feat(midaz): productize chart on lerian-common library (full, no regression) by guimoreirar · Pull Request #1741 · LerianStudio/helm

guimoreirar · 2026-07-24T16:43:48Z

Full productization of charts/midaz/ on the lerian-common library — render byte-identical to main for old-pattern values (empty diff, verified) AND supporting the grouped-params (new) values format used by GitOps envs.

What changed

ledger/crm configmaps: cfgValue/globalValue/datastore for grouped clean params (legacy configmap.<KEY> still WINS → backward-compatible), plus serviceDiscovery.envFlat / otel.envFlat / multiTenant.envFlat reproducing main's EXACT blocks (17 SD_* keys, OTEL, MULTI_TENANT) and preserving SD_TOKEN.
ledger/crm ingress via lerian-common.ingress; ledger MT-secret via lerian-common.multiTenant.secret.
values.yaml gains grouped clean-param blocks (additive; old flat values keep working).
Adds lerian-common-helm dependency (file://../lerian-common, >=1.0.0 <2.0.0).
CI: materializeLocalDependencies in the render-gate validator so it resolves file:// local library deps (no-op for charts without local deps; enabling infra for the productization pattern).

Verification

Old-pattern render (sample values) diff vs main: empty (zero regression).
New grouped-params render (GitOps values): honors the datastore mask.
SD 17 keys + SD_TOKEN preserved. strict 0 violations; render-gate ok.

Depends on #1742 (merged — lerian-common flat helpers on main).

coderabbitai · 2026-07-24T16:44:15Z

Note

Reviews paused

It looks like this branch is under active development. To avoid overwhelming you with review comments due to an influx of new commits, CodeRabbit has automatically paused this review. You can configure this behavior by changing the reviews.auto_review.auto_pause_after_reviewed_commits setting.

Use the following commands to manage reviews:

@coderabbitai resume to resume automatic reviews.
@coderabbitai review to trigger a single review.

Use the checkboxes below for quick actions:

▶️ Resume reviews
🔍 Trigger review

📝 Walkthrough

Walkthrough

Midaz adds a local lerian-common-helm dependency, productized ledger and CRM values, shared helper-based environment rendering, shared ingress and secret rendering, and render-gate support for local dependency directories.

Changes

Midaz shared Helm helper integration

Layer / File(s)	Summary
Local dependency rendering `.github/scripts/validate-helm-charts/main.go`, `charts/midaz/Chart.yaml`	The chart declares `lerian-common-helm` from `file://../lerian-common`, while the render gate copies existing local dependency directories into temporary workspaces before running Helm dependency builds.
Productized configuration values `charts/midaz/values.yaml`	Ledger and CRM expose grouped productized settings, leave legacy `configmap` blocks empty by default, and document legacy-key precedence.
Helper-based environment rendering `charts/midaz/templates/ledger/configmap.yaml`, `charts/midaz/templates/crm/configmap.yaml`	Ledger and CRM environment variables now use shared helpers for configuration values, datastore settings, telemetry, authentication, multi-tenancy, service discovery, broker settings, modules, streaming, and rate limits.
Shared ingress and secret rendering `charts/midaz/templates/crm/ingress.yaml`, `charts/midaz/templates/ledger/ingress.yaml`, `charts/midaz/templates/ledger/secrets.yaml`	Ingress manifests delegate to `lerian-common.ingress`, and ledger multi-tenant secret data delegates to `lerian-common.multiTenant.secret`.

Sequence Diagram(s)

sequenceDiagram
  participant RenderGate
  participant TempChart
  participant Helm
  participant LerianCommonHelpers
  RenderGate->>TempChart: Copy chart and existing file:// dependencies
  RenderGate->>Helm: Build dependencies and render chart
  Helm->>LerianCommonHelpers: Resolve shared ingress, config, and secret templates
  LerianCommonHelpers-->>Helm: Return rendered chart resources

Possibly related PRs

LerianStudio/helm#1705: Modifies Midaz service-discovery configuration in the same CRM and ledger templates.
LerianStudio/helm#1742: Introduces the shared lerian-common.otel.envFlat helper consumed by these templates.
LerianStudio/helm#1745: Adds the same local file://../lerian-common dependency and related shared-helper integrations.

✨ Finishing Touches

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch feat/midaz-productization

_{Comment @coderabbitai help to get the list of available commands.}

…ession) Full productization consuming the lerian-common library, render byte-identical to main for old-pattern values (empty diff) and supporting the grouped-params (new) values format: - ledger/crm configmaps: cfgValue/globalValue/datastore for grouped clean params (legacy configmap.<KEY> still wins), + serviceDiscovery.envFlat/ otel.envFlat/multiTenant.envFlat preserving main's exact SD (17 keys)/OTEL/MT blocks + SD_TOKEN. - ledger/crm ingress via lerian-common.ingress; ledger MT-secret via multiTenant.secret. - values.yaml gains grouped clean-param blocks (additive, backward-compatible). - lerian-common dependency (file://../lerian-common, >=1.0.0 <2.0.0). Also adds materializeLocalDependencies to the render-gate validator so it resolves file:// local library deps (enabling infra for the local-lib productization pattern; no-op for charts without local deps).

coderabbitai

Actionable comments posted: 6

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In @.github/scripts/validate-helm-charts/main.go:
- Around line 1535-1548: Update materializeLocalDependencies to validate each
resolved file:// dependency path remains contained within both chartDir and
tmpChart before calling dirExists or copyDir. Reject traversal or absolute paths
that escape either root, using path containment checks rather than trusting
filepath.Join/Clean; preserve skipping non-file dependencies and missing source
directories.

In `@charts/midaz/templates/crm/configmap.yaml`:
- Around line 53-54: Update the CRM configmap template around
PLUGIN_AUTH_ADDRESS and PLUGIN_AUTH_ENABLED to reuse the shared
lerian-common.auth.env helper, matching the ledger configmap’s implementation
and preserving the helper’s emitted key contract. Account for its
enabled-before-host output order so render-parity expectations are updated or
intentionally preserved as required.
- Around line 43-49: Update the OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT default in
the lerian-common.otel.envFlat invocation to reuse the existing cfgValue
resolution for ENV_NAME, preserving the legacy-key, crm.env, and development
fallback order used earlier in the template instead of reading
.Values.crm.configmap.ENV_NAME directly.

In `@charts/midaz/templates/crm/ingress.yaml`:
- Around line 2-11: Add a fail guard before the lerian-common.ingress include in
charts/midaz/templates/crm/ingress.yaml lines 2-11, requiring crm.ingress.hosts
or $gIng.domain; apply the same guard to
charts/midaz/templates/ledger/ingress.yaml lines 2-11 using
ledger.ingress.hosts. Alternatively, enforce this validation centrally in
lerian-common.ingress for all consumers.

In `@charts/midaz/templates/ledger/configmap.yaml`:
- Line 71: Define guarded local variables near the top of the template for the
nullable `.Values.ledger.database` and `.Values.ledger.mongo` sections,
defaulting each to an empty dict. Update the nested `cfgValue` call sites to use
`$ledgerDb.onboarding`/`$ledgerDb.transaction` and
`$ledgerMongo.onboarding`/`$ledgerMongo.transaction`, while leaving single-level
parameter lookups unchanged.
- Line 249: Update the service-discovery include in the ConfigMap template to
use the left-trimmed template delimiter, matching the other includes in the
file. Preserve the existing `lerian-common.serviceDiscovery.envFlat` invocation
and `nindent 2` behavior while removing the extra blank line before
`SD_ADDRESS`.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 037c3abb-f619-460f-b670-633a9ed60f9b

📥 Commits

Reviewing files that changed from the base of the PR and between f88a294 and 0578ef4.

⛔ Files ignored due to path filters (1)

charts/midaz/Chart.lock is excluded by !**/*.lock

📒 Files selected for processing (8)

.github/scripts/validate-helm-charts/main.go
charts/midaz/Chart.yaml
charts/midaz/templates/crm/configmap.yaml
charts/midaz/templates/crm/ingress.yaml
charts/midaz/templates/ledger/configmap.yaml
charts/midaz/templates/ledger/ingress.yaml
charts/midaz/templates/ledger/secrets.yaml
charts/midaz/values.yaml

…onfigmap) Replace the flat SD_* passthrough with lerian-common.serviceDiscovery.env: - enable per-app via ledger/crm.serviceDiscovery.enabled (SD_ENABLED emitted from the param); no SD_* in configmap (stays {} — clean). - env-wide server config derived from global.serviceDiscovery; internal DNS and external https:// endpoints derived from the chart service + ingress. - INERT when disabled or global.serviceDiscovery unset → backward-compatible (benedita keeps driving SD via extraEnvVars until it migrates). Depends on #1747 for the internal/tls-skip-verify platform defaults.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/midaz/templates/ledger/configmap.yaml`:
- Around line 252-259: Preserve legacy configmap.SD_* precedence by adding the
compatibility branch before derived service-discovery settings and resolving
enabled state from configmap.SD_ENABLED when provided. Apply this in
charts/midaz/templates/ledger/configmap.yaml:252-259 and
charts/midaz/templates/crm/configmap.yaml:62-69, retaining/rendering all legacy
configmap.SD_* sibling keys even without global.serviceDiscovery.address.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 05ee7117-01c0-4f6c-a50d-90ad2ddff0f9

📥 Commits

Reviewing files that changed from the base of the PR and between 0578ef4 and 3cd3042.

📒 Files selected for processing (3)

charts/midaz/templates/crm/configmap.yaml
charts/midaz/templates/ledger/configmap.yaml
charts/midaz/values.yaml

Mirror the serviceDiscovery model for the other two lib contracts, so all three are enable-by-param with clean configmaps: - multiTenant: ledger/crm.multiTenant.enabled -> MULTI_TENANT_ENABLED; ledger derives URL/serviceName/circuit-breaker/redis via multiTenant.env from global.multiTenant (crm exposes only the toggle). - streaming: ledger/crm.streaming.enabled -> STREAMING_ENABLED; brokers/SASL/TLS derived via streaming.env from global.streaming; per-component clientId + cloudeventsSource. Emitted only when enabled -> configmap stays {} when off. values.yaml gains the multiTenant/streaming sections alongside serviceDiscovery for ledger and crm.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/midaz/templates/ledger/configmap.yaml`:
- Around line 53-60: Preserve legacy toggle precedence by resolving both
MULTI_TENANT_ENABLED and STREAMING_ENABLED through lerian-common.cfgValue, using
the resolved value for the emitted environment variable and helper gating;
compare included values to "true" so legacy "false" strings remain disabled.
Apply this to charts/midaz/templates/ledger/configmap.yaml lines 53-60 and
265-270, and charts/midaz/templates/crm/configmap.yaml lines 56-57 and 70-75.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 282808e8-4558-463c-b214-d33fe8d17b05

📥 Commits

Reviewing files that changed from the base of the PR and between 3cd3042 and b23f68a.

⛔ Files ignored due to path filters (1)

charts/midaz/Chart.lock is excluded by !**/*.lock

📒 Files selected for processing (3)

charts/midaz/templates/crm/configmap.yaml
charts/midaz/templates/ledger/configmap.yaml
charts/midaz/values.yaml

…Tenant} config Document the shared, env-wide config the client sets once per environment (consumed by the derivation helpers): SD address/tls/tlsSkipVerify/workload/ preferView; streaming brokers/tlsEnabled/saslMechanism/saslUsername; multiTenant url/redisHost/redisPort/redisTls. Per-app sections keep only enabled; endpoints and client identity are derived per component. configmap stays clean.

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/midaz/values.yaml`:
- Around line 104-109: Change the serviceDiscovery.tlsSkipVerify default in the
values configuration from true to false, so enabling TLS does not implicitly
disable certificate verification. Preserve the existing SD_TLS_SKIP_VERIFY
mapping and require deployments that intentionally skip verification to set it
explicitly.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 5a7363bd-fd6e-4a7b-be2e-5c22a59895dc

📥 Commits

Reviewing files that changed from the base of the PR and between b23f68a and 7edca7e.

📒 Files selected for processing (1)

charts/midaz/values.yaml

…ess, SD default - crm configmap: resolve OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT via lerian-common.cfgValue so the grouped crm.env param is honored, not only the legacy configmap.ENV_NAME. - crm/ledger configmap: resolve MULTI_TENANT_ENABLED and STREAMING_ENABLED via lerian-common.cfgValue with presence-based precedence and compare to "true"; a legacy configmap.<KEY>=false now wins over the grouped param (fixes the sprig default footgun) and the resolved bool gates both the emitted env var and the multiTenant/streaming helper include. - ledger configmap: guard nested database/mongo params so a nil parent section yields the default instead of a hard nil-pointer template error. - serviceDiscovery.env / values: default SD_TLS_SKIP_VERIFY to false (was true, an MITM risk); operators still opt in explicitly. midaz is the only consumer of this helper, so no other chart changes behavior. - crm/ledger ingress: require the component ingress.enabled toggle (match main's guard) so a bare global.ingress.enabled no longer renders an empty-host Ingress. - validate-helm-charts: contain file:// dependency paths within the repo root and render workspace to reject .. traversal.

…efault moves to a separate lerian-common PR Reverts the one-line _service_discovery.tpl default flip from the previous commit so this PR consumes lerian-common exactly as on main. The secure SD_TLS_SKIP_VERIFY default (true -> false) ships in its own lerian-common PR.

…tion

Main auto-bumped lerian-common-helm to 1.2.1 on the #1755 merge; update the midaz lock so helm dependency build resolves the file:// dependency.

Add the official hashicorp/vault chart (0.28.1) as an optional, dev-mode subchart gated by vault.enabled (default true) so the standalone stack is self-contained, mirroring components/infra/docker-compose.yml (midaz-hc-vault + midaz-hc-vault-init). - Chart.yaml: vault dependency + refreshed Chart.lock - values.yaml: vault block (dev server, fullnameOverride midaz-hc-vault so the Service is midaz-hc-vault:8200; injector/csi/ui disabled; small resources) - templates/vault/transit-init-job.yaml: post-install/post-upgrade hook that enables the Transit engine at transit-st (or transit-mt when the CRM multi-tenant toggle is on), idempotent, mirroring midaz-hc-vault-init CRM already defaults KMS_VENDOR=hashicorp-vault + KMS_VAULT_ADDR= http://midaz-hc-vault:8200 with token auth; no token env is read by the app (dev root token is internal, permitted while DEPLOYMENT_MODE resolves to local), so no crm/ledger secret wiring change is required. Ledger has no KMS config, so it is left untouched.

…validator The optional dev-mode Vault (vault.enabled) needs devRootToken="root" to match the app's built-in DefaultVaultDevToken; it is a throwaway in-memory dev token, not a real credential. Add it to allowlistedCredentialDefaults so the default-credential rule passes. Production sets vault.enabled=false + external Vault.

SD_ENABLED read only the grouped serviceDiscovery.enabled param, ignoring the legacy configmap.SD_ENABLED key — so an operator enabling Service Discovery via the old flat API got SD silently disabled on upgrade. Resolve it through lerian-common.cfgValue (legacy configmap key -> param -> default), mirroring MULTI_TENANT_ENABLED/STREAMING_ENABLED; the resolved bool gates both the env var and the serviceDiscovery.env helper. Applied to ledger and crm.

…tion

Re-pin to lerian-common 1.3.2 (SD_ENABLED-alone full contract, .enabled bool normalization, MT tuning + ingress className presence-based). Add the two assertions that require the fixed helper: - SD_ENABLED alone renders the full SD contract with SD_ADDRESS=localhost:8500 - multi-tenant CIRCUIT_BREAKER_THRESHOLD accepts an explicit 0 14 render assertions now cover the full productized contract surface.

Resolve STREAMING_SASL_USERNAME (configmap.STREAMING_SASL_USERNAME -> global.streaming.saslUsername) and pass it to lerian-common.streaming.secret in the Ledger and CRM Secrets, so a SASL mechanism configured without a username fails the render (needs the re-pinned lib that enforces it; inert with the current pin).

…tion

Re-pin to 1.3.3 so streaming.secret enforces STREAMING_SASL_USERNAME alongside the password when a SASL mechanism is set (the Ledger/CRM Secrets already pass the resolved username). Add negative assertions: a SASL mechanism + password but no username fails the render in both Ledger and CRM. 16 render assertions now cover the full contract.

…tion

Re-pin to 1.3.4 so streaming.env enforces the complete SASL contract (supported mechanism, required username incl. useExistingSecret, TLS-or-plaintext). Add six negative assertions across Ledger + CRM: unsupported mechanism (GSSAPI), SASL without TLS, and an external Secret (useExistingSecret) without a username. Also pin TLS on the pre-existing SASL render/pass assertions so they exercise their intended path. 22 render assertions now cover the full productized contract.

Pilot productization (like #1741). Done: lerian-common 1.3.4 dependency; MULTI_TENANT_* block replaced with lerian-common.multiTenant.env (enable via cfgValue grouped param; requiredUrl/requiredRedisHost preserved). Render-validated equivalent to raw. TODO: OTEL (otel.env + global.observability), datastores (DB/REDIS/RABBITMQ via datastore.value), ENV_NAME/DEPLOYMENT_MODE single-source, global.* values API, fail-fast secrets, render-asserts, backward-compat + lint + render-gate.

## (2026-08-03) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) ### Bug Fixes * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff))

Adopt lerian-common 1.3.4 in the same model as br-ccs / midaz #1741: - MULTI_TENANT_* -> multiTenant.env (toggle via br-sta.multiTenant.enabled; URL + Redis infra from global.multiTenant). MT infra now renders only when enabled (was always emitted empty via the passthrough range) — env-var absent == empty for the app. - OTEL -> otel.env (ENABLE_TELEMETRY / OTLP endpoint / deployment-env from global.observability) + otel.envFlat (identity; SERVICE_VERSION tracks the image tag). - POSTGRES/REDIS/RABBITMQ host + primary conn fields -> datastore.value mask (configmap > br-sta.datastores > global.datastores > default); subchart DNS derivation preserved when the mask yields no host. - Productized keys excluded from the generic configmap/secret passthrough range ( set) and removed from the shipped configmap defaults so grouped / global / mask actually drive them (native key had masked them). - Fail-fast secrets: MULTI_TENANT_SERVICE_API_KEY (MT on) via multiTenant.secret; RABBITMQ_DEFAULT_PASS (rmq on, no RABBITMQ_URL). - Add render-gate fixture exercising the enabled paths. Worker inherits the manager ConfigMap/Secret via envFrom — unchanged. Default render is byte-identical except the MT-disabled infra keys (now gated, as in every other productized chart). helm lint + render-gate + strict standard pass.

## (2026-08-03) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))

… auth downgrade) Gandalf/CodeRabbit blocker: sprig `| default ""` on STREAMING_SASL_MECHANISM collapsed a YAML false/0 to "", so `--set configmap.STREAMING_SASL_MECHANISM=false` rendered STREAMING_SASL_MECHANISM: "" and SILENTLY DISABLED SASL instead of rejecting an invalid mechanism — an authentication downgrade. Coerce the resolved mechanism to "" ONLY when it is nil (kindIs "invalid"), so a null override still avoids the literal "<nil>" (SASL off) but a non-null false/0 is preserved: toString gives "false"/"0", which fails the PLAIN/SCRAM allowlist and aborts the render. String normalization (lowercase, outer/whitespace-only) is unchanged. Also format the unsupported-mechanism value via toString so a non-string prints cleanly (was %!q(bool=false)). Negative assertions for false/0 (and the normalization matrix) land in the consumer render-assertion gate in #1741 (the harness does not exist on this library branch). Addresses the Gandalf review on HEAD 6940159.

## (2026-08-03) ### Features * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) ### Bug Fixes * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139))

…e + grouped params Complete the productization to match midaz #1741: route ALL always-on config keys through lerian-common.cfgValue (configmap.<KEY> escape-hatch > brCcs.<group>.<field> > chart default) instead of raw $cm.KEY passthrough, and empty brCcs.configmap (defaults now live in the template). Auth resolves via globalValue (global.auth). Adds clean grouped param blocks: app/server/cors/postgres/redis/broker/outbox/ fetcher/sta/reporter/swagger/rateLimit/pagination/observability/m2m/readiness/ shutdown/objectStorage. The raw configmap map remains as an override escape-hatch and for optional/opt-in keys. No raw env vars shipped in values.yaml anymore; operators use the typed grouped API (e.g. brCcs.redis.poolSize) with configmap.<KEY> still winning as override. Default render byte-identical to the prior productized head (objectStorage bucket defaults carried into the group). helm lint + render-gate + strict standard pass.

…e + grouped params Replace the generic configmap passthrough range with per-key lerian-common.cfgValue resolution (configmap.<KEY> escape-hatch > br-sta.<group>.<field> > chart default) and empty br-sta.configmap (defaults now live in the template). Adds grouped param blocks (app/server/cors/multiTenant/postgres/redis/broker/outbox/sta/auth/swagger/ rateLimit/pagination/idempotency). Postgres/Redis/RabbitMQ host+conn fields still via the datastore mask; MT/OTEL via the global.* helpers; worker sub-component unchanged. No raw env vars shipped in values.yaml anymore; operators use the typed grouped API (e.g. br-sta.redis.poolSize) with configmap.<KEY> still winning as override. Default render byte-identical to the prior productized head. helm lint + render-gate + strict pass.

Adopt lerian-common 1.3.4 in the same model as br-ccs / br-sta / midaz #1741: - MULTI_TENANT_* -> multiTenant.env (toggle via .multiTenant.enabled; URL + Redis infra from global.multiTenant). MT tuning keys now render only when enabled (were always emitted via the passthrough range). - OTEL -> otel.env (ENABLE_TELEMETRY / OTLP endpoint / deployment-env from global.observability; br-slc keeps telemetry ON by default) + otel.envFlat (identity; SERVICE_VERSION stays '1.0.0' to preserve the render). - POSTGRES/REDIS/RABBITMQ host + primary conn fields -> datastore.value mask (configmap.data > .datastores > global.datastores > default). No bundled subcharts (BYOC external infra), so hosts default '' / 'localhost'. - Productized keys excluded from the generic configmap/secret passthrough range ( set) and removed from the shipped configmap.data defaults so grouped / global / mask actually drive them. - Fail-fast secrets (only when secrets.create=true): MULTI_TENANT_SERVICE_API_KEY via multiTenant.secret; RABBITMQ_DEFAULT_PASS when RABBITMQ_ENABLED=true. - Extend the CI render fixture to exercise the enabled paths. Flat single-service chart; sub-components (signer/xsd-validator/mqbridge) carry no productizable domains and are unchanged. Default render byte-identical except the MT-disabled tuning keys (now gated, as in the other productized charts). helm lint + render-gate + strict standard pass.

…e + grouped params Replace the configmap.data passthrough range with per-key lerian-common.cfgValue resolution (configmap.data.<KEY> escape-hatch > .Values.<group>.<field> > chart default) and empty configmap.data (defaults now live in the template). Adds top-level grouped param blocks (app/server/cors/security/multiTenant/postgres/redis/broker/ circuitBreaker/outbox/streaming/auth/swagger/rateLimit/webhook). Postgres/Redis/ RabbitMQ host+conn fields still via the datastore mask; MT/OTEL via global.*. Credential-like-named config paths (WEBHOOK_API_KEY_FILE, AWS_ACCESS_KEY_ID) keep a | default "" form so the secret-in-configmap gate recognises them as non-secret. No raw env vars shipped in values.yaml anymore; operators use the typed grouped API (e.g. redis.poolSize) with configmap.data.<KEY> still winning as override. Default render byte-identical to the prior productized head. helm lint + render-gate + strict pass.

## (2026-08-04) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](e6cfb98)) * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **ci:** add chart standard validation and render gate ([9d4ab59](9d4ab59)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](f6e4695)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](6521ba7)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](9b65378)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](4946cb5)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **ci:** enforce single-source infra secrets ([3b787d5](3b787d5)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](756a1f9)) * **ci:** harden validator with collapse gate ([cc324ee](cc324ee)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](e67d89c)), closes [#138](#138) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](82dbb81)) * **ci:** per-chart values.schema.json generator ([d295433](d295433)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](3e18fa6)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](86eb651)) * **tracer:** template ENV_NAME in configmap ([50a6f50](50a6f50)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **migrations:** update migration logic and enable migrations job ([643f703](643f703)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](8b24026)) ### Bug Fixes * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](79ef8f5)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](d7765b4)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](7ba4f9d)), closes [#1404](#1404) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](a649c71)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address CodeRabbit review on revamp PR [#1470](#1470) ([98288a5](98288a5)), closes [#1](#1) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](0d025e9)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](75ad0d4)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](5ff9c1d)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](fcaa3b4)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](14924af)), closes [#1470](#1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](a394658)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](a38dca3)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](734a38a)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](66f2939)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **charts:** fail loud on missing infra creds ([5bfc010](5bfc010)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](9ae56b4)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](#1467)) ([7c62a98](7c62a98)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](6a9d958)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](#1465)) ([a39f2c6](a39f2c6)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](#1405)) ([e0d9084](e0d9084)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](582ea97)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](45d152a)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **new:** sync migrations job and app versions ([d90d1d7](d90d1d7)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](944e1ce)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](f7aa25b)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](6214b2a)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](68bcd0b)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](b6dade8)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](3c9bea0)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](5ee7f45)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](67021d4)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](4852190)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](5c2edb0)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](b5892a3)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](a3c2b6d)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](99e3105)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **product-console:** update readiness probe path to default to root ([2996200](2996200)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](5292a60)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](07ea25b)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](4492c3d)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](ac4c1e8)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b)) * **charts:** value key typo and stale README notes ([91ce16f](91ce16f)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](#1430)) ([f38d6d9](f38d6d9))

## (2026-08-04) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))

## (2026-08-04) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](e6cfb98)) * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **ci:** add chart standard validation and render gate ([9d4ab59](9d4ab59)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](6521ba7)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](9b65378)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **ci:** enforce single-source infra secrets ([3b787d5](3b787d5)) * **ci:** harden validator with collapse gate ([cc324ee](cc324ee)) * **ci:** per-chart values.schema.json generator ([d295433](d295433)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](3e18fa6)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](8b24026)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](a649c71)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address CodeRabbit review on revamp PR [#1470](#1470) ([98288a5](98288a5)), closes [#1](#1) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](0d025e9)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](75ad0d4)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](fcaa3b4)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](14924af)), closes [#1470](#1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](a394658)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](a38dca3)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](66f2939)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **charts:** fail loud on missing infra creds ([5bfc010](5bfc010)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](6a9d958)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](582ea97)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](6214b2a)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](b6dade8)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](4852190)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](99e3105)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](5292a60)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](07ea25b)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b)) * **charts:** value key typo and stale README notes ([91ce16f](91ce16f))

## (2026-08-06) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sfn:** add the correios rail as a chart component ([05cdbe9](05cdbe9)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) ### Bug Fixes * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139))

guimoreirar · 2026-08-06T13:56:22Z

Superseded by #1842.

#1741 productized the midaz chart on lerian-common using the full-enumeration model (every key a grouped param) against the pre-#1838 chart (ledger + crm only). It is now stale: #1838 adds the unified-ledger (CRM/Fees/KMS) + tracer, and we've since adopted the tiered model (typed knobs only for dependency connections; everything else an escape-hatch passthrough).

#1842 replaces it — it targets main, aggregates #1838's feature, productizes ledger/crm/tracer with the tiered model (byte-identical, no regression), and ships a values-quickstart + a propertyNames.enum-guarded schema. Closing this in favour of #1842.

## (2026-08-07) ### Features * **br-sfn:** add the correios rail as a chart component ([05cdbe9](05cdbe9)) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) ### Bug Fixes * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.9.1 ([9f06e0a](9f06e0a))

## (2026-08-08) ### Features * **br-sfn:** add the correios rail as a chart component ([05cdbe9](05cdbe9)) * **plugin-access-manager:** expose PLATFORM_INTERNAL_CIDRS on identity ([6a5d71d](6a5d71d)) ### Bug Fixes * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.9.1 ([9f06e0a](9f06e0a))

guimoreirar requested a review from a team as a code owner July 24, 2026 16:43

github-actions Bot added the midaz label Jul 24, 2026

coderabbitai Bot approved these changes Jul 24, 2026

View reviewed changes

guimoreirar force-pushed the feat/midaz-productization branch from f88a294 to 0578ef4 Compare July 24, 2026 20:39

guimoreirar changed the title ~~feat(midaz): productize chart on lerian-common library (no regression)~~ feat(midaz): productize chart on lerian-common library (full, no regression) Jul 24, 2026

coderabbitai Bot requested changes Jul 24, 2026

View reviewed changes

guimoreirar mentioned this pull request Jul 24, 2026

feat(plugin-access-manager): productize on lerian-common library (no regression) #1745

Open

coderabbitai Bot mentioned this pull request Jul 24, 2026

feat(common): abstract service-discovery topology in serviceDiscovery.envFlat #1746

Closed

coderabbitai Bot requested changes Jul 24, 2026

View reviewed changes

Comment thread charts/midaz/templates/ledger/configmap.yaml Outdated

guimoreirar added 3 commits July 24, 2026 19:01

Merge remote-tracking branch 'origin/main' into HEAD

b2e8476

chore(midaz): sync Chart.lock to lerian-common 1.2.0

423888b

coderabbitai Bot requested changes Jul 24, 2026

View reviewed changes

Comment thread charts/midaz/templates/ledger/configmap.yaml Outdated

coderabbitai Bot requested changes Jul 24, 2026

View reviewed changes

Comment thread charts/midaz/values.yaml Outdated

github-actions Bot added the common label Jul 28, 2026

github-actions Bot removed the common label Jul 28, 2026

guimoreirar mentioned this pull request Jul 28, 2026

fix(common): default SD_TLS_SKIP_VERIFY to false #1755

Merged

coderabbitai Bot approved these changes Jul 28, 2026

View reviewed changes

guimoreirar added 5 commits July 28, 2026 10:46

Merge remote-tracking branch 'origin/main' into feat/midaz-productiza…

60ebefe

…tion

chore(midaz): refresh Chart.lock for lerian-common 1.2.1

b9dcfdb

Main auto-bumped lerian-common-helm to 1.2.1 on the #1755 merge; update the midaz lock so helm dependency build resolves the file:// dependency.

guimoreirar mentioned this pull request Jul 29, 2026

fix(pipe): render-gate resolves file:// local chart dependencies #1759

Merged

guimoreirar added 2 commits July 31, 2026 17:52

Merge remote-tracking branch 'origin/main' into feat/midaz-productiza…

f815e27

…tion

guimoreirar mentioned this pull request Jul 31, 2026

fix(common): streaming.secret requires SASL username with the mechanism #1798

Merged

guimoreirar added 3 commits July 31, 2026 18:09

Merge remote-tracking branch 'origin/main' into feat/midaz-productiza…

612c54c

…tion

guimoreirar mentioned this pull request Aug 2, 2026

fix(common): enforce the full SASL contract in streaming.env #1805

Merged

guimoreirar added 2 commits August 2, 2026 15:22

Merge remote-tracking branch 'origin/main' into feat/midaz-productiza…

582e6f3

…tion

guimoreirar mentioned this pull request Aug 2, 2026

fix(common): normalize SASL mechanism/bools before validating (lib-streaming parity) #1809

Merged

guimoreirar mentioned this pull request Aug 4, 2026

feat(charts): productize streaming-hub ConfigMap onto lerian-common #1832

Closed

guimoreirar mentioned this pull request Aug 6, 2026

feat(midaz): productize on lerian-common (tiered) with unified ledger + tracer #1842

Open

10 tasks

guimoreirar closed this Aug 6, 2026

Navigation Menu

Uh oh!

Uh oh!

feat(midaz): productize chart on lerian-common library (full, no regression) - #1741

feat(midaz): productize chart on lerian-common library (full, no regression)#1741
guimoreirar wants to merge 43 commits into
mainfrom
feat/midaz-productization

guimoreirar commented Jul 24, 2026 •

edited

Loading

Uh oh!

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

guimoreirar commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

guimoreirar commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Verification

Uh oh!

coderabbitai Bot commented Jul 24, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Reviews paused

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

guimoreirar commented Aug 6, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

guimoreirar commented Jul 24, 2026 •

edited

Loading

coderabbitai Bot commented Jul 24, 2026 •

edited

Loading