413d4b0b82a9becbe482f6)) * add gpg key and clean file ([81630ce](https://github.com/LerianStudio/helm/commit/81630ce857b0e00600b63d602c3dec4df45eab61)) * add gRPC port configuration for transaction service ([1f9f761](https://github.com/LerianStudio/helm/commit/1f9f7612cf82f8dd2803c00d665f461fc13c2e12)) * add gRPC port to transaction service ([30351b9](https://github.com/LerianStudio/helm/commit/30351b9dc6622ed4ab3ac1010c777d518537c999)) * **plugins:** add Helm chart for BC Correios plugin ([81bc419](https://github.com/LerianStudio/helm/commit/81bc41948bc410bf1952ab23081e2d205bf1f51f)) * add helm chart for BR PIX direct JD plugin with PostgreSQL dependency ([0adcba2](https://github.com/LerianStudio/helm/commit/0adcba27ed3fd6158b4632d3223f4a2f211545fb)) * add Helm chart for plugin-br-bank-transfer-jd ([2ee97b9](https://github.com/LerianStudio/helm/commit/2ee97b9986a7fc2821c3c3935e34eb183f02daf8)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **plugin-br-payments:** add helm chart ([85cfe2a](https://github.com/LerianStudio/helm/commit/85cfe2a00eb299bc252b6fe6c496c4166d5cd390)) * **plugin-br-pix-switch:** add helm chart ([8977d4b](https://github.com/LerianStudio/helm/commit/8977d4b73d6f9d3df64153b89f976279e7a3a43d)) * add helm hook weights and delete policies for postgres and rabbitmq resources ([1bb5bf8](https://github.com/LerianStudio/helm/commit/1bb5bf8e3a02b547123d9e0a395163adca958729)) * add Helm hooks to onboarding and transaction ConfigMaps for pre-install/upgrade ordering ([a163833](https://github.com/LerianStudio/helm/commit/a163833ccd5c476f2a624252cea0169780fd55fd)) * add helm-compose config and karpenter node ([9a52467](https://github.com/LerianStudio/helm/commit/9a52467339718fd820e76355e97113cb6104fc2c)) * **plugin-br-pix-indirect-btg:** add HMAC validation and mTLS BTG config envs ([d1563c4](https://github.com/LerianStudio/helm/commit/d1563c48a40a1ef1dc9e8fd387203dc91c188261)) * add IAM Roles Anywhere sidecar support for fetcher and matcher ([a67b756](https://github.com/LerianStudio/helm/commit/a67b756fed6c39b62dfacda1f2ae34fecbd2b12e)) * **plugin-fees:** add IAM Roles Anywhere sidecar support ([d9621a1](https://github.com/LerianStudio/helm/commit/d9621a1da9d48355713f8d53ee881e01f8350143)) * **reporter:** add IAM Roles Anywhere sidecar support ([2b76810](https://github.com/LerianStudio/helm/commit/2b7681083e0bd731d3fc2e8605b1c0a02a3cc975)) * add imagePullSecrets and resource limits to nginx deployment ([73edcda](https://github.com/LerianStudio/helm/commit/73edcda18eb3f27c3c62ade6db7f353e8fdaa78c)) * **plugin-br-pix-switch:** add in-cluster sibling URL defaults ([c1f7b8f](https://github.com/LerianStudio/helm/commit/c1f7b8fdc42bae4bb588987df29a5e32a3969712)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * add index to semantic-release versioning ([4c98cf1](https://github.com/LerianStudio/helm/commit/4c98cf120e280bcdb252fed83aab285f1fa0f5e8)) * add index to semantic-release versioning ([af4c306](https://github.com/LerianStudio/helm/commit/af4c306d8e6ece405b451407c941eb1bf4eff5bd)) * add ingress template ([44b73b2](https://github.com/LerianStudio/helm/commit/44b73b2e3d2330af536435194930132e65d2ecc2)) * **ingress:** add ingress templates ([020369a](https://github.com/LerianStudio/helm/commit/020369a13b9696eb2e6e12c389ed211d2feb95f1)) * **ingress:** add ingress templates ([816fcee](https://github.com/LerianStudio/helm/commit/816fcee9d905744bcd47003fb16b974104c2d2d3)) * add init container in casdoor to check if the database is ready ([#48](https://github.com/LerianStudio/helm/issues/48)) ([8337771](https://github.com/LerianStudio/helm/commit/833777165ff6ed1d4183cc48757acd2d8b7ddd83)) * add initial helm chart for BR Pix Direct JD plugin ([2f097d0](https://github.com/LerianStudio/helm/commit/2f097d0f713783cf599888c880fc82fa6eec0ea3)) * **underwriter:** add initial Helm chart for Underwriter service ([7bbba1a](https://github.com/LerianStudio/helm/commit/7bbba1afcb883a261ef121710a9f5d0a854326ff)) * **plugin-br-pix-indirect-btg:** add INTERNAL_WEBHOOK_SECRET and bump to 1.0.0-rc.26 ([e5ef789](https://github.com/LerianStudio/helm/commit/e5ef7890094698e5bd5faceacc1e56746e0f2305)) * **dependencies:** add job to apply default definitions to external rabbitmq host ([c91db90](https://github.com/LerianStudio/helm/commit/c91db90f8311960f818d7f0b0046bc9eda1a4e6b)) * add Kubernetes manifests for PIX QR code service deployment ([8b1881f](https://github.com/LerianStudio/helm/commit/8b1881f157b140d02bed50cd6d7e70e67b074cb1)) * add Kubernetes manifests for plugin-br-pix-direct-jd job deployment ([9b67a67](https://github.com/LerianStudio/helm/commit/9b67a67fd073657a1c1dd7751288275fe24619d0)) * **midaz:** add ledger service configuration and restructure values files ([d4332f9](https://github.com/LerianStudio/helm/commit/d4332f9a122f4cf9045f76c8ce1e76dd080beda6)) * **midaz:** add ledger service with unified API and migration helpers ([0ee6e83](https://github.com/LerianStudio/helm/commit/0ee6e83a4a04e185585e7391f9ff7271ef8546b1)) * **doc:** add lerian banner ([35b904a](https://github.com/LerianStudio/helm/commit/35b904afb9d910e51b1508693aa7c3ce06ea9a75)) * add logical replication slot and improve SQL formatting ([ec2cfee](https://github.com/LerianStudio/helm/commit/ec2cfee6dab3fc571fb74e7e662c08000836a893)) * **plugin-fees:** add M2M and AWS_REGION env vars to chart ([f026d18](https://github.com/LerianStudio/helm/commit/f026d18e6b053f778b26d24dc1932a91f8c689d5)) * **fetcher:** add manager component Kubernetes manifests with full deployment configuration ([12ec0dd](https://github.com/LerianStudio/helm/commit/12ec0ddca52e9046324204ec7b717b87296e434b)) * **matcher:** add matcher helm chart ([6a235c1](https://github.com/LerianStudio/helm/commit/6a235c1fde13dc7ae70b3e719ed9b7dab4e3bb28)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **matcher:** add missing env vars for matcher v1.0.0+ ([0bf1e7f](https://github.com/LerianStudio/helm/commit/0bf1e7f71c9dbb9ffea852f369def1d61ebfffac)) * **plugin-br-pix-indirect-btg:** add missing inbound webhook entity envs and security tier config ([ca62f49](https://github.com/LerianStudio/helm/commit/ca62f49564f7bf5c543028ec639870a762410605)) * **charts:** add missing NEU app env vars to reporter and fetcher ([8d4db13](https://github.com/LerianStudio/helm/commit/8d4db13cd6f1c1ebda31797c799b6d2ecebc7e5c)) * **product-console:** add MONGO_PARAMETERS env var for TLS/auth options ([164468c](https://github.com/LerianStudio/helm/commit/164468c7bbe92e069a3d4d25bd05eef17f8827c6)) * **plugin-br-pix-switch:** add mongodb + rabbitmq subchart dependencies ([0e9b3d4](https://github.com/LerianStudio/helm/commit/0e9b3d42d6cadd7e93d1ebd7e3d353d58c57f2cf)) * **console:** add mongodb environments ([256757e](https://github.com/LerianStudio/helm/commit/256757eb38cff41510d114572f4d18d92569fd6f)) * **console:** add mongodb environments ([88db3ba](https://github.com/LerianStudio/helm/commit/88db3bad7e8f2ec4fe5056980cbb7e41cdd02c38)) * **console:** add mongodb environments ([7c86ca0](https://github.com/LerianStudio/helm/commit/7c86ca00a65680a99b642d976ac36578c39c31f9)) * **console:** add mongodb port ([73ec8e2](https://github.com/LerianStudio/helm/commit/73ec8e27a619c333a6f2cfe60fcc0c8d49fd8295)) * **plugin-fees:** add MULTI_TENANT_ALLOW_INSECURE_HTTP to configmap template ([48cf209](https://github.com/LerianStudio/helm/commit/48cf20922c92bf3ece54122be84251913497c9a4)) * **plugin-fees:** add multi-tenant support and fix AVP secret rendering ([#1229](https://github.com/LerianStudio/helm/issues/1229)) ([04e12ac](https://github.com/LerianStudio/helm/commit/04e12acc2a1f0188fe78b227896880aa8f60bd28)) * **flowker:** add multi-tenant support and missing env vars ([9892b7d](https://github.com/LerianStudio/helm/commit/9892b7d9635f3b29d1159eccc60e5fd891d2badc)) * **tracer:** add multi-tenant support to chart (2.1.0-beta.1) ([a4c4a7e](https://github.com/LerianStudio/helm/commit/a4c4a7e62e71016696b0fc166eee66df2c76d61e)) * **console:** add new console env vars ([cf974b8](https://github.com/LerianStudio/helm/commit/cf974b8d696f9eb89e951fd144632d0e5817291f)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-fees:** add new env vars for v3.1.0 ([f824431](https://github.com/LerianStudio/helm/commit/f8244314c78d1bfc76a3a83dce58e5e29d330b17)), closes [#1195](https://github.com/LerianStudio/helm/issues/1195) * **console:** add new env vars ([a228e39](https://github.com/LerianStudio/helm/commit/a228e39c856f9f4b561d55949edcaa051d5b9af9)) * **console:** add new env vars ([8b8d76f](https://github.com/LerianStudio/helm/commit/8b8d76f525a96f36c1d694c65db51ed7280a68a5)) * **dependencies:** add new parameters to chart file ([#44](https://github.com/LerianStudio/helm/issues/44)) ([4796070](https://github.com/LerianStudio/helm/commit/4796070cb5ad4c32d28bbb7ffc085b5fb3aeb495)) * **doc:** add new version ([39c0a71](https://github.com/LerianStudio/helm/commit/39c0a71dacbe9c80aa095a580c5d42d153b0947b)) * **doc:** add new version ([f864ad2](https://github.com/LerianStudio/helm/commit/f864ad20353a26f7dbe525332ef3b54f6af6fb74)) * add nginx configuration templates ([5755baa](https://github.com/LerianStudio/helm/commit/5755baaef5a346db79dfb78c7638b74c928c442f)) * add nginx dependence for midaz-console ([baa0cd4](https://github.com/LerianStudio/helm/commit/baa0cd4e4a209c520a2cb8e7de67c154f8a39e24)) * **midaz:** add nginx paramters to midaz-console ([84ff310](https://github.com/LerianStudio/helm/commit/84ff3103d5cd01da01c64c15eec4a83c5df66f17)) * **fetcher:** add OpenTelemetry HOST_IP injection support ([0ea3d75](https://github.com/LerianStudio/helm/commit/0ea3d7570288ab2e6e99a8f81564b031e11af626)) * add option to use existing secrets in helm chart ([f810082](https://github.com/LerianStudio/helm/commit/f810082fe8ce19eb69823f12b92345e418bb68d8)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * add plugin crm ui values ([493e4eb](https://github.com/LerianStudio/helm/commit/493e4eba4bf4457bbd75cf21334d33f16267b833)) * add plugin crm ui values ([c31de8d](https://github.com/LerianStudio/helm/commit/c31de8d30aedca6c9b4cc91b096c1e76a92a1a35)) * add plugin fees ui templates ([3451909](https://github.com/LerianStudio/helm/commit/345190944d3648c0ebae6e47890967cfefcc7e49)) * add plugin to semantic-release ([4ec01d8](https://github.com/LerianStudio/helm/commit/4ec01d8aceef35145239ae5b513977531798b329)) * add plugin to semantic-release ([d102c52](https://github.com/LerianStudio/helm/commit/d102c52039f5c1262f9dc00eb07728d226e656ef)) * add plugin to semantic-release ([a26017e](https://github.com/LerianStudio/helm/commit/a26017e363c87530e30e96e9b5fdc2581c19bb49)) * add plugin to semantic-release ([b001de0](https://github.com/LerianStudio/helm/commit/b001de0f2fad2b2b1cf05b5c0db9f48aa1af5265)) * add plugin to semantic-release ([f786586](https://github.com/LerianStudio/helm/commit/f7865866e41aad38bdf343e45fce351fa2af2a9b)) * add plugin to semantic-release ([13f0af3](https://github.com/LerianStudio/helm/commit/13f0af38e59cf9fb7a3596293a83dd3e6b9757a0)) * add postgres definitions and update security settings for console deployment ([6371b55](https://github.com/LerianStudio/helm/commit/6371b5568b94bc8f6fe57817132dee4644870ef3)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](https://github.com/LerianStudio/helm/commit/f6e469519784f6f301929066c55a152698e16d77)) * add pre-install and pre-upgrade hooks to onboarding and transaction secrets ([8199e92](https://github.com/LerianStudio/helm/commit/8199e92a9904adfc89adc6acf65a367d6c42b7e7)) * **product-console:** add product-console helm chart ([c956078](https://github.com/LerianStudio/helm/commit/c956078bd0959c13f42a018aa52b80862781b11d)) * **fetcher:** add RabbitMQ bootstrap job with definitions for external RabbitMQ instances ([90c5edc](https://github.com/LerianStudio/helm/commit/90c5edc90b4798ed0d31e56ca9479095889a521e)) * add RabbitMQ consumer credentials configuration in values-template ([da5c625](https://github.com/LerianStudio/helm/commit/da5c6255dfc8a2a671f9dfb88bb511d0536ddd6e)) * add rate limit configuration to midaz, fetcher, and reporter charts ([db2ec46](https://github.com/LerianStudio/helm/commit/db2ec461f6df0cc003cfe05fe4dd33df08d27d4e)) * add RBAC and nginx restart capability to service discovery job ([236e62f](https://github.com/LerianStudio/helm/commit/236e62f776e356b716fbd3059c37377cdbd154b6)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **pipe:** add release step for ghcr ([f0e4f3f](https://github.com/LerianStudio/helm/commit/f0e4f3f5221b392bb68b2a5f87aa85facc5cfbee)) * **plugin-br-pix-indirect-btg:** add required validation for INTERNAL_WEBHOOK_SECRET ([df410e2](https://github.com/LerianStudio/helm/commit/df410e2d27b21a724447b44d50f9faaed7796be6)) * **plugin-fees:** Add SA template Fees ([14af5bd](https://github.com/LerianStudio/helm/commit/14af5bdd8e0cb45747c5d23797ed10ac6f4a96a3)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **console:** add secrets ([ad89e3b](https://github.com/LerianStudio/helm/commit/ad89e3ba7bd1713686bc0546be1e6b11341b10da)) * add security context and service account to nginx deployment ([3eaa99e](https://github.com/LerianStudio/helm/commit/3eaa99e8ecf17e3992e0c952699c2c111cf3aac3)) * **chart:** add security context to plugin identity ([47b48fc](https://github.com/LerianStudio/helm/commit/47b48fc9ec49f706519fceb4a7007c0179f62317)) * **pipe:** Add semantic changelog ([8c65e59](https://github.com/LerianStudio/helm/commit/8c65e5970101edc9ac621ec30b783bbc4fc3225c)) * **pipe:** Add semantic changelog ([452b6e7](https://github.com/LerianStudio/helm/commit/452b6e78b97a10aa4cd94daf5c95cd1545dc8222)) * **pipe:** Add semantic changelog ([c54115e](https://github.com/LerianStudio/helm/commit/c54115ebf8bd43a0dc8d41233d1100ac136ba8c3)) * **pipe:** Add semantic changelog ([d9befbb](https://github.com/LerianStudio/helm/commit/d9befbb65561716987a9825587f5ac0c9b63be3b)) * **ci:** Add Semantic Release changelog ([6537310](https://github.com/LerianStudio/helm/commit/6537310682b459b7f9fd48ed3c18dd739a816b0f)) * add service discovery job to plugins ui ([2bdaf78](https://github.com/LerianStudio/helm/commit/2bdaf789279b7cbefef51dbc4ad4db219325df73)) * **reporter:** add ServiceAccount annotations support for IRSA ([3685103](https://github.com/LerianStudio/helm/commit/3685103f9547e595667f85a9267272e337f3b077)) * **fetcher:** add ServiceAccount support for worker ([aa616c7](https://github.com/LerianStudio/helm/commit/aa616c7e00827621e525f75e3eb23c44fa2c9993)) * add step to update gh-pages ([bd762c7](https://github.com/LerianStudio/helm/commit/bd762c72ead853758a349d52913a63b45ed40a5c)) * add step to update gh-pages ([ddffd1b](https://github.com/LerianStudio/helm/commit/ddffd1b3dfbd179e26958361965f93a62273af07)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **midaz:** add support to external screts ([ab13b87](https://github.com/LerianStudio/helm/commit/ab13b878fdf8c280dc9e95cf015a459ce8b1edc6)) * **tracer:** add tracer helm chart ([275c30e](https://github.com/LerianStudio/helm/commit/275c30e44dcc66052cfc459e997dd0618e5ca766)) * add transaction gRPC configuration and update service versions ([cb48384](https://github.com/LerianStudio/helm/commit/cb4838437068d4e616c864c7cd37340399c0f504)) * **midaz:** add user consumer config to rabbitmq ([fb28359](https://github.com/LerianStudio/helm/commit/fb28359f8a4634317aeebd56e40af1a9083eb857)) * **plugin-br-pix-indirect-btg:** add validation to ensure INTERNAL_WEBHOOK_SECRET matches ([0f485b2](https://github.com/LerianStudio/helm/commit/0f485b225b9b5cd23e01e6154770550df8a69043)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-smart-templates:** add valkey to smart templates chart ([709876b](https://github.com/LerianStudio/helm/commit/709876bb3b4d9c61a301d554f2f093615ad91084)) * add values template file ([7252f36](https://github.com/LerianStudio/helm/commit/7252f36fe7070fe18675073c21bb9269443270e8)) * **matcher:** add values-template and rabbitmq definitions ([3063245](https://github.com/LerianStudio/helm/commit/30632451da1ae248b1eeaf1dce680411b075f334)) * **matcher:** add VERSION env var and OTEL support ([cee8f96](https://github.com/LerianStudio/helm/commit/cee8f9682f769b77f6d2a5d52964b53dc92f9253)) * **plugin-br-pix-switch:** add wait-for-dependencies init container ([281226e](https://github.com/LerianStudio/helm/commit/281226e570ce08ce0ba412525986cb0766df77a2)) * **fetcher:** add worker component Kubernetes manifests with deployment, configmap and secrets ([fd8d8f3](https://github.com/LerianStudio/helm/commit/fd8d8f325262e945ed1e738efea2558e5ce9e2c6)) * add worker reconciliation config ([596c5a9](https://github.com/LerianStudio/helm/commit/596c5a91ed1fd498a7efc964f65cad94cc6b47c8)) * **console:** adds new env vars ([473cf5a](https://github.com/LerianStudio/helm/commit/473cf5a8d681e42c9ad8318b42b08dbea1e3e045)) * ajuste utilização recursos console ([44c7e64](https://github.com/LerianStudio/helm/commit/44c7e641170ad5e9b0a3629971c2cdc731059928)) * allow custom nginx configmap names and update plugins.conf path to snippets directory ([fe69b7b](https://github.com/LerianStudio/helm/commit/fe69b7b26b86c85a8d916afae4c9c9b009d8ba0d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **plugin-br-pix-switch:** auto-derive OTEL service version + node-IP OTLP endpoint ([15e6196](https://github.com/LerianStudio/helm/commit/15e6196cf549401084b7c6a1d7afd55c13f194b5)) * **reporter,fetcher:** auto-set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image tag ([bcc28f1](https://github.com/LerianStudio/helm/commit/bcc28f1bdc02b51347e677a8d26ac5ab7d7c40b6)) * **plugin-br-pix-switch:** auto-wire URLs to in-cluster subcharts ([561b398](https://github.com/LerianStudio/helm/commit/561b39871e2a17028eb56b9f3c0490ee74c5df43)) * **plugin-access-manager:** bump auth version ([12d5453](https://github.com/LerianStudio/helm/commit/12d54531235c76ccb25de1e976336505a0c51c91)) * **plugin-access-manager:** bump auth version ([10b5e4c](https://github.com/LerianStudio/helm/commit/10b5e4c9d7cc99ed93ff254b3e5c2632df25b9c6)) * **plugin-access-manager:** bump auth version ([90c6906](https://github.com/LerianStudio/helm/commit/90c6906ac94512dc14308f871aa4ed82717de49d)) * **midaz:** bump chart version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable ([bb157a4](https://github.com/LerianStudio/helm/commit/bb157a4472446033b94ab96837433e4df160555f)) * casdoor bump version ([bf5e28c](https://github.com/LerianStudio/helm/commit/bf5e28c0d3a259c192e94023fe1701bcca3d4fe4)) * **midaz:** config internal collector in midaz ([07d310e](https://github.com/LerianStudio/helm/commit/07d310ef840b1b95f86b6bdf1f75eba1a7e5b64a)) * **midaz:** config internal collector in midaz ([fb7d829](https://github.com/LerianStudio/helm/commit/fb7d8290ad20cb4e92ccd7eea19c07bb46b46bc7)) * **chart:** configure pdb to auth backend ([112bc47](https://github.com/LerianStudio/helm/commit/112bc47d72db94b57e81138297d973cb31d4ddf6)) * **helm:** create chart file to plugin crm ([69b01c8](https://github.com/LerianStudio/helm/commit/69b01c868752eb91973e2d292eb2e7ffaa57c1e0)) * **helm:** create chart file to plugin-fees ([38a0e81](https://github.com/LerianStudio/helm/commit/38a0e81c29d53bb81bb1895869b058942bc1d116)) * create chart midaz opensource ([afeadcf](https://github.com/LerianStudio/helm/commit/afeadcf46aef60af8b74055695a55fc00131f029)) * **helm:** create chart templates to plugin crm ([777ea2f](https://github.com/LerianStudio/helm/commit/777ea2fa1582d1530fbc4946c4ef184ae90598e9)) * **chart:** create chart templates to plugin-fees ([adabbaa](https://github.com/LerianStudio/helm/commit/adabbaaf405b471b111abe208408fce9c0772e99)) * **chart:** create chart templates to plugin-fees ([303caf0](https://github.com/LerianStudio/helm/commit/303caf06a48ff63e20fcdd13fd2c5d0629aae33c)) * **helm:** create doc to plugin crm ([4cbaa9d](https://github.com/LerianStudio/helm/commit/4cbaa9d4e8377260508c5687f292cfec8dbeee36)) * **plugin-smart-templates:** create functions to plugin-smart-templates ui ([d660619](https://github.com/LerianStudio/helm/commit/d6606192c1c6f0c0bd404e3b44c660079ce653b9)) * **plugin-smart-templates:** create helm templates to plugin-smart-templates ui ([a06f9c0](https://github.com/LerianStudio/helm/commit/a06f9c06c2d89de0a7f8ce6ba845057a8af3c268)) * **dependencies:** create init config file ([bddd6f0](https://github.com/LerianStudio/helm/commit/bddd6f025782740e3fc021ae4d7e64c0e78fd580)) * **dependencies:** create init sql file ([dcca103](https://github.com/LerianStudio/helm/commit/dcca103dcf229a307833685ad04711f662099219)) * **midaz:** create internal collector helm chart ([d17a5a4](https://github.com/LerianStudio/helm/commit/d17a5a45388428c30fa2133a58e275d445b634c7)) * **dependencies:** create job to apply migrations in casdoor db ([5a74bcc](https://github.com/LerianStudio/helm/commit/5a74bcc6ca8691159c4a3d11826a5afb34909e49)) * **values:** create pdb definitions ([fe34974](https://github.com/LerianStudio/helm/commit/fe34974aaa497979e0d13b610b77b4d1d7895f2f)) * **console:** create pdb template ([102c56a](https://github.com/LerianStudio/helm/commit/102c56a6e697623317585b8808f09f3cb7458882)) * **onboarding:** create pdb template ([8bc0d48](https://github.com/LerianStudio/helm/commit/8bc0d489407c8c5181a20f2c731e5abc7946b8b6)) * **transaction:** create pdb template ([738f5d3](https://github.com/LerianStudio/helm/commit/738f5d3ff33cc62f155186af1514340fa3133503)) * **chart:** create plugin access manager auth templates ([2fdd9ac](https://github.com/LerianStudio/helm/commit/2fdd9ac466966c5557757afae07a52f9894240fd)) * **chart:** create plugin access manager chart file ([094eecc](https://github.com/LerianStudio/helm/commit/094eeccff09029260104c7428a254c25260d20d6)) * **chart:** create plugin access manager identity templates ([c52068d](https://github.com/LerianStudio/helm/commit/c52068d228e3a79bbf4904e9823fb29407694add)) * **chart:** create plugin access manager templates ([c4221ad](https://github.com/LerianStudio/helm/commit/c4221adf91b52acc3c590d9d7b1f8db314f01d88)) * **values:** create plugin access manager values file ([b1727d0](https://github.com/LerianStudio/helm/commit/b1727d0f162fb1c464b35559f5684740a5af819e)) * create plugin fees ui functions ([0d2c127](https://github.com/LerianStudio/helm/commit/0d2c127d3d4f1aed530a864937e4e0e5fe7c8332)) * **plugin-smart-templates:** create secret to plugin-smart-templates ui ([552d061](https://github.com/LerianStudio/helm/commit/552d06115d589ceb41ac5d201fe972e82fc4c588)) * **plugin-smart-templates:** create values defintions to plugin-smart-templates ui ([48a25ca](https://github.com/LerianStudio/helm/commit/48a25ca3f4d889ba827a3674a284a563dbcbb105)) * **helm:** create values file to plugin crm ([de6b154](https://github.com/LerianStudio/helm/commit/de6b1547947f91d580a9ff5f7fb14c1e5efa4d0d)) * **values:** create values file to plugin-fees ([304f228](https://github.com/LerianStudio/helm/commit/304f22871b76180f4b299daa3ecaac06571ffd92)) * **values:** create values file to plugin-fees ([f383281](https://github.com/LerianStudio/helm/commit/f383281421b709744823d9de1bc053288ab6d747)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** default DEPLOYMENT_MODE to byoc (1.1.0-beta.3) ([aa12385](https://github.com/LerianStudio/helm/commit/aa12385a12d159121c021f53350ebac3f90b3668)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](https://github.com/LerianStudio/helm/commit/4946cb505bb4ee121910113c4ca78a74e8a97269)) * dependency update ([18bd991](https://github.com/LerianStudio/helm/commit/18bd9910348f05785a975b38d8b11068f1069407)) * dependency update ([b56d142](https://github.com/LerianStudio/helm/commit/b56d1421e7251dc932d4b025cc6be4be31ee3c42)) * dependency update ([55eb548](https://github.com/LerianStudio/helm/commit/55eb5489f192d16508b7ecfd93bddcf71aa42feb)) * **grafana:** disable grafana ([423a6f5](https://github.com/LerianStudio/helm/commit/423a6f5495c50c4ccae86c5391cb52841af300e8)) * **plugni-fees:** Disable SA create ([4074905](https://github.com/LerianStudio/helm/commit/4074905ddec1dec2c62eab214fdbff1b548ef329)) * **plugin-fees:** enable extra env vars to configmap template ([5f60cea](https://github.com/LerianStudio/helm/commit/5f60ceac653f34a021d0db1a10447113fb693005)) * **plugin-fees:** enable extra env vars to values yaml ([dc626a7](https://github.com/LerianStudio/helm/commit/dc626a7a5825e0afbd1d44c1f56594f3a97f14fe)) * **plugin-crm:** enable extra env vars ([5ea9e2f](https://github.com/LerianStudio/helm/commit/5ea9e2fc7cda9500fe728d4bf2cd877844b666a4)) * **plugin-smart-templates:** enable extra env vars ([c03007b](https://github.com/LerianStudio/helm/commit/c03007bf50902abd45c54d5bee3296450a13d50b)) * enable karpenter node ([02b029d](https://github.com/LerianStudio/helm/commit/02b029d1a18e462be5c5c11c5d0c5f0cceee6122)) * **midaz:** enable ledger service by default ([1abf1f1](https://github.com/LerianStudio/helm/commit/1abf1f1b1944583717002bd23d2fb72fae71a676)) * enable telemetry for onboarding and transaction services ([2497433](https://github.com/LerianStudio/helm/commit/2497433be24d42829985604f47cf983705c05f6e)) * **console:** enforce absolute DNS resolution ([8e519fe](https://github.com/LerianStudio/helm/commit/8e519fe25255119d50ecfef91ca8ab5a01df5f78)) * **onboarding:** enforce absolute DNS resolution ([c471521](https://github.com/LerianStudio/helm/commit/c471521eb53ce2e100f080247c2ff25bc1255650)) * **transaction:** enforce absolute DNS resolution ([1759a5b](https://github.com/LerianStudio/helm/commit/1759a5b1ce44339302482bd5ccabed5056c33a2f)) * **ci:** enforce single-source infra secrets ([3b787d5](https://github.com/LerianStudio/helm/commit/3b787d508ba556c21b036b41ff990245e7258427)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](https://github.com/LerianStudio/helm/commit/756a1f9c85d570a539866b54f070192d40cb2f59)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **midaz:** extend RBAC permissions for discovery service to access replicasets and list/watch deployments ([9285689](https://github.com/LerianStudio/helm/commit/9285689f5bbb1ae361741668834473809cb7c86b)) * **matcher:** finalize matcher helm chart for v1.0.0 ([2be45e9](https://github.com/LerianStudio/helm/commit/2be45e958cbc4fc001831c1f87b11a1aea472d15)) * **ci:** harden validator with collapse gate ([cc324ee](https://github.com/LerianStudio/helm/commit/cc324ee94663baa3228d6b4ed754cc09d0ac4fbf)) * helm doc ([#26](https://github.com/LerianStudio/helm/issues/26)) ([ccb3021](https://github.com/LerianStudio/helm/commit/ccb30211fbd9ab5b1ff5e3151f1f9361d25e3cff)) * improve Helm setup reliability in release workflow ([eb49cc3](https://github.com/LerianStudio/helm/commit/eb49cc348065b87027112371b4496080b25dd4e4)) * **midaz:** improve RabbitMQ bootstrap script with smart URL handling and enhanced logging ([8d99add](https://github.com/LerianStudio/helm/commit/8d99addbd1dec7b570ccdb9fc7f6add52564172d)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](https://github.com/LerianStudio/helm/commit/e67d89c3fffa8154989f6d71f65582331fba98d9)), closes [#138](https://github.com/LerianStudio/helm/issues/138) * **lerian-notification:** initial chart ([2a001d4](https://github.com/LerianStudio/helm/commit/2a001d4ba433a61cd3317929cc96045c42561bfd)) * **bootstrap-mongodb:** make app user and roles configurable via values ([5a37252](https://github.com/LerianStudio/helm/commit/5a37252bc760b70a50ad1814d5fb7955065f7400)) * **plugin-access-manager:** make createDatabase configurable ([1574601](https://github.com/LerianStudio/helm/commit/1574601cb8d8a8d2a8cdf9f360dc695f5f102bfb)) * midaz helm chart ([8768a8e](https://github.com/LerianStudio/helm/commit/8768a8e1f97dbe82d0cb96b899c3865e7b9c95c3)) * midaz helm chart ([94b2a6e](https://github.com/LerianStudio/helm/commit/94b2a6eab897bb6c1cd6f336fc9cf12f642ad697)) * **rabbitmq:** migrate from Bitnami chart to groundhog2k chart ([454c850](https://github.com/LerianStudio/helm/commit/454c850bb9bce3b24f62bea34cf65997a55fcf2b)) * **valkey:** migrate from StatefulSet to Deployment ([3854dfe](https://github.com/LerianStudio/helm/commit/3854dfe3430eaf7f4d99e39d032103eca4ff10fd)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-br-bank-transfer:** move CLIENT_IDs to secrets ([d3e36c0](https://github.com/LerianStudio/helm/commit/d3e36c03dce5f43305daf1c6da2da4f65a142f76)) * **pipe:** new pipe to deploy all charts ([20629f5](https://github.com/LerianStudio/helm/commit/20629f50ce386463a83ac0ebc0fce367430f04a0)) * **pipe:** new releaserc template ([24dc653](https://github.com/LerianStudio/helm/commit/24dc653adae4f036f7d5b9da044f42c43e9acd09)) * onboarding bump version ([4fc43e7](https://github.com/LerianStudio/helm/commit/4fc43e748f50fc4afd34e475a1c7d7360efaf3bc)) * onboarding rabbitmq protocol variable ([add46ac](https://github.com/LerianStudio/helm/commit/add46ac46bdcf1e629db5f92d4e129f550e93cfb)) * onboarding rabbitmq protocol variable ([01b91e6](https://github.com/LerianStudio/helm/commit/01b91e690ca469e58800047c055c872b90ab00d8)) * onboarding rabbitmq protocol variable ([9980d0c](https://github.com/LerianStudio/helm/commit/9980d0cd82b658b34d9244cc524630222f0cf61e)) * onboarding rabbitmq protocol variable ([3d44fa1](https://github.com/LerianStudio/helm/commit/3d44fa1c77b8442600f272497fd4fe79351aadf9)) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](https://github.com/LerianStudio/helm/commit/82dbb81fda6cb8611844cabdaff52b9cc65758b1)) * **charts:** parametrize probe path and timing for all charts using /readyz ([c4d15a2](https://github.com/LerianStudio/helm/commit/c4d15a20995b4edbcf11ce8576c1b80b5a05287d)) * **ci:** per-chart values.schema.json generator ([d295433](https://github.com/LerianStudio/helm/commit/d2954334953f15a1db0ee47064d5885bcec89f6b)) * **plugin-br-pix-switch:** per-component command/args for single-image multi-binary support ([d607978](https://github.com/LerianStudio/helm/commit/d607978e45aedec2137b0ecf5505529a08a254cd)) * **plugin-br-pix-switch:** per-component image repository defaults (1.1.0-beta.6) ([48b9d17](https://github.com/LerianStudio/helm/commit/48b9d17c3930e97c3d84355f6c56c39f739913b8)), closes [#137](https://github.com/LerianStudio/helm/issues/137) * plugin auth bump version ([f99a6fb](https://github.com/LerianStudio/helm/commit/f99a6fb0ad500f482703e87bb47ff5a87be857ff)) * plugin identity bump version ([d98f1b5](https://github.com/LerianStudio/helm/commit/d98f1b57ca9d5445651721904a16587d7689241d)) * **midaz:** plugins ui support to console ([17f2376](https://github.com/LerianStudio/helm/commit/17f23766c70f1e1784f7cb83fccff7f54fcd5333)) * **midaz:** plugins ui support to console ([7eced23](https://github.com/LerianStudio/helm/commit/7eced23afd42a256af0f28f308e814058b046f17)) * **midaz:** plugins ui support to console ([495afa4](https://github.com/LerianStudio/helm/commit/495afa420d2395027082a7b8b14fc7402512ede2)) * **midaz:** plugins ui support to console ([3b8ad93](https://github.com/LerianStudio/helm/commit/3b8ad93dfac6f20ab87a23f3c7e1e0eca853c252)) * **midaz:** plugins ui support to console ([3af6680](https://github.com/LerianStudio/helm/commit/3af668074fe67d2c6abf5a9a15dacb906d9200db)) * **midaz:** plugins ui support to console ([8303bad](https://github.com/LerianStudio/helm/commit/8303badc38db540dbbbb60ad0cf6384a3642ca50)) * **midaz:** plugins ui support to console ([d902801](https://github.com/LerianStudio/helm/commit/d90280110322bed7b0b54fd781320c361582ad36)) * postgres replication ([fa57f99](https://github.com/LerianStudio/helm/commit/fa57f99ed9d8dc8a157b776c65a02beb6f3453b4)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **plugin-br-pix-switch:** providersIngress for outbound-provider adapters (1.1.0-beta.8) ([061f8b9](https://github.com/LerianStudio/helm/commit/061f8b9ed0bc9ac7d94629980121a32022edc020)) * **plugin-br-pix-switch:** refactor chart to multi-component (1.1.0-beta.2) ([ea1ff08](https://github.com/LerianStudio/helm/commit/ea1ff08c41a4c3f6d94715977f9792d307d9ee1d)) * refactor plugin fees templates folder ([af27cba](https://github.com/LerianStudio/helm/commit/af27cbaaf3255ca7b4bb62acd7cbdc221b3ab2bb)) * **midaz:** remove console service and nginx components ([68be4ac](https://github.com/LerianStudio/helm/commit/68be4aca05f97e0a3bcdf35058dfccf8ee8e192a)) * **doc:** remove old components ([954dd09](https://github.com/LerianStudio/helm/commit/954dd097b1be74841efa6022a94d807e228c6ec4)) * **github:** remove pgbouncer reference ([49924e8](https://github.com/LerianStudio/helm/commit/49924e811d918e8ed136e878bb480da51096d98a)) * **pipe:** remove step commit history ([b0fd599](https://github.com/LerianStudio/helm/commit/b0fd5993ef1eecb84d34759552871d9f1447b7a3)) * **pipe:** remove step commit history ([e42b665](https://github.com/LerianStudio/helm/commit/e42b665d1bda4e9461e08b855e120fcb596c6521)) * **pipe:** remove step commit history ([ed1ec98](https://github.com/LerianStudio/helm/commit/ed1ec98c8132bd84ee4c344cd70ac9da355bf9af)) * **pipe:** remove step commit history ([b8b256d](https://github.com/LerianStudio/helm/commit/b8b256d997e838caea71ced0ed190e24aa73896a)) * **pipe:** remove step commit history ([a56f7c6](https://github.com/LerianStudio/helm/commit/a56f7c6027fe4e5c90f08231b2cab83e1dc4cc30)) * **pipe:** remove step commit history ([323b43a](https://github.com/LerianStudio/helm/commit/323b43aa1b8b73d103cdaba3b692d2bde73ff772)) * rename Smart Templates to Reporter and enhance RabbitMQ config ([1b1c269](https://github.com/LerianStudio/helm/commit/1b1c269a3e43625c48535e7d759dff9fb5b159f8)) * **plugins:** restructur plugins with frontend add support for external secrets and create guide to upgrade ([ea4a669](https://github.com/LerianStudio/helm/commit/ea4a66964a13c4331f7cdd4ade710fe29177a23f)) * **plugin-br-pix-switch:** schema migration Jobs (1.1.0-beta.9) ([8e88410](https://github.com/LerianStudio/helm/commit/8e884103cf1e251711f442cec4055d703626d561)), closes [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) * **plugin-br-pix-switch:** shared multi-path ingresses (1.2.0-beta.1) ([78c74f4](https://github.com/LerianStudio/helm/commit/78c74f4ef0129663ce13ae4e2155927b02140468)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **reporter:** support external KEDA operator ([0f19cbe](https://github.com/LerianStudio/helm/commit/0f19cbecb1208201f6413921a6726e89616a09b1)) * support external secrets for RabbitMQ admin credentials in Helm chart ([76fa832](https://github.com/LerianStudio/helm/commit/76fa832de626e9ad6c8d44fb366c75cdd900f55d)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](https://github.com/LerianStudio/helm/commit/86eb65124a2e4c5a5590908fe5b6365c825215e8)) * **tracer:** template ENV_NAME in configmap ([50a6f50](https://github.com/LerianStudio/helm/commit/50a6f501b24164485475f64529514293e1e83211)) * transaction bump version ([84028fb](https://github.com/LerianStudio/helm/commit/84028fb3c2be79e976ac9bea48707696db4f40c4)) * transaction rabbitmq protocol variable ([27e075c](https://github.com/LerianStudio/helm/commit/27e075c1b2762d6648ed26c666491c6c039dd0ae)) * transaction rabbitmq protocol variable ([f0f8334](https://github.com/LerianStudio/helm/commit/f0f8334ff61cbcdad9b434e08547dab328fbf2fa)) * transaction rabbitmq protocol variable ([60ff71f](https://github.com/LerianStudio/helm/commit/60ff71f7b07e90ecfdb8c55895225682b25c2694)) * transaction rabbitmq protocol variable ([7fdc26c](https://github.com/LerianStudio/helm/commit/7fdc26c4bcdf7a7ebffe8bc5aaa662964c9a7605)) * **chart:** update app version ([348b0cc](https://github.com/LerianStudio/helm/commit/348b0ccb5fea5042fe08da2af81cbd0b323a7aca)) * **chart:** update app version ([6f40285](https://github.com/LerianStudio/helm/commit/6f402851add6d9898c04e263d5706644645cacb2)) * **helm:** update app version ([fb2f841](https://github.com/LerianStudio/helm/commit/fb2f84162e5951495e2ab12296f6855edb09fce7)) * **midaz:** update app version ([e18a30b](https://github.com/LerianStudio/helm/commit/e18a30b59c5f33cb462d6ac4bdd8c675097f2d9d)) * **values:** update app version ([598ed6d](https://github.com/LerianStudio/helm/commit/598ed6d478240d26ee9baa9560d73db1912ba05d)) * **values:** update apps version and add backend config ([7cb17c2](https://github.com/LerianStudio/helm/commit/7cb17c2225d0863ee655b6ea5fc5532421ffa93d)) * **dependencies:** update auth backend init file ([be72215](https://github.com/LerianStudio/helm/commit/be72215937655d4adb136ae9802d68ade6a279b9)) * **chart:** update auth backend templates ([8659b67](https://github.com/LerianStudio/helm/commit/8659b6758e533c9a0922d481107ba59656d3f0a5)) * **chart:** update auth templates ([a6221e4](https://github.com/LerianStudio/helm/commit/a6221e4b89edec63f40b80bd31574588d9204a5b)) * **chart:** update auth templates ([c5bcb23](https://github.com/LerianStudio/helm/commit/c5bcb23959466580106b98f7e3312195f7f42f35)) * **values:** update auth version ([b549735](https://github.com/LerianStudio/helm/commit/b54973599235c3f52058e68dcd499c8c21c8dac7)) * **doc:** update charts documentation ([422e771](https://github.com/LerianStudio/helm/commit/422e7717a8f7c79d96f4cdd110421f0c68857d82)) * **doc:** update charts documentation ([b9618c4](https://github.com/LerianStudio/helm/commit/b9618c462cf3f0ad6b3f237347ffae01fc23cb09)) * **midaz:** update console configmap ([bf616a3](https://github.com/LerianStudio/helm/commit/bf616a3ee69f10ab2ffa21fce05ed92a21d10c6e)) * **console:** update console image ([0cf1135](https://github.com/LerianStudio/helm/commit/0cf11350d345410c751d99cf8c5347793219b469)) * **console:** update console image ([4da311d](https://github.com/LerianStudio/helm/commit/4da311d8968411a29d129ef02e133b3ddd0bb25e)) * **console:** update console version ([d789c7d](https://github.com/LerianStudio/helm/commit/d789c7dc7596e65c90c0e18072687b2ea828b295)) * **values:** update console version ([778eea0](https://github.com/LerianStudio/helm/commit/778eea0d86f62b9257f4f94892ef2b340df945da)) * **values:** update extra env vars for postgres ([9852143](https://github.com/LerianStudio/helm/commit/9852143eff1ca1bbc3e6c33660d80ec4bb337d6d)) * **fetcher:** update fetcher-manager@1.1.0, fetcher-worker@1.1.0 - new env vars ([345798a](https://github.com/LerianStudio/helm/commit/345798aca7179ec1b36958b22b4f702fe772ce9a)) * **fetcher:** update fetcher-manager@1.2.0, fetcher-worker@1.2.0 - new env vars ([47785ab](https://github.com/LerianStudio/helm/commit/47785abc7269481a7b2365b49589b5bd614d0f41)) * **fetcher:** update fetcher-manager@1.3.0, fetcher-worker@1.3.0 - new env vars ([679fd73](https://github.com/LerianStudio/helm/commit/679fd73b41b0019aa0c75c782adae169826f1053)) * **pipe:** update gitignore ([6ae09d6](https://github.com/LerianStudio/helm/commit/6ae09d68f21e21e5b93834017c0525511baaf94a)) * **chart:** update identity templates ([f8def52](https://github.com/LerianStudio/helm/commit/f8def529a453cf4c2db448df07ba167ff14d6c83)) * **values:** update identity version ([f8ee875](https://github.com/LerianStudio/helm/commit/f8ee875bb51ac52300d683e366f976aa903077b2)) * **product-console:** update image tag to 1.5.0 and add upgrade guide ([a289f8c](https://github.com/LerianStudio/helm/commit/a289f8c27b440f30174dac68339fe50d83d27679)) * **values:** update midaz version ([#36](https://github.com/LerianStudio/helm/issues/36)) ([af4b898](https://github.com/LerianStudio/helm/commit/af4b898e7ed4e431ab853320a3275b9d219630f7)) * **migrations:** update migration logic and enable migrations job ([643f703](https://github.com/LerianStudio/helm/commit/643f703aed35990cb8997a2df90f1fe2bacf9494)) * **midaz:** update onboarding configmap ([7a28f50](https://github.com/LerianStudio/helm/commit/7a28f50d694f2b527d51d201205d486ce8b2d3d5)) * **midaz:** update otel env var ([769a770](https://github.com/LerianStudio/helm/commit/769a77004aebb612aed5d81b9dec30624a003734)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.10, job@1.2.1-beta.10 - new env vars ([63ae72c](https://github.com/LerianStudio/helm/commit/63ae72c6add50c9e0fbeff1567bb018afe3ef553)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.11, job@1.2.1-beta.11 - new env vars ([3b07e6b](https://github.com/LerianStudio/helm/commit/3b07e6bd9b5c07c865599da7749bff593f593da8)) * **chart:** update plugin access manager values ([e4221eb](https://github.com/LerianStudio/helm/commit/e4221ebc5da46a51c5d71ef0755bba35e3313584)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.0, plugin-br-pix-indirect-btg-worker-inbound@1.5.0, plugin-br-pix-indirect-btg-worker-outbound@1.5.0 - new env vars ([80fe4fc](https://github.com/LerianStudio/helm/commit/80fe4fc55014cf24844c1e1626b213475d5419a3)) * **plugin-fees:** update plugin-fees@3.1.0 - new env vars ([0111ef7](https://github.com/LerianStudio/helm/commit/0111ef72746c78f97321c78b110ffb0e2ac68e61)) * **docs:** update rabbitmq documentation ([cae5467](https://github.com/LerianStudio/helm/commit/cae54677bcf8a2a26949ed341df9caea50cea762)) * **docs:** update readme file ([314da0e](https://github.com/LerianStudio/helm/commit/314da0e538e7534a79cbea9423d2d6b5c08c3a8e)) * **reporter:** update reporter-manager@1.2.0, reporter-worker@1.2.0 - new env vars ([624ec97](https://github.com/LerianStudio/helm/commit/624ec978ef73810b568c9a8a578d4f8635f998d2)) * **values:** update resources limits ([04ccb18](https://github.com/LerianStudio/helm/commit/04ccb184cd7393e5c1f60fa5945fd89d0b5289d2)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **midaz:** update transaction configmap ([be52752](https://github.com/LerianStudio/helm/commit/be5275243af5315dc64026f436460f345eb41e78)) * **midaz:** update transaction otel env var ([79717c5](https://github.com/LerianStudio/helm/commit/79717c5815e8c1f5a9e859cea47ef3553fe821df)) * **midaz:** update transaction otel env var ([927f39e](https://github.com/LerianStudio/helm/commit/927f39e5ab03e15460d28769bacb9fe1ac43d0ed)) * **plugin-crm:** update ui env vars ([9fab16d](https://github.com/LerianStudio/helm/commit/9fab16dbcbc80ccc55c0bc2c32e2d099facb6110)) * **midaz:** update values file ([98e396c](https://github.com/LerianStudio/helm/commit/98e396cb1a366691c8b0a3f32f697086583c99bf)) * **midaz:** update values file ([c0cbef1](https://github.com/LerianStudio/helm/commit/c0cbef16e5225e218a60d25d71496c2085250820)) * **values:** update values file ([db9b3db](https://github.com/LerianStudio/helm/commit/db9b3db3961bea039663a7dba0f548601e3c146b)) * **values:** update values file ([cc698a0](https://github.com/LerianStudio/helm/commit/cc698a0a76b24e97b4ff890605535e9ad128e886)) * **midaz:** update values template ([90f3133](https://github.com/LerianStudio/helm/commit/90f31338d4158ddaeca92ab47417b9ca8e7cf20b)) * **chart:** update version ([40d723d](https://github.com/LerianStudio/helm/commit/40d723d6159d78f2a198cdfa9c7c969d07219289)) * **chart:** update version ([22e2930](https://github.com/LerianStudio/helm/commit/22e2930ce80b8e33926bb6db7a5f70ca6faa4fa5)) * **chart:** update version ([8031ceb](https://github.com/LerianStudio/helm/commit/8031cebf57f599fda19f74224cd17a746bfe1e21)) * **chart:** update version ([a8af389](https://github.com/LerianStudio/helm/commit/a8af389aa9135313e2e534e4fd0af358a3b8fcf2)) * **chart:** update version ([412e782](https://github.com/LerianStudio/helm/commit/412e782cff316594cb5b6ea0410a7c5d66ebf6a1)) * **chart:** update version ([4a42b13](https://github.com/LerianStudio/helm/commit/4a42b1367e2ac41654210610641c44fcb7f8b463)) * upgrade app version to 3.3.0 and add SSL mode configs for database connections ([c9d334f](https://github.com/LerianStudio/helm/commit/c9d334f2354705719d3469d614317d6524fd9987)) * **lerian-notification:** use /migrate binary in migrations Job ([1696dd7](https://github.com/LerianStudio/helm/commit/1696dd7f1af6292d634a1e2a428eb2a69aeb6d86)), closes [LerianStudio/lerian-notification#40](https://github.com/LerianStudio/lerian-notification/issues/40) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) * values template file ([2f7c796](https://github.com/LerianStudio/helm/commit/2f7c79606290492be77d34dfbd6ec76e89334cbb)) * values template file ([54ba721](https://github.com/LerianStudio/helm/commit/54ba721da0981d80e2df95a008d22d0fb0b03fd8)) ### Bug Fixes * **release:** add branch check to release notification job to only run on main branch ([f2f8e02](https://github.com/LerianStudio/helm/commit/f2f8e02c5eacdc9ea06d1b5af6df99a73df589db)) * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **values:** add comments in values ([#43](https://github.com/LerianStudio/helm/issues/43)) ([03a5842](https://github.com/LerianStudio/helm/commit/03a5842787db8dc1b4d954038b36a343ad7180c1)) * **plugin-access-manager:** add configurable DB_SSLMODE for auth PostgreSQL connections ([dd1d626](https://github.com/LerianStudio/helm/commit/dd1d626766129b1459e768732e2f826d3ad96eac)) * **new:** add DEFAULT_MIDAZ_ORGANIZATION_ID to configmap for enhanced multi-tenancy support ([d7b66a0](https://github.com/LerianStudio/helm/commit/d7b66a052d47394096ecdc18809e7c2d4fffeed3)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([33adde3](https://github.com/LerianStudio/helm/commit/33adde3650e26f65c09643ba8b2fd669bd504adc)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([5f8ca7b](https://github.com/LerianStudio/helm/commit/5f8ca7b5abc6ca7c895af8c3ae1055907689c1d3)) * **product-console:** add image annotation for product-console 1.6.0 ([03c927c](https://github.com/LerianStudio/helm/commit/03c927c3029714c435534a4c72ca450bcdccbd08)) * add kindIs guard for backward compat with string image values ([313d9f6](https://github.com/LerianStudio/helm/commit/313d9f6b646cf3b3bb26cc2644063b16806c1847)) * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](https://github.com/LerianStudio/helm/commit/79ef8f5ea3d7bc2626972fcd4621b1e327c08aed)) * **matcher:** add missing env vars for systemplane and multi-tenant ([965da94](https://github.com/LerianStudio/helm/commit/965da94cdddb8c11654625e071e28c7a83193938)) * add missing MONGO_HOST/MONGO_PORT and align MONGODB_DB_NAME ([0725fa2](https://github.com/LerianStudio/helm/commit/0725fa2b26ed516c15ff1b5292b35581ff437de2)) * **midaz:** add missing MONGO_PARAMETERS to CRM configmap ([2bfecc2](https://github.com/LerianStudio/helm/commit/2bfecc220b7646c57b5e47f141cfb6e79469baec)) * add missing space in MIDAZ_CONSOLE_BASE_PATH template expression ([7b9bb67](https://github.com/LerianStudio/helm/commit/7b9bb677785cd1d381d1b8d497ee0a8bdc921c83)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](https://github.com/LerianStudio/helm/commit/d7765b455710ba5009a931493d351f88f735a1ce)) * **product-console:** add MongoDB connection info to NOTES.txt ([b4d6557](https://github.com/LerianStudio/helm/commit/b4d6557b5ccf5a93a70104bc5d5533171bc0147f)) * **product-console:** add mongodb.enabled flag to values-template ([7024d9d](https://github.com/LerianStudio/helm/commit/7024d9d0d47422b362b400b9494cfd440378122a)) * **configmap:** add new configuration options for deployment mode, private upstreams, and reconciliation settings ([f1a475e](https://github.com/LerianStudio/helm/commit/f1a475ea82bed1d9174193e58e271a5a730a5cc1)) * **plugin-access-manager:** add new configuration options for logging, rate limiting, and MFA in configmap.yaml ([d1e83b2](https://github.com/LerianStudio/helm/commit/d1e83b286a91b144bc44788a4fb457c4273b052f)) * **chart:** add new env var to enable auth plugin ([53b8ffb](https://github.com/LerianStudio/helm/commit/53b8ffb5ef5beaf77756b45e815b946b106c9320)) * add newline at end of values.yaml file ([044905f](https://github.com/LerianStudio/helm/commit/044905f48ff2d9fe8bd7f84770f34bebd700baf9)) * add plugin-br-bank-transfer-jd section to README version matrix ([ccd19ac](https://github.com/LerianStudio/helm/commit/ccd19acf8352c2e4a1390af297c61f0d63d7ae1e)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](https://github.com/LerianStudio/helm/commit/7ba4f9d8fede36092d0a7a60f08620f5ca3fd777)), closes [#1404](https://github.com/LerianStudio/helm/issues/1404) * **fetcher:** add RabbitMQ and storage configuration options, remove unused secret template ([865613d](https://github.com/LerianStudio/helm/commit/865613d1cf6264ee5b97e5e85d342e5f36043415)) * **plugin-br-pix-switch:** add RABBITMQ_URI to dict-hub-vsync configmap ([75074ae](https://github.com/LerianStudio/helm/commit/75074ae94521b346e0a0c167a166988d65084497)) * add required validation for Roles Anywhere ARNs and README migration note ([50e4718](https://github.com/LerianStudio/helm/commit/50e47186dee052e541566d65d2362c8fe175e5a5)), closes [#1](https://github.com/LerianStudio/helm/issues/1) [#3](https://github.com/LerianStudio/helm/issues/3) [#1113](https://github.com/LerianStudio/helm/issues/1113) * add trailing slash to default MIDAZ_ONBOARDING_URL in fees configmap ([fe394c5](https://github.com/LerianStudio/helm/commit/fe394c5e4fde1fb3cca5a5c7cc9a3019ac92cd5f)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **plugin-br-pix-indirect-btg:** add WEBHOOK_DEFAULT_URL to outbound configmap ([0dd6d81](https://github.com/LerianStudio/helm/commit/0dd6d81592f19d983e0ddfa75dbaf5e00b8fbd85)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * address CodeRabbit CLI review findings ([974bbb8](https://github.com/LerianStudio/helm/commit/974bbb85bee5549825b25a379042eeeaf3f79ba7)) * **plugin-br-pix-switch:** address CodeRabbit feedback on NOTES, README, configmap, and labeler ([78e4615](https://github.com/LerianStudio/helm/commit/78e4615949c5e9b7dabcc2f497d687deae7ccfe4)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **plugin-br-pix-indirect-btg:** address coderabbit review feedback ([bb664a9](https://github.com/LerianStudio/helm/commit/bb664a9eb52c4e2636397955b7bde365643e34db)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **lerian-notification:** address CodeRabbit review on initial chart ([36c326f](https://github.com/LerianStudio/helm/commit/36c326fe1bbabd80112ef82cab3bb862fa0a18b1)), closes [#1332](https://github.com/LerianStudio/helm/issues/1332) * **product-console:** address CodeRabbit review on NOTES.txt ([e8cf8d7](https://github.com/LerianStudio/helm/commit/e8cf8d7157aedb39c4d58be3d88e6ac4a044391f)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **charts:** address CodeRabbit review on revamp PR [#1470](https://github.com/LerianStudio/helm/issues/1470) ([98288a5](https://github.com/LerianStudio/helm/commit/98288a5c6b09efe520675e9c4d605ddb4e8d71f0)), closes [#1](https://github.com/LerianStudio/helm/issues/1) * address CodeRabbit security and quality issues ([eb80852](https://github.com/LerianStudio/helm/commit/eb80852c7012443feebb00cb5d3cb1e6a2a80c2c)) * address remaining CodeRabbit review comments ([6f26a8b](https://github.com/LerianStudio/helm/commit/6f26a8b44643d9eaaa3957d1892f0f763d9da3c3)) * **pix-btg:** adjust default url ([51c4753](https://github.com/LerianStudio/helm/commit/51c4753e916e653ae44829792c8b47a9fc625efd)) * **midaz:** adjust ledger component port from 3000 to 3002 ([8e01518](https://github.com/LerianStudio/helm/commit/8e015184256566ca18c2973067fb8d48e8332fb5)) * **midaz:** adjust ledger component port from 3000 to 3002 ([bb58334](https://github.com/LerianStudio/helm/commit/bb583344a4ba4b59f114355eef6c4339b6d4b102)) * **midaz:** adjust midaz-crm repository image ([5f9fdcb](https://github.com/LerianStudio/helm/commit/5f9fdcb9733aa2b6d620a8d5b61ca7fc54036265)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **tracer:** align chart default port with source convention (2.0.0-beta.6) ([0f8683d](https://github.com/LerianStudio/helm/commit/0f8683dfacda22346b632511a0bfa92b4119f550)), closes [#193](https://github.com/LerianStudio/helm/issues/193) * **flowker:** align chart default port with source convention (2.1.0-beta.6) ([662ad6e](https://github.com/LerianStudio/helm/commit/662ad6e4a39aef852901dd2e1c861018e89fdfaa)), closes [#1308](https://github.com/LerianStudio/helm/issues/1308) * **underwriter:** align chart with app config + standardize VERSION ([9d9a875](https://github.com/LerianStudio/helm/commit/9d9a875ce000cd6136c36fd22967c24c743dbd3a)) * align comment with actual template keys per CodeRabbit review ([338e19c](https://github.com/LerianStudio/helm/commit/338e19ccf967d764ef4165818b585b4698d8e8a5)) * **matcher:** align default securityContext with distroless nonroot UID ([87f0c59](https://github.com/LerianStudio/helm/commit/87f0c59675607d596145d2caa99f96dfd09f1e35)) * **flowker:** align Mongo env vars with app source code ([fdeb22c](https://github.com/LerianStudio/helm/commit/fdeb22c6d2b98425b2c9fae436d4eb81d871eec3)) * align NextAuth URLs with reporter UI base URL ([8d5f4f7](https://github.com/LerianStudio/helm/commit/8d5f4f7e6a671872f6d8e3b95f60b119f89416e0)) * **matcher:** align OTEL env vars with app and bump to v1.0.0-beta.3 ([d1616fb](https://github.com/LerianStudio/helm/commit/d1616fb09bd3e80cce2bbd3e91930771f985ff75)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](https://github.com/LerianStudio/helm/commit/75ad0d4a418787d0d3e85ef8311ee822202e1a2e)) * always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image.tag ([56bfc66](https://github.com/LerianStudio/helm/commit/56bfc666dd2c8d8d83802f026f4ec6436bda8dc4)) * **plugin-br-pix-switch:** apply container securityContext, fix tolerations type, add NOTES defaults ([86b7f17](https://github.com/LerianStudio/helm/commit/86b7f1789c06a09a46d32f9cc2fddcbd560fa25d)) * **onboarding:** auth endpoint and remove old env var ([de370da](https://github.com/LerianStudio/helm/commit/de370daa57563a194d5273888587f0aa95262a0b)) * **transaction:** auth endpoint ([12d8f6d](https://github.com/LerianStudio/helm/commit/12d8f6d3c9d52bff108f220f297d0d4f1db6ca78)) * **values:** auth env vars ([23b34a1](https://github.com/LerianStudio/helm/commit/23b34a13ea547a1587d71689b30adfe02f580dc0)) * **plugin-br-pix-switch:** bootstrap Job fixes surfaced by live install test ([fc9e125](https://github.com/LerianStudio/helm/commit/fc9e12530d40da9dfc6cec51ba2afbd0e66bf9f0)) * bump chart and console versions to 4.4.3 and 3.4.3 ([1cb77cc](https://github.com/LerianStudio/helm/commit/1cb77cc00932d6302e3a71f9bd08253d85f2c3d0)) * **console:** bump image tag to 2.2.1 ([9dfde6e](https://github.com/LerianStudio/helm/commit/9dfde6ee7deb61ef67376dd84d3396845f88fe9f)) * bump plugin-fees chart to version 3.4.4 ([8aaed46](https://github.com/LerianStudio/helm/commit/8aaed46539f10d3879eb7563c1cfa63841d6ddb2)) * change Helm hooks from post-install to pre-install for Postgres and RabbitMQ initialization ([374ccbb](https://github.com/LerianStudio/helm/commit/374ccbb36160f5a614271f65c0a55cf79be568f1)) * chart ([81f1126](https://github.com/LerianStudio/helm/commit/81f112612a3327fffc69da8720b2222122df44a4)) * chart ([f6e6446](https://github.com/LerianStudio/helm/commit/f6e644662db2f641b0e71e3cccd518fa4fe715dc)) * chart app version ([4ae59b0](https://github.com/LerianStudio/helm/commit/4ae59b08085f19e6a20617782e5a3b28044c01f6)) * **tracer:** chart cleanup for 2.0.0-beta.5 ([b8767d5](https://github.com/LerianStudio/helm/commit/b8767d5853b9108a751590468dea17400815f906)) * chart name ([78ae357](https://github.com/LerianStudio/helm/commit/78ae357d208a2835174345b9179c596cf50a401b)) * chart name ([6db8350](https://github.com/LerianStudio/helm/commit/6db83502f0f75b59a5345c27eeade292b31078a9)) * chart name ([1f78da5](https://github.com/LerianStudio/helm/commit/1f78da504538d1a518f503e69b21b1696a893313)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * clean dead OTEL defaults and fix SWAGGER_HOST service names ([76909b8](https://github.com/LerianStudio/helm/commit/76909b801a697be8c28fb345d1f9de611be88bee)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](https://github.com/LerianStudio/helm/commit/5ff9c1d027c1079a972ea550e63d1417b8e3c34d)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * codeowners groups ([#23](https://github.com/LerianStudio/helm/issues/23)) ([b51ff0c](https://github.com/LerianStudio/helm/commit/b51ff0ce5f7d838c2f01565340d91a79cd9c772f)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](https://github.com/LerianStudio/helm/commit/fcaa3b46bf7c06be7c94b7d21bf61b728265bd9d)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](https://github.com/LerianStudio/helm/commit/14924af14cbb6299471ff1d52c0e3591892f13a6)), closes [#1470](https://github.com/LerianStudio/helm/issues/1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](https://github.com/LerianStudio/helm/commit/a3946586aa847615a7082a2c4583646926d53792)) * complete standardization of VERSION across all remaining charts ([63adbb9](https://github.com/LerianStudio/helm/commit/63adbb959f5ea18a22219d7f78d6422f4e9ffb38)) * **plugin-access-manager:** construct dataSourceName at runtime with environment variables ([ac4fd9f](https://github.com/LerianStudio/helm/commit/ac4fd9f94212fed2adbc7d5c6b17e9ad10e3b9cd)) * **plugin-br-pix-switch:** correct appVersion to 1.0.0-beta.1 and add to compatibility matrix ([85bd001](https://github.com/LerianStudio/helm/commit/85bd0015bd9aa7e1def72ed14f981e3a8d080c19)) * **bank-transfer:** correct encryption key env var names ([fb79deb](https://github.com/LerianStudio/helm/commit/fb79deb833c798f68b75e075f8cf6aa2146ad523)) * **flowker:** correct livenessProbe default path from /health/live to /health ([f588107](https://github.com/LerianStudio/helm/commit/f588107a6a543361ceb00d798c9479d1ad37cec3)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **midaz:** correct RabbitMQ bootstrap secret key reference from RABBITMQ_TRANSACTION_PASS to RABBITMQ_DEFAULT_PASS ([f86aa98](https://github.com/LerianStudio/helm/commit/f86aa9826b425861d1614f01ffacb8f68726975f)) * correct RabbitMQ configuration path in transaction service ([eab6df2](https://github.com/LerianStudio/helm/commit/eab6df2eb2793166f7dc2a3455e562a399dcb096)) * **plugin-access-manager:** correct REDIS_PASSWORD reference in identity secrets ([2c6c323](https://github.com/LerianStudio/helm/commit/2c6c323da55401c0323e3023eb9f6958089bbe5e)) * **plugin-access-manager:** correct REDIS_PORT reference from au to identity in configmap ([aafd65a](https://github.com/LerianStudio/helm/commit/aafd65aebbe2b4d27724a02e969701a3a408621a)) * **fetcher:** correct repository URL in Chart.yaml home field ([378a458](https://github.com/LerianStudio/helm/commit/378a458596b151f37393f4292ef8badf88fc57b5)) * crm ui port ([35f387b](https://github.com/LerianStudio/helm/commit/35f387b6037c85963dc793229e6975ca5addc65c)) * **lerian-notification:** declare kubeVersion compatibility ([fd3067e](https://github.com/LerianStudio/helm/commit/fd3067e0a78ac2d207dc1c64f19f7fad5cdca8cc)) * **product-console:** derive MongoDB service name dynamically in NOTES.txt ([4bbf749](https://github.com/LerianStudio/helm/commit/4bbf749465bf0cbf6112ed3cc32653a0d3972480)) * **auth:** disable auth ingress ([4e08d7a](https://github.com/LerianStudio/helm/commit/4e08d7af33f67b9500b459a40ad93473cf82007f)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](https://github.com/LerianStudio/helm/commit/a38dca3beda61b5ad6a4b56c4712dc63ea3e1555)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](https://github.com/LerianStudio/helm/commit/734a38a07fdb6d694b373b52097502dd0aaae440)) * **midaz:** enable external service bootstrap jobs by default for RabbitMQ and PostgreSQL ([f65f8ff](https://github.com/LerianStudio/helm/commit/f65f8ff4f669f99d0eb55f32826dfb7e2891695d)) * **plugin-access-manager:** enable extra env vars to auth configmap template ([1be8107](https://github.com/LerianStudio/helm/commit/1be8107a59d8f0c5e9a12ceb4b70829dbc90b858)) * **plugin-access-manager:** enable extra env vars to auth ([a085323](https://github.com/LerianStudio/helm/commit/a085323623b5df8283e7583b9f03fefeb3202260)) * **plugin-access-manager:** enable extra env vars to identity configmap template ([01f1efe](https://github.com/LerianStudio/helm/commit/01f1efe5c64a1c8237722d1da80ee322e8e27067)) * **plugin-access-manager:** enable extra env vars to identity ([356b815](https://github.com/LerianStudio/helm/commit/356b8157cdcc1a503aa514f077142283e8ea9b21)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** fail loud on missing infra creds ([5bfc010](https://github.com/LerianStudio/helm/commit/5bfc01046118dc1df300b9c4640186c99a304bf8)) * fix ([8e3d5ad](https://github.com/LerianStudio/helm/commit/8e3d5ad6deff4dc6a84d7f0c343d5e605428686f)) * fix ([3ff9f64](https://github.com/LerianStudio/helm/commit/3ff9f645ed8119d28a4dc256848d27206a4d80ce)) * **audit:** fix audit configmap ([#41](https://github.com/LerianStudio/helm/issues/41)) ([429fdef](https://github.com/LerianStudio/helm/commit/429fdef691c87dc5b4a7e44c236b2550f548c20d)) * **values:** fix autoscaling parameters ([69585b6](https://github.com/LerianStudio/helm/commit/69585b6743736edad8d393c5e50eddc9e4ff114d)) * **matcher:** fix configmap archival condition and S3 endpoint for IAM Roles Anywhere ([53232ae](https://github.com/LerianStudio/helm/commit/53232ae6aec2f6fd8b1a4dba74edad8bf261056f)) * **transaction:** fix default value of rabbitmq secret ([71afd7a](https://github.com/LerianStudio/helm/commit/71afd7a7067ee4b1cf429669e4a44c58479af037)) * **doc:** fix midaz transaction container port ([bab48e6](https://github.com/LerianStudio/helm/commit/bab48e600b179abf07bbc207982803102ea1d704)) * **pipe:** fix pr title workflow ([#34](https://github.com/LerianStudio/helm/issues/34)) ([5134118](https://github.com/LerianStudio/helm/commit/51341186dfd7f643e3be1d598c51d3909748a3dd)) * **midaz:** fix rabbitmq job to apply default definition ([a1349ff](https://github.com/LerianStudio/helm/commit/a1349ff2891e3368d21d9b077fab46c448685356)) * **chart:** fix set secret ref to console deployment ([34b4885](https://github.com/LerianStudio/helm/commit/34b488597985e744a4108eda086a9e14eddac702)) * **transaction:** fix transaction container port ([cb4ec59](https://github.com/LerianStudio/helm/commit/cb4ec592c2c47036bee2b519d795ca08336904dc)) * **midaz:** fix transaction deployment template ([c269284](https://github.com/LerianStudio/helm/commit/c2692846f8f3a30f73c41da792ebf47595e067b1)) * **chart:** fix typo in environment variable name ([2f57d53](https://github.com/LerianStudio/helm/commit/2f57d53b1b47b8ef0829729a37d819949efd03c4)) * **plugin-br-pix-indirect-btg:** fix useExistingSecrets typo in all deployments ([fa2dc49](https://github.com/LerianStudio/helm/commit/fa2dc4964c8080f0825471be4a1a2a3889fa7833)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](https://github.com/LerianStudio/helm/commit/9ae56b40a5b127510b82256975682648e06bbaea)) * generate multiples CHANGELOG's ([3f60787](https://github.com/LerianStudio/helm/commit/3f607875b618db474e4055c44a2cffd8216f4261)) * **lerian-notification:** handle explicit maxUnavailable: null in PDB ([03ee596](https://github.com/LerianStudio/helm/commit/03ee596ecdba8da4e6727236b2785c2d14c0c1c5)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](https://github.com/LerianStudio/helm/issues/1467)) ([7c62a98](https://github.com/LerianStudio/helm/commit/7c62a98cabe072e32a717169317018a2af334e5c)) * helm chart ([9b6552f](https://github.com/LerianStudio/helm/commit/9b6552f37d039bb5187c92319bcc3787d1c4ddcc)) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **plugin-br-pix-indirect-btg:** improve reconciliation config and remove vault annotations ([ad64484](https://github.com/LerianStudio/helm/commit/ad64484db87788071ff7ade533a04754eed58347)) * **components:** init file for auth app ([4939e82](https://github.com/LerianStudio/helm/commit/4939e823f60cdbc0965281f496b058178bf70a00)) * job to apply rabbitmq definitions ([b959644](https://github.com/LerianStudio/helm/commit/b959644941d2f137fd6d766ff3cb6c022ac3354d)) * **plugin-br-pix-switch:** leave adapter-btg-mock ingress untouched ([7a1c827](https://github.com/LerianStudio/helm/commit/7a1c827984df9e31a819f18e05cb5de77aa32457)) * **plugin-br-pix-switch:** liveness probe path /live -> /health ([030af5f](https://github.com/LerianStudio/helm/commit/030af5fd92687e5980a6f2e3357493f037e56496)) * **components:** load definitions for rabbitmq ([167c80a](https://github.com/LerianStudio/helm/commit/167c80a8e156fb653e2e365f155c4c35e2785fca)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](https://github.com/LerianStudio/helm/issues/1465)) ([a39f2c6](https://github.com/LerianStudio/helm/commit/a39f2c652365001992fa259b8d7932f45d65ed8a)) * **plugin-br-pix-switch:** match probe template fallbacks to per-component routePrefix ([ee914d7](https://github.com/LerianStudio/helm/commit/ee914d78ef23df3d368a4465eef80f8641c21730)) * **midaz:** midaz console configmap ([5d8428c](https://github.com/LerianStudio/helm/commit/5d8428ce7fa7fd2678b18b1146bcadbb2fc4ced7)) * midaz nginx proxy config ([46d3af2](https://github.com/LerianStudio/helm/commit/46d3af2330ae02cf7298efc8275cf6e4ee309685)) * move MONGO_URI to secrets and support JD sandbox mode ([6d41468](https://github.com/LerianStudio/helm/commit/6d41468e7e14de2a61f99b90769b7b7643208d0d)) * **plugin-br-pix-switch:** namespace handling + global image tag override ([0fd1ef6](https://github.com/LerianStudio/helm/commit/0fd1ef681a03fabd2937ed48477ad9469ab95c70)) * **midaz:** nginx server definition ([b63b23a](https://github.com/LerianStudio/helm/commit/b63b23a5bf3292d2a36e8872bd3e3a3c257152c5)) * **midaz:** nginx server definition ([d4f18da](https://github.com/LerianStudio/helm/commit/d4f18dadfda3b4446df5cc5f094784decc247f9d)) * **midaz:** nginx server definitions ([9863437](https://github.com/LerianStudio/helm/commit/9863437a6a3d925edcf547ae801389cb9954c145)) * onboarding adjust default value of env var ([d274067](https://github.com/LerianStudio/helm/commit/d274067915c39400b9f920ef6af93f02bbc7d9d9)) * onboarding init container ([46284e5](https://github.com/LerianStudio/helm/commit/46284e5bee1bf07269aeac457c7f7dad74b848b6)) * **lerian-notification:** order SA/ConfigMap/Secret before migrations Job ([23069fc](https://github.com/LerianStudio/helm/commit/23069fcc638795bdc02bc093c770f9cafb0ea135)) * **product-console:** parametrize probes that were missed in initial commit ([5be4277](https://github.com/LerianStudio/helm/commit/5be4277d671dd74af3fbe64dc7bd95295272d50a)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **reporter:** prevent null env in manager and worker deployments ([51a72c6](https://github.com/LerianStudio/helm/commit/51a72c640b78716a69f2ddee05e5a5be3e1125cd)) * **reporter:** prevent null env in ScaledJob when no env vars are configured ([7fa29b4](https://github.com/LerianStudio/helm/commit/7fa29b47d0859aaae3097af6b33b4585412b230c)) * **plugin-br-pix-switch:** probe paths follow per-component routePrefix ([d6e5264](https://github.com/LerianStudio/helm/commit/d6e5264d2fca1a64ac207978e90ab1a1b2cbde75)), closes [#135](https://github.com/LerianStudio/helm/issues/135) * **plugin-br-pix-switch:** providers ingress default path /mock-btg -> /btg-mock ([b6df396](https://github.com/LerianStudio/helm/commit/b6df396a0984f06c6c3774c0d89bf48bdfd20ac3)) * **docs:** rabbitmq mispelling name ([cefee91](https://github.com/LerianStudio/helm/commit/cefee916b39020938945ce97f442dbdbf3ba6d63)) * **onboarding:** rabbitmq mispelling name ([bf8de0c](https://github.com/LerianStudio/helm/commit/bf8de0cf79e4a40a3fa0bb7581a7f11b9458de76)) * **transaction:** rabbitmq mispelling name ([8e05032](https://github.com/LerianStudio/helm/commit/8e050329da399b563d2ce6f5fa70edcf2291cccd)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** remove common secret to match reporter pattern ([37050a0](https://github.com/LerianStudio/helm/commit/37050a0834a3fc70676e00e3b5dd4018f9e0ec02)) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * remove duplicate reporter-manager/secret.yaml with incorrect template references ([e8cc8b6](https://github.com/LerianStudio/helm/commit/e8cc8b6e63e587a9c5fc7c45284c1482ec766564)) * remove empty variable ([48052b2](https://github.com/LerianStudio/helm/commit/48052b2c411e6d882c5c7067f19b4364cdb363e6)) * **release:** remove generate_changelog dependency from back-merge step ([40dfa39](https://github.com/LerianStudio/helm/commit/40dfa390347ce04d88ae8bf22dde9dcc824f93b2)) * **onboarding:** remove grpc port from container ([3bd9621](https://github.com/LerianStudio/helm/commit/3bd96218a95decae1c58cc29078c8bbfd71736a9)) * **midaz:** remove hardcoded localhost URLs from console configmap ([75ab6e8](https://github.com/LerianStudio/helm/commit/75ab6e87a0271f08e48f496b8b753b0f1721d843)) * remove hardcoded namespaceOverride to use release namespace ([f650315](https://github.com/LerianStudio/helm/commit/f650315e2ca1849da559dffb51fd0f01f5669167)) * remove hook ([aa92d78](https://github.com/LerianStudio/helm/commit/aa92d78f74000f6f4f2c7fc22db35cc0010916ca)) * remove hotfix branch from release config ([11d0188](https://github.com/LerianStudio/helm/commit/11d018800fe55cbfc1cc840974248b8c85b5fb0b)) * **plugin-access-manager:** remove imagePullSecrets from values.yaml for identity and auth sections ([238ca51](https://github.com/LerianStudio/helm/commit/238ca519ce930eb2b4431abfd6a0fd69f1efda27)) * **product-console:** remove inconsistent artifacthub image annotation ([77e46c4](https://github.com/LerianStudio/helm/commit/77e46c4b36f2ebf51e7da2d6d6864b3b0d244733)) * **plugin-fees:** remove MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC from configmap ([f3e7f9b](https://github.com/LerianStudio/helm/commit/f3e7f9bae9113bba8d11602afcbd4048778b892a)) * **onboarding:** remove old secrets ([0c7966f](https://github.com/LerianStudio/helm/commit/0c7966f91207c688b0e014bab463dac40846f56e)) * **trasaction:** remove old secrets ([1a2a10c](https://github.com/LerianStudio/helm/commit/1a2a10c9a165c0767f45b7909276c287d5c4d3a3)) * remove RabbitMQ health check from onboarding deployment ([181179e](https://github.com/LerianStudio/helm/commit/181179e4dea9faea9717eb0eafc946f86d6a1192)) * **plugin-br-pix-indirect-btg:** remove trailing newline from values.yaml ([938bf17](https://github.com/LerianStudio/helm/commit/938bf17d10d468c257d83fa4e2a46778deb071aa)) * **plugin-br-bank-transfer:** rename chart to include -helm suffix ([f393e35](https://github.com/LerianStudio/helm/commit/f393e35ec6b5ad070ccc24214771b3c2cfd81fb0)) * **audit:** rename env vars and update container port ([9796046](https://github.com/LerianStudio/helm/commit/979604649c30ce6b8788acb3c1f67dff1a765f63)) * **transaction:** rename env vars and update container port ([4052bc5](https://github.com/LerianStudio/helm/commit/4052bc51634b989fba34c2245319db767aa02275)) * **chart:** rename ledger component to onboarding ([47dd9d0](https://github.com/LerianStudio/helm/commit/47dd9d01c491f30669c3f4ec6271bae1c8d0de75)) * **chart:** rename ledger component to onboarding ([e04404b](https://github.com/LerianStudio/helm/commit/e04404b79c78396a6cb1227cafa5bad10b51d3ee)) * **doc:** rename ledger component to onboarding ([0aa6e34](https://github.com/LerianStudio/helm/commit/0aa6e34ed38d68308cec31b5280b17c017c3d277)) * **components:** rename ledger db for onboarding ([40e49b8](https://github.com/LerianStudio/helm/commit/40e49b8cb2dcf6b169ea4a9c32b5c516f0d06b57)) * **pipe:** rename ledger to onboarding ([448ce90](https://github.com/LerianStudio/helm/commit/448ce9015baee8d553a81f6253d77d76bb96c3ba)) * **bank-transfer:** rename MULTI_TENANT_INFRA_ENABLED to MULTI_TENANT_ENABLED for consistency ([0fb14a6](https://github.com/LerianStudio/helm/commit/0fb14a62d9644d039931afe1c5a6f7291bbaafa8)) * **dependencies:** rename otel to grafana ([#57](https://github.com/LerianStudio/helm/issues/57)) ([974c47f](https://github.com/LerianStudio/helm/commit/974c47f6974d42804e5210d530829efa0394d734)) * **tracer:** rename PLUGIN_AUTH_HOST to PLUGIN_AUTH_ADDRESS (2.0.0-beta.4) ([4be1526](https://github.com/LerianStudio/helm/commit/4be1526c4e9f1415e4ef8dec74533ff1a4ac98fa)) * rename PRIVATE_KEY to KEY in qr-code secrets template ([8736d13](https://github.com/LerianStudio/helm/commit/8736d1343048542d33331c97ded6b3aff1cce369)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** resources limits in onboarding and transaction values ([9d788f5](https://github.com/LerianStudio/helm/commit/9d788f5dc9639cb97bf285332c31033fedb0545a)) * **plugin-fees:** revert MIDAZ_TRANSACTION_URL to midaz-transaction default ([0871187](https://github.com/LerianStudio/helm/commit/0871187b0197c5af9439f0cd9f6f1813b68ae4c4)) * rollback midaz version ([e458c1c](https://github.com/LerianStudio/helm/commit/e458c1ccfa01a5f67fb221a3cf33b8cb8054d4b7)) * rollback plugin-access-manager version ([ce2b088](https://github.com/LerianStudio/helm/commit/ce2b08841977784e729d7efeb635c64780072b54)) * **lerian-notification:** self-contain migrations Job; drop hook annotations from SA/ConfigMap/Secret ([068b1e3](https://github.com/LerianStudio/helm/commit/068b1e3fe5ef93f274bf4f219031fc867f43ffc6)) * **plugins:** separate RABBITMQ_HOST from RABBITMQ_URL in bc-correios chart ([#1268](https://github.com/LerianStudio/helm/issues/1268)) ([780aff8](https://github.com/LerianStudio/helm/commit/780aff85155d47316160f60a596dfc7e70b0c6be)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-pix-indirect-btg:** set DB_SSL_MODE default to disable ([29f2348](https://github.com/LerianStudio/helm/commit/29f2348e7c55bb7eafcb6cfddbc013d2ceeae3f7)) * **plugin-br-pix-switch:** set default PLUGIN_AUTH_URL on auth-using components ([f689afc](https://github.com/LerianStudio/helm/commit/f689afcc5173a3a15fd105fd7a4fbb2605b26f71)) * **product-console:** set image tag to 1.3.0 in values.yaml ([a535b88](https://github.com/LerianStudio/helm/commit/a535b885158731c4ef859e5197f3283dcd2c1b60)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](https://github.com/LerianStudio/helm/issues/1405)) ([e0d9084](https://github.com/LerianStudio/helm/commit/e0d908413cf66830d4afa6a53bac3ce8573a10af)) * **plugin-br-pix-indirect-btg:** set REDIS_TLS default to false in reconciliation configmap ([b8dc4d1](https://github.com/LerianStudio/helm/commit/b8dc4d1af0462ae2f12ba9b1542711d0ebdce300)) * setup otel in template ([#24](https://github.com/LerianStudio/helm/issues/24)) ([837fd03](https://github.com/LerianStudio/helm/commit/837fd03c642b14387299b9b4a50fe00dc22e2f29)) * simplify hotfix branch prerelease configuration ([8f61d2d](https://github.com/LerianStudio/helm/commit/8f61d2d31b87a6f4273beab1f73fe64b3fb78cf0)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](https://github.com/LerianStudio/helm/commit/582ea9751785df979371f64e367c4ceb8a2731de)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](https://github.com/LerianStudio/helm/commit/45d152ab94251e5d08eeeba666d0908c2d90c287)) * **plugin-access-manager:** split migrations and initUser image into repository/tag fields ([5be206a](https://github.com/LerianStudio/helm/commit/5be206ad28843d9de908efb7c329e9305070415f)) * **components:** sql init for auth app ([9824943](https://github.com/LerianStudio/helm/commit/9824943ab8a6d2e038cd55448259c27149c50546)) * **midaz:** standardize base URL configuration using MIDAZ_CONSOLE_BASE_PATH as source of truth ([bc4705a](https://github.com/LerianStudio/helm/commit/bc4705aafe9ab36a3c56264099400543202d7412)) * **plugins:** standardize MIDAZ console URL configuration ([b89bb83](https://github.com/LerianStudio/helm/commit/b89bb837974a805cc9b238684e7d8ab7e752eef6)) * standardize VERSION/OTEL_RESOURCE_SERVICE_VERSION in remaining charts ([4172495](https://github.com/LerianStudio/helm/commit/4172495136f2d17d0897c6b4bdbcc081634a372a)) * **plugin-br-pix-switch:** swap envFrom order so Secret overrides ConfigMap (1.1.0-beta.4) ([c1241c0](https://github.com/LerianStudio/helm/commit/c1241c0f9b2839cbf22ef2ecd73a738a54fa9920)) * **new:** sync migrations job and app versions ([d90d1d7](https://github.com/LerianStudio/helm/commit/d90d1d7042bd1b82a4638dd993274539d9aeed42)) * templates ([bc18fc3](https://github.com/LerianStudio/helm/commit/bc18fc3fddd8736d8694f3be401d1a85fc781039)) * transaction adjust default value of env var ([6e807a9](https://github.com/LerianStudio/helm/commit/6e807a9da365d88d023746233992b316ef1696df)) * transaction init container ([3d3492c](https://github.com/LerianStudio/helm/commit/3d3492c9e0c017d7e904fc26e9aeadfdfbe76c8e)) * **midaz:** update app image tag from 2.2.0 to 2.2.1 ([3103f2d](https://github.com/LerianStudio/helm/commit/3103f2d2f97fdc4021e3702efc7e0f5494fd6fe0)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](https://github.com/LerianStudio/helm/commit/944e1ce9b6af49dfcbd3bce0851093cefc4989eb)) * **configmap:** update APPLICATION_NAME default value to crm ([53b65c3](https://github.com/LerianStudio/helm/commit/53b65c3ecc9a07f901832e99efc45fec3bd1d65f)) * **plugin-access-manager:** update appVersion and image tags to 2.6.2 ([ed831fb](https://github.com/LerianStudio/helm/commit/ed831fb2dca1a1f65988b03edc9d4d14bc14e6bf)) * **plugin-access-manager:** update appVersion and image tags to 2.6.3 ([f4d26c0](https://github.com/LerianStudio/helm/commit/f4d26c0378bfb41d6f0be5de46e7be614463529d)) * **product-console:** update appVersion to 1.3.0 ([c708e76](https://github.com/LerianStudio/helm/commit/c708e76df0e532850dd8d5e2472a4b34c72a249c)) * **plugin-access-manager:** update appVersion to 2.6.5 ([db5045a](https://github.com/LerianStudio/helm/commit/db5045a532276e6bd34b4b30682f58e7f2bca567)) * **plugin-bc-correios:** update br-spb-bc-correios@1.2.0 ([f5d8eca](https://github.com/LerianStudio/helm/commit/f5d8eca7c779bf8b941f7a5bfa94fa6db2bba394)) * update casdoor backend images ([ea9e82b](https://github.com/LerianStudio/helm/commit/ea9e82bfce3259bf88fb13b0b39b0a2f6280c7a1)) * update casdoor backend images ([8c1741d](https://github.com/LerianStudio/helm/commit/8c1741dcd6e3c7df86ed6f5f59d07309792754ba)) * **plugin-fees:** update chart version to 5.4.0 and app version to 3.2.0 ([303911d](https://github.com/LerianStudio/helm/commit/303911d1c080482ac5df1440cf50ad58ea26a581)) * **midaz:** update console@3.4.8, onboarding@3.4.8, transaction@3.4.8 and add back-merge workflow ([2400460](https://github.com/LerianStudio/helm/commit/2400460545b915829faf6f5871c4551f6cc51445)) * update default NGINX_BASE_PATH to use correct service name midaz-console-nginx ([ed89e32](https://github.com/LerianStudio/helm/commit/ed89e324691ebe09e742abb5d9d4e56216efdce5)) * update default value to swagger hot env var ([a691862](https://github.com/LerianStudio/helm/commit/a6918621eee89815ab6e074dbd841f5d7d520b3d)) * update default value to swagger hot env var ([25fe35e](https://github.com/LerianStudio/helm/commit/25fe35e5cba187cdebd9a711f6ceee31e6687936)) * **bank-transfer:** update DEFAULT_TENANT_ID to allow empty default value in configmap ([10ea45e](https://github.com/LerianStudio/helm/commit/10ea45e0ff6d8b0023efc0a293db31390566300c)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](https://github.com/LerianStudio/helm/commit/f7aa25b6756bf756a3d7cc3e0f90fba1b85f31df)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **ci:** update Helm setup action to v3.5 in release workflow ([6736085](https://github.com/LerianStudio/helm/commit/673608587a310dece3aeb5fda8fd0d408584c4ad)) * **plugin-access-manager:** update identity@2.1.1, auth@2.4.0 and use image.tag for version fields ([e260dee](https://github.com/LerianStudio/helm/commit/e260deef9bc8bafe34a85755c1532a400aac416a)) * update image repository ([4d9116f](https://github.com/LerianStudio/helm/commit/4d9116fd515d1628be6159dbd0c4512de0720a8c)) * update image repository ([43d0cc0](https://github.com/LerianStudio/helm/commit/43d0cc0cc1559589afae24aa9b568206a9902649)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](https://github.com/LerianStudio/helm/commit/68bcd0ba0581b73f7e41b9edcdfe6aff4d9a56fc)) * **plugin-access-manager:** update image tags and add CORS, rate limiting, multi-tenancy, and circuit breaker configurations ([628ad1d](https://github.com/LerianStudio/helm/commit/628ad1d77b88e3bfde9bcf07d14ae64f0f234603)) * **plugin-access-manager:** update image tags for identity and auth components to latest versions ([08f9a6a](https://github.com/LerianStudio/helm/commit/08f9a6a9216b2db51fe0cbd9a35f97eba037a762)) * **midaz:** update ledger service default port from 3000 to 3002 ([2878908](https://github.com/LerianStudio/helm/commit/28789085b331fe28430cfce77a6a2e7f9bb65b97)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **midaz:** update midaz-crm@3.6.2, midaz-ledger@3.6.2 ([960a392](https://github.com/LerianStudio/helm/commit/960a392f9d63e4576dabcc3ed1008be42063c4b5)) * **midaz:** update midaz-crm@3.6.3, midaz-ledger@3.6.3 ([1cce7ba](https://github.com/LerianStudio/helm/commit/1cce7ba9f7494151eb9f62361d6b07915063210a)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](https://github.com/LerianStudio/helm/commit/3c9bea0fedc48926df8151fa421d4c0a27f07ccb)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](https://github.com/LerianStudio/helm/commit/5ee7f4531e5fe78d61e63142f528f98d220bf131)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](https://github.com/LerianStudio/helm/commit/67021d410f8bd95628dc2e1fda00029e587a6408)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](https://github.com/LerianStudio/helm/commit/4852190a64cc81e28e78f9a27d7978187cd1ac72)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](https://github.com/LerianStudio/helm/commit/5c2edb0ebd628ad373269f290736c0ee56899f3b)) * update mongodb ([858c934](https://github.com/LerianStudio/helm/commit/858c93496a5e45fcb84389614536d63ca6b84a02)) * **console:** update mongodb default port ([fd58b09](https://github.com/LerianStudio/helm/commit/fd58b09788b9f7ccc03937ac5e950060110cedf3)) * update nginx deployment config with correct service account and simplified configmap names ([b1119fd](https://github.com/LerianStudio/helm/commit/b1119fdad81d1d4bbcb2c3aecbe74d56cd0a3136)) * **doc:** update nginx ingress config ([#35](https://github.com/LerianStudio/helm/issues/35)) ([d9763ea](https://github.com/LerianStudio/helm/commit/d9763ea4c2139c7d5f020d71422a634f37e15172)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.7, job@1.2.1-beta.7 ([4010717](https://github.com/LerianStudio/helm/commit/4010717e52a535803550f84faf3092439cb063b7)) * update plugin registration URL to use midaz-console-nginx hostname ([0eaca46](https://github.com/LerianStudio/helm/commit/0eaca4642ff0d7907302ecc7e95c1426378a56a8)) * **plugin-access-manager:** update plugin-auth@2.6.0 ([6b5b3d8](https://github.com/LerianStudio/helm/commit/6b5b3d85f0f2312dd0104b79ab3efb7fa707ec80)) * **plugin-access-manager:** update plugin-auth@2.6.1 ([253b5e8](https://github.com/LerianStudio/helm/commit/253b5e8c6dc6940884d28b3d3064b941e7936742)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](https://github.com/LerianStudio/helm/commit/b5892a37b4b8b67cbcf3bee1bb8557b807e637ce)) * **plugin-br-bank-transfer-jd:** update plugin-br-bank-transfer-jd@1.0.0 ([afcdded](https://github.com/LerianStudio/helm/commit/afcdded551872f8fea45bd5811129d967862fc48)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@2.1.0 ([3e29c6c](https://github.com/LerianStudio/helm/commit/3e29c6cbcda36b88db0140e18d1995e41d711ada)) * update plugin-br-pix-indirect-btg pix OTEL_RESOURCE_SERVICE_VERSION ([4fa8d3f](https://github.com/LerianStudio/helm/commit/4fa8d3fa16f4c4db14a353fee4132f3734177229)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.1 ([4397bc6](https://github.com/LerianStudio/helm/commit/4397bc641c2009520ddfa74db5b07ce560682137)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.3 ([b9a4b68](https://github.com/LerianStudio/helm/commit/b9a4b68daddf3bc7f34ece779be416e297372c46)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.2.0 ([5e4b893](https://github.com/LerianStudio/helm/commit/5e4b89388355b6970ad8a7d381b36c66ab7ef7e4)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.0 ([df6de7b](https://github.com/LerianStudio/helm/commit/df6de7b0c40b062351913790901f48423e5f664a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.2 ([ffb414d](https://github.com/LerianStudio/helm/commit/ffb414d8b71c60108afc8d8ca997616610c88a05)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.1 ([adbe456](https://github.com/LerianStudio/helm/commit/adbe456f10361ac91c79e72b81bd171d9d1a28da)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.2 ([2c2b639](https://github.com/LerianStudio/helm/commit/2c2b639e67f749a6e98452ecb09aab79a327e468)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.3 ([e08d78a](https://github.com/LerianStudio/helm/commit/e08d78a8e4220c78695d51a6764417241f8ff8ea)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.4 ([a42a959](https://github.com/LerianStudio/helm/commit/a42a959fd56639a0805eef3dca75d117cdcb407e)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.6 ([fe3749c](https://github.com/LerianStudio/helm/commit/fe3749cd1cd6dae57a2d156181cab624db53aa76)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.7 ([793be45](https://github.com/LerianStudio/helm/commit/793be450b2ee8fdb9042dca0b275845d4461fff8)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.8 ([55681de](https://github.com/LerianStudio/helm/commit/55681def27a6eaf2655b0cdd03ba1d90956db54a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.3.0 ([35c27d1](https://github.com/LerianStudio/helm/commit/35c27d157a06baf08d0c35587b0ba42fa83e003f)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.4.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.4.1, plugin-br-pix-indirect-btg-worker-inbound@1.4.1, plugin-br-pix-indirect-btg-worker-outbound@1.4.1 ([3c6970f](https://github.com/LerianStudio/helm/commit/3c6970fa684f810608c93c9b5a14762913fa0642)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.1, plugin-br-pix-indirect-btg-worker-inbound@1.5.1, plugin-br-pix-indirect-btg-worker-outbound@1.5.1 ([226f506](https://github.com/LerianStudio/helm/commit/226f506964e0b271d4f61ec451a52121371096a3)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.2, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.2, plugin-br-pix-indirect-btg-worker-inbound@1.5.2, plugin-br-pix-indirect-btg-worker-outbound@1.5.2 ([6dbb46c](https://github.com/LerianStudio/helm/commit/6dbb46cfa97ec25e3a96a7c296452ed5a2a93f38)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](https://github.com/LerianStudio/helm/commit/a3c2b6d91208d9a2def2fffe15f9065d6d12e0c0)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-fees:** update plugin-fees@3.0.7 ([844537d](https://github.com/LerianStudio/helm/commit/844537d1ff6d902a454b6f49bd70e431a1b9055f)) * **plugin-fees:** update plugin-fees@3.0.8 ([8c5579c](https://github.com/LerianStudio/helm/commit/8c5579c72b31b43e4a5389112a9849092e645617)) * **plugin-access-manager:** update plugin-identity@2.4.2 ([8b01a14](https://github.com/LerianStudio/helm/commit/8b01a14b077f8fdbc0dd642c1f09b695f27d8623)) * update rabbitmq authentication format to use value field in helm chart ([9ef3305](https://github.com/LerianStudio/helm/commit/9ef33051275a99abd848ef6b1717a8e613e49f94)) * update rabbitmq authentication username field to user ([07a183a](https://github.com/LerianStudio/helm/commit/07a183a8be746cdef266d09dbfe011b04b5da468)) * **product-console:** update readiness probe path to default to root ([2996200](https://github.com/LerianStudio/helm/commit/29962007e8b4428251289da18ac13c97c46fac02)) * **midaz:** update README with ledger service documentation and remove console/nginx references ([e472f4f](https://github.com/LerianStudio/helm/commit/e472f4f192b3ab73f75e17f0968150dca1394e26)) * update reporter cm ([fcdd63c](https://github.com/LerianStudio/helm/commit/fcdd63c752b873d83618c75093f9709aaaebf353)) * **reporter:** update reporter-manager@1.0.0, reporter-worker@1.0.0 ([d586bf1](https://github.com/LerianStudio/helm/commit/d586bf17c2427509b5bdc6a33797b15d4fd126b5)) * **reporter:** update reporter-manager@1.1.1 ([4f98acf](https://github.com/LerianStudio/helm/commit/4f98acfb798423cf6e82b27b2b9dbe97b44d4351)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **matcher:** update securityContext to run as root ([8de4a13](https://github.com/LerianStudio/helm/commit/8de4a13461263bfdac56c72f5521fa4bb228f5b4)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](https://github.com/LerianStudio/helm/commit/4492c3d629bbe1048e250967572a7b6599a15a68)) * **plugin-br-bank-transfer:** update service port and server address to 4027 in configuration files ([dd4e2a0](https://github.com/LerianStudio/helm/commit/dd4e2a05f1c62f619f3cd45bd4f8a9b01a596546)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * update transaction service DNS name in onboarding config ([b98a488](https://github.com/LerianStudio/helm/commit/b98a488e3b27c077eebd65e3bbffcddac2a313e1)) * **reporter:** update worker default image tag to match latest stable release ([147ed4c](https://github.com/LerianStudio/helm/commit/147ed4c20cb81a955402d3d4361852966a11516e)) * **bootstrap-mongodb:** use /bin/bash instead of /bin/sh for mongosh container ([b956943](https://github.com/LerianStudio/helm/commit/b956943f69f1ecee7e90f3db5f75b37c2827d179)) * use /bin/sh instead of /bin/bash in alpine kubectl container ([24c9fc0](https://github.com/LerianStudio/helm/commit/24c9fc0702fd5252105c7ec2774413647a0b7009)) * **matcher:** use configmap value for OBJECT_STORAGE_ENDPOINT with IAM Roles Anywhere ([c0f19a4](https://github.com/LerianStudio/helm/commit/c0f19a4648595b8784d0d5e7ce3f9991074978ac)) * **midaz:** use dig function for safer nested value access in ledger init container timeout ([86ee67d](https://github.com/LerianStudio/helm/commit/86ee67d4f3bfe9281f5336a68a59cb8175e4e2d4)) * use dynamic service names based on release name ([cc9e734](https://github.com/LerianStudio/helm/commit/cc9e7345d452a7ba32263269c8e974a7856c5544)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](https://github.com/LerianStudio/helm/commit/ac4c1e82a13017aa3d2c7d031f449c86ad63bc23)) * **plugin-fees:** use midaz-ledger service for MIDAZ_TRANSACTION_URL default ([9515b35](https://github.com/LerianStudio/helm/commit/9515b3520d4e36ec74eb0279ff30933c0955499e)) * **bootstrap-mongodb:** use name helpers instead of hardcoded names ([d932f48](https://github.com/LerianStudio/helm/commit/d932f48eec2054013278151769001633b0c94091)) * **reporter:** use RABBITMQ_URI for KEDA scaler host ([60809c9](https://github.com/LerianStudio/helm/commit/60809c9273e1f1af8a177038e6c922d3a672b057)) * **plugin-access-manager:** use separate repository and tag for auth backend image ([01b9a5c](https://github.com/LerianStudio/helm/commit/01b9a5c85abd3d26e56ce698b5b0661a227d6c77)) * **reporter:** use unique names for cluster-scoped resources ([5cdaa80](https://github.com/LerianStudio/helm/commit/5cdaa8066d13a312d84a138d81609226f492a745)) * **bootstrap-mongodb:** use updateUser + process.env for safer reconciliation ([13ee1dc](https://github.com/LerianStudio/helm/commit/13ee1dc99078c5581a659ed33b361e7191229200)), closes [#1187](https://github.com/LerianStudio/helm/issues/1187) * **charts:** value key typo and stale README notes ([91ce16f](https://github.com/LerianStudio/helm/commit/91ce16fd0abb82f251f6151bdf34cfd7029edf80)) * values ([b1dc8f7](https://github.com/LerianStudio/helm/commit/b1dc8f7105ab3aa0bbed2549525f013875087b7d)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](https://github.com/LerianStudio/helm/issues/1430)) ([f38d6d9](https://github.com/LerianStudio/helm/commit/f38d6d91fec753cada642103ae242bb388e67669)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) ### Performance Improvements * Update resources ([b5f07f0](https://github.com/LerianStudio/helm/commit/b5f07f0fd2319f2bbe3155fd075c1ae7874cf59c)) * Update resources ([9ffc743](https://github.com/LerianStudio/helm/commit/9ffc7430951db115934fb10223f0d9287adfcf60)) ### Reverts * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET from global to component-level secrets ([653594c](https://github.com/LerianStudio/helm/commit/653594ccc07a2fdde1e3f7b09ff627089278a668)) * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET validation from global to pix.secrets ([f95be82](https://github.com/LerianStudio/helm/commit/f95be8266c5b88c92c839060063a69b581a41edf)) ### Miscellaneous Chores * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([28de7ce](https://github.com/LerianStudio/helm/commit/28de7ceb2dd9b39d87ae64d0f64573530a03be9b)) * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([e2113c0](https://github.com/LerianStudio/helm/commit/e2113c0bd99fe8f04e3c4ede5766f3fb99497ec0)) ### Code Refactoring * **plugin-br-payments:** rename PROVIDER_* values to BTG_* ([6454fc3](https://github.com/LerianStudio/helm/commit/6454fc3ff1395821bb4b7d21f3f0bd5915964cc6)) --- charts/br-slc/Chart.yaml | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/charts/br-slc/Chart.yaml b/charts/br-slc/Chart.yaml index e5a7d261..f6851b5f 100644 --- a/charts/br-slc/Chart.yaml +++ b/charts/br-slc/Chart.yaml @@ -18,7 +18,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 0.1.0-beta.2 +version: 1.0.0-beta.1 # appVersion is the default image tag for the app, the signer/validator/mqbridge # sidecars, and the migrations Job. Override per image via .tag when a # component needs to pin a different build. From 15408857300206c791787cae57a3316b77ea876f Mon Sep 17 00:00:00 2001 From: prymax10 Date: Fri, 17 Jul 2026 11:35:20 -0300 Subject: [PATCH 095/113] feat(new): add lender chart (#1672) Lift-and-shift of the lender-helm multi-component chart (API lender + UI lenderConsole) from helm-internal into the public product repo, so the credit product ships like the other products (midaz/fetcher/reporter/matcher). - Templates copied byte-for-byte and restructured into the public multi-component tree (templates/lender/, templates/lenderConsole/, shared bootstrap + _helpers at templates root), mirroring matcher@develop. - values.schema.json generated by the repo generator; README with Chart Contract; CI render fixture; pr-title scope; root README version matrix. - Rendered output is byte-identical to the live helm-internal 1.0.2 chart (verified render-diff: selectors/names/ports/probes identical, only the helm.sh/chart label differs), so the gitops cutover carries no selector churn. Hardening findings (CodeRabbit) are deferred to a follow-up PR to keep this a pure identity-preserving migration - see lenderup3.md H6. Co-authored-by: Claude Opus 4.8 (1M context) --- .../configs/helm-render-values/lender.yaml | 13 + .github/workflows/pr-title.yml | 1 + README.md | 13 + charts/lender/Chart.yaml | 25 + charts/lender/README.md | 80 +++ charts/lender/templates/_helpers.tpl | 83 +++ .../lender/templates/bootstrap-postgres.yaml | 145 ++++++ charts/lender/templates/lender/configmap.yaml | 44 ++ .../lender/templates/lender/deployment.yaml | 94 ++++ charts/lender/templates/lender/hpa.yaml | 33 ++ charts/lender/templates/lender/ingress.yaml | 44 ++ charts/lender/templates/lender/pdb.yaml | 27 + charts/lender/templates/lender/secrets.yaml | 17 + charts/lender/templates/lender/service.yaml | 27 + .../templates/lender/serviceaccount.yaml | 13 + .../templates/lenderConsole/configmap.yaml | 13 + .../templates/lenderConsole/deployment.yaml | 82 +++ .../templates/lenderConsole/ingress.yaml | 44 ++ .../templates/lenderConsole/service.yaml | 22 + charts/lender/values-template.yaml | 90 ++++ charts/lender/values.schema.json | 41 ++ charts/lender/values.yaml | 483 ++++++++++++++++++ 22 files changed, 1434 insertions(+) create mode 100644 .github/configs/helm-render-values/lender.yaml create mode 100644 charts/lender/Chart.yaml create mode 100644 charts/lender/README.md create mode 100644 charts/lender/templates/_helpers.tpl create mode 100644 charts/lender/templates/bootstrap-postgres.yaml create mode 100644 charts/lender/templates/lender/configmap.yaml create mode 100644 charts/lender/templates/lender/deployment.yaml create mode 100644 charts/lender/templates/lender/hpa.yaml create mode 100644 charts/lender/templates/lender/ingress.yaml create mode 100644 charts/lender/templates/lender/pdb.yaml create mode 100644 charts/lender/templates/lender/secrets.yaml create mode 100644 charts/lender/templates/lender/service.yaml create mode 100644 charts/lender/templates/lender/serviceaccount.yaml create mode 100644 charts/lender/templates/lenderConsole/configmap.yaml create mode 100644 charts/lender/templates/lenderConsole/deployment.yaml create mode 100644 charts/lender/templates/lenderConsole/ingress.yaml create mode 100644 charts/lender/templates/lenderConsole/service.yaml create mode 100644 charts/lender/values-template.yaml create mode 100644 charts/lender/values.schema.json create mode 100644 charts/lender/values.yaml diff --git a/.github/configs/helm-render-values/lender.yaml b/.github/configs/helm-render-values/lender.yaml new file mode 100644 index 00000000..eb452b8f --- /dev/null +++ b/.github/configs/helm-render-values/lender.yaml @@ -0,0 +1,13 @@ +# CI-only render fixture for the lender chart. NOT a production example. +# Enables BOTH components so the render gate exercises the console path, and +# supplies the required-when-enabled values. No real credentials. +lender: + secrets: + # lender.secrets.POSTGRES_PASSWORD is `required` when useExistingSecret=false. + POSTGRES_PASSWORD: "ci-dummy-not-a-real-secret" + +lenderConsole: + enabled: true + image: + # lenderConsole.image.tag is `required` when lenderConsole.enabled=true. + tag: "0.0.0-ci" diff --git a/.github/workflows/pr-title.yml b/.github/workflows/pr-title.yml index 0b5929ac..03327610 100644 --- a/.github/workflows/pr-title.yml +++ b/.github/workflows/pr-title.yml @@ -52,6 +52,7 @@ jobs: fetcher flowker underwriter + lender matcher tracer br-sta diff --git a/README.md b/README.md index 5d9576e5..6000c4dc 100644 --- a/README.md +++ b/README.md @@ -170,6 +170,19 @@ For implementation and configuration details, see the [README](https://charts.le | `3.1.0-beta.1` | 1.0.0 | ----------------- +### Lender + +For more details, check out the [official documentation](https://docs.lerian.studio/en/lender). + +For implementation and configuration details, see the [README](https://charts.lerian.studio/charts/lender). + +#### Application Version Mapping + +| Chart Version | Lender Version | +| :---: | :---: | +| `1.0.2` | 1.0.0-beta.49 | +----------------- + ### Matcher For more details, check out the [official documentation](https://docs.lerian.studio/en/matcher#matcher). diff --git a/charts/lender/Chart.yaml b/charts/lender/Chart.yaml new file mode 100644 index 00000000..c1d241ce --- /dev/null +++ b/charts/lender/Chart.yaml @@ -0,0 +1,25 @@ +apiVersion: v2 +name: lender-helm +description: A Helm chart for Lender - Lerian credit journey engine (API + optional console) +type: application +annotations: + lerian.studio/chart-type: multi-component +home: https://github.com/LerianStudio/lender +sources: + - https://github.com/LerianStudio/helm/tree/main/charts/lender + - https://github.com/LerianStudio/lender +maintainers: + - name: "Lerian Studio" + email: "support@lerian.studio" +version: 1.0.2 +# NOTE: appVersion tracks the lender API image line. The real image tag is set +# per-component via lender.image.tag and lenderConsole.image.tag. +appVersion: "1.0.0-beta.49" +keywords: + - lender + - credit + - underwriter + - lerian + - ddd + - hexagonal +icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4 diff --git a/charts/lender/README.md b/charts/lender/README.md new file mode 100644 index 00000000..6ce3e0bf --- /dev/null +++ b/charts/lender/README.md @@ -0,0 +1,80 @@ +# Lender Helm Chart + +This chart installs [Lender](https://github.com/LerianStudio/lender), Lerian's credit +journey engine (CDC / PJ / Cards). It is a **multi-component** chart: + +- `lender` — the Go API (main component; image tag lands at `lender.image.tag`). +- `lenderConsole` — the optional Vite/React SPA UI served by `nginx-unprivileged` + (disabled by default; enable per environment once a `lender-ui` image is published). + +PostgreSQL and Valkey/Redis are **external** (Benedita DB-LXC pattern) — the chart +ships no datastore subcharts. An optional ArgoCD PreSync bootstrap Job +(`global.externalPostgresDefinitions.enabled`) provisions the DB/role/grants +idempotently; schema migrations remain operator-driven (`cmd/migrate up`, out of band). + +## Chart Contract + +- Chart type: `multi-component` +- Required secrets: `lender.secrets.POSTGRES_PASSWORD` (install fails loud when unset, + unless `lender.useExistingSecret=true` — then `lender.existingSecretName` is required + instead). `REDIS_PASSWORD` and `AUTH_JWT_SECRET` are optional (emitted from + `lender.secrets.*` only when set). When the bootstrap Job is enabled + (`global.externalPostgresDefinitions.enabled=true`) without an `useExistingSecret.name`, + `global.externalPostgresDefinitions.postgresAdminLogin.password` and + `global.externalPostgresDefinitions.lenderCredentials.password` are also required. +- Dependency notes: No subcharts / no `dependencies:` — Postgres is external (Benedita + DB-LXC pattern), provided via values. Therefore no `Chart.lock`. +- Production overrides: set `lender.image.tag`; provide `lender.secrets.POSTGRES_PASSWORD` + (or `lender.useExistingSecret=true` + `lender.existingSecretName`) and, when the UI is + used, `lenderConsole.enabled=true` with `lenderConsole.image.tag` (**required** when the + console is enabled). Configure `lender.ingress` / `lenderConsole.ingress` hosts per + environment. `lenderConsole.securityContext.readOnlyRootFilesystem` is intentionally + `false` (nginx-unprivileged renders `/config.js` at start and writes pid/cache to the + root fs — live-proven; do not flip it to `true`). +- Source/license: https://github.com/LerianStudio/lender + +## Components + +### Lender API (`lender`) + +The Go API. Binds `0.0.0.0:4017` (`SERVER_ADDRESS`), exposes `/health` (liveness) and +`/readyz` (readiness). Non-sensitive env is rendered from `lender.configmap`; sensitive +env from `lender.secrets` (or an existing Secret). Feature flags (RabbitMQ, streaming, +outbox, multi-tenant, collection) default OFF so the service boots single-tenant. + +### Lender Console (`lenderConsole`) + +Optional Vite SPA served by `nginx-unprivileged` (uid/gid `101`). Disabled by default; +no chart change is needed to wire a future UI — set `lenderConsole.enabled=true` and a +`lenderConsole.image.tag`. Runtime config (e.g. `API_BASE_URL`) is delivered via +`lenderConsole.configmap` and rendered into the SPA at container start. + +## Install + +```console +$ helm install lender oci://registry-1.docker.io/lerianstudio/lender-helm \ + --version 1.0.2 -n lender --create-namespace +``` + +## Configuring Ingress (NGINX) + +```yaml +lender: + ingress: + enabled: true + className: "nginx" + hosts: + - host: lender.example.com + paths: + - path: / + pathType: Prefix + tls: + - secretName: lender-tls + hosts: + - lender.example.com +``` + +## Support & Community + +- **GitHub Issues**: https://github.com/LerianStudio/lender/issues +- **Email**: [contact@lerian.studio](mailto:contact@lerian.studio) diff --git a/charts/lender/templates/_helpers.tpl b/charts/lender/templates/_helpers.tpl new file mode 100644 index 00000000..4fae96c5 --- /dev/null +++ b/charts/lender/templates/_helpers.tpl @@ -0,0 +1,83 @@ +{{/* +Expand the name of the chart. +*/}} +{{- define "lender.name" -}} +{{- default "lender" .Values.nameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create a default fully qualified app name for the lender API component. +We truncate at 63 chars because some Kubernetes name fields are limited to this (by the DNS naming spec). +*/}} +{{- define "lender.fullname" -}} +{{- default (include "lender.name" .) .Values.fullnameOverride | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Fully qualified name for the lender console (UI) component. +*/}} +{{- define "lenderConsole.fullname" -}} +{{- $base := include "lender.fullname" . | trunc 55 | trimSuffix "-" }} +{{- printf "%s-console" $base | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Create chart name and version as used by the chart label. +*/}} +{{- define "lender.chart" -}} +{{- printf "%s-%s" .Chart.Name .Chart.Version | replace "+" "_" | trunc 63 | trimSuffix "-" }} +{{- end }} + +{{/* +Resolve the lender API image tag (falls back to Chart.AppVersion). +*/}} +{{- define "lender.defaultTag" -}} +{{- default .Chart.AppVersion .Values.lender.image.tag }} +{{- end -}} + +{{/* +Return valid lender version label value. +*/}} +{{- define "lender.versionLabelValue" -}} +{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "lender.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }} +{{- end -}} + +{{/* +Common labels +*/}} +{{- define "lender.labels" -}} +helm.sh/chart: {{ include "lender.chart" .context }} +{{ include "lender.selectorLabels" (dict "context" .context "component" .component "name" .name) }} +app.kubernetes.io/version: {{ include "lender.versionLabelValue" .context }} +app.kubernetes.io/managed-by: {{ .context.Release.Service }} +{{- end }} + +{{/* +Selector labels +*/}} +{{- define "lender.selectorLabels" -}} +app.kubernetes.io/name: {{ include "lender.name" .context }} +app.kubernetes.io/instance: {{ .context.Release.Name }} +{{- if .component }} +app.kubernetes.io/component: {{ .component }} +{{- end }} +{{- end }} + +{{/* +Create the name of the service account to use +*/}} +{{- define "lender.serviceAccountName" -}} +{{- if .Values.lender.serviceAccount.create }} +{{- default (include "lender.fullname" .) .Values.lender.serviceAccount.name }} +{{- else }} +{{- default "default" .Values.lender.serviceAccount.name }} +{{- end }} +{{- end }} + +{{/* +Expand the namespace of the release. +Allows overriding it for multi-namespace deployments in combined charts. +*/}} +{{- define "global.namespace" -}} +{{- default .Release.Namespace .Values.namespaceOverride | trunc 63 | trimSuffix "-" -}} +{{- end }} diff --git a/charts/lender/templates/bootstrap-postgres.yaml b/charts/lender/templates/bootstrap-postgres.yaml new file mode 100644 index 00000000..25e330f7 --- /dev/null +++ b/charts/lender/templates/bootstrap-postgres.yaml @@ -0,0 +1,145 @@ +{{- if .Values.global.externalPostgresDefinitions.enabled }} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "lender.fullname" . }}-bootstrap-postgres + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" "bootstrap" "name" "postgres") | nindent 4 }} + annotations: + # Run as an ArgoCD PreSync hook, recreated every sync (Job pod templates are + # immutable, so a fixed-name Job would collide on helm upgrade). sync-wave -10 + # provisions the DB/role before the app rolls. ttl is a non-ArgoCD fallback. + argocd.argoproj.io/hook: PreSync + argocd.argoproj.io/hook-delete-policy: BeforeHookCreation + argocd.argoproj.io/sync-wave: "-10" +spec: + ttlSecondsAfterFinished: 300 + completions: 1 + parallelism: 1 + backoffLimit: 3 + template: + spec: + restartPolicy: Never + initContainers: + - name: wait-for-dependencies + image: busybox:1.37 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + command: + - /bin/sh + - -c + - > + TIMEOUT=300; + ELAPSED=0; + echo "Checking $DB_HOST:$DB_PORT..."; + while ! nc -z "$DB_HOST" "$DB_PORT"; do + if [ $ELAPSED -ge $TIMEOUT ]; then + echo "Timeout waiting for $DB_HOST:$DB_PORT after ${TIMEOUT}s"; + exit 1; + fi; + echo "$DB_HOST:$DB_PORT is not ready yet, waiting... (${ELAPSED}s/${TIMEOUT}s)"; + sleep 5; + ELAPSED=$((ELAPSED + 5)); + done; + echo "$DB_HOST:$DB_PORT is ready!"; + containers: + - name: psql + image: postgres:17 + env: + - name: DB_HOST + value: {{ .Values.global.externalPostgresDefinitions.connection.host | quote }} + - name: DB_PORT + value: {{ .Values.global.externalPostgresDefinitions.connection.port | quote }} + - name: DB_USER_ADMIN + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_USER_ADMIN + {{- else }} + value: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.username | quote }} + {{- end }} + - name: DB_ADMIN_PASSWORD + {{- if .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.postgresAdminLogin.useExistingSecret.name | quote }} + key: DB_ADMIN_PASSWORD + {{- else }} + value: {{ required "global.externalPostgresDefinitions.postgresAdminLogin.password is required when postgresAdminLogin.useExistingSecret.name is unset" .Values.global.externalPostgresDefinitions.postgresAdminLogin.password | quote }} + {{- end }} + - name: DB_PASSWORD_LENDER + {{- if .Values.global.externalPostgresDefinitions.lenderCredentials.useExistingSecret.name }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.externalPostgresDefinitions.lenderCredentials.useExistingSecret.name | quote }} + key: DB_PASSWORD_LENDER + {{- else }} + value: {{ required "global.externalPostgresDefinitions.lenderCredentials.password is required when lenderCredentials.useExistingSecret.name is unset" .Values.global.externalPostgresDefinitions.lenderCredentials.password | quote }} + {{- end }} + - name: DB_DATABASE + value: postgres + command: + - /bin/bash + - -c + - | + set -euo pipefail + echo "=== Lender PostgreSQL Bootstrap ===" + echo "Host: $DB_HOST:$DB_PORT" + echo "" + + # The role password is passed to psql via the `pw` variable and + # interpolated with :'pw', which psql quotes/escapes as a SQL string + # literal — it is never embedded into the -c SQL string directly, so + # there is no SQL injection surface. + run_psql() { + PGPASSWORD="$DB_ADMIN_PASSWORD" psql -v ON_ERROR_STOP=1 -v pw="$DB_PASSWORD_LENDER" "$@" + } + + echo "Checking existing PostgreSQL objects..." + DB_EXISTS=0 + ROLE_EXISTS=0 + + if run_psql -At -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_database WHERE datname='lender'" | grep -q 1; then + DB_EXISTS=1 + fi + if run_psql -At -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "SELECT 1 FROM pg_roles WHERE rolname='lender'" | grep -q 1; then + ROLE_EXISTS=1 + fi + + # Create the role if missing, otherwise refresh its password. + # NOTE: psql interpolates :'pw' only for stdin/-f input, NOT for -c; + # feed the statement on stdin so the password is safely psql-quoted. + if [ "$ROLE_EXISTS" = "1" ]; then + echo "Role 'lender' already exists. Updating password..." + printf '%s\n' "ALTER ROLE \"lender\" WITH LOGIN PASSWORD :'pw';" | run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" + else + echo "Creating role 'lender'..." + printf '%s\n' "CREATE ROLE \"lender\" LOGIN PASSWORD :'pw';" | run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" + fi + + # Create the database if missing. + if [ "$DB_EXISTS" = "1" ]; then + echo "Database 'lender' already exists. Skipping creation." + else + echo "Creating database 'lender'..." + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "CREATE DATABASE \"lender\" OWNER \"lender\"" + fi + + # Privileges (safe to run repeatedly). No CREATEDB grant — least privilege. + echo "Ensuring privileges and schema permissions..." + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "$DB_DATABASE" -c "GRANT ALL PRIVILEGES ON DATABASE \"lender\" TO \"lender\"" + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "lender" -c "GRANT ALL ON SCHEMA public TO \"lender\"" + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "lender" -c "GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO \"lender\"" + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "lender" -c "GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO \"lender\"" + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "lender" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON TABLES TO \"lender\"" + run_psql -h "$DB_HOST" -p "$DB_PORT" -U "$DB_USER_ADMIN" -d "lender" -c "ALTER DEFAULT PRIVILEGES IN SCHEMA public GRANT ALL ON SEQUENCES TO \"lender\"" + + echo "" + echo "=== Lender PostgreSQL Bootstrap completed successfully ===" + echo "NOTE: schema migrations are operator-driven (cmd/migrate up) and run out-of-band." +{{- end }} diff --git a/charts/lender/templates/lender/configmap.yaml b/charts/lender/templates/lender/configmap.yaml new file mode 100644 index 00000000..a1ec08df --- /dev/null +++ b/charts/lender/templates/lender/configmap.yaml @@ -0,0 +1,44 @@ +{{- if .Values.lender.enabled }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} +data: + # Auto-generated version (from image tag, falls back to Chart.AppVersion) + VERSION: {{ .Values.lender.image.tag | default .Chart.AppVersion | quote }} + OTEL_RESOURCE_SERVICE_VERSION: {{ .Values.lender.image.tag | default .Chart.AppVersion | quote }} + + # Non-sensitive environment (mirrors config/.env.example superset). + # MULTI_TENANT_* sub-keys are owned by the gated block below; only + # MULTI_TENANT_ENABLED is emitted here to avoid duplicate ConfigMap keys. + {{- range $key, $value := .Values.lender.configmap }} + {{- if or (not (hasPrefix "MULTI_TENANT_" $key)) (eq $key "MULTI_TENANT_ENABLED") }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} + + # Multi-tenant starter (rendered only when MULTI_TENANT_ENABLED=true) + {{- if eq (.Values.lender.configmap.MULTI_TENANT_ENABLED | default "false" | toString) "true" }} + MULTI_TENANT_URL: {{ required "lender.configmap.MULTI_TENANT_URL is required when MULTI_TENANT_ENABLED=true" .Values.lender.configmap.MULTI_TENANT_URL | quote }} + MULTI_TENANT_REDIS_HOST: {{ required "lender.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" .Values.lender.configmap.MULTI_TENANT_REDIS_HOST | quote }} + MULTI_TENANT_REDIS_PORT: {{ .Values.lender.configmap.MULTI_TENANT_REDIS_PORT | default "6379" | quote }} + MULTI_TENANT_REDIS_TLS: {{ .Values.lender.configmap.MULTI_TENANT_REDIS_TLS | default "false" | quote }} + MULTI_TENANT_MAX_TENANT_POOLS: {{ .Values.lender.configmap.MULTI_TENANT_MAX_TENANT_POOLS | default "100" | quote }} + MULTI_TENANT_IDLE_TIMEOUT_SEC: {{ .Values.lender.configmap.MULTI_TENANT_IDLE_TIMEOUT_SEC | default "300" | quote }} + MULTI_TENANT_TIMEOUT: {{ .Values.lender.configmap.MULTI_TENANT_TIMEOUT | default "30" | quote }} + MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ .Values.lender.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }} + MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.lender.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }} + MULTI_TENANT_CACHE_TTL_SEC: {{ .Values.lender.configmap.MULTI_TENANT_CACHE_TTL_SEC | default "120" | quote }} + MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: {{ .Values.lender.configmap.MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC | default "30" | quote }} + {{- end }} + + # Extra env vars (GitOps passthrough) + {{- with .Values.lender.extraEnvVars }} + {{- range . }} + {{ .name }}: {{ .value | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lender/deployment.yaml b/charts/lender/templates/lender/deployment.yaml new file mode 100644 index 00000000..f7124f5b --- /dev/null +++ b/charts/lender/templates/lender/deployment.yaml @@ -0,0 +1,94 @@ +{{- if .Values.lender.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} +spec: + revisionHistoryLimit: {{ .Values.lender.revisionHistoryLimit | default 10 }} + strategy: + type: {{ .Values.lender.deploymentUpdate.type }} + {{- if eq .Values.lender.deploymentUpdate.type "RollingUpdate" }} + rollingUpdate: + maxSurge: {{ .Values.lender.deploymentUpdate.maxSurge }} + maxUnavailable: {{ .Values.lender.deploymentUpdate.maxUnavailable }} + {{- end }} + {{- if not .Values.lender.autoscaling.enabled }} + replicas: {{ .Values.lender.replicaCount }} + {{- end }} + selector: + matchLabels: + {{- include "lender.selectorLabels" (dict "context" . "name" .Values.lender.name) | nindent 6 }} + template: + metadata: + {{- with .Values.lender.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 8 }} + spec: + {{- with .Values.lender.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + serviceAccountName: {{ include "lender.serviceAccountName" . }} + securityContext: + {{- toYaml .Values.lender.podSecurityContext | nindent 8 }} + containers: + - name: {{ include "lender.fullname" . }} + securityContext: + {{- toYaml .Values.lender.securityContext | nindent 12 }} + image: "{{ .Values.lender.image.repository }}:{{ .Values.lender.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{ .Values.lender.image.pullPolicy }} + envFrom: + - secretRef: + name: {{ if .Values.lender.useExistingSecret }}{{ required "lender.existingSecretName is required when lender.useExistingSecret=true" .Values.lender.existingSecretName }}{{ else }}{{ include "lender.fullname" . }}{{ end }} + - configMapRef: + name: {{ include "lender.fullname" . }} + {{- if eq (toString .Values.lender.configmap.ENABLE_TELEMETRY) "true" }} + env: + - name: "HOST_IP" + valueFrom: + fieldRef: + fieldPath: status.hostIP + - name: "OTEL_EXPORTER_OTLP_ENDPOINT" + value: "http://$(HOST_IP):4317" + {{- end }} + ports: + - name: http + containerPort: {{ .Values.lender.service.port }} + protocol: TCP + livenessProbe: + httpGet: + path: /health + port: http + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: /readyz + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + resources: + {{- toYaml .Values.lender.resources | nindent 12 }} + {{- with .Values.lender.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.lender.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.lender.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lender/hpa.yaml b/charts/lender/templates/lender/hpa.yaml new file mode 100644 index 00000000..3c757acd --- /dev/null +++ b/charts/lender/templates/lender/hpa.yaml @@ -0,0 +1,33 @@ +{{- if and .Values.lender.enabled .Values.lender.autoscaling.enabled }} +apiVersion: autoscaling/v2 +kind: HorizontalPodAutoscaler +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} +spec: + scaleTargetRef: + apiVersion: apps/v1 + kind: Deployment + name: {{ include "lender.fullname" . }} + minReplicas: {{ .Values.lender.autoscaling.minReplicas }} + maxReplicas: {{ .Values.lender.autoscaling.maxReplicas }} + metrics: + {{- if .Values.lender.autoscaling.targetCPUUtilizationPercentage }} + - type: Resource + resource: + name: cpu + target: + type: Utilization + averageUtilization: {{ .Values.lender.autoscaling.targetCPUUtilizationPercentage }} + {{- end }} + {{- if .Values.lender.autoscaling.targetMemoryUtilizationPercentage }} + - type: Resource + resource: + name: memory + target: + type: Utilization + averageUtilization: {{ .Values.lender.autoscaling.targetMemoryUtilizationPercentage }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lender/ingress.yaml b/charts/lender/templates/lender/ingress.yaml new file mode 100644 index 00000000..1840e82a --- /dev/null +++ b/charts/lender/templates/lender/ingress.yaml @@ -0,0 +1,44 @@ +{{- if and .Values.lender.enabled .Values.lender.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} + {{- with .Values.lender.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.lender.ingress.className }} + ingressClassName: {{ .Values.lender.ingress.className }} + {{- end }} + {{- if .Values.lender.ingress.tls }} + tls: + {{- range .Values.lender.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.lender.ingress.hosts }} + {{- if .host }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "lender.fullname" $ }} + port: + number: {{ $.Values.lender.service.port }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lender/pdb.yaml b/charts/lender/templates/lender/pdb.yaml new file mode 100644 index 00000000..934c8718 --- /dev/null +++ b/charts/lender/templates/lender/pdb.yaml @@ -0,0 +1,27 @@ +{{- if and .Values.lender.enabled .Values.lender.pdb.enabled }} +apiVersion: policy/v1 +kind: PodDisruptionBudget +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} + {{- with .Values.lender.pdb.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if hasKey .Values.lender.pdb "maxUnavailable" }} + maxUnavailable: {{ .Values.lender.pdb.maxUnavailable }} + {{- else }} + minAvailable: {{ .Values.lender.pdb.minAvailable | default 1 }} + {{- end }} + selector: + matchLabels: + {{- /* Scope to the API component so disruption budgeting counts only API + pods, not lenderConsole (shared name/instance). PDB selector is + mutable, so this applies on upgrade. (The Deployment selector needs + the same discriminator but is immutable — tracked as a follow-up + requiring a recreate; HPA/autoscaling is off on these tiers.) */ -}} + {{- include "lender.selectorLabels" (dict "context" . "name" .Values.lender.name "component" .Values.lender.name) | nindent 6 }} +{{- end }} diff --git a/charts/lender/templates/lender/secrets.yaml b/charts/lender/templates/lender/secrets.yaml new file mode 100644 index 00000000..b50a0654 --- /dev/null +++ b/charts/lender/templates/lender/secrets.yaml @@ -0,0 +1,17 @@ +{{- if and .Values.lender.enabled (not .Values.lender.useExistingSecret) }} +apiVersion: v1 +kind: Secret +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} +type: Opaque +stringData: + POSTGRES_PASSWORD: {{ required "lender.secrets.POSTGRES_PASSWORD is required when lender.useExistingSecret=false (supply explicitly or set useExistingSecret=true)" .Values.lender.secrets.POSTGRES_PASSWORD | quote }} + {{- range $key, $value := .Values.lender.secrets }} + {{- if ne $key "POSTGRES_PASSWORD" }} + {{ $key }}: {{ $value | quote }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lender/service.yaml b/charts/lender/templates/lender/service.yaml new file mode 100644 index 00000000..088879dc --- /dev/null +++ b/charts/lender/templates/lender/service.yaml @@ -0,0 +1,27 @@ +{{- if .Values.lender.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "lender.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} + {{- with .Values.lender.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.lender.service.type }} + ports: + - port: {{ .Values.lender.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- /* Include the component discriminator so this API Service selects ONLY + the lender API pods, not the lenderConsole pods (which share + name/instance labels). Without it the Service load-balances /api + traffic onto the console nginx too, yielding intermittent + missing-CORS / SPA-fallback responses. */ -}} + {{- include "lender.selectorLabels" (dict "context" . "name" .Values.lender.name "component" .Values.lender.name) | nindent 4 }} +{{- end }} diff --git a/charts/lender/templates/lender/serviceaccount.yaml b/charts/lender/templates/lender/serviceaccount.yaml new file mode 100644 index 00000000..f43822f2 --- /dev/null +++ b/charts/lender/templates/lender/serviceaccount.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.lender.enabled .Values.lender.serviceAccount.create }} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "lender.serviceAccountName" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lender.name "name" .Values.lender.name) | nindent 4 }} + {{- with .Values.lender.serviceAccount.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lenderConsole/configmap.yaml b/charts/lender/templates/lenderConsole/configmap.yaml new file mode 100644 index 00000000..84b93e7e --- /dev/null +++ b/charts/lender/templates/lenderConsole/configmap.yaml @@ -0,0 +1,13 @@ +{{- if and .Values.lenderConsole.enabled .Values.lenderConsole.configmap }} +apiVersion: v1 +kind: ConfigMap +metadata: + name: {{ include "lenderConsole.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lenderConsole.name "name" .Values.lenderConsole.name) | nindent 4 }} +data: + {{- range $key, $value := .Values.lenderConsole.configmap }} + {{ $key }}: {{ $value | quote }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lenderConsole/deployment.yaml b/charts/lender/templates/lenderConsole/deployment.yaml new file mode 100644 index 00000000..c0a2c09a --- /dev/null +++ b/charts/lender/templates/lenderConsole/deployment.yaml @@ -0,0 +1,82 @@ +{{- if .Values.lenderConsole.enabled }} +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "lenderConsole.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lenderConsole.name "name" .Values.lenderConsole.name) | nindent 4 }} +spec: + revisionHistoryLimit: {{ if hasKey .Values.lenderConsole "revisionHistoryLimit" }}{{ .Values.lenderConsole.revisionHistoryLimit }}{{ else }}10{{ end }} + replicas: {{ .Values.lenderConsole.replicaCount }} + selector: + matchLabels: + {{- include "lender.selectorLabels" (dict "context" . "name" .Values.lenderConsole.name "component" .Values.lenderConsole.name) | nindent 6 }} + template: + metadata: + {{- with .Values.lenderConsole.podAnnotations }} + annotations: + {{- toYaml . | nindent 8 }} + {{- end }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lenderConsole.name "name" .Values.lenderConsole.name) | nindent 8 }} + spec: + {{- with .Values.lenderConsole.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + {{- toYaml .Values.lenderConsole.podSecurityContext | nindent 8 }} + containers: + - name: {{ include "lenderConsole.fullname" . }} + securityContext: + {{- toYaml .Values.lenderConsole.securityContext | nindent 12 }} + image: "{{ .Values.lenderConsole.image.repository }}:{{ required "lenderConsole.image.tag is required when lenderConsole.enabled=true" .Values.lenderConsole.image.tag }}" + imagePullPolicy: {{ .Values.lenderConsole.image.pullPolicy }} + {{- if .Values.lenderConsole.configmap }} + envFrom: + - configMapRef: + name: {{ include "lenderConsole.fullname" . }} + {{- end }} + {{- with .Values.lenderConsole.extraEnvVars }} + env: + {{- range . }} + - name: {{ .name }} + value: {{ .value | quote }} + {{- end }} + {{- end }} + ports: + - name: http + containerPort: {{ .Values.lenderConsole.service.port }} + protocol: TCP + livenessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 15 + periodSeconds: 20 + timeoutSeconds: 5 + failureThreshold: 3 + readinessProbe: + httpGet: + path: / + port: http + initialDelaySeconds: 10 + periodSeconds: 10 + timeoutSeconds: 5 + failureThreshold: 3 + resources: + {{- toYaml .Values.lenderConsole.resources | nindent 12 }} + {{- with .Values.lenderConsole.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.lenderConsole.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.lenderConsole.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lenderConsole/ingress.yaml b/charts/lender/templates/lenderConsole/ingress.yaml new file mode 100644 index 00000000..697b3fc9 --- /dev/null +++ b/charts/lender/templates/lenderConsole/ingress.yaml @@ -0,0 +1,44 @@ +{{- if and .Values.lenderConsole.enabled .Values.lenderConsole.ingress.enabled }} +apiVersion: networking.k8s.io/v1 +kind: Ingress +metadata: + name: {{ include "lenderConsole.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lenderConsole.name "name" .Values.lenderConsole.name) | nindent 4 }} + {{- with .Values.lenderConsole.ingress.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + {{- if .Values.lenderConsole.ingress.className }} + ingressClassName: {{ .Values.lenderConsole.ingress.className }} + {{- end }} + {{- if .Values.lenderConsole.ingress.tls }} + tls: + {{- range .Values.lenderConsole.ingress.tls }} + - hosts: + {{- range .hosts }} + - {{ . | quote }} + {{- end }} + secretName: {{ .secretName }} + {{- end }} + {{- end }} + rules: + {{- range .Values.lenderConsole.ingress.hosts }} + {{- if .host }} + - host: {{ .host | quote }} + http: + paths: + {{- range .paths }} + - path: {{ .path }} + pathType: {{ .pathType }} + backend: + service: + name: {{ include "lenderConsole.fullname" $ }} + port: + number: {{ $.Values.lenderConsole.service.port }} + {{- end }} + {{- end }} + {{- end }} +{{- end }} diff --git a/charts/lender/templates/lenderConsole/service.yaml b/charts/lender/templates/lenderConsole/service.yaml new file mode 100644 index 00000000..0e9b8f6e --- /dev/null +++ b/charts/lender/templates/lenderConsole/service.yaml @@ -0,0 +1,22 @@ +{{- if .Values.lenderConsole.enabled }} +apiVersion: v1 +kind: Service +metadata: + name: {{ include "lenderConsole.fullname" . }} + namespace: {{ include "global.namespace" . }} + labels: + {{- include "lender.labels" (dict "context" . "component" .Values.lenderConsole.name "name" .Values.lenderConsole.name) | nindent 4 }} + {{- with .Values.lenderConsole.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.lenderConsole.service.type }} + ports: + - port: {{ .Values.lenderConsole.service.port }} + targetPort: http + protocol: TCP + name: http + selector: + {{- include "lender.selectorLabels" (dict "context" . "name" .Values.lenderConsole.name "component" .Values.lenderConsole.name) | nindent 4 }} +{{- end }} diff --git a/charts/lender/values-template.yaml b/charts/lender/values-template.yaml new file mode 100644 index 00000000..4f58a65f --- /dev/null +++ b/charts/lender/values-template.yaml @@ -0,0 +1,90 @@ +# Template values for lender deployment. +# Copy this file and customize for your environment (GitOps overlay). + +namespaceOverride: "lender" + +global: + externalPostgresDefinitions: + enabled: false + connection: + host: "" + port: "5432" + postgresAdminLogin: + useExistingSecret: + name: "" + username: "" + password: "" + lenderCredentials: + useExistingSecret: + name: "" + password: "" + +lender: + enabled: true + replicaCount: 1 + + image: + repository: ghcr.io/lerianstudio/lender + pullPolicy: IfNotPresent + tag: "" + + imagePullSecrets: + - name: ghcr-credential + + ingress: + # Disabled in the template overlay so the default cannot render a hostless + # Ingress matching arbitrary hostnames. Enable and set a host per environment. + enabled: false + className: "nginx" + annotations: {} + hosts: [] + tls: [] + + resources: + limits: + cpu: 500m + memory: 512Mi + requests: + cpu: 100m + memory: 128Mi + + autoscaling: + enabled: true + minReplicas: 1 + maxReplicas: 5 + targetCPUUtilizationPercentage: 80 + targetMemoryUtilizationPercentage: 80 + + configmap: + ENV_NAME: "" + SERVER_ADDRESS: ":4017" + LOG_LEVEL: "info" + POSTGRES_HOST: "" + POSTGRES_PORT: "5432" + POSTGRES_USER: "lender" + POSTGRES_NAME: "lender" + POSTGRES_SSLMODE: "disable" + ALLOW_INSECURE_TLS: "true" + REDIS_HOST: "" + REDIS_DB: "0" + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_HOST: "" + ENABLE_TELEMETRY: "false" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + MULTI_TENANT_ENABLED: "false" + + secrets: + POSTGRES_PASSWORD: "" + REDIS_PASSWORD: "" + AUTH_JWT_SECRET: "" + + useExistingSecret: false + existingSecretName: "" + +# UI component — keep disabled until a lender-ui image is wired per environment. +lenderConsole: + enabled: false + image: + repository: ghcr.io/lerianstudio/lender-ui + pullPolicy: IfNotPresent + tag: "" diff --git a/charts/lender/values.schema.json b/charts/lender/values.schema.json new file mode 100644 index 00000000..9c01f9ff --- /dev/null +++ b/charts/lender/values.schema.json @@ -0,0 +1,41 @@ +{ + "$schema": "https://json-schema.org/draft-07/schema#", + "type": "object", + "additionalProperties": false, + "properties": { + "nameOverride": { + "type": "string" + }, + "fullnameOverride": { + "type": "string" + }, + "namespaceOverride": { + "type": "string" + }, + "global": { + "type": "object", + "additionalProperties": true + }, + "lender": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + }, + "secrets": { + "type": "object" + } + }, + "additionalProperties": true + }, + "lenderConsole": { + "type": "object", + "properties": { + "configmap": { + "type": "object" + } + }, + "additionalProperties": true + } + } +} diff --git a/charts/lender/values.yaml b/charts/lender/values.yaml new file mode 100644 index 00000000..132a7218 --- /dev/null +++ b/charts/lender/values.yaml @@ -0,0 +1,483 @@ +# Default values for lender components. +# This is a YAML-formatted file. +# Declare variables to be passed into your templates. +# +# Chart is multi-component: +# * lender -> the Go API (main component; image tag lands at lender.image.tag) +# * lenderConsole -> the Vite/React "lender-console" UI (disabled by default; no image exists yet) +nameOverride: "lender" +fullnameOverride: "" +namespaceOverride: "lender" + +global: + # -- Bootstrap job for external PostgreSQL: creates database, role, and grants privileges. + # This job ONLY provisions the DB/role idempotently. Schema migrations are operator-driven + # (cmd/migrate up) and run out-of-band; the runtime image ships no migrate binary. + externalPostgresDefinitions: + # -- Enable or disable the PostgreSQL bootstrap job + enabled: false + # -- PostgreSQL connection settings + connection: + # -- PostgreSQL host + host: "lender-postgresql" + # -- PostgreSQL port + port: "5432" + # -- Admin credentials for PostgreSQL + postgresAdminLogin: + useExistingSecret: + # -- Name of existing secret containing DB_USER_ADMIN and DB_ADMIN_PASSWORD keys + name: "" + # -- Admin username (ignored if useExistingSecret.name is set) + username: "postgres" + # -- Admin password (ignored if useExistingSecret.name is set). + # No default: supply explicitly or use useExistingSecret.name. + password: "" + # -- Credentials for the lender role created by the job + lenderCredentials: + useExistingSecret: + # -- Name of existing secret containing DB_PASSWORD_LENDER key + name: "" + # -- Password for the lender role (ignored if useExistingSecret.name is set). + # No default: supply explicitly or use useExistingSecret.name. + password: "" + +lender: + # -- Service name + name: lender + + # -- Service description + description: "Lerian credit journey engine (API)" + + # -- Enable or disable the lender API service + enabled: true + + # -- Number of replicas for the lender service + replicaCount: 1 + + # -- Number of old ReplicaSets to retain for deployment rollback + revisionHistoryLimit: 10 + + image: + # -- Repository for the lender API container image + repository: ghcr.io/lerianstudio/lender + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Image tag used for deployment (release pipeline sets this via lender.tag mapping) + tag: "1.0.0-beta.48" + + # -- Secrets for pulling images from a private registry + imagePullSecrets: + - name: ghcr-credential + + # -- Pod annotations for additional metadata + podAnnotations: {} + + podSecurityContext: {} + # fsGroup: 2000 + + securityContext: + # -- Defines the group ID for the user running the process inside the container + runAsGroup: 1000 + # -- Defines the user ID for the process running inside the container + runAsUser: 1000 + # -- Ensures the process does not run as root + runAsNonRoot: true + capabilities: + drop: + - ALL + # -- Blocks privilege escalation inside the container + allowPrivilegeEscalation: false + # -- Defines the root filesystem as read-only + readOnlyRootFilesystem: true + seccompProfile: + type: RuntimeDefault + + # -- PodDisruptionBudget configuration + pdb: + # -- Enable or disable PodDisruptionBudget + enabled: true + # -- Minimum number of available pods + minAvailable: 1 + # -- Maximum number of unavailable pods + maxUnavailable: 1 + # -- Annotations for the PodDisruptionBudget + annotations: {} + + # -- Deployment update strategy + deploymentUpdate: + # -- Type of deployment strategy + type: RollingUpdate + # -- Maximum number of pods that can be created over the desired number of pods + maxSurge: 1 + # -- Maximum number of pods that can be unavailable during the update + maxUnavailable: 1 + + service: + # -- Kubernetes service type + type: ClusterIP + # -- Port for the HTTP API (SERVER_ADDRESS binds 0.0.0.0:4017) + port: 4017 + annotations: {} + + ingress: + # -- Enable or disable ingress + enabled: true + # -- Ingress class name + className: "nginx" + # -- Additional ingress annotations (host/group set by GitOps values) + annotations: + nginx.ingress.kubernetes.io/proxy-buffer-size: "16k" + gethomepage.dev/enabled: "true" + gethomepage.dev/name: "Lender" + gethomepage.dev/description: "Lerian credit journey engine" + hosts: + - host: "lender.lerian.net" + paths: + - path: / + pathType: Prefix + # -- TLS configuration for ingress + tls: [] + + resources: + # -- CPU and memory limits for pods + limits: + cpu: 500m + memory: 512Mi + # -- Minimum CPU and memory requests + requests: + cpu: 100m + memory: 128Mi + + autoscaling: + # -- Enable or disable horizontal pod autoscaling + enabled: true + # -- Minimum number of replicas + minReplicas: 1 + # -- Maximum number of replicas + maxReplicas: 5 + # -- Target CPU utilization percentage for autoscaling + targetCPUUtilizationPercentage: 80 + # -- Target memory utilization percentage for autoscaling + targetMemoryUtilizationPercentage: 80 + + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + + # -- Tolerations for scheduling on tainted nodes + tolerations: {} + + # -- Affinity rules for pod scheduling + affinity: {} + + # -- ConfigMap for non-sensitive environment variables. + # @default -- templates/configmap.yaml + # NOTE: keys mirror config/.env.example (the app config superset). Feature flags default OFF + # so the service boots single-tenant with rabbit/streaming/multi-tenant/outbox disabled. + configmap: + # Application Settings + ENV_NAME: "production" + LOG_LEVEL: "info" + DEPLOYMENT_MODE: "production" + SERVER_ADDRESS: ":4017" + HTTP_BODY_LIMIT_BYTES: "104857600" + + # CORS (legacy names) + CORS_ALLOWED_ORIGINS: "*" + CORS_ALLOWED_METHODS: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + CORS_ALLOWED_HEADERS: "Origin,Content-Type,Accept,Authorization,X-Request-ID,X-Idempotency,Idempotency-Key" + CORS_EXPOSE_HEADERS: "" + CORS_ALLOW_CREDENTIALS: "false" + + # CORS (active lib-commons ACCESS_CONTROL_* names) + ACCESS_CONTROL_ALLOW_ORIGIN: "*" + ACCESS_CONTROL_ALLOW_METHODS: "GET,POST,PUT,PATCH,DELETE,OPTIONS" + ACCESS_CONTROL_ALLOW_HEADERS: "Origin,Content-Type,Accept,Authorization,X-Request-ID,X-Idempotency,Idempotency-Key" + ACCESS_CONTROL_EXPOSE_HEADERS: "" + ACCESS_CONTROL_ALLOW_CREDENTIALS: "false" + + # TLS + TLS_TERMINATED_UPSTREAM: "true" + + # Tenancy + DEFAULT_TENANT_ID: "11111111-1111-1111-1111-111111111111" + + # PostgreSQL (primary, non-secret) + POSTGRES_HOST: "postgres.lender.lerian.net" + POSTGRES_PORT: "5432" + POSTGRES_USER: "lender" + POSTGRES_NAME: "lender" + POSTGRES_SSLMODE: "disable" + # lib-commons refuses a plaintext (sslmode=disable) connection unless this is set. + # Managed data tier is plaintext, so default is "true". + ALLOW_INSECURE_TLS: "true" + MIGRATIONS_PATH: "migrations" + MIGRATIONS_BR_PATH: "internal/jurisdictions/br/migrations" + + # PostgreSQL connection pool + POSTGRES_MAX_OPEN_CONNS: "25" + POSTGRES_MAX_IDLE_CONNS: "5" + POSTGRES_CONN_MAX_LIFETIME_MINS: "30" + POSTGRES_CONN_MAX_IDLE_TIME_MINS: "5" + POSTGRES_CONNECT_TIMEOUT_SEC: "10" + + # Redis / Valkey (non-secret) + REDIS_HOST: "valkey.lender.lerian.net:6379" + REDIS_DB: "0" + REDIS_PROTOCOL: "3" + REDIS_POOL_SIZE: "10" + REDIS_MIN_IDLE_CONNS: "2" + REDIS_READ_TIMEOUT: "3" + REDIS_WRITE_TIMEOUT: "3" + REDIS_DIAL_TIMEOUT: "5" + REDIS_POOL_TIMEOUT: "2" + REDIS_MAX_RETRIES: "3" + REDIS_MIN_RETRY_BACKOFF: "8" + REDIS_MAX_RETRY_BACKOFF: "1" + + # Authentication (lib-auth + plugin-auth) + PLUGIN_AUTH_ENABLED: "false" + PLUGIN_AUTH_HOST: "http://plugin-access-manager-auth:4000" + + # API Documentation (unified Huma OpenAPI 3.1) + SWAGGER_ENABLED: "true" + + # Local resilience sample provider mode + EXAMPLE_STATUS_PROVIDER_MODE: "healthy" + + # Infrastructure boot timeout + INFRA_CONNECT_TIMEOUT_SEC: "30" + + # OpenTelemetry + ENABLE_TELEMETRY: "false" + OTEL_LIBRARY_NAME: "github.com/LerianStudio/lender" + OTEL_RESOURCE_SERVICE_NAME: "lender" + OTEL_EXPORTER_OTLP_ENDPOINT: "" + OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: "production" + DB_METRICS_INTERVAL_SEC: "15" + + # Rate limiting + RATE_LIMIT_ENABLED: "true" + RATE_LIMIT_MAX: "500" + RATE_LIMIT_WINDOW_SEC: "60" + AGGRESSIVE_RATE_LIMIT_MAX: "100" + AGGRESSIVE_RATE_LIMIT_WINDOW_SEC: "60" + RELAXED_RATE_LIMIT_MAX: "1000" + RELAXED_RATE_LIMIT_WINDOW_SEC: "60" + ALLOW_RUNTIME_RATELIMIT_DISABLE: "true" + + # Idempotency + IDEMPOTENCY_RETRY_WINDOW_SEC: "300" + + # Pagination + MAX_PAGINATION_LIMIT: "100" + MAX_PAGINATION_MONTH_DATE_RANGE: "3" + + # M2M credentials (non-secret; provider stays off until M2M_TARGET_SERVICE is set) + M2M_CREDENTIAL_CACHE_TTL_SEC: "300" + AWS_REGION: "us-east-1" + + # Circuit breaker starter + CIRCUIT_BREAKER_ENABLED: "false" + + # Borrower collection issuance (off) + COLLECTION_ENABLED: "false" + + # Bounded raw-body collection webhook listener (off) + COLLECTION_WEBHOOK_ENABLED: "false" + COLLECTION_WEBHOOK_ADDRESS: ":9081" + COLLECTION_WEBHOOK_BODY_LIMIT_BYTES: "1048576" + COLLECTION_WEBHOOK_MAX_SKEW_SEC: "300" + COLLECTION_WEBHOOK_UPSTREAM_TLS_TERMINATION_VALIDATED: "false" + + # Outbox starter (off; all knobs non-sensitive) + OUTBOX_ENABLED: "false" + OUTBOX_TABLE_NAME: "outbox_events" + OUTBOX_DISPATCH_INTERVAL_SEC: "2" + OUTBOX_BATCH_SIZE: "50" + OUTBOX_PUBLISH_MAX_ATTEMPTS: "3" + OUTBOX_PUBLISH_BACKOFF_MS: "200" + OUTBOX_RETRY_WINDOW_SEC: "300" + OUTBOX_MAX_DISPATCH_ATTEMPTS: "10" + OUTBOX_PROCESSING_TIMEOUT_SEC: "600" + OUTBOX_MAX_FAILED_PER_BATCH: "25" + OUTBOX_INCLUDE_TENANT_METRICS: "false" + OUTBOX_ALLOW_EMPTY_TENANT: "true" + + # Streaming (Redpanda/Kafka) starter (off; non-secret knobs; SASL creds via secrets passthrough) + STREAMING_ENABLED: "false" + STREAMING_BROKERS: "localhost:9092" + STREAMING_CLIENT_ID: "lender" + STREAMING_CB_FAILURE_RATIO: "0.5" + STREAMING_CB_MIN_REQUESTS: "10" + STREAMING_CB_TIMEOUT_S: "30" + STREAMING_CLOSE_TIMEOUT_S: "30" + STREAMING_TLS_ENABLED: "false" + + # Inbound consignado consumer opt-in flags (all dark by default) + CONSUMER_CONSIGNADO_AVERBACAO_CONFIRMED_ENABLED: "false" + CONSUMER_CONSIGNADO_AVERBACAO_REJECTED_ENABLED: "false" + CONSUMER_CONSIGNADO_EMPLOYMENT_STATUS_REPORTED_ENABLED: "false" + CONSUMER_CONSIGNADO_REDIRECTION_OUTCOME_ENABLED: "false" + CONSUMER_CONSIGNADO_RECONCILIATION_RECEIVED_ENABLED: "false" + CONSUMER_CONSIGNADO_MATCH_RUN_COMPLETED_ENABLED: "false" + + # Consignado exclusion local worker tunables + CONSIGNADO_EXCLUSION_LOCAL_BATCH_SIZE: "50" + CONSIGNADO_EXCLUSION_LOCAL_TENANT_CONCURRENCY: "4" + CONSIGNADO_EXCLUSION_LOCAL_LEASE_SECONDS: "30" + CONSIGNADO_EXCLUSION_LOCAL_BACKOFF_BASE_SECONDS: "1" + CONSIGNADO_EXCLUSION_LOCAL_BACKOFF_MAX_SECONDS: "300" + CONSIGNADO_EXCLUSION_LOCAL_POLL_INTERVAL_MS: "1000" + + # RabbitMQ starter (off; non-secret knobs; RABBITMQ_DEFAULT_PASS via secrets passthrough) + RABBITMQ_ENABLED: "false" + RABBITMQ_HOST: "localhost" + RABBITMQ_PORT_AMQP: "5672" + RABBITMQ_PORT_HOST: "15672" + RABBITMQ_DEFAULT_USER: "lender" + RABBITMQ_VHOST: "/" + RABBITMQ_EXCHANGE: "events" + RABBITMQ_REQUIRE_HEALTH_ALLOWED_HOSTS: "false" + RABBITMQ_ALLOW_INSECURE_HEALTH_CHECK: "false" + RABBITMQ_ALLOW_INSECURE_TLS: "false" + RABBITMQ_PUBLISHER_CONFIRM_TIMEOUT_MS: "5000" + RABBITMQ_PUBLISHER_RECOVERY_INITIAL_MS: "1000" + RABBITMQ_PUBLISHER_RECOVERY_MAX_MS: "30000" + RABBITMQ_PUBLISHER_MAX_RECOVERIES: "10" + + # Multi-tenant starter (off). When enabled, the block below is rendered and + # MULTI_TENANT_URL / MULTI_TENANT_REDIS_HOST become required. + MULTI_TENANT_ENABLED: "false" + + # -- Secrets for storing sensitive data (rendered as stringData; AVP substitutes ). + # Range-based: add any additional credential key here (e.g. RABBITMQ_DEFAULT_PASS, + # MULTI_TENANT_SERVICE_API_KEY, MULTI_TENANT_REDIS_PASSWORD, STREAMING_SASL_PASSWORD) + # to inject it as an env var when you enable the corresponding feature. + # @default -- templates/secrets.yaml + secrets: + # -- PostgreSQL password. No default: supply explicitly (e.g. AVP ) + # or set useExistingSecret=true. Install fails if empty and useExistingSecret=false. + POSTGRES_PASSWORD: "" + # -- Redis / Valkey password (empty if auth disabled) + REDIS_PASSWORD: "" + # -- JWT signing secret + AUTH_JWT_SECRET: "" + + # -- Use an existing secret instead of rendering the secrets block + useExistingSecret: false + existingSecretName: "" + + # -- Extra environment variables (name/value) merged into the ConfigMap. + # GitOps escape hatch: set any additional key without a chart change. + extraEnvVars: [] + + serviceAccount: + # -- Specifies whether a ServiceAccount should be created + create: true + # -- Annotations for the ServiceAccount + annotations: {} + # -- Name of the service account + # @default -- `lender.fullname` + name: "" + +# lender-console (UI) — Vite/React SPA "lender-console". +# DISABLED by default: there is no UI image published today (no UI Dockerfile; +# the release pipeline builds only the Go API image). The skeleton below lets a +# future UI be wired without a chart change; keep enabled=false until an image exists. +lenderConsole: + # -- Enable or disable the lender console (UI) component + enabled: false + + # -- Service name + name: lender-console + + # -- Number of replicas for the console + replicaCount: 1 + + # -- Number of old ReplicaSets to retain for deployment rollback + revisionHistoryLimit: 10 + + image: + # -- Repository for the console (UI) container image. Published as `lender-ui` + # (Vite SPA -> nginx-unprivileged), matching the matcher-ui convention. + repository: ghcr.io/lerianstudio/lender-ui + # -- Image pull policy + pullPolicy: IfNotPresent + # -- Image tag (must be set before enabling the component) + tag: "" + + # -- Secrets for pulling images from a private registry + imagePullSecrets: + - name: ghcr-credential + + # -- Pod annotations for additional metadata + podAnnotations: {} + + podSecurityContext: {} + + securityContext: + # uid/gid 101 = the nginxinc/nginx-unprivileged runtime user (matches the + # lender-ui image and the matcher-ui reference). NOT 1000. + runAsGroup: 101 + runAsUser: 101 + runAsNonRoot: true + capabilities: + drop: + - ALL + allowPrivilegeEscalation: false + # readOnlyRootFilesystem intentionally NOT defaulted here (repo strict + # validator rejects a `false` chart default). nginx-unprivileged needs a + # writable root fs (pid/temp/cache under /tmp and /var/cache/nginx, plus the + # /config.js render at start), so every environment that enables the console + # sets `readOnlyRootFilesystem: false` explicitly in its own values overlay. + # With the key unset the container inherits the Kubernetes default (writable), + # which matches that behavior. Proper fix (emptyDir mounts + readOnly=true, + # as matcher-ui does) is tracked as a follow-up. + seccompProfile: + type: RuntimeDefault + + service: + # -- Kubernetes service type + type: ClusterIP + # -- Port for the UI HTTP server + port: 8080 + annotations: {} + + ingress: + # -- Enable or disable ingress + enabled: true + # -- Ingress class name + className: "nginx" + # -- Additional ingress annotations (host/group set by GitOps values) + annotations: + nginx.ingress.kubernetes.io/proxy-buffer-size: "16k" + hosts: + - host: "lender-console.lerian.net" + paths: + - path: / + pathType: Prefix + # -- TLS configuration for ingress + tls: [] + + resources: + limits: + cpu: 200m + memory: 256Mi + requests: + cpu: 50m + memory: 64Mi + + # -- Node selector for scheduling pods on specific nodes + nodeSelector: {} + + # -- Tolerations for scheduling on tainted nodes + tolerations: {} + + # -- Affinity rules for pod scheduling + affinity: {} + + # -- ConfigMap for the console (non-sensitive UI runtime config) + configmap: {} + + # -- Extra environment variables (name/value) for the console + extraEnvVars: [] From 8249a96a0c1b04e4687d1fc4992a76443e4c9342 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 14:38:56 +0000 Subject: [PATCH 096/113] chore(release): 1.0.0-beta.1 MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit ## (2026-07-17) ### ⚠ BREAKING CHANGES * **plugin-br-payments:** any values overlay using the previous keys (app.configmap.PROVIDER_*, app.secrets.PROVIDER_*) must be updated in the same change set that pins to 1.0.0-beta.2 or later. The follow-up gitops PR in midaz-firmino-gitops (firmino/dev/plugin-br-payments/values.yaml) is the only known consumer today. * the onboarding and transaction services have been consolidated into the ledger service. All Kubernetes resources (Deployment, Service, ConfigMap, Secret, Ingress, HPA, PDB, ServiceAccount) for both services have been removed from the chart. If you are already using the ledger service, no action is required. Migration (only if you were using onboarding or transaction services): - Remove and blocks from your values overrides - Ensure is set - All configuration is now managed under Also adds missing env vars to ledger configmap/secrets (swagger, multi-tenant, overdraft events, balance sync worker) * **plugin-access-manager:** Values path changed from 'auth.backend.migrations.image' (string) to 'auth.backend.migrations.image.repository' + '.tag' (object). Same for 'auth.initUser.image' and 'auth.initUser.imagePullPolicy'. Existing values overrides using the old string format will need updating. * **midaz:** Ledger service is now enabled by default, replacing the separate onboarding and transaction services. - ledger.enabled now defaults to true - onboarding and transaction services are automatically disabled when ledger is enabled - Existing deployments using onboarding/transaction need to explicitly set ledger.enabled=false to maintain current behavior Migration guide: docs/UPGRADE-5.0.md * **rabbitmq:** Default Rabbitmq no longer uses the bitnami chart. Persistent volume claims from the bitnami Statefulset may not be reused automatically * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. * **valkey:** Valkey no longer uses StatefulSet. Persistent volume claims from StatefulSet will not be reused automatically. * feat!(midaz): remove onboarding and transaction services from midaz chart ([41e88df](https://github.com/LerianStudio/helm/commit/41e88df0368450368cea9a001129d3d6d0f8bd02)) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](https://github.com/LerianStudio/helm/commit/e6cfb988be25319c0071b3fef2adfc250e251189)) * **values:** add app new version and reference default config ([b972952](https://github.com/LerianStudio/helm/commit/b97295261b87645884b197bbbf8aeea8dd78e452)) * **values:** add app new version and reference default secret ([ef8069c](https://github.com/LerianStudio/helm/commit/ef8069c403b3e7878571ddb3b92ee6f8be2f251f)) * **plugin-fees:** add APPLICATION_NAME, MULTI_TENANT_TIMEOUT, MULTI_TENANT_CACHE_TTL_SEC ([a7b6199](https://github.com/LerianStudio/helm/commit/a7b6199c800795da1300c47fd31412dd3f3b9853)) * **chart:** add auth backend helpers functions ([7248963](https://github.com/LerianStudio/helm/commit/72489636dfd8d57191e4d61da0369d6267b277df)) * **chart:** add auth backend templates ([57fb163](https://github.com/LerianStudio/helm/commit/57fb163b2c7cca15b1006ef493e3ee43b7cc616c)) * **onboarding:** add auth config ([8a055cb](https://github.com/LerianStudio/helm/commit/8a055cb83b9f6a9d9c76ca3343ab6a61c1d1c00c)) * **transaction:** add auth config ([a7ede5b](https://github.com/LerianStudio/helm/commit/a7ede5b29f6c69752cffad6970d5d73bd21062cb)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **plugin-br-pix-switch:** add bootstrap Jobs for postgres + mongodb ([79f12c7](https://github.com/LerianStudio/helm/commit/79f12c79a33464e64dd4c0dbfdab29ec116e3db9)) * add bootstrap-mongodb.yaml for idempotent MongoDB user/db provisioning ([c36e378](https://github.com/LerianStudio/helm/commit/c36e378b82a709e8ec50f659a19f9e654c3792b1)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **pipe:** add branch develop to generate beta release ([2990c0e](https://github.com/LerianStudio/helm/commit/2990c0e71d5b6773321b67c986b0a5a32b970cd3)) * **ci:** add chart standard validation and render gate ([9d4ab59](https://github.com/LerianStudio/helm/commit/9d4ab5980484335942ae7827954abcc0c97f633c)) * **fetcher:** add common configmap and secrets templates for shared configuration ([7f75dd0](https://github.com/LerianStudio/helm/commit/7f75dd089489faac6e797e657ea10a34f2e876d7)) * **midaz:** add conditional deployment logic for onboarding service and update ingress routing ([f2e3c76](https://github.com/LerianStudio/helm/commit/f2e3c76aa1fe0928439bf2cfbff401bd30078714)) * **midaz:** add conditional deployment logic for transaction service ([df12827](https://github.com/LerianStudio/helm/commit/df128273a67ebc2d6572c3bd0b798d534933489b)) * **plugin-smart-templates:** add configmap annotations ([adac247](https://github.com/LerianStudio/helm/commit/adac247e5d389e8587c8e5867d19547ce98bd810)) * **reporter:** add configurable secret for KEDA TriggerAuthentication ([d84a26d](https://github.com/LerianStudio/helm/commit/d84a26d398d1df7a487e053e25cdddc8cc37df88)) * **plugins:** add CRM data source secrets and disable ingress by default ([e262736](https://github.com/LerianStudio/helm/commit/e26273677fd0d683f02d79f7cb082b43e626a377)) * **midaz:** add CRM service with MongoDB integration and complete Kubernetes manifests ([a9368d2](https://github.com/LerianStudio/helm/commit/a9368d2d9a27d7f1278e0ec06ad7a4e25124b2d5)) * add crm ui functions ([3473c00](https://github.com/LerianStudio/helm/commit/3473c0089f1e0c6efe8eb71704e12c0913d07c55)) * add crm ui templates ([8089ad7](https://github.com/LerianStudio/helm/commit/8089ad7e7056b469abf9b07d880356ace2adbc3f)) * add dependencies to midaz helm ([e1e4095](https://github.com/LerianStudio/helm/commit/e1e4095c7e9fc48c69738c0610ee7ad4bd56c12a)) * **plugin-fees:** add deployment mode and readiness timeout settings ([fa5783b](https://github.com/LerianStudio/helm/commit/fa5783bb7cb7e64d32bb4c15c0e32b637aee5bb0)) * **values:** add deployment strategy definitions ([dd93837](https://github.com/LerianStudio/helm/commit/dd9383729db20e4f88265edde5900d35c7dbbafa)) * **console:** add deployment strategy ([0000ab0](https://github.com/LerianStudio/helm/commit/0000ab0a6c088e2eca167f396bff859638b478e4)) * **onboarding:** add deployment strategy ([220274b](https://github.com/LerianStudio/helm/commit/220274beb453eb54ec6e9c3a6020016cf8a7be91)) * **transaction:** add deployment strategy ([65076f4](https://github.com/LerianStudio/helm/commit/65076f421904b98f46329ff40cb31f7cf409476b)) * add doc ([5593a96](https://github.com/LerianStudio/helm/commit/5593a96ff02c3b968c4a703a5a7ccc2afa53be04)) * add doc ([97daf1e](https://github.com/LerianStudio/helm/commit/97daf1ecb4c2a51415c58cf0bc815a36d1e52cc3)) * add doc ([2f02d2e](https://github.com/LerianStudio/helm/commit/2f02d2ef0fad7ad80fe131253a8e232b66499430)) * add doc ([6e20f92](https://github.com/LerianStudio/helm/commit/6e20f92c1c31fa26560edfa77fec348783564de2)) * **product-console:** add dynamic OTEL host injection support ([4f473e9](https://github.com/LerianStudio/helm/commit/4f473e94c54955f11383f7f439a5c8d2454b47ae)) * **midaz:** add external OTEL collector support ([f38af29](https://github.com/LerianStudio/helm/commit/f38af29a9900c118d72e07481487b146e9dab02e)) * add external secret support for RabbitMQ and Postgres definitions in Helm chart ([0994db6](https://github.com/LerianStudio/helm/commit/0994db63ae8857fc4fd5540164b9334df58b3415)) * add external secret support paramters to values file ([e35c63e](https://github.com/LerianStudio/helm/commit/e35c63efac785fb1b5fa1c31643f1a3df1b143d4)) * add external secret support to deployment ([363ee02](https://github.com/LerianStudio/helm/commit/363ee020e997e8da492cfb284b10d33c08ab780a)) * add external secret support to worker job ([58809e1](https://github.com/LerianStudio/helm/commit/58809e1efded5775234e5bdc3018d3584694a7df)) * add external secret support to worker values file ([4e62d4f](https://github.com/LerianStudio/helm/commit/4e62d4fb02c8f17009f40e6f2d04d837d404feec)) * **scripts:** add fallback to root image.tag in chart version update script ([4fdcb77](https://github.com/LerianStudio/helm/commit/4fdcb77603969e24faab5a82527abddcb2517534)) * **plugin-fees:** add fees ui env var ([c1e52e1](https://github.com/LerianStudio/helm/commit/c1e52e1e525d168adce6be38a70470facaf18590)) * **fetcher:** add fetcher helm chart with manager and worker components ([363c0cf](https://github.com/LerianStudio/helm/commit/363c0cfd5b7c0049be06358ab34e8e4619897a98)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **doc:** add general readme and moving midaz readme ([41f11fe](https://github.com/LerianStudio/helm/commit/41f11fe167c213be99413d4b0b82a9becbe482f6)) * add gpg key and clean file ([81630ce](https://github.com/LerianStudio/helm/commit/81630ce857b0e00600b63d602c3dec4df45eab61)) * add gRPC port configuration for transaction service ([1f9f761](https://github.com/LerianStudio/helm/commit/1f9f7612cf82f8dd2803c00d665f461fc13c2e12)) * add gRPC port to transaction service ([30351b9](https://github.com/LerianStudio/helm/commit/30351b9dc6622ed4ab3ac1010c777d518537c999)) * **plugins:** add Helm chart for BC Correios plugin ([81bc419](https://github.com/LerianStudio/helm/commit/81bc41948bc410bf1952ab23081e2d205bf1f51f)) * add helm chart for BR PIX direct JD plugin with PostgreSQL dependency ([0adcba2](https://github.com/LerianStudio/helm/commit/0adcba27ed3fd6158b4632d3223f4a2f211545fb)) * add Helm chart for plugin-br-bank-transfer-jd ([2ee97b9](https://github.com/LerianStudio/helm/commit/2ee97b9986a7fc2821c3c3935e34eb183f02daf8)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **plugin-br-payments:** add helm chart ([85cfe2a](https://github.com/LerianStudio/helm/commit/85cfe2a00eb299bc252b6fe6c496c4166d5cd390)) * **plugin-br-pix-switch:** add helm chart ([8977d4b](https://github.com/LerianStudio/helm/commit/8977d4b73d6f9d3df64153b89f976279e7a3a43d)) * add helm hook weights and delete policies for postgres and rabbitmq resources ([1bb5bf8](https://github.com/LerianStudio/helm/commit/1bb5bf8e3a02b547123d9e0a395163adca958729)) * add Helm hooks to onboarding and transaction ConfigMaps for pre-install/upgrade ordering ([a163833](https://github.com/LerianStudio/helm/commit/a163833ccd5c476f2a624252cea0169780fd55fd)) * add helm-compose config and karpenter node ([9a52467](https://github.com/LerianStudio/helm/commit/9a52467339718fd820e76355e97113cb6104fc2c)) * **plugin-br-pix-indirect-btg:** add HMAC validation and mTLS BTG config envs ([d1563c4](https://github.com/LerianStudio/helm/commit/d1563c48a40a1ef1dc9e8fd387203dc91c188261)) * add IAM Roles Anywhere sidecar support for fetcher and matcher ([a67b756](https://github.com/LerianStudio/helm/commit/a67b756fed6c39b62dfacda1f2ae34fecbd2b12e)) * **plugin-fees:** add IAM Roles Anywhere sidecar support ([d9621a1](https://github.com/LerianStudio/helm/commit/d9621a1da9d48355713f8d53ee881e01f8350143)) * **reporter:** add IAM Roles Anywhere sidecar support ([2b76810](https://github.com/LerianStudio/helm/commit/2b7681083e0bd731d3fc2e8605b1c0a02a3cc975)) * add imagePullSecrets and resource limits to nginx deployment ([73edcda](https://github.com/LerianStudio/helm/commit/73edcda18eb3f27c3c62ade6db7f353e8fdaa78c)) * **plugin-br-pix-switch:** add in-cluster sibling URL defaults ([c1f7b8f](https://github.com/LerianStudio/helm/commit/c1f7b8fdc42bae4bb588987df29a5e32a3969712)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * add index to semantic-release versioning ([4c98cf1](https://github.com/LerianStudio/helm/commit/4c98cf120e280bcdb252fed83aab285f1fa0f5e8)) * add index to semantic-release versioning ([af4c306](https://github.com/LerianStudio/helm/commit/af4c306d8e6ece405b451407c941eb1bf4eff5bd)) * add ingress template ([44b73b2](https://github.com/LerianStudio/helm/commit/44b73b2e3d2330af536435194930132e65d2ecc2)) * **ingress:** add ingress templates ([020369a](https://github.com/LerianStudio/helm/commit/020369a13b9696eb2e6e12c389ed211d2feb95f1)) * **ingress:** add ingress templates ([816fcee](https://github.com/LerianStudio/helm/commit/816fcee9d905744bcd47003fb16b974104c2d2d3)) * add init container in casdoor to check if the database is ready ([#48](https://github.com/LerianStudio/helm/issues/48)) ([8337771](https://github.com/LerianStudio/helm/commit/833777165ff6ed1d4183cc48757acd2d8b7ddd83)) * add initial helm chart for BR Pix Direct JD plugin ([2f097d0](https://github.com/LerianStudio/helm/commit/2f097d0f713783cf599888c880fc82fa6eec0ea3)) * **underwriter:** add initial Helm chart for Underwriter service ([7bbba1a](https://github.com/LerianStudio/helm/commit/7bbba1afcb883a261ef121710a9f5d0a854326ff)) * **plugin-br-pix-indirect-btg:** add INTERNAL_WEBHOOK_SECRET and bump to 1.0.0-rc.26 ([e5ef789](https://github.com/LerianStudio/helm/commit/e5ef7890094698e5bd5faceacc1e56746e0f2305)) * **dependencies:** add job to apply default definitions to external rabbitmq host ([c91db90](https://github.com/LerianStudio/helm/commit/c91db90f8311960f818d7f0b0046bc9eda1a4e6b)) * add Kubernetes manifests for PIX QR code service deployment ([8b1881f](https://github.com/LerianStudio/helm/commit/8b1881f157b140d02bed50cd6d7e70e67b074cb1)) * add Kubernetes manifests for plugin-br-pix-direct-jd job deployment ([9b67a67](https://github.com/LerianStudio/helm/commit/9b67a67fd073657a1c1dd7751288275fe24619d0)) * **midaz:** add ledger service configuration and restructure values files ([d4332f9](https://github.com/LerianStudio/helm/commit/d4332f9a122f4cf9045f76c8ce1e76dd080beda6)) * **midaz:** add ledger service with unified API and migration helpers ([0ee6e83](https://github.com/LerianStudio/helm/commit/0ee6e83a4a04e185585e7391f9ff7271ef8546b1)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **doc:** add lerian banner ([35b904a](https://github.com/LerianStudio/helm/commit/35b904afb9d910e51b1508693aa7c3ce06ea9a75)) * add logical replication slot and improve SQL formatting ([ec2cfee](https://github.com/LerianStudio/helm/commit/ec2cfee6dab3fc571fb74e7e662c08000836a893)) * **plugin-fees:** add M2M and AWS_REGION env vars to chart ([f026d18](https://github.com/LerianStudio/helm/commit/f026d18e6b053f778b26d24dc1932a91f8c689d5)) * **fetcher:** add manager component Kubernetes manifests with full deployment configuration ([12ec0dd](https://github.com/LerianStudio/helm/commit/12ec0ddca52e9046324204ec7b717b87296e434b)) * **matcher:** add matcher helm chart ([6a235c1](https://github.com/LerianStudio/helm/commit/6a235c1fde13dc7ae70b3e719ed9b7dab4e3bb28)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **matcher:** add missing env vars for matcher v1.0.0+ ([0bf1e7f](https://github.com/LerianStudio/helm/commit/0bf1e7f71c9dbb9ffea852f369def1d61ebfffac)) * **plugin-br-pix-indirect-btg:** add missing inbound webhook entity envs and security tier config ([ca62f49](https://github.com/LerianStudio/helm/commit/ca62f49564f7bf5c543028ec639870a762410605)) * **charts:** add missing NEU app env vars to reporter and fetcher ([8d4db13](https://github.com/LerianStudio/helm/commit/8d4db13cd6f1c1ebda31797c799b6d2ecebc7e5c)) * **product-console:** add MONGO_PARAMETERS env var for TLS/auth options ([164468c](https://github.com/LerianStudio/helm/commit/164468c7bbe92e069a3d4d25bd05eef17f8827c6)) * **plugin-br-pix-switch:** add mongodb + rabbitmq subchart dependencies ([0e9b3d4](https://github.com/LerianStudio/helm/commit/0e9b3d42d6cadd7e93d1ebd7e3d353d58c57f2cf)) * **console:** add mongodb environments ([256757e](https://github.com/LerianStudio/helm/commit/256757eb38cff41510d114572f4d18d92569fd6f)) * **console:** add mongodb environments ([88db3ba](https://github.com/LerianStudio/helm/commit/88db3bad7e8f2ec4fe5056980cbb7e41cdd02c38)) * **console:** add mongodb environments ([7c86ca0](https://github.com/LerianStudio/helm/commit/7c86ca00a65680a99b642d976ac36578c39c31f9)) * **console:** add mongodb port ([73ec8e2](https://github.com/LerianStudio/helm/commit/73ec8e27a619c333a6f2cfe60fcc0c8d49fd8295)) * **plugin-fees:** add MULTI_TENANT_ALLOW_INSECURE_HTTP to configmap template ([48cf209](https://github.com/LerianStudio/helm/commit/48cf20922c92bf3ece54122be84251913497c9a4)) * **plugin-fees:** add multi-tenant support and fix AVP secret rendering ([#1229](https://github.com/LerianStudio/helm/issues/1229)) ([04e12ac](https://github.com/LerianStudio/helm/commit/04e12acc2a1f0188fe78b227896880aa8f60bd28)) * **flowker:** add multi-tenant support and missing env vars ([9892b7d](https://github.com/LerianStudio/helm/commit/9892b7d9635f3b29d1159eccc60e5fd891d2badc)) * **tracer:** add multi-tenant support to chart (2.1.0-beta.1) ([a4c4a7e](https://github.com/LerianStudio/helm/commit/a4c4a7e62e71016696b0fc166eee66df2c76d61e)) * **console:** add new console env vars ([cf974b8](https://github.com/LerianStudio/helm/commit/cf974b8d696f9eb89e951fd144632d0e5817291f)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-fees:** add new env vars for v3.1.0 ([f824431](https://github.com/LerianStudio/helm/commit/f8244314c78d1bfc76a3a83dce58e5e29d330b17)), closes [#1195](https://github.com/LerianStudio/helm/issues/1195) * **console:** add new env vars ([a228e39](https://github.com/LerianStudio/helm/commit/a228e39c856f9f4b561d55949edcaa051d5b9af9)) * **console:** add new env vars ([8b8d76f](https://github.com/LerianStudio/helm/commit/8b8d76f525a96f36c1d694c65db51ed7280a68a5)) * **dependencies:** add new parameters to chart file ([#44](https://github.com/LerianStudio/helm/issues/44)) ([4796070](https://github.com/LerianStudio/helm/commit/4796070cb5ad4c32d28bbb7ffc085b5fb3aeb495)) * **doc:** add new version ([39c0a71](https://github.com/LerianStudio/helm/commit/39c0a71dacbe9c80aa095a580c5d42d153b0947b)) * **doc:** add new version ([f864ad2](https://github.com/LerianStudio/helm/commit/f864ad20353a26f7dbe525332ef3b54f6af6fb74)) * add nginx configuration templates ([5755baa](https://github.com/LerianStudio/helm/commit/5755baaef5a346db79dfb78c7638b74c928c442f)) * add nginx dependence for midaz-console ([baa0cd4](https://github.com/LerianStudio/helm/commit/baa0cd4e4a209c520a2cb8e7de67c154f8a39e24)) * **midaz:** add nginx paramters to midaz-console ([84ff310](https://github.com/LerianStudio/helm/commit/84ff3103d5cd01da01c64c15eec4a83c5df66f17)) * **fetcher:** add OpenTelemetry HOST_IP injection support ([0ea3d75](https://github.com/LerianStudio/helm/commit/0ea3d7570288ab2e6e99a8f81564b031e11af626)) * add option to use existing secrets in helm chart ([f810082](https://github.com/LerianStudio/helm/commit/f810082fe8ce19eb69823f12b92345e418bb68d8)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * add plugin crm ui values ([493e4eb](https://github.com/LerianStudio/helm/commit/493e4eba4bf4457bbd75cf21334d33f16267b833)) * add plugin crm ui values ([c31de8d](https://github.com/LerianStudio/helm/commit/c31de8d30aedca6c9b4cc91b096c1e76a92a1a35)) * add plugin fees ui templates ([3451909](https://github.com/LerianStudio/helm/commit/345190944d3648c0ebae6e47890967cfefcc7e49)) * add plugin to semantic-release ([4ec01d8](https://github.com/LerianStudio/helm/commit/4ec01d8aceef35145239ae5b513977531798b329)) * add plugin to semantic-release ([d102c52](https://github.com/LerianStudio/helm/commit/d102c52039f5c1262f9dc00eb07728d226e656ef)) * add plugin to semantic-release ([a26017e](https://github.com/LerianStudio/helm/commit/a26017e363c87530e30e96e9b5fdc2581c19bb49)) * add plugin to semantic-release ([b001de0](https://github.com/LerianStudio/helm/commit/b001de0f2fad2b2b1cf05b5c0db9f48aa1af5265)) * add plugin to semantic-release ([f786586](https://github.com/LerianStudio/helm/commit/f7865866e41aad38bdf343e45fce351fa2af2a9b)) * add plugin to semantic-release ([13f0af3](https://github.com/LerianStudio/helm/commit/13f0af38e59cf9fb7a3596293a83dd3e6b9757a0)) * add postgres definitions and update security settings for console deployment ([6371b55](https://github.com/LerianStudio/helm/commit/6371b5568b94bc8f6fe57817132dee4644870ef3)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](https://github.com/LerianStudio/helm/commit/f6e469519784f6f301929066c55a152698e16d77)) * add pre-install and pre-upgrade hooks to onboarding and transaction secrets ([8199e92](https://github.com/LerianStudio/helm/commit/8199e92a9904adfc89adc6acf65a367d6c42b7e7)) * **product-console:** add product-console helm chart ([c956078](https://github.com/LerianStudio/helm/commit/c956078bd0959c13f42a018aa52b80862781b11d)) * **fetcher:** add RabbitMQ bootstrap job with definitions for external RabbitMQ instances ([90c5edc](https://github.com/LerianStudio/helm/commit/90c5edc90b4798ed0d31e56ca9479095889a521e)) * add RabbitMQ consumer credentials configuration in values-template ([da5c625](https://github.com/LerianStudio/helm/commit/da5c6255dfc8a2a671f9dfb88bb511d0536ddd6e)) * add rate limit configuration to midaz, fetcher, and reporter charts ([db2ec46](https://github.com/LerianStudio/helm/commit/db2ec461f6df0cc003cfe05fe4dd33df08d27d4e)) * add RBAC and nginx restart capability to service discovery job ([236e62f](https://github.com/LerianStudio/helm/commit/236e62f776e356b716fbd3059c37377cdbd154b6)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **pipe:** add release step for ghcr ([f0e4f3f](https://github.com/LerianStudio/helm/commit/f0e4f3f5221b392bb68b2a5f87aa85facc5cfbee)) * **plugin-br-pix-indirect-btg:** add required validation for INTERNAL_WEBHOOK_SECRET ([df410e2](https://github.com/LerianStudio/helm/commit/df410e2d27b21a724447b44d50f9faaed7796be6)) * **plugin-fees:** Add SA template Fees ([14af5bd](https://github.com/LerianStudio/helm/commit/14af5bdd8e0cb45747c5d23797ed10ac6f4a96a3)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **console:** add secrets ([ad89e3b](https://github.com/LerianStudio/helm/commit/ad89e3ba7bd1713686bc0546be1e6b11341b10da)) * add security context and service account to nginx deployment ([3eaa99e](https://github.com/LerianStudio/helm/commit/3eaa99e8ecf17e3992e0c952699c2c111cf3aac3)) * **chart:** add security context to plugin identity ([47b48fc](https://github.com/LerianStudio/helm/commit/47b48fc9ec49f706519fceb4a7007c0179f62317)) * **pipe:** Add semantic changelog ([8c65e59](https://github.com/LerianStudio/helm/commit/8c65e5970101edc9ac621ec30b783bbc4fc3225c)) * **pipe:** Add semantic changelog ([452b6e7](https://github.com/LerianStudio/helm/commit/452b6e78b97a10aa4cd94daf5c95cd1545dc8222)) * **pipe:** Add semantic changelog ([c54115e](https://github.com/LerianStudio/helm/commit/c54115ebf8bd43a0dc8d41233d1100ac136ba8c3)) * **pipe:** Add semantic changelog ([d9befbb](https://github.com/LerianStudio/helm/commit/d9befbb65561716987a9825587f5ac0c9b63be3b)) * **ci:** Add Semantic Release changelog ([6537310](https://github.com/LerianStudio/helm/commit/6537310682b459b7f9fd48ed3c18dd739a816b0f)) * add service discovery job to plugins ui ([2bdaf78](https://github.com/LerianStudio/helm/commit/2bdaf789279b7cbefef51dbc4ad4db219325df73)) * **reporter:** add ServiceAccount annotations support for IRSA ([3685103](https://github.com/LerianStudio/helm/commit/3685103f9547e595667f85a9267272e337f3b077)) * **fetcher:** add ServiceAccount support for worker ([aa616c7](https://github.com/LerianStudio/helm/commit/aa616c7e00827621e525f75e3eb23c44fa2c9993)) * add step to update gh-pages ([bd762c7](https://github.com/LerianStudio/helm/commit/bd762c72ead853758a349d52913a63b45ed40a5c)) * add step to update gh-pages ([ddffd1b](https://github.com/LerianStudio/helm/commit/ddffd1b3dfbd179e26958361965f93a62273af07)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **midaz:** add support to external screts ([ab13b87](https://github.com/LerianStudio/helm/commit/ab13b878fdf8c280dc9e95cf015a459ce8b1edc6)) * **tracer:** add tracer helm chart ([275c30e](https://github.com/LerianStudio/helm/commit/275c30e44dcc66052cfc459e997dd0618e5ca766)) * add transaction gRPC configuration and update service versions ([cb48384](https://github.com/LerianStudio/helm/commit/cb4838437068d4e616c864c7cd37340399c0f504)) * **midaz:** add user consumer config to rabbitmq ([fb28359](https://github.com/LerianStudio/helm/commit/fb28359f8a4634317aeebd56e40af1a9083eb857)) * **plugin-br-pix-indirect-btg:** add validation to ensure INTERNAL_WEBHOOK_SECRET matches ([0f485b2](https://github.com/LerianStudio/helm/commit/0f485b225b9b5cd23e01e6154770550df8a69043)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-smart-templates:** add valkey to smart templates chart ([709876b](https://github.com/LerianStudio/helm/commit/709876bb3b4d9c61a301d554f2f093615ad91084)) * add values template file ([7252f36](https://github.com/LerianStudio/helm/commit/7252f36fe7070fe18675073c21bb9269443270e8)) * **matcher:** add values-template and rabbitmq definitions ([3063245](https://github.com/LerianStudio/helm/commit/30632451da1ae248b1eeaf1dce680411b075f334)) * **matcher:** add VERSION env var and OTEL support ([cee8f96](https://github.com/LerianStudio/helm/commit/cee8f9682f769b77f6d2a5d52964b53dc92f9253)) * **plugin-br-pix-switch:** add wait-for-dependencies init container ([281226e](https://github.com/LerianStudio/helm/commit/281226e570ce08ce0ba412525986cb0766df77a2)) * **fetcher:** add worker component Kubernetes manifests with deployment, configmap and secrets ([fd8d8f3](https://github.com/LerianStudio/helm/commit/fd8d8f325262e945ed1e738efea2558e5ce9e2c6)) * add worker reconciliation config ([596c5a9](https://github.com/LerianStudio/helm/commit/596c5a91ed1fd498a7efc964f65cad94cc6b47c8)) * **console:** adds new env vars ([473cf5a](https://github.com/LerianStudio/helm/commit/473cf5a8d681e42c9ad8318b42b08dbea1e3e045)) * ajuste utilização recursos console ([44c7e64](https://github.com/LerianStudio/helm/commit/44c7e641170ad5e9b0a3629971c2cdc731059928)) * allow custom nginx configmap names and update plugins.conf path to snippets directory ([fe69b7b](https://github.com/LerianStudio/helm/commit/fe69b7b26b86c85a8d916afae4c9c9b009d8ba0d)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **plugin-br-pix-switch:** auto-derive OTEL service version + node-IP OTLP endpoint ([15e6196](https://github.com/LerianStudio/helm/commit/15e6196cf549401084b7c6a1d7afd55c13f194b5)) * **reporter,fetcher:** auto-set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image tag ([bcc28f1](https://github.com/LerianStudio/helm/commit/bcc28f1bdc02b51347e677a8d26ac5ab7d7c40b6)) * **plugin-br-pix-switch:** auto-wire URLs to in-cluster subcharts ([561b398](https://github.com/LerianStudio/helm/commit/561b39871e2a17028eb56b9f3c0490ee74c5df43)) * **plugin-access-manager:** bump auth version ([12d5453](https://github.com/LerianStudio/helm/commit/12d54531235c76ccb25de1e976336505a0c51c91)) * **plugin-access-manager:** bump auth version ([10b5e4c](https://github.com/LerianStudio/helm/commit/10b5e4c9d7cc99ed93ff254b3e5c2632df25b9c6)) * **plugin-access-manager:** bump auth version ([90c6906](https://github.com/LerianStudio/helm/commit/90c6906ac94512dc14308f871aa4ed82717de49d)) * **midaz:** bump chart version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable ([bb157a4](https://github.com/LerianStudio/helm/commit/bb157a4472446033b94ab96837433e4df160555f)) * casdoor bump version ([bf5e28c](https://github.com/LerianStudio/helm/commit/bf5e28c0d3a259c192e94023fe1701bcca3d4fe4)) * **midaz:** config internal collector in midaz ([07d310e](https://github.com/LerianStudio/helm/commit/07d310ef840b1b95f86b6bdf1f75eba1a7e5b64a)) * **midaz:** config internal collector in midaz ([fb7d829](https://github.com/LerianStudio/helm/commit/fb7d8290ad20cb4e92ccd7eea19c07bb46b46bc7)) * **chart:** configure pdb to auth backend ([112bc47](https://github.com/LerianStudio/helm/commit/112bc47d72db94b57e81138297d973cb31d4ddf6)) * **helm:** create chart file to plugin crm ([69b01c8](https://github.com/LerianStudio/helm/commit/69b01c868752eb91973e2d292eb2e7ffaa57c1e0)) * **helm:** create chart file to plugin-fees ([38a0e81](https://github.com/LerianStudio/helm/commit/38a0e81c29d53bb81bb1895869b058942bc1d116)) * create chart midaz opensource ([afeadcf](https://github.com/LerianStudio/helm/commit/afeadcf46aef60af8b74055695a55fc00131f029)) * **helm:** create chart templates to plugin crm ([777ea2f](https://github.com/LerianStudio/helm/commit/777ea2fa1582d1530fbc4946c4ef184ae90598e9)) * **chart:** create chart templates to plugin-fees ([adabbaa](https://github.com/LerianStudio/helm/commit/adabbaaf405b471b111abe208408fce9c0772e99)) * **chart:** create chart templates to plugin-fees ([303caf0](https://github.com/LerianStudio/helm/commit/303caf06a48ff63e20fcdd13fd2c5d0629aae33c)) * **helm:** create doc to plugin crm ([4cbaa9d](https://github.com/LerianStudio/helm/commit/4cbaa9d4e8377260508c5687f292cfec8dbeee36)) * **plugin-smart-templates:** create functions to plugin-smart-templates ui ([d660619](https://github.com/LerianStudio/helm/commit/d6606192c1c6f0c0bd404e3b44c660079ce653b9)) * **plugin-smart-templates:** create helm templates to plugin-smart-templates ui ([a06f9c0](https://github.com/LerianStudio/helm/commit/a06f9c06c2d89de0a7f8ce6ba845057a8af3c268)) * **dependencies:** create init config file ([bddd6f0](https://github.com/LerianStudio/helm/commit/bddd6f025782740e3fc021ae4d7e64c0e78fd580)) * **dependencies:** create init sql file ([dcca103](https://github.com/LerianStudio/helm/commit/dcca103dcf229a307833685ad04711f662099219)) * **midaz:** create internal collector helm chart ([d17a5a4](https://github.com/LerianStudio/helm/commit/d17a5a45388428c30fa2133a58e275d445b634c7)) * **dependencies:** create job to apply migrations in casdoor db ([5a74bcc](https://github.com/LerianStudio/helm/commit/5a74bcc6ca8691159c4a3d11826a5afb34909e49)) * **values:** create pdb definitions ([fe34974](https://github.com/LerianStudio/helm/commit/fe34974aaa497979e0d13b610b77b4d1d7895f2f)) * **console:** create pdb template ([102c56a](https://github.com/LerianStudio/helm/commit/102c56a6e697623317585b8808f09f3cb7458882)) * **onboarding:** create pdb template ([8bc0d48](https://github.com/LerianStudio/helm/commit/8bc0d489407c8c5181a20f2c731e5abc7946b8b6)) * **transaction:** create pdb template ([738f5d3](https://github.com/LerianStudio/helm/commit/738f5d3ff33cc62f155186af1514340fa3133503)) * **chart:** create plugin access manager auth templates ([2fdd9ac](https://github.com/LerianStudio/helm/commit/2fdd9ac466966c5557757afae07a52f9894240fd)) * **chart:** create plugin access manager chart file ([094eecc](https://github.com/LerianStudio/helm/commit/094eeccff09029260104c7428a254c25260d20d6)) * **chart:** create plugin access manager identity templates ([c52068d](https://github.com/LerianStudio/helm/commit/c52068d228e3a79bbf4904e9823fb29407694add)) * **chart:** create plugin access manager templates ([c4221ad](https://github.com/LerianStudio/helm/commit/c4221adf91b52acc3c590d9d7b1f8db314f01d88)) * **values:** create plugin access manager values file ([b1727d0](https://github.com/LerianStudio/helm/commit/b1727d0f162fb1c464b35559f5684740a5af819e)) * create plugin fees ui functions ([0d2c127](https://github.com/LerianStudio/helm/commit/0d2c127d3d4f1aed530a864937e4e0e5fe7c8332)) * **plugin-smart-templates:** create secret to plugin-smart-templates ui ([552d061](https://github.com/LerianStudio/helm/commit/552d06115d589ceb41ac5d201fe972e82fc4c588)) * **plugin-smart-templates:** create values defintions to plugin-smart-templates ui ([48a25ca](https://github.com/LerianStudio/helm/commit/48a25ca3f4d889ba827a3674a284a563dbcbb105)) * **helm:** create values file to plugin crm ([de6b154](https://github.com/LerianStudio/helm/commit/de6b1547947f91d580a9ff5f7fb14c1e5efa4d0d)) * **values:** create values file to plugin-fees ([304f228](https://github.com/LerianStudio/helm/commit/304f22871b76180f4b299daa3ecaac06571ffd92)) * **values:** create values file to plugin-fees ([f383281](https://github.com/LerianStudio/helm/commit/f383281421b709744823d9de1bc053288ab6d747)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** default DEPLOYMENT_MODE to byoc (1.1.0-beta.3) ([aa12385](https://github.com/LerianStudio/helm/commit/aa12385a12d159121c021f53350ebac3f90b3668)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](https://github.com/LerianStudio/helm/commit/4946cb505bb4ee121910113c4ca78a74e8a97269)) * dependency update ([18bd991](https://github.com/LerianStudio/helm/commit/18bd9910348f05785a975b38d8b11068f1069407)) * dependency update ([b56d142](https://github.com/LerianStudio/helm/commit/b56d1421e7251dc932d4b025cc6be4be31ee3c42)) * dependency update ([55eb548](https://github.com/LerianStudio/helm/commit/55eb5489f192d16508b7ecfd93bddcf71aa42feb)) * **grafana:** disable grafana ([423a6f5](https://github.com/LerianStudio/helm/commit/423a6f5495c50c4ccae86c5391cb52841af300e8)) * **plugni-fees:** Disable SA create ([4074905](https://github.com/LerianStudio/helm/commit/4074905ddec1dec2c62eab214fdbff1b548ef329)) * **plugin-fees:** enable extra env vars to configmap template ([5f60cea](https://github.com/LerianStudio/helm/commit/5f60ceac653f34a021d0db1a10447113fb693005)) * **plugin-fees:** enable extra env vars to values yaml ([dc626a7](https://github.com/LerianStudio/helm/commit/dc626a7a5825e0afbd1d44c1f56594f3a97f14fe)) * **plugin-crm:** enable extra env vars ([5ea9e2f](https://github.com/LerianStudio/helm/commit/5ea9e2fc7cda9500fe728d4bf2cd877844b666a4)) * **plugin-smart-templates:** enable extra env vars ([c03007b](https://github.com/LerianStudio/helm/commit/c03007bf50902abd45c54d5bee3296450a13d50b)) * enable karpenter node ([02b029d](https://github.com/LerianStudio/helm/commit/02b029d1a18e462be5c5c11c5d0c5f0cceee6122)) * **midaz:** enable ledger service by default ([1abf1f1](https://github.com/LerianStudio/helm/commit/1abf1f1b1944583717002bd23d2fb72fae71a676)) * enable telemetry for onboarding and transaction services ([2497433](https://github.com/LerianStudio/helm/commit/2497433be24d42829985604f47cf983705c05f6e)) * **console:** enforce absolute DNS resolution ([8e519fe](https://github.com/LerianStudio/helm/commit/8e519fe25255119d50ecfef91ca8ab5a01df5f78)) * **onboarding:** enforce absolute DNS resolution ([c471521](https://github.com/LerianStudio/helm/commit/c471521eb53ce2e100f080247c2ff25bc1255650)) * **transaction:** enforce absolute DNS resolution ([1759a5b](https://github.com/LerianStudio/helm/commit/1759a5b1ce44339302482bd5ccabed5056c33a2f)) * **ci:** enforce single-source infra secrets ([3b787d5](https://github.com/LerianStudio/helm/commit/3b787d508ba556c21b036b41ff990245e7258427)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](https://github.com/LerianStudio/helm/commit/756a1f9c85d570a539866b54f070192d40cb2f59)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **midaz:** extend RBAC permissions for discovery service to access replicasets and list/watch deployments ([9285689](https://github.com/LerianStudio/helm/commit/9285689f5bbb1ae361741668834473809cb7c86b)) * **matcher:** finalize matcher helm chart for v1.0.0 ([2be45e9](https://github.com/LerianStudio/helm/commit/2be45e958cbc4fc001831c1f87b11a1aea472d15)) * **ci:** harden validator with collapse gate ([cc324ee](https://github.com/LerianStudio/helm/commit/cc324ee94663baa3228d6b4ed754cc09d0ac4fbf)) * helm doc ([#26](https://github.com/LerianStudio/helm/issues/26)) ([ccb3021](https://github.com/LerianStudio/helm/commit/ccb30211fbd9ab5b1ff5e3151f1f9361d25e3cff)) * improve Helm setup reliability in release workflow ([eb49cc3](https://github.com/LerianStudio/helm/commit/eb49cc348065b87027112371b4496080b25dd4e4)) * **midaz:** improve RabbitMQ bootstrap script with smart URL handling and enhanced logging ([8d99add](https://github.com/LerianStudio/helm/commit/8d99addbd1dec7b570ccdb9fc7f6add52564172d)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](https://github.com/LerianStudio/helm/commit/e67d89c3fffa8154989f6d71f65582331fba98d9)), closes [#138](https://github.com/LerianStudio/helm/issues/138) * **lerian-notification:** initial chart ([2a001d4](https://github.com/LerianStudio/helm/commit/2a001d4ba433a61cd3317929cc96045c42561bfd)) * **bootstrap-mongodb:** make app user and roles configurable via values ([5a37252](https://github.com/LerianStudio/helm/commit/5a37252bc760b70a50ad1814d5fb7955065f7400)) * **plugin-access-manager:** make createDatabase configurable ([1574601](https://github.com/LerianStudio/helm/commit/1574601cb8d8a8d2a8cdf9f360dc695f5f102bfb)) * midaz helm chart ([8768a8e](https://github.com/LerianStudio/helm/commit/8768a8e1f97dbe82d0cb96b899c3865e7b9c95c3)) * midaz helm chart ([94b2a6e](https://github.com/LerianStudio/helm/commit/94b2a6eab897bb6c1cd6f336fc9cf12f642ad697)) * **rabbitmq:** migrate from Bitnami chart to groundhog2k chart ([454c850](https://github.com/LerianStudio/helm/commit/454c850bb9bce3b24f62bea34cf65997a55fcf2b)) * **valkey:** migrate from StatefulSet to Deployment ([3854dfe](https://github.com/LerianStudio/helm/commit/3854dfe3430eaf7f4d99e39d032103eca4ff10fd)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **plugin-br-bank-transfer:** move CLIENT_IDs to secrets ([d3e36c0](https://github.com/LerianStudio/helm/commit/d3e36c03dce5f43305daf1c6da2da4f65a142f76)) * **pipe:** new pipe to deploy all charts ([20629f5](https://github.com/LerianStudio/helm/commit/20629f50ce386463a83ac0ebc0fce367430f04a0)) * **pipe:** new releaserc template ([24dc653](https://github.com/LerianStudio/helm/commit/24dc653adae4f036f7d5b9da044f42c43e9acd09)) * onboarding bump version ([4fc43e7](https://github.com/LerianStudio/helm/commit/4fc43e748f50fc4afd34e475a1c7d7360efaf3bc)) * onboarding rabbitmq protocol variable ([add46ac](https://github.com/LerianStudio/helm/commit/add46ac46bdcf1e629db5f92d4e129f550e93cfb)) * onboarding rabbitmq protocol variable ([01b91e6](https://github.com/LerianStudio/helm/commit/01b91e690ca469e58800047c055c872b90ab00d8)) * onboarding rabbitmq protocol variable ([9980d0c](https://github.com/LerianStudio/helm/commit/9980d0cd82b658b34d9244cc524630222f0cf61e)) * onboarding rabbitmq protocol variable ([3d44fa1](https://github.com/LerianStudio/helm/commit/3d44fa1c77b8442600f272497fd4fe79351aadf9)) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](https://github.com/LerianStudio/helm/commit/82dbb81fda6cb8611844cabdaff52b9cc65758b1)) * **charts:** parametrize probe path and timing for all charts using /readyz ([c4d15a2](https://github.com/LerianStudio/helm/commit/c4d15a20995b4edbcf11ce8576c1b80b5a05287d)) * **ci:** per-chart values.schema.json generator ([d295433](https://github.com/LerianStudio/helm/commit/d2954334953f15a1db0ee47064d5885bcec89f6b)) * **plugin-br-pix-switch:** per-component command/args for single-image multi-binary support ([d607978](https://github.com/LerianStudio/helm/commit/d607978e45aedec2137b0ecf5505529a08a254cd)) * **plugin-br-pix-switch:** per-component image repository defaults (1.1.0-beta.6) ([48b9d17](https://github.com/LerianStudio/helm/commit/48b9d17c3930e97c3d84355f6c56c39f739913b8)), closes [#137](https://github.com/LerianStudio/helm/issues/137) * plugin auth bump version ([f99a6fb](https://github.com/LerianStudio/helm/commit/f99a6fb0ad500f482703e87bb47ff5a87be857ff)) * plugin identity bump version ([d98f1b5](https://github.com/LerianStudio/helm/commit/d98f1b57ca9d5445651721904a16587d7689241d)) * **midaz:** plugins ui support to console ([17f2376](https://github.com/LerianStudio/helm/commit/17f23766c70f1e1784f7cb83fccff7f54fcd5333)) * **midaz:** plugins ui support to console ([7eced23](https://github.com/LerianStudio/helm/commit/7eced23afd42a256af0f28f308e814058b046f17)) * **midaz:** plugins ui support to console ([495afa4](https://github.com/LerianStudio/helm/commit/495afa420d2395027082a7b8b14fc7402512ede2)) * **midaz:** plugins ui support to console ([3b8ad93](https://github.com/LerianStudio/helm/commit/3b8ad93dfac6f20ab87a23f3c7e1e0eca853c252)) * **midaz:** plugins ui support to console ([3af6680](https://github.com/LerianStudio/helm/commit/3af668074fe67d2c6abf5a9a15dacb906d9200db)) * **midaz:** plugins ui support to console ([8303bad](https://github.com/LerianStudio/helm/commit/8303badc38db540dbbbb60ad0cf6384a3642ca50)) * **midaz:** plugins ui support to console ([d902801](https://github.com/LerianStudio/helm/commit/d90280110322bed7b0b54fd781320c361582ad36)) * postgres replication ([fa57f99](https://github.com/LerianStudio/helm/commit/fa57f99ed9d8dc8a157b776c65a02beb6f3453b4)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **plugin-br-pix-switch:** providersIngress for outbound-provider adapters (1.1.0-beta.8) ([061f8b9](https://github.com/LerianStudio/helm/commit/061f8b9ed0bc9ac7d94629980121a32022edc020)) * **plugin-br-pix-switch:** refactor chart to multi-component (1.1.0-beta.2) ([ea1ff08](https://github.com/LerianStudio/helm/commit/ea1ff08c41a4c3f6d94715977f9792d307d9ee1d)) * refactor plugin fees templates folder ([af27cba](https://github.com/LerianStudio/helm/commit/af27cbaaf3255ca7b4bb62acd7cbdc221b3ab2bb)) * **midaz:** remove console service and nginx components ([68be4ac](https://github.com/LerianStudio/helm/commit/68be4aca05f97e0a3bcdf35058dfccf8ee8e192a)) * **doc:** remove old components ([954dd09](https://github.com/LerianStudio/helm/commit/954dd097b1be74841efa6022a94d807e228c6ec4)) * **github:** remove pgbouncer reference ([49924e8](https://github.com/LerianStudio/helm/commit/49924e811d918e8ed136e878bb480da51096d98a)) * **pipe:** remove step commit history ([b0fd599](https://github.com/LerianStudio/helm/commit/b0fd5993ef1eecb84d34759552871d9f1447b7a3)) * **pipe:** remove step commit history ([e42b665](https://github.com/LerianStudio/helm/commit/e42b665d1bda4e9461e08b855e120fcb596c6521)) * **pipe:** remove step commit history ([ed1ec98](https://github.com/LerianStudio/helm/commit/ed1ec98c8132bd84ee4c344cd70ac9da355bf9af)) * **pipe:** remove step commit history ([b8b256d](https://github.com/LerianStudio/helm/commit/b8b256d997e838caea71ced0ed190e24aa73896a)) * **pipe:** remove step commit history ([a56f7c6](https://github.com/LerianStudio/helm/commit/a56f7c6027fe4e5c90f08231b2cab83e1dc4cc30)) * **pipe:** remove step commit history ([323b43a](https://github.com/LerianStudio/helm/commit/323b43aa1b8b73d103cdaba3b692d2bde73ff772)) * rename Smart Templates to Reporter and enhance RabbitMQ config ([1b1c269](https://github.com/LerianStudio/helm/commit/1b1c269a3e43625c48535e7d759dff9fb5b159f8)) * **plugins:** restructur plugins with frontend add support for external secrets and create guide to upgrade ([ea4a669](https://github.com/LerianStudio/helm/commit/ea4a66964a13c4331f7cdd4ade710fe29177a23f)) * **plugin-br-pix-switch:** schema migration Jobs (1.1.0-beta.9) ([8e88410](https://github.com/LerianStudio/helm/commit/8e884103cf1e251711f442cec4055d703626d561)), closes [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) [plugin-br-pix-switch#143](https://github.com/LerianStudio/plugin-br-pix-switch/issues/143) * **plugin-br-pix-switch:** shared multi-path ingresses (1.2.0-beta.1) ([78c74f4](https://github.com/LerianStudio/helm/commit/78c74f4ef0129663ce13ae4e2155927b02140468)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **reporter:** support external KEDA operator ([0f19cbe](https://github.com/LerianStudio/helm/commit/0f19cbecb1208201f6413921a6726e89616a09b1)) * support external secrets for RabbitMQ admin credentials in Helm chart ([76fa832](https://github.com/LerianStudio/helm/commit/76fa832de626e9ad6c8d44fb366c75cdd900f55d)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](https://github.com/LerianStudio/helm/commit/86eb65124a2e4c5a5590908fe5b6365c825215e8)) * **tracer:** template ENV_NAME in configmap ([50a6f50](https://github.com/LerianStudio/helm/commit/50a6f501b24164485475f64529514293e1e83211)) * transaction bump version ([84028fb](https://github.com/LerianStudio/helm/commit/84028fb3c2be79e976ac9bea48707696db4f40c4)) * transaction rabbitmq protocol variable ([27e075c](https://github.com/LerianStudio/helm/commit/27e075c1b2762d6648ed26c666491c6c039dd0ae)) * transaction rabbitmq protocol variable ([f0f8334](https://github.com/LerianStudio/helm/commit/f0f8334ff61cbcdad9b434e08547dab328fbf2fa)) * transaction rabbitmq protocol variable ([60ff71f](https://github.com/LerianStudio/helm/commit/60ff71f7b07e90ecfdb8c55895225682b25c2694)) * transaction rabbitmq protocol variable ([7fdc26c](https://github.com/LerianStudio/helm/commit/7fdc26c4bcdf7a7ebffe8bc5aaa662964c9a7605)) * **chart:** update app version ([348b0cc](https://github.com/LerianStudio/helm/commit/348b0ccb5fea5042fe08da2af81cbd0b323a7aca)) * **chart:** update app version ([6f40285](https://github.com/LerianStudio/helm/commit/6f402851add6d9898c04e263d5706644645cacb2)) * **helm:** update app version ([fb2f841](https://github.com/LerianStudio/helm/commit/fb2f84162e5951495e2ab12296f6855edb09fce7)) * **midaz:** update app version ([e18a30b](https://github.com/LerianStudio/helm/commit/e18a30b59c5f33cb462d6ac4bdd8c675097f2d9d)) * **values:** update app version ([598ed6d](https://github.com/LerianStudio/helm/commit/598ed6d478240d26ee9baa9560d73db1912ba05d)) * **values:** update apps version and add backend config ([7cb17c2](https://github.com/LerianStudio/helm/commit/7cb17c2225d0863ee655b6ea5fc5532421ffa93d)) * **dependencies:** update auth backend init file ([be72215](https://github.com/LerianStudio/helm/commit/be72215937655d4adb136ae9802d68ade6a279b9)) * **chart:** update auth backend templates ([8659b67](https://github.com/LerianStudio/helm/commit/8659b6758e533c9a0922d481107ba59656d3f0a5)) * **chart:** update auth templates ([a6221e4](https://github.com/LerianStudio/helm/commit/a6221e4b89edec63f40b80bd31574588d9204a5b)) * **chart:** update auth templates ([c5bcb23](https://github.com/LerianStudio/helm/commit/c5bcb23959466580106b98f7e3312195f7f42f35)) * **values:** update auth version ([b549735](https://github.com/LerianStudio/helm/commit/b54973599235c3f52058e68dcd499c8c21c8dac7)) * **doc:** update charts documentation ([422e771](https://github.com/LerianStudio/helm/commit/422e7717a8f7c79d96f4cdd110421f0c68857d82)) * **doc:** update charts documentation ([b9618c4](https://github.com/LerianStudio/helm/commit/b9618c462cf3f0ad6b3f237347ffae01fc23cb09)) * **midaz:** update console configmap ([bf616a3](https://github.com/LerianStudio/helm/commit/bf616a3ee69f10ab2ffa21fce05ed92a21d10c6e)) * **console:** update console image ([0cf1135](https://github.com/LerianStudio/helm/commit/0cf11350d345410c751d99cf8c5347793219b469)) * **console:** update console image ([4da311d](https://github.com/LerianStudio/helm/commit/4da311d8968411a29d129ef02e133b3ddd0bb25e)) * **console:** update console version ([d789c7d](https://github.com/LerianStudio/helm/commit/d789c7dc7596e65c90c0e18072687b2ea828b295)) * **values:** update console version ([778eea0](https://github.com/LerianStudio/helm/commit/778eea0d86f62b9257f4f94892ef2b340df945da)) * **values:** update extra env vars for postgres ([9852143](https://github.com/LerianStudio/helm/commit/9852143eff1ca1bbc3e6c33660d80ec4bb337d6d)) * **fetcher:** update fetcher-manager@1.1.0, fetcher-worker@1.1.0 - new env vars ([345798a](https://github.com/LerianStudio/helm/commit/345798aca7179ec1b36958b22b4f702fe772ce9a)) * **fetcher:** update fetcher-manager@1.2.0, fetcher-worker@1.2.0 - new env vars ([47785ab](https://github.com/LerianStudio/helm/commit/47785abc7269481a7b2365b49589b5bd614d0f41)) * **fetcher:** update fetcher-manager@1.3.0, fetcher-worker@1.3.0 - new env vars ([679fd73](https://github.com/LerianStudio/helm/commit/679fd73b41b0019aa0c75c782adae169826f1053)) * **pipe:** update gitignore ([6ae09d6](https://github.com/LerianStudio/helm/commit/6ae09d68f21e21e5b93834017c0525511baaf94a)) * **chart:** update identity templates ([f8def52](https://github.com/LerianStudio/helm/commit/f8def529a453cf4c2db448df07ba167ff14d6c83)) * **values:** update identity version ([f8ee875](https://github.com/LerianStudio/helm/commit/f8ee875bb51ac52300d683e366f976aa903077b2)) * **product-console:** update image tag to 1.5.0 and add upgrade guide ([a289f8c](https://github.com/LerianStudio/helm/commit/a289f8c27b440f30174dac68339fe50d83d27679)) * **values:** update midaz version ([#36](https://github.com/LerianStudio/helm/issues/36)) ([af4b898](https://github.com/LerianStudio/helm/commit/af4b898e7ed4e431ab853320a3275b9d219630f7)) * **migrations:** update migration logic and enable migrations job ([643f703](https://github.com/LerianStudio/helm/commit/643f703aed35990cb8997a2df90f1fe2bacf9494)) * **midaz:** update onboarding configmap ([7a28f50](https://github.com/LerianStudio/helm/commit/7a28f50d694f2b527d51d201205d486ce8b2d3d5)) * **midaz:** update otel env var ([769a770](https://github.com/LerianStudio/helm/commit/769a77004aebb612aed5d81b9dec30624a003734)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.10, job@1.2.1-beta.10 - new env vars ([63ae72c](https://github.com/LerianStudio/helm/commit/63ae72c6add50c9e0fbeff1567bb018afe3ef553)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.11, job@1.2.1-beta.11 - new env vars ([3b07e6b](https://github.com/LerianStudio/helm/commit/3b07e6bd9b5c07c865599da7749bff593f593da8)) * **chart:** update plugin access manager values ([e4221eb](https://github.com/LerianStudio/helm/commit/e4221ebc5da46a51c5d71ef0755bba35e3313584)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.0, plugin-br-pix-indirect-btg-worker-inbound@1.5.0, plugin-br-pix-indirect-btg-worker-outbound@1.5.0 - new env vars ([80fe4fc](https://github.com/LerianStudio/helm/commit/80fe4fc55014cf24844c1e1626b213475d5419a3)) * **plugin-fees:** update plugin-fees@3.1.0 - new env vars ([0111ef7](https://github.com/LerianStudio/helm/commit/0111ef72746c78f97321c78b110ffb0e2ac68e61)) * **docs:** update rabbitmq documentation ([cae5467](https://github.com/LerianStudio/helm/commit/cae54677bcf8a2a26949ed341df9caea50cea762)) * **docs:** update readme file ([314da0e](https://github.com/LerianStudio/helm/commit/314da0e538e7534a79cbea9423d2d6b5c08c3a8e)) * **reporter:** update reporter-manager@1.2.0, reporter-worker@1.2.0 - new env vars ([624ec97](https://github.com/LerianStudio/helm/commit/624ec978ef73810b568c9a8a578d4f8635f998d2)) * **values:** update resources limits ([04ccb18](https://github.com/LerianStudio/helm/commit/04ccb184cd7393e5c1f60fa5945fd89d0b5289d2)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **midaz:** update transaction configmap ([be52752](https://github.com/LerianStudio/helm/commit/be5275243af5315dc64026f436460f345eb41e78)) * **midaz:** update transaction otel env var ([79717c5](https://github.com/LerianStudio/helm/commit/79717c5815e8c1f5a9e859cea47ef3553fe821df)) * **midaz:** update transaction otel env var ([927f39e](https://github.com/LerianStudio/helm/commit/927f39e5ab03e15460d28769bacb9fe1ac43d0ed)) * **plugin-crm:** update ui env vars ([9fab16d](https://github.com/LerianStudio/helm/commit/9fab16dbcbc80ccc55c0bc2c32e2d099facb6110)) * **midaz:** update values file ([98e396c](https://github.com/LerianStudio/helm/commit/98e396cb1a366691c8b0a3f32f697086583c99bf)) * **midaz:** update values file ([c0cbef1](https://github.com/LerianStudio/helm/commit/c0cbef16e5225e218a60d25d71496c2085250820)) * **values:** update values file ([db9b3db](https://github.com/LerianStudio/helm/commit/db9b3db3961bea039663a7dba0f548601e3c146b)) * **values:** update values file ([cc698a0](https://github.com/LerianStudio/helm/commit/cc698a0a76b24e97b4ff890605535e9ad128e886)) * **midaz:** update values template ([90f3133](https://github.com/LerianStudio/helm/commit/90f31338d4158ddaeca92ab47417b9ca8e7cf20b)) * **chart:** update version ([40d723d](https://github.com/LerianStudio/helm/commit/40d723d6159d78f2a198cdfa9c7c969d07219289)) * **chart:** update version ([22e2930](https://github.com/LerianStudio/helm/commit/22e2930ce80b8e33926bb6db7a5f70ca6faa4fa5)) * **chart:** update version ([8031ceb](https://github.com/LerianStudio/helm/commit/8031cebf57f599fda19f74224cd17a746bfe1e21)) * **chart:** update version ([a8af389](https://github.com/LerianStudio/helm/commit/a8af389aa9135313e2e534e4fd0af358a3b8fcf2)) * **chart:** update version ([412e782](https://github.com/LerianStudio/helm/commit/412e782cff316594cb5b6ea0410a7c5d66ebf6a1)) * **chart:** update version ([4a42b13](https://github.com/LerianStudio/helm/commit/4a42b1367e2ac41654210610641c44fcb7f8b463)) * upgrade app version to 3.3.0 and add SSL mode configs for database connections ([c9d334f](https://github.com/LerianStudio/helm/commit/c9d334f2354705719d3469d614317d6524fd9987)) * **lerian-notification:** use /migrate binary in migrations Job ([1696dd7](https://github.com/LerianStudio/helm/commit/1696dd7f1af6292d634a1e2a428eb2a69aeb6d86)), closes [LerianStudio/lerian-notification#40](https://github.com/LerianStudio/lerian-notification/issues/40) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](https://github.com/LerianStudio/helm/commit/8b24026b20f920fa4c8544ca0c66cb671dcf99a8)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) * values template file ([2f7c796](https://github.com/LerianStudio/helm/commit/2f7c79606290492be77d34dfbd6ec76e89334cbb)) * values template file ([54ba721](https://github.com/LerianStudio/helm/commit/54ba721da0981d80e2df95a008d22d0fb0b03fd8)) ### Bug Fixes * **release:** add branch check to release notification job to only run on main branch ([f2f8e02](https://github.com/LerianStudio/helm/commit/f2f8e02c5eacdc9ea06d1b5af6df99a73df589db)) * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **values:** add comments in values ([#43](https://github.com/LerianStudio/helm/issues/43)) ([03a5842](https://github.com/LerianStudio/helm/commit/03a5842787db8dc1b4d954038b36a343ad7180c1)) * **plugin-access-manager:** add configurable DB_SSLMODE for auth PostgreSQL connections ([dd1d626](https://github.com/LerianStudio/helm/commit/dd1d626766129b1459e768732e2f826d3ad96eac)) * **new:** add DEFAULT_MIDAZ_ORGANIZATION_ID to configmap for enhanced multi-tenancy support ([d7b66a0](https://github.com/LerianStudio/helm/commit/d7b66a052d47394096ecdc18809e7c2d4fffeed3)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([33adde3](https://github.com/LerianStudio/helm/commit/33adde3650e26f65c09643ba8b2fd669bd504adc)) * **charts:** add http:// prefix to OTEL_EXPORTER_OTLP_ENDPOINT ([5f8ca7b](https://github.com/LerianStudio/helm/commit/5f8ca7b5abc6ca7c895af8c3ae1055907689c1d3)) * **product-console:** add image annotation for product-console 1.6.0 ([03c927c](https://github.com/LerianStudio/helm/commit/03c927c3029714c435534a4c72ca450bcdccbd08)) * add kindIs guard for backward compat with string image values ([313d9f6](https://github.com/LerianStudio/helm/commit/313d9f6b646cf3b3bb26cc2644063b16806c1847)) * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](https://github.com/LerianStudio/helm/commit/79ef8f5ea3d7bc2626972fcd4621b1e327c08aed)) * **matcher:** add missing env vars for systemplane and multi-tenant ([965da94](https://github.com/LerianStudio/helm/commit/965da94cdddb8c11654625e071e28c7a83193938)) * add missing MONGO_HOST/MONGO_PORT and align MONGODB_DB_NAME ([0725fa2](https://github.com/LerianStudio/helm/commit/0725fa2b26ed516c15ff1b5292b35581ff437de2)) * **midaz:** add missing MONGO_PARAMETERS to CRM configmap ([2bfecc2](https://github.com/LerianStudio/helm/commit/2bfecc220b7646c57b5e47f141cfb6e79469baec)) * add missing space in MIDAZ_CONSOLE_BASE_PATH template expression ([7b9bb67](https://github.com/LerianStudio/helm/commit/7b9bb677785cd1d381d1b8d497ee0a8bdc921c83)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](https://github.com/LerianStudio/helm/commit/d7765b455710ba5009a931493d351f88f735a1ce)) * **product-console:** add MongoDB connection info to NOTES.txt ([b4d6557](https://github.com/LerianStudio/helm/commit/b4d6557b5ccf5a93a70104bc5d5533171bc0147f)) * **product-console:** add mongodb.enabled flag to values-template ([7024d9d](https://github.com/LerianStudio/helm/commit/7024d9d0d47422b362b400b9494cfd440378122a)) * **configmap:** add new configuration options for deployment mode, private upstreams, and reconciliation settings ([f1a475e](https://github.com/LerianStudio/helm/commit/f1a475ea82bed1d9174193e58e271a5a730a5cc1)) * **plugin-access-manager:** add new configuration options for logging, rate limiting, and MFA in configmap.yaml ([d1e83b2](https://github.com/LerianStudio/helm/commit/d1e83b286a91b144bc44788a4fb457c4273b052f)) * **chart:** add new env var to enable auth plugin ([53b8ffb](https://github.com/LerianStudio/helm/commit/53b8ffb5ef5beaf77756b45e815b946b106c9320)) * add newline at end of values.yaml file ([044905f](https://github.com/LerianStudio/helm/commit/044905f48ff2d9fe8bd7f84770f34bebd700baf9)) * add plugin-br-bank-transfer-jd section to README version matrix ([ccd19ac](https://github.com/LerianStudio/helm/commit/ccd19acf8352c2e4a1390af297c61f0d63d7ae1e)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](https://github.com/LerianStudio/helm/commit/7ba4f9d8fede36092d0a7a60f08620f5ca3fd777)), closes [#1404](https://github.com/LerianStudio/helm/issues/1404) * **fetcher:** add RabbitMQ and storage configuration options, remove unused secret template ([865613d](https://github.com/LerianStudio/helm/commit/865613d1cf6264ee5b97e5e85d342e5f36043415)) * **plugin-br-pix-switch:** add RABBITMQ_URI to dict-hub-vsync configmap ([75074ae](https://github.com/LerianStudio/helm/commit/75074ae94521b346e0a0c167a166988d65084497)) * add required validation for Roles Anywhere ARNs and README migration note ([50e4718](https://github.com/LerianStudio/helm/commit/50e47186dee052e541566d65d2362c8fe175e5a5)), closes [#1](https://github.com/LerianStudio/helm/issues/1) [#3](https://github.com/LerianStudio/helm/issues/3) [#1113](https://github.com/LerianStudio/helm/issues/1113) * add trailing slash to default MIDAZ_ONBOARDING_URL in fees configmap ([fe394c5](https://github.com/LerianStudio/helm/commit/fe394c5e4fde1fb3cca5a5c7cc9a3019ac92cd5f)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **plugin-br-pix-indirect-btg:** add WEBHOOK_DEFAULT_URL to outbound configmap ([0dd6d81](https://github.com/LerianStudio/helm/commit/0dd6d81592f19d983e0ddfa75dbaf5e00b8fbd85)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](https://github.com/LerianStudio/helm/commit/a649c716026858c0a3ca34e613233ec874013650)) * address CodeRabbit CLI review findings ([974bbb8](https://github.com/LerianStudio/helm/commit/974bbb85bee5549825b25a379042eeeaf3f79ba7)) * **plugin-br-pix-switch:** address CodeRabbit feedback on NOTES, README, configmap, and labeler ([78e4615](https://github.com/LerianStudio/helm/commit/78e4615949c5e9b7dabcc2f497d687deae7ccfe4)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **plugin-br-pix-indirect-btg:** address coderabbit review feedback ([bb664a9](https://github.com/LerianStudio/helm/commit/bb664a9eb52c4e2636397955b7bde365643e34db)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **lerian-notification:** address CodeRabbit review on initial chart ([36c326f](https://github.com/LerianStudio/helm/commit/36c326fe1bbabd80112ef82cab3bb862fa0a18b1)), closes [#1332](https://github.com/LerianStudio/helm/issues/1332) * **product-console:** address CodeRabbit review on NOTES.txt ([e8cf8d7](https://github.com/LerianStudio/helm/commit/e8cf8d7157aedb39c4d58be3d88e6ac4a044391f)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **charts:** address CodeRabbit review on revamp PR [#1470](https://github.com/LerianStudio/helm/issues/1470) ([98288a5](https://github.com/LerianStudio/helm/commit/98288a5c6b09efe520675e9c4d605ddb4e8d71f0)), closes [#1](https://github.com/LerianStudio/helm/issues/1) * address CodeRabbit security and quality issues ([eb80852](https://github.com/LerianStudio/helm/commit/eb80852c7012443feebb00cb5d3cb1e6a2a80c2c)) * address remaining CodeRabbit review comments ([6f26a8b](https://github.com/LerianStudio/helm/commit/6f26a8b44643d9eaaa3957d1892f0f763d9da3c3)) * **pix-btg:** adjust default url ([51c4753](https://github.com/LerianStudio/helm/commit/51c4753e916e653ae44829792c8b47a9fc625efd)) * **midaz:** adjust ledger component port from 3000 to 3002 ([8e01518](https://github.com/LerianStudio/helm/commit/8e015184256566ca18c2973067fb8d48e8332fb5)) * **midaz:** adjust ledger component port from 3000 to 3002 ([bb58334](https://github.com/LerianStudio/helm/commit/bb583344a4ba4b59f114355eef6c4339b6d4b102)) * **midaz:** adjust midaz-crm repository image ([5f9fdcb](https://github.com/LerianStudio/helm/commit/5f9fdcb9733aa2b6d620a8d5b61ca7fc54036265)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](https://github.com/LerianStudio/helm/commit/0d025e93ef058e5f71488b14eab453eee4f2b378)) * **tracer:** align chart default port with source convention (2.0.0-beta.6) ([0f8683d](https://github.com/LerianStudio/helm/commit/0f8683dfacda22346b632511a0bfa92b4119f550)), closes [#193](https://github.com/LerianStudio/helm/issues/193) * **flowker:** align chart default port with source convention (2.1.0-beta.6) ([662ad6e](https://github.com/LerianStudio/helm/commit/662ad6e4a39aef852901dd2e1c861018e89fdfaa)), closes [#1308](https://github.com/LerianStudio/helm/issues/1308) * **underwriter:** align chart with app config + standardize VERSION ([9d9a875](https://github.com/LerianStudio/helm/commit/9d9a875ce000cd6136c36fd22967c24c743dbd3a)) * align comment with actual template keys per CodeRabbit review ([338e19c](https://github.com/LerianStudio/helm/commit/338e19ccf967d764ef4165818b585b4698d8e8a5)) * **matcher:** align default securityContext with distroless nonroot UID ([87f0c59](https://github.com/LerianStudio/helm/commit/87f0c59675607d596145d2caa99f96dfd09f1e35)) * **flowker:** align Mongo env vars with app source code ([fdeb22c](https://github.com/LerianStudio/helm/commit/fdeb22c6d2b98425b2c9fae436d4eb81d871eec3)) * align NextAuth URLs with reporter UI base URL ([8d5f4f7](https://github.com/LerianStudio/helm/commit/8d5f4f7e6a671872f6d8e3b95f60b119f89416e0)) * **matcher:** align OTEL env vars with app and bump to v1.0.0-beta.3 ([d1616fb](https://github.com/LerianStudio/helm/commit/d1616fb09bd3e80cce2bbd3e91930771f985ff75)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](https://github.com/LerianStudio/helm/commit/75ad0d4a418787d0d3e85ef8311ee822202e1a2e)) * always set VERSION and OTEL_RESOURCE_SERVICE_VERSION from image.tag ([56bfc66](https://github.com/LerianStudio/helm/commit/56bfc666dd2c8d8d83802f026f4ec6436bda8dc4)) * **plugin-br-pix-switch:** apply container securityContext, fix tolerations type, add NOTES defaults ([86b7f17](https://github.com/LerianStudio/helm/commit/86b7f1789c06a09a46d32f9cc2fddcbd560fa25d)) * **onboarding:** auth endpoint and remove old env var ([de370da](https://github.com/LerianStudio/helm/commit/de370daa57563a194d5273888587f0aa95262a0b)) * **transaction:** auth endpoint ([12d8f6d](https://github.com/LerianStudio/helm/commit/12d8f6d3c9d52bff108f220f297d0d4f1db6ca78)) * **values:** auth env vars ([23b34a1](https://github.com/LerianStudio/helm/commit/23b34a13ea547a1587d71689b30adfe02f580dc0)) * **plugin-br-pix-switch:** bootstrap Job fixes surfaced by live install test ([fc9e125](https://github.com/LerianStudio/helm/commit/fc9e12530d40da9dfc6cec51ba2afbd0e66bf9f0)) * bump chart and console versions to 4.4.3 and 3.4.3 ([1cb77cc](https://github.com/LerianStudio/helm/commit/1cb77cc00932d6302e3a71f9bd08253d85f2c3d0)) * **console:** bump image tag to 2.2.1 ([9dfde6e](https://github.com/LerianStudio/helm/commit/9dfde6ee7deb61ef67376dd84d3396845f88fe9f)) * bump plugin-fees chart to version 3.4.4 ([8aaed46](https://github.com/LerianStudio/helm/commit/8aaed46539f10d3879eb7563c1cfa63841d6ddb2)) * change Helm hooks from post-install to pre-install for Postgres and RabbitMQ initialization ([374ccbb](https://github.com/LerianStudio/helm/commit/374ccbb36160f5a614271f65c0a55cf79be568f1)) * chart ([81f1126](https://github.com/LerianStudio/helm/commit/81f112612a3327fffc69da8720b2222122df44a4)) * chart ([f6e6446](https://github.com/LerianStudio/helm/commit/f6e644662db2f641b0e71e3cccd518fa4fe715dc)) * chart app version ([4ae59b0](https://github.com/LerianStudio/helm/commit/4ae59b08085f19e6a20617782e5a3b28044c01f6)) * **tracer:** chart cleanup for 2.0.0-beta.5 ([b8767d5](https://github.com/LerianStudio/helm/commit/b8767d5853b9108a751590468dea17400815f906)) * chart name ([78ae357](https://github.com/LerianStudio/helm/commit/78ae357d208a2835174345b9179c596cf50a401b)) * chart name ([6db8350](https://github.com/LerianStudio/helm/commit/6db83502f0f75b59a5345c27eeade292b31078a9)) * chart name ([1f78da5](https://github.com/LerianStudio/helm/commit/1f78da504538d1a518f503e69b21b1696a893313)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * clean dead OTEL defaults and fix SWAGGER_HOST service names ([76909b8](https://github.com/LerianStudio/helm/commit/76909b801a697be8c28fb345d1f9de611be88bee)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](https://github.com/LerianStudio/helm/commit/5ff9c1d027c1079a972ea550e63d1417b8e3c34d)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * codeowners groups ([#23](https://github.com/LerianStudio/helm/issues/23)) ([b51ff0c](https://github.com/LerianStudio/helm/commit/b51ff0ce5f7d838c2f01565340d91a79cd9c772f)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](https://github.com/LerianStudio/helm/commit/fcaa3b46bf7c06be7c94b7d21bf61b728265bd9d)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](https://github.com/LerianStudio/helm/commit/14924af14cbb6299471ff1d52c0e3591892f13a6)), closes [#1470](https://github.com/LerianStudio/helm/issues/1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](https://github.com/LerianStudio/helm/commit/a3946586aa847615a7082a2c4583646926d53792)) * complete standardization of VERSION across all remaining charts ([63adbb9](https://github.com/LerianStudio/helm/commit/63adbb959f5ea18a22219d7f78d6422f4e9ffb38)) * **plugin-access-manager:** construct dataSourceName at runtime with environment variables ([ac4fd9f](https://github.com/LerianStudio/helm/commit/ac4fd9f94212fed2adbc7d5c6b17e9ad10e3b9cd)) * **plugin-br-pix-switch:** correct appVersion to 1.0.0-beta.1 and add to compatibility matrix ([85bd001](https://github.com/LerianStudio/helm/commit/85bd0015bd9aa7e1def72ed14f981e3a8d080c19)) * **bank-transfer:** correct encryption key env var names ([fb79deb](https://github.com/LerianStudio/helm/commit/fb79deb833c798f68b75e075f8cf6aa2146ad523)) * **flowker:** correct livenessProbe default path from /health/live to /health ([f588107](https://github.com/LerianStudio/helm/commit/f588107a6a543361ceb00d798c9479d1ad37cec3)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **midaz:** correct RabbitMQ bootstrap secret key reference from RABBITMQ_TRANSACTION_PASS to RABBITMQ_DEFAULT_PASS ([f86aa98](https://github.com/LerianStudio/helm/commit/f86aa9826b425861d1614f01ffacb8f68726975f)) * correct RabbitMQ configuration path in transaction service ([eab6df2](https://github.com/LerianStudio/helm/commit/eab6df2eb2793166f7dc2a3455e562a399dcb096)) * **plugin-access-manager:** correct REDIS_PASSWORD reference in identity secrets ([2c6c323](https://github.com/LerianStudio/helm/commit/2c6c323da55401c0323e3023eb9f6958089bbe5e)) * **plugin-access-manager:** correct REDIS_PORT reference from au to identity in configmap ([aafd65a](https://github.com/LerianStudio/helm/commit/aafd65aebbe2b4d27724a02e969701a3a408621a)) * **fetcher:** correct repository URL in Chart.yaml home field ([378a458](https://github.com/LerianStudio/helm/commit/378a458596b151f37393f4292ef8badf88fc57b5)) * crm ui port ([35f387b](https://github.com/LerianStudio/helm/commit/35f387b6037c85963dc793229e6975ca5addc65c)) * **lerian-notification:** declare kubeVersion compatibility ([fd3067e](https://github.com/LerianStudio/helm/commit/fd3067e0a78ac2d207dc1c64f19f7fad5cdca8cc)) * **product-console:** derive MongoDB service name dynamically in NOTES.txt ([4bbf749](https://github.com/LerianStudio/helm/commit/4bbf749465bf0cbf6112ed3cc32653a0d3972480)) * **auth:** disable auth ingress ([4e08d7a](https://github.com/LerianStudio/helm/commit/4e08d7af33f67b9500b459a40ad93473cf82007f)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](https://github.com/LerianStudio/helm/commit/a38dca3beda61b5ad6a4b56c4712dc63ea3e1555)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](https://github.com/LerianStudio/helm/commit/734a38a07fdb6d694b373b52097502dd0aaae440)) * **midaz:** enable external service bootstrap jobs by default for RabbitMQ and PostgreSQL ([f65f8ff](https://github.com/LerianStudio/helm/commit/f65f8ff4f669f99d0eb55f32826dfb7e2891695d)) * **plugin-access-manager:** enable extra env vars to auth configmap template ([1be8107](https://github.com/LerianStudio/helm/commit/1be8107a59d8f0c5e9a12ceb4b70829dbc90b858)) * **plugin-access-manager:** enable extra env vars to auth ([a085323](https://github.com/LerianStudio/helm/commit/a085323623b5df8283e7583b9f03fefeb3202260)) * **plugin-access-manager:** enable extra env vars to identity configmap template ([01f1efe](https://github.com/LerianStudio/helm/commit/01f1efe5c64a1c8237722d1da80ee322e8e27067)) * **plugin-access-manager:** enable extra env vars to identity ([356b815](https://github.com/LerianStudio/helm/commit/356b8157cdcc1a503aa514f077142283e8ea9b21)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](https://github.com/LerianStudio/helm/commit/66f293980505a341f78afae668f657ddd602f732)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** fail loud on missing infra creds ([5bfc010](https://github.com/LerianStudio/helm/commit/5bfc01046118dc1df300b9c4640186c99a304bf8)) * fix ([8e3d5ad](https://github.com/LerianStudio/helm/commit/8e3d5ad6deff4dc6a84d7f0c343d5e605428686f)) * fix ([3ff9f64](https://github.com/LerianStudio/helm/commit/3ff9f645ed8119d28a4dc256848d27206a4d80ce)) * **audit:** fix audit configmap ([#41](https://github.com/LerianStudio/helm/issues/41)) ([429fdef](https://github.com/LerianStudio/helm/commit/429fdef691c87dc5b4a7e44c236b2550f548c20d)) * **values:** fix autoscaling parameters ([69585b6](https://github.com/LerianStudio/helm/commit/69585b6743736edad8d393c5e50eddc9e4ff114d)) * **matcher:** fix configmap archival condition and S3 endpoint for IAM Roles Anywhere ([53232ae](https://github.com/LerianStudio/helm/commit/53232ae6aec2f6fd8b1a4dba74edad8bf261056f)) * **transaction:** fix default value of rabbitmq secret ([71afd7a](https://github.com/LerianStudio/helm/commit/71afd7a7067ee4b1cf429669e4a44c58479af037)) * **doc:** fix midaz transaction container port ([bab48e6](https://github.com/LerianStudio/helm/commit/bab48e600b179abf07bbc207982803102ea1d704)) * **pipe:** fix pr title workflow ([#34](https://github.com/LerianStudio/helm/issues/34)) ([5134118](https://github.com/LerianStudio/helm/commit/51341186dfd7f643e3be1d598c51d3909748a3dd)) * **midaz:** fix rabbitmq job to apply default definition ([a1349ff](https://github.com/LerianStudio/helm/commit/a1349ff2891e3368d21d9b077fab46c448685356)) * **chart:** fix set secret ref to console deployment ([34b4885](https://github.com/LerianStudio/helm/commit/34b488597985e744a4108eda086a9e14eddac702)) * **transaction:** fix transaction container port ([cb4ec59](https://github.com/LerianStudio/helm/commit/cb4ec592c2c47036bee2b519d795ca08336904dc)) * **midaz:** fix transaction deployment template ([c269284](https://github.com/LerianStudio/helm/commit/c2692846f8f3a30f73c41da792ebf47595e067b1)) * **chart:** fix typo in environment variable name ([2f57d53](https://github.com/LerianStudio/helm/commit/2f57d53b1b47b8ef0829729a37d819949efd03c4)) * **plugin-br-pix-indirect-btg:** fix useExistingSecrets typo in all deployments ([fa2dc49](https://github.com/LerianStudio/helm/commit/fa2dc4964c8080f0825471be4a1a2a3889fa7833)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](https://github.com/LerianStudio/helm/commit/9ae56b40a5b127510b82256975682648e06bbaea)) * generate multiples CHANGELOG's ([3f60787](https://github.com/LerianStudio/helm/commit/3f607875b618db474e4055c44a2cffd8216f4261)) * **lerian-notification:** handle explicit maxUnavailable: null in PDB ([03ee596](https://github.com/LerianStudio/helm/commit/03ee596ecdba8da4e6727236b2785c2d14c0c1c5)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](https://github.com/LerianStudio/helm/issues/1467)) ([7c62a98](https://github.com/LerianStudio/helm/commit/7c62a98cabe072e32a717169317018a2af334e5c)) * helm chart ([9b6552f](https://github.com/LerianStudio/helm/commit/9b6552f37d039bb5187c92319bcc3787d1c4ddcc)) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](https://github.com/LerianStudio/helm/commit/6a9d958b5fbee278b5345ef6af0496cc8c9c6ab8)) * **plugin-br-pix-indirect-btg:** improve reconciliation config and remove vault annotations ([ad64484](https://github.com/LerianStudio/helm/commit/ad64484db87788071ff7ade533a04754eed58347)) * **components:** init file for auth app ([4939e82](https://github.com/LerianStudio/helm/commit/4939e823f60cdbc0965281f496b058178bf70a00)) * job to apply rabbitmq definitions ([b959644](https://github.com/LerianStudio/helm/commit/b959644941d2f137fd6d766ff3cb6c022ac3354d)) * **plugin-br-pix-switch:** leave adapter-btg-mock ingress untouched ([7a1c827](https://github.com/LerianStudio/helm/commit/7a1c827984df9e31a819f18e05cb5de77aa32457)) * **plugin-br-pix-switch:** liveness probe path /live -> /health ([030af5f](https://github.com/LerianStudio/helm/commit/030af5fd92687e5980a6f2e3357493f037e56496)) * **components:** load definitions for rabbitmq ([167c80a](https://github.com/LerianStudio/helm/commit/167c80a8e156fb653e2e365f155c4c35e2785fca)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](https://github.com/LerianStudio/helm/issues/1465)) ([a39f2c6](https://github.com/LerianStudio/helm/commit/a39f2c652365001992fa259b8d7932f45d65ed8a)) * **plugin-br-pix-switch:** match probe template fallbacks to per-component routePrefix ([ee914d7](https://github.com/LerianStudio/helm/commit/ee914d78ef23df3d368a4465eef80f8641c21730)) * **midaz:** midaz console configmap ([5d8428c](https://github.com/LerianStudio/helm/commit/5d8428ce7fa7fd2678b18b1146bcadbb2fc4ced7)) * midaz nginx proxy config ([46d3af2](https://github.com/LerianStudio/helm/commit/46d3af2330ae02cf7298efc8275cf6e4ee309685)) * move MONGO_URI to secrets and support JD sandbox mode ([6d41468](https://github.com/LerianStudio/helm/commit/6d41468e7e14de2a61f99b90769b7b7643208d0d)) * **plugin-br-pix-switch:** namespace handling + global image tag override ([0fd1ef6](https://github.com/LerianStudio/helm/commit/0fd1ef681a03fabd2937ed48477ad9469ab95c70)) * **midaz:** nginx server definition ([b63b23a](https://github.com/LerianStudio/helm/commit/b63b23a5bf3292d2a36e8872bd3e3a3c257152c5)) * **midaz:** nginx server definition ([d4f18da](https://github.com/LerianStudio/helm/commit/d4f18dadfda3b4446df5cc5f094784decc247f9d)) * **midaz:** nginx server definitions ([9863437](https://github.com/LerianStudio/helm/commit/9863437a6a3d925edcf547ae801389cb9954c145)) * onboarding adjust default value of env var ([d274067](https://github.com/LerianStudio/helm/commit/d274067915c39400b9f920ef6af93f02bbc7d9d9)) * onboarding init container ([46284e5](https://github.com/LerianStudio/helm/commit/46284e5bee1bf07269aeac457c7f7dad74b848b6)) * **lerian-notification:** order SA/ConfigMap/Secret before migrations Job ([23069fc](https://github.com/LerianStudio/helm/commit/23069fcc638795bdc02bc093c770f9cafb0ea135)) * **product-console:** parametrize probes that were missed in initial commit ([5be4277](https://github.com/LerianStudio/helm/commit/5be4277d671dd74af3fbe64dc7bd95295272d50a)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **reporter:** prevent null env in manager and worker deployments ([51a72c6](https://github.com/LerianStudio/helm/commit/51a72c640b78716a69f2ddee05e5a5be3e1125cd)) * **reporter:** prevent null env in ScaledJob when no env vars are configured ([7fa29b4](https://github.com/LerianStudio/helm/commit/7fa29b47d0859aaae3097af6b33b4585412b230c)) * **plugin-br-pix-switch:** probe paths follow per-component routePrefix ([d6e5264](https://github.com/LerianStudio/helm/commit/d6e5264d2fca1a64ac207978e90ab1a1b2cbde75)), closes [#135](https://github.com/LerianStudio/helm/issues/135) * **plugin-br-pix-switch:** providers ingress default path /mock-btg -> /btg-mock ([b6df396](https://github.com/LerianStudio/helm/commit/b6df396a0984f06c6c3774c0d89bf48bdfd20ac3)) * **docs:** rabbitmq mispelling name ([cefee91](https://github.com/LerianStudio/helm/commit/cefee916b39020938945ce97f442dbdbf3ba6d63)) * **onboarding:** rabbitmq mispelling name ([bf8de0c](https://github.com/LerianStudio/helm/commit/bf8de0cf79e4a40a3fa0bb7581a7f11b9458de76)) * **transaction:** rabbitmq mispelling name ([8e05032](https://github.com/LerianStudio/helm/commit/8e050329da399b563d2ce6f5fa70edcf2291cccd)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **fetcher:** remove common secret to match reporter pattern ([37050a0](https://github.com/LerianStudio/helm/commit/37050a0834a3fc70676e00e3b5dd4018f9e0ec02)) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * remove duplicate reporter-manager/secret.yaml with incorrect template references ([e8cc8b6](https://github.com/LerianStudio/helm/commit/e8cc8b6e63e587a9c5fc7c45284c1482ec766564)) * remove empty variable ([48052b2](https://github.com/LerianStudio/helm/commit/48052b2c411e6d882c5c7067f19b4364cdb363e6)) * **release:** remove generate_changelog dependency from back-merge step ([40dfa39](https://github.com/LerianStudio/helm/commit/40dfa390347ce04d88ae8bf22dde9dcc824f93b2)) * **onboarding:** remove grpc port from container ([3bd9621](https://github.com/LerianStudio/helm/commit/3bd96218a95decae1c58cc29078c8bbfd71736a9)) * **midaz:** remove hardcoded localhost URLs from console configmap ([75ab6e8](https://github.com/LerianStudio/helm/commit/75ab6e87a0271f08e48f496b8b753b0f1721d843)) * remove hardcoded namespaceOverride to use release namespace ([f650315](https://github.com/LerianStudio/helm/commit/f650315e2ca1849da559dffb51fd0f01f5669167)) * remove hook ([aa92d78](https://github.com/LerianStudio/helm/commit/aa92d78f74000f6f4f2c7fc22db35cc0010916ca)) * remove hotfix branch from release config ([11d0188](https://github.com/LerianStudio/helm/commit/11d018800fe55cbfc1cc840974248b8c85b5fb0b)) * **plugin-access-manager:** remove imagePullSecrets from values.yaml for identity and auth sections ([238ca51](https://github.com/LerianStudio/helm/commit/238ca519ce930eb2b4431abfd6a0fd69f1efda27)) * **product-console:** remove inconsistent artifacthub image annotation ([77e46c4](https://github.com/LerianStudio/helm/commit/77e46c4b36f2ebf51e7da2d6d6864b3b0d244733)) * **plugin-fees:** remove MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC from configmap ([f3e7f9b](https://github.com/LerianStudio/helm/commit/f3e7f9bae9113bba8d11602afcbd4048778b892a)) * **onboarding:** remove old secrets ([0c7966f](https://github.com/LerianStudio/helm/commit/0c7966f91207c688b0e014bab463dac40846f56e)) * **trasaction:** remove old secrets ([1a2a10c](https://github.com/LerianStudio/helm/commit/1a2a10c9a165c0767f45b7909276c287d5c4d3a3)) * remove RabbitMQ health check from onboarding deployment ([181179e](https://github.com/LerianStudio/helm/commit/181179e4dea9faea9717eb0eafc946f86d6a1192)) * **plugin-br-pix-indirect-btg:** remove trailing newline from values.yaml ([938bf17](https://github.com/LerianStudio/helm/commit/938bf17d10d468c257d83fa4e2a46778deb071aa)) * **plugin-br-bank-transfer:** rename chart to include -helm suffix ([f393e35](https://github.com/LerianStudio/helm/commit/f393e35ec6b5ad070ccc24214771b3c2cfd81fb0)) * **audit:** rename env vars and update container port ([9796046](https://github.com/LerianStudio/helm/commit/979604649c30ce6b8788acb3c1f67dff1a765f63)) * **transaction:** rename env vars and update container port ([4052bc5](https://github.com/LerianStudio/helm/commit/4052bc51634b989fba34c2245319db767aa02275)) * **chart:** rename ledger component to onboarding ([47dd9d0](https://github.com/LerianStudio/helm/commit/47dd9d01c491f30669c3f4ec6271bae1c8d0de75)) * **chart:** rename ledger component to onboarding ([e04404b](https://github.com/LerianStudio/helm/commit/e04404b79c78396a6cb1227cafa5bad10b51d3ee)) * **doc:** rename ledger component to onboarding ([0aa6e34](https://github.com/LerianStudio/helm/commit/0aa6e34ed38d68308cec31b5280b17c017c3d277)) * **components:** rename ledger db for onboarding ([40e49b8](https://github.com/LerianStudio/helm/commit/40e49b8cb2dcf6b169ea4a9c32b5c516f0d06b57)) * **pipe:** rename ledger to onboarding ([448ce90](https://github.com/LerianStudio/helm/commit/448ce9015baee8d553a81f6253d77d76bb96c3ba)) * **bank-transfer:** rename MULTI_TENANT_INFRA_ENABLED to MULTI_TENANT_ENABLED for consistency ([0fb14a6](https://github.com/LerianStudio/helm/commit/0fb14a62d9644d039931afe1c5a6f7291bbaafa8)) * **dependencies:** rename otel to grafana ([#57](https://github.com/LerianStudio/helm/issues/57)) ([974c47f](https://github.com/LerianStudio/helm/commit/974c47f6974d42804e5210d530829efa0394d734)) * **tracer:** rename PLUGIN_AUTH_HOST to PLUGIN_AUTH_ADDRESS (2.0.0-beta.4) ([4be1526](https://github.com/LerianStudio/helm/commit/4be1526c4e9f1415e4ef8dec74533ff1a4ac98fa)) * rename PRIVATE_KEY to KEY in qr-code secrets template ([8736d13](https://github.com/LerianStudio/helm/commit/8736d1343048542d33331c97ded6b3aff1cce369)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** resources limits in onboarding and transaction values ([9d788f5](https://github.com/LerianStudio/helm/commit/9d788f5dc9639cb97bf285332c31033fedb0545a)) * **plugin-fees:** revert MIDAZ_TRANSACTION_URL to midaz-transaction default ([0871187](https://github.com/LerianStudio/helm/commit/0871187b0197c5af9439f0cd9f6f1813b68ae4c4)) * rollback midaz version ([e458c1c](https://github.com/LerianStudio/helm/commit/e458c1ccfa01a5f67fb221a3cf33b8cb8054d4b7)) * rollback plugin-access-manager version ([ce2b088](https://github.com/LerianStudio/helm/commit/ce2b08841977784e729d7efeb635c64780072b54)) * **lerian-notification:** self-contain migrations Job; drop hook annotations from SA/ConfigMap/Secret ([068b1e3](https://github.com/LerianStudio/helm/commit/068b1e3fe5ef93f274bf4f219031fc867f43ffc6)) * **plugins:** separate RABBITMQ_HOST from RABBITMQ_URL in bc-correios chart ([#1268](https://github.com/LerianStudio/helm/issues/1268)) ([780aff8](https://github.com/LerianStudio/helm/commit/780aff85155d47316160f60a596dfc7e70b0c6be)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-pix-indirect-btg:** set DB_SSL_MODE default to disable ([29f2348](https://github.com/LerianStudio/helm/commit/29f2348e7c55bb7eafcb6cfddbc013d2ceeae3f7)) * **plugin-br-pix-switch:** set default PLUGIN_AUTH_URL on auth-using components ([f689afc](https://github.com/LerianStudio/helm/commit/f689afcc5173a3a15fd105fd7a4fbb2605b26f71)) * **product-console:** set image tag to 1.3.0 in values.yaml ([a535b88](https://github.com/LerianStudio/helm/commit/a535b885158731c4ef859e5197f3283dcd2c1b60)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](https://github.com/LerianStudio/helm/issues/1405)) ([e0d9084](https://github.com/LerianStudio/helm/commit/e0d908413cf66830d4afa6a53bac3ce8573a10af)) * **plugin-br-pix-indirect-btg:** set REDIS_TLS default to false in reconciliation configmap ([b8dc4d1](https://github.com/LerianStudio/helm/commit/b8dc4d1af0462ae2f12ba9b1542711d0ebdce300)) * setup otel in template ([#24](https://github.com/LerianStudio/helm/issues/24)) ([837fd03](https://github.com/LerianStudio/helm/commit/837fd03c642b14387299b9b4a50fe00dc22e2f29)) * simplify hotfix branch prerelease configuration ([8f61d2d](https://github.com/LerianStudio/helm/commit/8f61d2d31b87a6f4273beab1f73fe64b3fb78cf0)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](https://github.com/LerianStudio/helm/commit/582ea9751785df979371f64e367c4ceb8a2731de)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](https://github.com/LerianStudio/helm/commit/45d152ab94251e5d08eeeba666d0908c2d90c287)) * **plugin-access-manager:** split migrations and initUser image into repository/tag fields ([5be206a](https://github.com/LerianStudio/helm/commit/5be206ad28843d9de908efb7c329e9305070415f)) * **components:** sql init for auth app ([9824943](https://github.com/LerianStudio/helm/commit/9824943ab8a6d2e038cd55448259c27149c50546)) * **midaz:** standardize base URL configuration using MIDAZ_CONSOLE_BASE_PATH as source of truth ([bc4705a](https://github.com/LerianStudio/helm/commit/bc4705aafe9ab36a3c56264099400543202d7412)) * **plugins:** standardize MIDAZ console URL configuration ([b89bb83](https://github.com/LerianStudio/helm/commit/b89bb837974a805cc9b238684e7d8ab7e752eef6)) * standardize VERSION/OTEL_RESOURCE_SERVICE_VERSION in remaining charts ([4172495](https://github.com/LerianStudio/helm/commit/4172495136f2d17d0897c6b4bdbcc081634a372a)) * **plugin-br-pix-switch:** swap envFrom order so Secret overrides ConfigMap (1.1.0-beta.4) ([c1241c0](https://github.com/LerianStudio/helm/commit/c1241c0f9b2839cbf22ef2ecd73a738a54fa9920)) * **new:** sync migrations job and app versions ([d90d1d7](https://github.com/LerianStudio/helm/commit/d90d1d7042bd1b82a4638dd993274539d9aeed42)) * templates ([bc18fc3](https://github.com/LerianStudio/helm/commit/bc18fc3fddd8736d8694f3be401d1a85fc781039)) * transaction adjust default value of env var ([6e807a9](https://github.com/LerianStudio/helm/commit/6e807a9da365d88d023746233992b316ef1696df)) * transaction init container ([3d3492c](https://github.com/LerianStudio/helm/commit/3d3492c9e0c017d7e904fc26e9aeadfdfbe76c8e)) * **midaz:** update app image tag from 2.2.0 to 2.2.1 ([3103f2d](https://github.com/LerianStudio/helm/commit/3103f2d2f97fdc4021e3702efc7e0f5494fd6fe0)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](https://github.com/LerianStudio/helm/commit/944e1ce9b6af49dfcbd3bce0851093cefc4989eb)) * **configmap:** update APPLICATION_NAME default value to crm ([53b65c3](https://github.com/LerianStudio/helm/commit/53b65c3ecc9a07f901832e99efc45fec3bd1d65f)) * **plugin-access-manager:** update appVersion and image tags to 2.6.2 ([ed831fb](https://github.com/LerianStudio/helm/commit/ed831fb2dca1a1f65988b03edc9d4d14bc14e6bf)) * **plugin-access-manager:** update appVersion and image tags to 2.6.3 ([f4d26c0](https://github.com/LerianStudio/helm/commit/f4d26c0378bfb41d6f0be5de46e7be614463529d)) * **product-console:** update appVersion to 1.3.0 ([c708e76](https://github.com/LerianStudio/helm/commit/c708e76df0e532850dd8d5e2472a4b34c72a249c)) * **plugin-access-manager:** update appVersion to 2.6.5 ([db5045a](https://github.com/LerianStudio/helm/commit/db5045a532276e6bd34b4b30682f58e7f2bca567)) * **plugin-bc-correios:** update br-spb-bc-correios@1.2.0 ([f5d8eca](https://github.com/LerianStudio/helm/commit/f5d8eca7c779bf8b941f7a5bfa94fa6db2bba394)) * update casdoor backend images ([ea9e82b](https://github.com/LerianStudio/helm/commit/ea9e82bfce3259bf88fb13b0b39b0a2f6280c7a1)) * update casdoor backend images ([8c1741d](https://github.com/LerianStudio/helm/commit/8c1741dcd6e3c7df86ed6f5f59d07309792754ba)) * **plugin-fees:** update chart version to 5.4.0 and app version to 3.2.0 ([303911d](https://github.com/LerianStudio/helm/commit/303911d1c080482ac5df1440cf50ad58ea26a581)) * **midaz:** update console@3.4.8, onboarding@3.4.8, transaction@3.4.8 and add back-merge workflow ([2400460](https://github.com/LerianStudio/helm/commit/2400460545b915829faf6f5871c4551f6cc51445)) * update default NGINX_BASE_PATH to use correct service name midaz-console-nginx ([ed89e32](https://github.com/LerianStudio/helm/commit/ed89e324691ebe09e742abb5d9d4e56216efdce5)) * update default value to swagger hot env var ([a691862](https://github.com/LerianStudio/helm/commit/a6918621eee89815ab6e074dbd841f5d7d520b3d)) * update default value to swagger hot env var ([25fe35e](https://github.com/LerianStudio/helm/commit/25fe35e5cba187cdebd9a711f6ceee31e6687936)) * **bank-transfer:** update DEFAULT_TENANT_ID to allow empty default value in configmap ([10ea45e](https://github.com/LerianStudio/helm/commit/10ea45e0ff6d8b0023efc0a293db31390566300c)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](https://github.com/LerianStudio/helm/commit/f7aa25b6756bf756a3d7cc3e0f90fba1b85f31df)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **ci:** update Helm setup action to v3.5 in release workflow ([6736085](https://github.com/LerianStudio/helm/commit/673608587a310dece3aeb5fda8fd0d408584c4ad)) * **plugin-access-manager:** update identity@2.1.1, auth@2.4.0 and use image.tag for version fields ([e260dee](https://github.com/LerianStudio/helm/commit/e260deef9bc8bafe34a85755c1532a400aac416a)) * update image repository ([4d9116f](https://github.com/LerianStudio/helm/commit/4d9116fd515d1628be6159dbd0c4512de0720a8c)) * update image repository ([43d0cc0](https://github.com/LerianStudio/helm/commit/43d0cc0cc1559589afae24aa9b568206a9902649)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](https://github.com/LerianStudio/helm/commit/68bcd0ba0581b73f7e41b9edcdfe6aff4d9a56fc)) * **plugin-access-manager:** update image tags and add CORS, rate limiting, multi-tenancy, and circuit breaker configurations ([628ad1d](https://github.com/LerianStudio/helm/commit/628ad1d77b88e3bfde9bcf07d14ae64f0f234603)) * **plugin-access-manager:** update image tags for identity and auth components to latest versions ([08f9a6a](https://github.com/LerianStudio/helm/commit/08f9a6a9216b2db51fe0cbd9a35f97eba037a762)) * **midaz:** update ledger service default port from 3000 to 3002 ([2878908](https://github.com/LerianStudio/helm/commit/28789085b331fe28430cfce77a6a2e7f9bb65b97)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](https://github.com/LerianStudio/helm/commit/b6dade8509d86e028b2c9a352b502c674edbd4f2)) * **midaz:** update midaz-crm@3.6.2, midaz-ledger@3.6.2 ([960a392](https://github.com/LerianStudio/helm/commit/960a392f9d63e4576dabcc3ed1008be42063c4b5)) * **midaz:** update midaz-crm@3.6.3, midaz-ledger@3.6.3 ([1cce7ba](https://github.com/LerianStudio/helm/commit/1cce7ba9f7494151eb9f62361d6b07915063210a)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](https://github.com/LerianStudio/helm/commit/3c9bea0fedc48926df8151fa421d4c0a27f07ccb)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](https://github.com/LerianStudio/helm/commit/5ee7f4531e5fe78d61e63142f528f98d220bf131)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](https://github.com/LerianStudio/helm/commit/67021d410f8bd95628dc2e1fda00029e587a6408)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](https://github.com/LerianStudio/helm/commit/4852190a64cc81e28e78f9a27d7978187cd1ac72)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](https://github.com/LerianStudio/helm/commit/5c2edb0ebd628ad373269f290736c0ee56899f3b)) * update mongodb ([858c934](https://github.com/LerianStudio/helm/commit/858c93496a5e45fcb84389614536d63ca6b84a02)) * **console:** update mongodb default port ([fd58b09](https://github.com/LerianStudio/helm/commit/fd58b09788b9f7ccc03937ac5e950060110cedf3)) * update nginx deployment config with correct service account and simplified configmap names ([b1119fd](https://github.com/LerianStudio/helm/commit/b1119fdad81d1d4bbcb2c3aecbe74d56cd0a3136)) * **doc:** update nginx ingress config ([#35](https://github.com/LerianStudio/helm/issues/35)) ([d9763ea](https://github.com/LerianStudio/helm/commit/d9763ea4c2139c7d5f020d71422a634f37e15172)) * **plugin-br-pix-direct-jd:** update pix@1.2.1-beta.7, job@1.2.1-beta.7 ([4010717](https://github.com/LerianStudio/helm/commit/4010717e52a535803550f84faf3092439cb063b7)) * update plugin registration URL to use midaz-console-nginx hostname ([0eaca46](https://github.com/LerianStudio/helm/commit/0eaca4642ff0d7907302ecc7e95c1426378a56a8)) * **plugin-access-manager:** update plugin-auth@2.6.0 ([6b5b3d8](https://github.com/LerianStudio/helm/commit/6b5b3d85f0f2312dd0104b79ab3efb7fa707ec80)) * **plugin-access-manager:** update plugin-auth@2.6.1 ([253b5e8](https://github.com/LerianStudio/helm/commit/253b5e8c6dc6940884d28b3d3064b941e7936742)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](https://github.com/LerianStudio/helm/commit/b5892a37b4b8b67cbcf3bee1bb8557b807e637ce)) * **plugin-br-bank-transfer-jd:** update plugin-br-bank-transfer-jd@1.0.0 ([afcdded](https://github.com/LerianStudio/helm/commit/afcdded551872f8fea45bd5811129d967862fc48)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@2.1.0 ([3e29c6c](https://github.com/LerianStudio/helm/commit/3e29c6cbcda36b88db0140e18d1995e41d711ada)) * update plugin-br-pix-indirect-btg pix OTEL_RESOURCE_SERVICE_VERSION ([4fa8d3f](https://github.com/LerianStudio/helm/commit/4fa8d3fa16f4c4db14a353fee4132f3734177229)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.1 ([4397bc6](https://github.com/LerianStudio/helm/commit/4397bc641c2009520ddfa74db5b07ce560682137)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.1.3 ([b9a4b68](https://github.com/LerianStudio/helm/commit/b9a4b68daddf3bc7f34ece779be416e297372c46)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg-worker-reconciliation@1.2.0 ([5e4b893](https://github.com/LerianStudio/helm/commit/5e4b89388355b6970ad8a7d381b36c66ab7ef7e4)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.0 ([df6de7b](https://github.com/LerianStudio/helm/commit/df6de7b0c40b062351913790901f48423e5f664a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.1.2 ([ffb414d](https://github.com/LerianStudio/helm/commit/ffb414d8b71c60108afc8d8ca997616610c88a05)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.1 ([adbe456](https://github.com/LerianStudio/helm/commit/adbe456f10361ac91c79e72b81bd171d9d1a28da)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.2 ([2c2b639](https://github.com/LerianStudio/helm/commit/2c2b639e67f749a6e98452ecb09aab79a327e468)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.3 ([e08d78a](https://github.com/LerianStudio/helm/commit/e08d78a8e4220c78695d51a6764417241f8ff8ea)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.4 ([a42a959](https://github.com/LerianStudio/helm/commit/a42a959fd56639a0805eef3dca75d117cdcb407e)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.6 ([fe3749c](https://github.com/LerianStudio/helm/commit/fe3749cd1cd6dae57a2d156181cab624db53aa76)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.7 ([793be45](https://github.com/LerianStudio/helm/commit/793be450b2ee8fdb9042dca0b275845d4461fff8)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.2.8 ([55681de](https://github.com/LerianStudio/helm/commit/55681def27a6eaf2655b0cdd03ba1d90956db54a)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.3.0 ([35c27d1](https://github.com/LerianStudio/helm/commit/35c27d157a06baf08d0c35587b0ba42fa83e003f)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.4.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.4.1, plugin-br-pix-indirect-btg-worker-inbound@1.4.1, plugin-br-pix-indirect-btg-worker-outbound@1.4.1 ([3c6970f](https://github.com/LerianStudio/helm/commit/3c6970fa684f810608c93c9b5a14762913fa0642)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.1, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.1, plugin-br-pix-indirect-btg-worker-inbound@1.5.1, plugin-br-pix-indirect-btg-worker-outbound@1.5.1 ([226f506](https://github.com/LerianStudio/helm/commit/226f506964e0b271d4f61ec451a52121371096a3)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.5.2, plugin-br-pix-indirect-btg-worker-reconciliation@1.5.2, plugin-br-pix-indirect-btg-worker-inbound@1.5.2, plugin-br-pix-indirect-btg-worker-outbound@1.5.2 ([6dbb46c](https://github.com/LerianStudio/helm/commit/6dbb46cfa97ec25e3a96a7c296452ed5a2a93f38)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](https://github.com/LerianStudio/helm/commit/a3c2b6d91208d9a2def2fffe15f9065d6d12e0c0)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-fees:** update plugin-fees@3.0.7 ([844537d](https://github.com/LerianStudio/helm/commit/844537d1ff6d902a454b6f49bd70e431a1b9055f)) * **plugin-fees:** update plugin-fees@3.0.8 ([8c5579c](https://github.com/LerianStudio/helm/commit/8c5579c72b31b43e4a5389112a9849092e645617)) * **plugin-access-manager:** update plugin-identity@2.4.2 ([8b01a14](https://github.com/LerianStudio/helm/commit/8b01a14b077f8fdbc0dd642c1f09b695f27d8623)) * update rabbitmq authentication format to use value field in helm chart ([9ef3305](https://github.com/LerianStudio/helm/commit/9ef33051275a99abd848ef6b1717a8e613e49f94)) * update rabbitmq authentication username field to user ([07a183a](https://github.com/LerianStudio/helm/commit/07a183a8be746cdef266d09dbfe011b04b5da468)) * **product-console:** update readiness probe path to default to root ([2996200](https://github.com/LerianStudio/helm/commit/29962007e8b4428251289da18ac13c97c46fac02)) * **midaz:** update README with ledger service documentation and remove console/nginx references ([e472f4f](https://github.com/LerianStudio/helm/commit/e472f4f192b3ab73f75e17f0968150dca1394e26)) * update reporter cm ([fcdd63c](https://github.com/LerianStudio/helm/commit/fcdd63c752b873d83618c75093f9709aaaebf353)) * **reporter:** update reporter-manager@1.0.0, reporter-worker@1.0.0 ([d586bf1](https://github.com/LerianStudio/helm/commit/d586bf17c2427509b5bdc6a33797b15d4fd126b5)) * **reporter:** update reporter-manager@1.1.1 ([4f98acf](https://github.com/LerianStudio/helm/commit/4f98acfb798423cf6e82b27b2b9dbe97b44d4351)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **matcher:** update securityContext to run as root ([8de4a13](https://github.com/LerianStudio/helm/commit/8de4a13461263bfdac56c72f5521fa4bb228f5b4)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](https://github.com/LerianStudio/helm/commit/4492c3d629bbe1048e250967572a7b6599a15a68)) * **plugin-br-bank-transfer:** update service port and server address to 4027 in configuration files ([dd4e2a0](https://github.com/LerianStudio/helm/commit/dd4e2a05f1c62f619f3cd45bd4f8a9b01a596546)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * update transaction service DNS name in onboarding config ([b98a488](https://github.com/LerianStudio/helm/commit/b98a488e3b27c077eebd65e3bbffcddac2a313e1)) * **reporter:** update worker default image tag to match latest stable release ([147ed4c](https://github.com/LerianStudio/helm/commit/147ed4c20cb81a955402d3d4361852966a11516e)) * **bootstrap-mongodb:** use /bin/bash instead of /bin/sh for mongosh container ([b956943](https://github.com/LerianStudio/helm/commit/b956943f69f1ecee7e90f3db5f75b37c2827d179)) * use /bin/sh instead of /bin/bash in alpine kubectl container ([24c9fc0](https://github.com/LerianStudio/helm/commit/24c9fc0702fd5252105c7ec2774413647a0b7009)) * **matcher:** use configmap value for OBJECT_STORAGE_ENDPOINT with IAM Roles Anywhere ([c0f19a4](https://github.com/LerianStudio/helm/commit/c0f19a4648595b8784d0d5e7ce3f9991074978ac)) * **midaz:** use dig function for safer nested value access in ledger init container timeout ([86ee67d](https://github.com/LerianStudio/helm/commit/86ee67d4f3bfe9281f5336a68a59cb8175e4e2d4)) * use dynamic service names based on release name ([cc9e734](https://github.com/LerianStudio/helm/commit/cc9e7345d452a7ba32263269c8e974a7856c5544)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](https://github.com/LerianStudio/helm/commit/ac4c1e82a13017aa3d2c7d031f449c86ad63bc23)) * **plugin-fees:** use midaz-ledger service for MIDAZ_TRANSACTION_URL default ([9515b35](https://github.com/LerianStudio/helm/commit/9515b3520d4e36ec74eb0279ff30933c0955499e)) * **bootstrap-mongodb:** use name helpers instead of hardcoded names ([d932f48](https://github.com/LerianStudio/helm/commit/d932f48eec2054013278151769001633b0c94091)) * **reporter:** use RABBITMQ_URI for KEDA scaler host ([60809c9](https://github.com/LerianStudio/helm/commit/60809c9273e1f1af8a177038e6c922d3a672b057)) * **plugin-access-manager:** use separate repository and tag for auth backend image ([01b9a5c](https://github.com/LerianStudio/helm/commit/01b9a5c85abd3d26e56ce698b5b0661a227d6c77)) * **reporter:** use unique names for cluster-scoped resources ([5cdaa80](https://github.com/LerianStudio/helm/commit/5cdaa8066d13a312d84a138d81609226f492a745)) * **bootstrap-mongodb:** use updateUser + process.env for safer reconciliation ([13ee1dc](https://github.com/LerianStudio/helm/commit/13ee1dc99078c5581a659ed33b361e7191229200)), closes [#1187](https://github.com/LerianStudio/helm/issues/1187) * **charts:** value key typo and stale README notes ([91ce16f](https://github.com/LerianStudio/helm/commit/91ce16fd0abb82f251f6151bdf34cfd7029edf80)) * values ([b1dc8f7](https://github.com/LerianStudio/helm/commit/b1dc8f7105ab3aa0bbed2549525f013875087b7d)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](https://github.com/LerianStudio/helm/issues/1430)) ([f38d6d9](https://github.com/LerianStudio/helm/commit/f38d6d91fec753cada642103ae242bb388e67669)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) ### Performance Improvements * Update resources ([b5f07f0](https://github.com/LerianStudio/helm/commit/b5f07f0fd2319f2bbe3155fd075c1ae7874cf59c)) * Update resources ([9ffc743](https://github.com/LerianStudio/helm/commit/9ffc7430951db115934fb10223f0d9287adfcf60)) ### Reverts * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET from global to component-level secrets ([653594c](https://github.com/LerianStudio/helm/commit/653594ccc07a2fdde1e3f7b09ff627089278a668)) * **plugin-br-pix-indirect-btg:** move INTERNAL_WEBHOOK_SECRET validation from global to pix.secrets ([f95be82](https://github.com/LerianStudio/helm/commit/f95be8266c5b88c92c839060063a69b581a41edf)) ### Miscellaneous Chores * **midaz:** chart bump version BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([28de7ce](https://github.com/LerianStudio/helm/commit/28de7ceb2dd9b39d87ae64d0f64573530a03be9b)) * **midaz:** remove redis port env var BREAKING CHANGE: The REDIS_PORT environment variable has been removed its value must now be included directly in the REDIS_HOST variable. ([e2113c0](https://github.com/LerianStudio/helm/commit/e2113c0bd99fe8f04e3c4ede5766f3fb99497ec0)) ### Code Refactoring * **plugin-br-payments:** rename PROVIDER_* values to BTG_* ([6454fc3](https://github.com/LerianStudio/helm/commit/6454fc3ff1395821bb4b7d21f3f0bd5915964cc6)) --- README.md | 2 +- charts/lender/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6000c4dc..8c6f0be0 100644 --- a/README.md +++ b/README.md @@ -180,7 +180,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Lender Version | | :---: | :---: | -| `1.0.2` | 1.0.0-beta.49 | +| `1.0.0-beta.1` | 1.0.0-beta.48 | ----------------- ### Matcher diff --git a/charts/lender/Chart.yaml b/charts/lender/Chart.yaml index c1d241ce..7cf6220d 100644 --- a/charts/lender/Chart.yaml +++ b/charts/lender/Chart.yaml @@ -11,7 +11,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.0.2 +version: 1.0.0-beta.1 # NOTE: appVersion tracks the lender API image line. The real image tag is set # per-component via lender.image.tag and lenderConsole.image.tag. appVersion: "1.0.0-beta.49" From 4b62eb66a7a241c653ca940c702f20dc91fdf0bd Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Fri, 17 Jul 2026 12:34:53 -0300 Subject: [PATCH 097/113] feat(charts): support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The br-ccs chart's templates/secrets.yaml renders brCcs.secrets through an explicit allowlist, so keys not on the list are silently dropped from the rendered Secret. LICENSE_KEY and ORGANIZATION_IDS (lib-license-go, GLOBAL enforcement) were not on it, so consumers wiring them under brCcs.secrets got an empty license env and failed the boot-time gateway check. Add both keys to the Secret allowlist (gated by if, so they render only when set) and document them in values.yaml and values-template.yaml. Held as a Secret — not a ConfigMap — matching the br-slc / br-sta / fetcher convention. Chart.yaml is not bumped here; semantic-release handles the version on merge. Co-Authored-By: Claude Opus 4.8 --- charts/br-ccs/templates/secrets.yaml | 12 ++++++++++++ charts/br-ccs/values-template.yaml | 4 ++++ charts/br-ccs/values.yaml | 6 ++++++ 3 files changed, 22 insertions(+) diff --git a/charts/br-ccs/templates/secrets.yaml b/charts/br-ccs/templates/secrets.yaml index 45d9cd24..b0bf790e 100644 --- a/charts/br-ccs/templates/secrets.yaml +++ b/charts/br-ccs/templates/secrets.yaml @@ -64,6 +64,18 @@ stringData: FETCHER_CRYPTO_KEY: {{ $s.FETCHER_CRYPTO_KEY | quote }} {{- end }} + # License (lib-license-go). Read as env via the envFrom secretRef. LICENSE_KEY + # authorizes the app against the Lerian license gateway at boot (fail-closed); + # ORGANIZATION_IDS selects the enforcement scope (e.g. "global"). Held as a + # Secret (not a ConfigMap) so the key material is not exposed in plain + # manifests, matching the br-slc / br-sta / fetcher convention. + {{- if $s.LICENSE_KEY }} + LICENSE_KEY: {{ $s.LICENSE_KEY | quote }} + {{- end }} + {{- if $s.ORGANIZATION_IDS }} + ORGANIZATION_IDS: {{ $s.ORGANIZATION_IDS | quote }} + {{- end }} + # Object storage credentials (per bucket) {{- range $k := (list "OBJECT_STORAGE_STA_ACCESS_KEY" "OBJECT_STORAGE_STA_SECRET_KEY" "OBJECT_STORAGE_CCS_ACCESS_KEY" "OBJECT_STORAGE_CCS_SECRET_KEY" "OBJECT_STORAGE_FETCHER_ACCESS_KEY" "OBJECT_STORAGE_FETCHER_SECRET_KEY") }} {{- if index $s $k }} diff --git a/charts/br-ccs/values-template.yaml b/charts/br-ccs/values-template.yaml index 3885303d..72c9d50f 100644 --- a/charts/br-ccs/values-template.yaml +++ b/charts/br-ccs/values-template.yaml @@ -116,6 +116,10 @@ brCcs: CCS_CRYPTO_MASTER_KEY: "" # AES-256-GCM master key, 64 hex chars (openssl rand -hex 32) FETCHER_CRYPTO_KEY: "" # Fetcher snapshot decryption key (base64; = Fetcher APP_ENC_KEY) + # License (lib-license-go; validated at boot, fail-closed) + # LICENSE_KEY: "" # Lerian license key + # ORGANIZATION_IDS: "" # enforcement scope (e.g. "global") + # Object storage credentials (set alongside the matching *_BUCKET) # OBJECT_STORAGE_STA_ACCESS_KEY: "" # OBJECT_STORAGE_STA_SECRET_KEY: "" diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index 08963e71..fee4617f 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -564,6 +564,12 @@ brCcs: CCS_CRYPTO_MASTER_KEY: "" FETCHER_CRYPTO_KEY: "" + # License (lib-license-go) — validated at boot against the Lerian license + # gateway (fail-closed). ORGANIZATION_IDS selects enforcement scope (e.g. + # "global"). Held as a Secret; wire via a secrets manager or existing Secret. + # LICENSE_KEY: "" + # ORGANIZATION_IDS: "" + # Object storage credentials (per bucket) OBJECT_STORAGE_STA_ACCESS_KEY: "" OBJECT_STORAGE_STA_SECRET_KEY: "" From a7cd29c10f7b0e4839cdb3ebb21802434d496165 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 15:41:49 +0000 Subject: [PATCH 098/113] chore(release): 1.0.0-beta.3 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) ### Bug Fixes * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) --- README.md | 2 +- charts/br-ccs/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8c6f0be0..ff9e6cd0 100644 --- a/README.md +++ b/README.md @@ -308,7 +308,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.2` | 1.0.0 | +| `1.0.0-beta.3` | 1.0.0 | ----------------- ### BR SLC diff --git a/charts/br-ccs/Chart.yaml b/charts/br-ccs/Chart.yaml index 031eb330..1c8c7e89 100644 --- a/charts/br-ccs/Chart.yaml +++ b/charts/br-ccs/Chart.yaml @@ -13,7 +13,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.0.0-beta.2 +version: 1.0.0-beta.3 appVersion: "1.0.0" From b54855644c9c7361863aa8a02a632ce980eeddb0 Mon Sep 17 00:00:00 2001 From: Bruno Lima Date: Fri, 17 Jul 2026 14:47:00 -0300 Subject: [PATCH 099/113] feat(charts): add per-upstream M2M OAuth2 client credentials to br-ccs secrets Render six per-upstream M2M OAuth2 secret keys (FETCHER_/REPORTER_/STA_CLIENT_ID and _CLIENT_SECRET) into the br-ccs Opaque Secret when set, mirroring the existing *_API_KEY block. These back the single-tenant M2M mint; multi-tenant (SaaS) resolves per-tenant credentials from AWS Secrets Manager and ignores them. PLUGIN_AUTH_ENABLED/PLUGIN_AUTH_HOST already render in the ConfigMap. Semantic-release will cut beta.4. X-Lerian-Ref: br-ccs-158 --- charts/br-ccs/templates/secrets.yaml | 11 +++++++++++ charts/br-ccs/values-template.yaml | 10 +++++++++- charts/br-ccs/values.yaml | 14 +++++++++++++- 3 files changed, 33 insertions(+), 2 deletions(-) diff --git a/charts/br-ccs/templates/secrets.yaml b/charts/br-ccs/templates/secrets.yaml index b0bf790e..9b0e2073 100644 --- a/charts/br-ccs/templates/secrets.yaml +++ b/charts/br-ccs/templates/secrets.yaml @@ -89,5 +89,16 @@ stringData: {{ $k }}: {{ index $s $k | quote }} {{- end }} {{- end }} + + # Per-upstream M2M OAuth2 client credentials (single-tenant). The client_id/client_secret + # pair authenticates br-ccs to each upstream (Fetcher / Reporter / STA) via the + # plugin-auth token endpoint. Multi-tenant (SaaS) resolves per-tenant credentials from + # AWS Secrets Manager instead and ignores these. Held as a Secret (never a ConfigMap) so + # the client secrets are not exposed in plain manifests, matching the *_API_KEY convention. + {{- range $k := (list "FETCHER_CLIENT_ID" "FETCHER_CLIENT_SECRET" "REPORTER_CLIENT_ID" "REPORTER_CLIENT_SECRET" "STA_CLIENT_ID" "STA_CLIENT_SECRET") }} + {{- if index $s $k }} + {{ $k }}: {{ index $s $k | quote }} + {{- end }} + {{- end }} {{- end }} {{- end }} diff --git a/charts/br-ccs/values-template.yaml b/charts/br-ccs/values-template.yaml index 72c9d50f..83efc837 100644 --- a/charts/br-ccs/values-template.yaml +++ b/charts/br-ccs/values-template.yaml @@ -128,11 +128,19 @@ brCcs: # OBJECT_STORAGE_FETCHER_ACCESS_KEY: "" # OBJECT_STORAGE_FETCHER_SECRET_KEY: "" - # Per-upstream M2M API keys (on-prem / local fallback; SaaS uses OAuth2) + # Per-upstream M2M API keys (on-prem / local literal-Bearer fallback) # FETCHER_API_KEY: "" # REPORTER_API_KEY: "" # STA_API_KEY: "" + # Per-upstream M2M OAuth2 client credentials (single-tenant; via plugin-auth token endpoint) + # FETCHER_CLIENT_ID: "" + # FETCHER_CLIENT_SECRET: "" + # REPORTER_CLIENT_ID: "" + # REPORTER_CLIENT_SECRET: "" + # STA_CLIENT_ID: "" + # STA_CLIENT_SECRET: "" + # Multi-tenant (tenant-manager) # MULTI_TENANT_SERVICE_API_KEY: "" diff --git a/charts/br-ccs/values.yaml b/charts/br-ccs/values.yaml index fee4617f..6f6e125a 100644 --- a/charts/br-ccs/values.yaml +++ b/charts/br-ccs/values.yaml @@ -578,11 +578,23 @@ brCcs: OBJECT_STORAGE_FETCHER_ACCESS_KEY: "" OBJECT_STORAGE_FETCHER_SECRET_KEY: "" - # Per-upstream M2M API keys (on-prem / local fallback; SaaS uses OAuth2) + # Per-upstream M2M API keys (on-prem / local literal-Bearer fallback) # FETCHER_API_KEY: "" # REPORTER_API_KEY: "" # STA_API_KEY: "" + # Per-upstream M2M OAuth2 client credentials (single-tenant) — the client_id/client_secret + # pair that authenticates br-ccs to each upstream (Fetcher / Reporter / STA) via + # the plugin-auth token endpoint. Multi-tenant (SaaS) resolves per-tenant credentials + # from AWS Secrets Manager instead. Held as a Secret; wire via a secrets manager or + # existing Secret. + # FETCHER_CLIENT_ID: "" + # FETCHER_CLIENT_SECRET: "" + # REPORTER_CLIENT_ID: "" + # REPORTER_CLIENT_SECRET: "" + # STA_CLIENT_ID: "" + # STA_CLIENT_SECRET: "" + # -- Existing secrets name useExistingSecret: false existingSecretName: "" From 780bd186ad4a1fb53ae87f0e96ea8a28840eab2a Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 17:59:14 +0000 Subject: [PATCH 100/113] chore(release): 1.0.0-beta.4 ## (2026-07-17) ### Features * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) --- README.md | 2 +- charts/br-ccs/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index ff9e6cd0..0f4c3b61 100644 --- a/README.md +++ b/README.md @@ -308,7 +308,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `1.0.0-beta.3` | 1.0.0 | +| `1.0.0-beta.4` | 1.0.0 | ----------------- ### BR SLC diff --git a/charts/br-ccs/Chart.yaml b/charts/br-ccs/Chart.yaml index 1c8c7e89..489b1748 100644 --- a/charts/br-ccs/Chart.yaml +++ b/charts/br-ccs/Chart.yaml @@ -13,7 +13,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.0.0-beta.3 +version: 1.0.0-beta.4 appVersion: "1.0.0" From ed3c31c344d120c622d6776e88b63286335e8460 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:25:12 +0000 Subject: [PATCH 101/113] chore(release): 1.2.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/br-sisbajud/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f4959433..2bc87746 100644 --- a/README.md +++ b/README.md @@ -286,5 +286,5 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | Migrations Version | | :---: | :---: | :---: | -| `1.1.0` | `1.0.0-beta.109` | `1.0.0-beta.109` | +| `1.2.0-beta.1` | `1.0.0-beta.109` | `1.0.0-beta.109` | ----------------- diff --git a/charts/br-sisbajud/Chart.yaml b/charts/br-sisbajud/Chart.yaml index a619cd19..770c992e 100644 --- a/charts/br-sisbajud/Chart.yaml +++ b/charts/br-sisbajud/Chart.yaml @@ -17,7 +17,7 @@ maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.1.0 +version: 1.2.0-beta.1 # NOTE: appVersion is the default image tag for the app and the migration Job. # Override via brSisbajud.image.tag when needed. From bed81db7849f76533b2c3bf5bf067fa08aca124f Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:27:11 +0000 Subject: [PATCH 102/113] chore(release): 3.1.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/fetcher/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 2bc87746..7ce7c19b 100644 --- a/README.md +++ b/README.md @@ -154,7 +154,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `3.0.0` | 1.4.2 | 1.4.2 | +| `3.1.0-beta.1` | 2.0.2 | 2.0.2 | ----------------- ### Underwriter diff --git a/charts/fetcher/Chart.yaml b/charts/fetcher/Chart.yaml index e01fda97..394f25ae 100644 --- a/charts/fetcher/Chart.yaml +++ b/charts/fetcher/Chart.yaml @@ -8,7 +8,7 @@ home: https://github.com/LerianStudio/fetcher maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.0.0 +version: 3.1.0-beta.1 appVersion: "2.0.2" keywords: - midaz From 4aa0e5efc2511557a2a96ba7544604273c96fc7b Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:29:06 +0000 Subject: [PATCH 103/113] chore(release): 3.2.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/flowker/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 7ce7c19b..77ae0124 100644 --- a/README.md +++ b/README.md @@ -205,7 +205,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Flowker Version | | :---: | :---: | -| `3.1.1` | 1.2.0-beta.82 | +| `3.2.0-beta.1` | 1.2.0-beta.82 | ----------------- ### Tracer diff --git a/charts/flowker/Chart.yaml b/charts/flowker/Chart.yaml index fd3b9eb6..3ca209be 100644 --- a/charts/flowker/Chart.yaml +++ b/charts/flowker/Chart.yaml @@ -11,7 +11,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 3.1.1 +version: 3.2.0-beta.1 appVersion: "1.2.0-beta.82" keywords: - flowker From bc5f7b1c480ba3147499d1abca099102182d0cf4 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:30:59 +0000 Subject: [PATCH 104/113] chore(release): 8.7.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/midaz/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 77ae0124..94c1ee00 100644 --- a/README.md +++ b/README.md @@ -24,7 +24,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Ledger Version | CRM Version | | :---: | :---: | :---: | -| `8.6.0` | 3.7.8 | 3.7.8 | +| `8.7.0-beta.1` | 3.7.8 | 3.7.8 | ----------------- ### Plugin Access Manager Helm Chart diff --git a/charts/midaz/Chart.yaml b/charts/midaz/Chart.yaml index d2be43da..c4b91d4c 100644 --- a/charts/midaz/Chart.yaml +++ b/charts/midaz/Chart.yaml @@ -14,7 +14,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to he chart and its templates, including the app version. -version: 8.6.0 +version: 8.7.0-beta.1 # This is the version number of the application being deployed. appVersion: "3.7.8" # A list of keywords about the chart. This helps others discover the chart. From 60166be112be5fdc066f1a949a54d52df6c22651 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:32:26 +0000 Subject: [PATCH 105/113] chore(release): 4.2.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/otel-collector-lerian/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 94c1ee00..0457a3c3 100644 --- a/README.md +++ b/README.md @@ -229,7 +229,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Otel Version | | :---: | :---: | -| `4.1.0` | 0.142.0 | +| `4.2.0-beta.1` | 0.142.0 | ----------------- ### Product Console diff --git a/charts/otel-collector-lerian/Chart.yaml b/charts/otel-collector-lerian/Chart.yaml index e6d732b9..fbe7f431 100644 --- a/charts/otel-collector-lerian/Chart.yaml +++ b/charts/otel-collector-lerian/Chart.yaml @@ -18,7 +18,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 4.1.0 +version: 4.2.0-beta.1 # This is the version number of the application being deployed. appVersion: "0.1.0" From 6182e0420b93a7f360f0efd205965573420b697d Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:34:10 +0000 Subject: [PATCH 106/113] chore(release): 8.4.0-beta.3 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) --- README.md | 2 +- charts/plugin-access-manager/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 0457a3c3..f49c5e8d 100644 --- a/README.md +++ b/README.md @@ -37,7 +37,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Auth Version | Identity Version | | :---: | :---: | :---: | -| `8.4.0-beta.2` | 2.6.7 | 2.4.5 | +| `8.4.0-beta.3` | 2.6.7 | 2.4.5 | ----------------- ### Plugin Fees Helm Chart diff --git a/charts/plugin-access-manager/Chart.yaml b/charts/plugin-access-manager/Chart.yaml index d5747365..54212d91 100644 --- a/charts/plugin-access-manager/Chart.yaml +++ b/charts/plugin-access-manager/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 8.4.0-beta.2 +version: 8.4.0-beta.3 # This is the version number of the application being deployed. appVersion: "2.6.7" # A list of keywords about the chart. This helps others discover the chart. From a66b52c26947700344f911d8925175b23e46c551 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:35:59 +0000 Subject: [PATCH 107/113] chore(release): 1.4.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-br-bank-transfer/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index f49c5e8d..5772e69e 100644 --- a/README.md +++ b/README.md @@ -90,7 +90,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | bankTransfer Version | | :---: | :---: | -| `1.3.0` | 1.0.0 | +| `1.4.0-beta.1` | 1.0.0 | ----------------- diff --git a/charts/plugin-br-bank-transfer/Chart.yaml b/charts/plugin-br-bank-transfer/Chart.yaml index 685af70c..bf5adeb9 100644 --- a/charts/plugin-br-bank-transfer/Chart.yaml +++ b/charts/plugin-br-bank-transfer/Chart.yaml @@ -11,7 +11,7 @@ sources: maintainers: - name: "Lerian Studio" email: "support@lerian.studio" -version: 1.3.0 +version: 1.4.0-beta.1 appVersion: "1.1.9" keywords: - bank-transfer From 6ea99f371f6420c193e85b245ee36184a5ca3951 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:37:47 +0000 Subject: [PATCH 108/113] chore(release): 3.1.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-br-pix-direct-jd/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 5772e69e..9d297141 100644 --- a/README.md +++ b/README.md @@ -105,7 +105,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Job Version | | :---: | :---: | :---: | -| `3.0.0` | 1.2.1-beta.11 | 1.2.1-beta.12 | +| `3.1.0-beta.1` | 1.2.1-beta.11 | 1.2.1-beta.12 | ----------------- ### Plugin BR Pix Switch diff --git a/charts/plugin-br-pix-direct-jd/Chart.yaml b/charts/plugin-br-pix-direct-jd/Chart.yaml index 0312737b..90aa98b0 100644 --- a/charts/plugin-br-pix-direct-jd/Chart.yaml +++ b/charts/plugin-br-pix-direct-jd/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.0.0 +version: 3.1.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.2.1-beta.11" From 8d258d3544470bab6d569355dd3e5431fa55a0f6 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:39:39 +0000 Subject: [PATCH 109/113] chore(release): 3.5.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-br-pix-indirect-btg/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 9d297141..b7c62601 100644 --- a/README.md +++ b/README.md @@ -129,7 +129,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Pix Version | Inbound Version | Outbound Version | Reconciliation Version | | :---: | :---: | :---: | :---: | :---: | -| `3.4.0` | 1.7.6 | 1.7.6 | 1.7.6 | 1.7.6 | +| `3.5.0-beta.1` | 1.7.6 | 1.7.6 | 1.7.6 | 1.7.6 | ----------------- diff --git a/charts/plugin-br-pix-indirect-btg/Chart.yaml b/charts/plugin-br-pix-indirect-btg/Chart.yaml index a75e20e9..195f94bb 100644 --- a/charts/plugin-br-pix-indirect-btg/Chart.yaml +++ b/charts/plugin-br-pix-indirect-btg/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.4.0 +version: 3.5.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.7.6" # A list of keywords about the chart. This helps others discover the chart. From d5d3ead700c754456c83517277aaf545fd7a93b2 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:41:24 +0000 Subject: [PATCH 110/113] chore(release): 2.1.0-beta.4 ## (2026-07-17) ### Features * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) --- README.md | 2 +- charts/plugin-br-pix-switch/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index b7c62601..70baba08 100644 --- a/README.md +++ b/README.md @@ -116,7 +116,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | App Version | | :---: | :---: | -| `2.1.0-beta.3` | 1.0.0-beta.1 | +| `2.1.0-beta.4` | 1.0.0-beta.1 | ----------------- ### Plugin BR Pix Indirect BTG diff --git a/charts/plugin-br-pix-switch/Chart.yaml b/charts/plugin-br-pix-switch/Chart.yaml index 51d38120..7afcd759 100644 --- a/charts/plugin-br-pix-switch/Chart.yaml +++ b/charts/plugin-br-pix-switch/Chart.yaml @@ -15,7 +15,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 2.1.0-beta.3 +version: 2.1.0-beta.4 # This is the version number of the application being deployed. appVersion: "1.0.0-beta.101" From 889d264aae3a0baef837aedbb402cc9909322a81 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:43:01 +0000 Subject: [PATCH 111/113] chore(release): 7.3.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/plugin-fees/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 70baba08..8e6fb12f 100644 --- a/README.md +++ b/README.md @@ -50,7 +50,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Fees Version | UI Version | | :---: | :---: | :---: | -| `7.2.0` | 3.3.0 | `3.0.0` | +| `7.3.0-beta.1` | 3.3.0 | `3.0.0` | ----------------- diff --git a/charts/plugin-fees/Chart.yaml b/charts/plugin-fees/Chart.yaml index 45f850cb..7499ab99 100644 --- a/charts/plugin-fees/Chart.yaml +++ b/charts/plugin-fees/Chart.yaml @@ -11,7 +11,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 7.2.0 +version: 7.3.0-beta.1 # This is the version number of the application being deployed. appVersion: "3.3.0" # A list of keywords about the chart. This helps others discover the chart. From f101f55aa0c34685fddc2f079a0741d59ee26cc5 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:44:59 +0000 Subject: [PATCH 112/113] chore(release): 3.2.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](https://github.com/LerianStudio/helm/commit/6521ba7d0092d6943eedd5021d36008c9e46ff5f)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](https://github.com/LerianStudio/helm/commit/9b6537872ce115d4c086947959d8395c44829910)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](https://github.com/LerianStudio/helm/commit/3e18fa66235d61134b20d2d4dfd7da72bbd41495)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](https://github.com/LerianStudio/helm/commit/6214b2a914a9cd2e94e0c25a129d90b9a86fb369)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](https://github.com/LerianStudio/helm/commit/99e3105d466c396ae01c0ef20ec885fa202ab72c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](https://github.com/LerianStudio/helm/commit/5292a600737a288111ad3e63a9c594dc3e53e705)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](https://github.com/LerianStudio/helm/commit/07ea25b643d174ba9c66d3052f4aff0e0e4975c4)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/product-console/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 8e6fb12f..6dbe5127 100644 --- a/README.md +++ b/README.md @@ -242,7 +242,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Console Version | | :---: | :---: | -| `3.1.0` | 1.6.0 | +| `3.2.0-beta.1` | 1.6.0 | ----------------- ### Plugin BC Correios diff --git a/charts/product-console/Chart.yaml b/charts/product-console/Chart.yaml index 015c26a7..ee463abd 100644 --- a/charts/product-console/Chart.yaml +++ b/charts/product-console/Chart.yaml @@ -19,7 +19,7 @@ maintainers: # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.1.0 +version: 3.2.0-beta.1 # This is the version number of the application being deployed. appVersion: "1.6.0" From 2f51375323270785abdee30e205affe078be2f32 Mon Sep 17 00:00:00 2001 From: lerian-studio Date: Fri, 17 Jul 2026 18:46:58 +0000 Subject: [PATCH 113/113] chore(release): 3.2.0-beta.1 ## (2026-07-17) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](https://github.com/LerianStudio/helm/commit/9180459802ccf1dd2ffa98bdd4ce198aed6a920a)) * **chart:** add adapter-lerian template directories ([1882905](https://github.com/LerianStudio/helm/commit/1882905b6e081077caddbad56c9894a2ec2d52ee)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](https://github.com/LerianStudio/helm/commit/328b236a9a5a207e1fe2cd3a11ed1fba5980d662)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](https://github.com/LerianStudio/helm/commit/003b78320a2ad1ca2d067317027b95d641433434)) * **br-sta:** add background worker Deployment ([f8b02f5](https://github.com/LerianStudio/helm/commit/f8b02f5154ee80224b5f1b6a9762ee7cc266ccee)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](https://github.com/LerianStudio/helm/commit/cc65a6db6631ceaf62708a777f888d7c59ddb05e)), closes [#99](https://github.com/LerianStudio/helm/issues/99) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](https://github.com/LerianStudio/helm/commit/82c420cd0185df870a631c749dd0d21ff84b9f05)) * **charts:** add br-spi-helm chart for the SPI rail ([5d6bf6a](https://github.com/LerianStudio/helm/commit/5d6bf6a3d210db1f257a2f7e116f47a886eb754f)), closes [#1607](https://github.com/LerianStudio/helm/issues/1607) * **br-sta:** add br-sta-helm chart ([b082dda](https://github.com/LerianStudio/helm/commit/b082ddad46f232749d3efd0babd24f49f0eec76f)) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](https://github.com/LerianStudio/helm/commit/ed1a9c9152faf12c7d69c480992e41d4c297a422)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](https://github.com/LerianStudio/helm/commit/6b20f50d97fa99ab9c878c38f0355632eb2f475c)) * **br-ccs:** add Helm chart ([0fa5f89](https://github.com/LerianStudio/helm/commit/0fa5f89f9d91e28a1de4c1c300d8870bb145e7d6)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](https://github.com/LerianStudio/helm/commit/1817beee8aad91199d16858f7829edf1470d7433)) * **new:** add lender chart ([#1672](https://github.com/LerianStudio/helm/issues/1672)) ([1540885](https://github.com/LerianStudio/helm/commit/15408857300206c791787cae57a3316b77ea876f)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](https://github.com/LerianStudio/helm/commit/ee6841dd7a18305d0c3018c674ac2e04e591128e)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](https://github.com/LerianStudio/helm/commit/576992f928f6de2d88c7008b98130836801fe855)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](https://github.com/LerianStudio/helm/commit/c95e7f23f7f38a451efde7c39371ea987f0f0966)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](https://github.com/LerianStudio/helm/commit/5e66bd289db0b85f1acbb7cb4a0254caf8e1a7b9)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](https://github.com/LerianStudio/helm/commit/b54855644c9c7361863aa8a02a632ce980eeddb0)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](https://github.com/LerianStudio/helm/commit/9bc7afc09bf929122e5437b59da074b91971185d)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](https://github.com/LerianStudio/helm/commit/b9f5bea547af1631342c92e49f54e1133ce6b2f7)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](https://github.com/LerianStudio/helm/commit/484e04e37e3b95a98381d4d1f1a9df914d23c04d)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](https://github.com/LerianStudio/helm/commit/9d3645db0ae9e53f89341ad21c28aa38720d6cc1)) * **plugin-br-pix-indirect-btg:** add schedule (pix recurrence) worker ([4dfe5ba](https://github.com/LerianStudio/helm/commit/4dfe5ba2d15f5e59c9065a65e58a6093de73ca98)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](https://github.com/LerianStudio/helm/commit/df8f89fa55b45336befb14cbaa49eeb3b36a559c)) * **charts:** add streaming-hub Helm chart ([#1569](https://github.com/LerianStudio/helm/issues/1569)) ([637014c](https://github.com/LerianStudio/helm/commit/637014cf233a763fa4e9fd8c48bdaa5a148cd70d)) * **charts:** add streaming-hub out-of-band DB migration support ([8f279f4](https://github.com/LerianStudio/helm/commit/8f279f4abb834de38ef176958a65874878187619)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](https://github.com/LerianStudio/helm/commit/3f5fe0bc8bb7db528adecf06bb7756f0367e8199)) * **plugin-access-manager:** default ALLOW_INSECURE_TLS on auth-backend ([055b428](https://github.com/LerianStudio/helm/commit/055b42888c1a2ef394eb9298f85136a0b530bcf2)) * **plugin-br-pix-switch:** expose all multi-tenant knobs across MT-aware components ([5df8bab](https://github.com/LerianStudio/helm/commit/5df8bab769de86b41d22cc579abbc1d846dddc86)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](https://github.com/LerianStudio/helm/commit/25390d4357f0c0a82106635f1ef3d9b60fcf46f6)) * **plugin-access-manager:** mirror POSTGRES_* env in migrations Job ([4d7c3ae](https://github.com/LerianStudio/helm/commit/4d7c3ae0c57167c2f16baf5f7eea3c92e0cd6a28)) * **matcher:** promote UI, MCP and detached migrations to multi-component chart ([88686ca](https://github.com/LerianStudio/helm/commit/88686caa6279e4df49206666240e34943a8637ef)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](https://github.com/LerianStudio/helm/commit/ead84176391be59021ebbc2ad04ca29306397020)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](https://github.com/LerianStudio/helm/commit/75f8cdbbe2335ae44d56833250b8b3c811b7640e)) * **plugin-access-manager:** support extraEnvVars on auth-backend ([9d8b5e3](https://github.com/LerianStudio/helm/commit/9d8b5e3c4957978ab0896ab9d7a2a7f6bf212bfc)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](https://github.com/LerianStudio/helm/commit/4b62eb66a7a241c653ca940c702f20dc91fdf0bd)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](https://github.com/LerianStudio/helm/commit/0ad123fba23416bc200db95220b6830656053116)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](https://github.com/LerianStudio/helm/commit/e64d6157c91e3f560720a980e59e987a3847993b)) * **streaming-hub:** update streaming-hub@1.0.0 - new env vars ([7d719d1](https://github.com/LerianStudio/helm/commit/7d719d1dc72de12f0b8bd33b3c487651ea26c558)) * **plugin-br-payments:** use single MIDAZ_LEDGER_URL ([de702ed](https://github.com/LerianStudio/helm/commit/de702edc6490f6cc1b9734c61849cc674610b254)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](https://github.com/LerianStudio/helm/commit/a5ba0b3230059607c719d03e17fb2d641338ed09)) * **br-sta:** add version matrix table to root README ([6808ebf](https://github.com/LerianStudio/helm/commit/6808ebff43b9138f589b7ea3bb1523eb7cc8855d)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](https://github.com/LerianStudio/helm/commit/41ef02f8e83a1f4c9dfc23e4c4c91512cedd47b8)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](https://github.com/LerianStudio/helm/commit/c2fe0acbd8d172cfbafe47e72a65fc91b0e04906)) * **schedule:** address CodeRabbit review comments ([96b69df](https://github.com/LerianStudio/helm/commit/96b69dfe5785ff30f91b8c1567195de25f9c1c5f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](https://github.com/LerianStudio/helm/commit/fc5659f99cbd76ce9a046903a8fe9049d7fcf6f4)) * **br-ccs:** address CodeRabbit review on PR [#1617](https://github.com/LerianStudio/helm/issues/1617) ([b4112dd](https://github.com/LerianStudio/helm/commit/b4112dd39592aa8049b8a56026205867f6bc545a)) * **br-sta:** address CodeRabbit review on PR [#1618](https://github.com/LerianStudio/helm/issues/1618) ([75a1b32](https://github.com/LerianStudio/helm/commit/75a1b321c9539151a5f8cf986cf778eee87516ba)) * **br-sta:** address CodeRabbit review on PR [#1621](https://github.com/LerianStudio/helm/issues/1621) ([5167b92](https://github.com/LerianStudio/helm/commit/5167b928c7afe40a1be03a1aaa1ff3c08a1a79c8)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](https://github.com/LerianStudio/helm/commit/18b02e5ae90882526584ba19c0e7b725f2ec7002)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](https://github.com/LerianStudio/helm/commit/c4732a869e9d5b70feb5276f5a7c8ebc70194f69)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](https://github.com/LerianStudio/helm/commit/6117aebb12f2d318b83a2b5c2e7e4c067674ec63)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](https://github.com/LerianStudio/helm/commit/59d300e70c652e673fe05a80293cff1e21f35a69)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](https://github.com/LerianStudio/helm/commit/27925f7d85868b1c03d1a9608757903473e3e7ee)) * **charts:** escape dynamic values in bootstrap-postgres SQL ([#1570](https://github.com/LerianStudio/helm/issues/1570)) ([9fa6863](https://github.com/LerianStudio/helm/commit/9fa68639cc4dc03eeb0c8d372433519b5362eb40)), closes [LerianStudio/helm#1569](https://github.com/LerianStudio/helm/issues/1569) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](https://github.com/LerianStudio/helm/commit/c87597092d8c79e6bc21046a77ae5b34a146df86)) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](https://github.com/LerianStudio/helm/commit/1fd3a50a6f4b0c1d6d6c365eb7327f2fb9489cdf)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](https://github.com/LerianStudio/helm/commit/eebc7ced3113219ac34bb9f12ba235c0f17616dc)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](https://github.com/LerianStudio/helm/commit/4e260aa9070474fead8cacf08fd8f75fcdb97e40)), closes [#1666](https://github.com/LerianStudio/helm/issues/1666) * **charts:** register streaming-hub in release README + add install docs ([#1571](https://github.com/LerianStudio/helm/issues/1571)) ([1f6a375](https://github.com/LerianStudio/helm/commit/1f6a37519a475f6b54cf51ea6873e6ceeb553a04)), closes [#1569](https://github.com/LerianStudio/helm/issues/1569) * **charts:** remove dead unrenderable streaming-hub secret boilerplate ([3a942b2](https://github.com/LerianStudio/helm/commit/3a942b2b3d9227cf76907676294f0bd7e2d72208)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](https://github.com/LerianStudio/helm/commit/24efbd2bd3b9f289f49f588e3a86e1f4715bfc77)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](https://github.com/LerianStudio/helm/commit/e54f32526520e74b010f79429f1eaed709971935)) * **br-sta:** require existingSecretName in schema when useExistingSecret is set ([4c1c218](https://github.com/LerianStudio/helm/commit/4c1c218f0e92f3cc759df536a4328ec07e76e699)), closes [#1618](https://github.com/LerianStudio/helm/issues/1618) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](https://github.com/LerianStudio/helm/commit/caff99fc9dc4a636ace9464777cf010b59321332)) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](https://github.com/LerianStudio/helm/commit/b4a338a6a87eff3938030e4a31c62d036031fe1f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](https://github.com/LerianStudio/helm/commit/988608594968493407efb605490dce13e1b13b40)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](https://github.com/LerianStudio/helm/commit/3c89507f237bf7dc86cff0c43897f519a499209a)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.7 ([bbedef9](https://github.com/LerianStudio/helm/commit/bbedef9032777c1019f1af85ce82e91bb4996297)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](https://github.com/LerianStudio/helm/commit/a5710e957cc8567df39449ecbdfb60283b4cbbf9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](https://github.com/LerianStudio/helm/commit/ecbda316fa5cfc8a9bbccaf3951922d4eb0c7475)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](https://github.com/LerianStudio/helm/commit/bcd81c17540d77e05d65f2c9437f05bbd8785a5e)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](https://github.com/LerianStudio/helm/commit/cc51d8bdd0a9efb708438d0a23a993c9d21e0eb4)) * **streaming-hub:** update streaming-hub@1.0.1 ([66fdf24](https://github.com/LerianStudio/helm/commit/66fdf2406e27dcb82602a7ed8c6c2c842f66bf5c)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](https://github.com/LerianStudio/helm/commit/063f33b034debecb9cc29daca790d887f12b25e3)) * **br-sta:** worker command must match the image's /service entrypoint ([4aefd1c](https://github.com/LerianStudio/helm/commit/4aefd1c32aa31d36c87643315d2bb7bb87cc600a)) --- README.md | 2 +- charts/reporter/Chart.yaml | 2 +- 2 files changed, 2 insertions(+), 2 deletions(-) diff --git a/README.md b/README.md index 6dbe5127..6de0e1ec 100644 --- a/README.md +++ b/README.md @@ -77,7 +77,7 @@ For implementation and configuration details, see the [README](https://charts.le | Chart Version | Manager Version | Worker Version | | :---: | :---: | :---: | -| `3.1.1` | 2.1.2 | 2.1.2 | +| `3.2.0-beta.1` | 2.2.0 | 2.2.0 | ----------------- ### Plugin BR Bank Transfer diff --git a/charts/reporter/Chart.yaml b/charts/reporter/Chart.yaml index a4194e73..ecd319de 100644 --- a/charts/reporter/Chart.yaml +++ b/charts/reporter/Chart.yaml @@ -14,7 +14,7 @@ maintainers: email: "support@lerian.studio" # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. -version: 3.1.1 +version: 3.2.0-beta.1 # This is the version number of the application being deployed. appVersion: "2.2.0" # A list of keywords about the chart. This helps others discover the chart.