feat(midaz): productize chart on lerian-common library (full, no regression)

.github/configs/helm-render-assertions/midaz.yaml

@@ -0,0 +1,241 @@
+# Render assertions for midaz — verified by `validate-helm-charts --render-gate`.
+# Each scenario renders the chart with the base fixture values
+# (.github/configs/helm-render-values/midaz.yaml) plus its `set` overrides, then
+# asserts every `expect` substring is present (and every `absent` one is missing) in
+# the rendered manifest. Overrides go through `helm --set`, so bare `false` / `0`
+# reach the template as YAML boolean/number — exactly the presence-vs-truthiness case
+# the productized helpers must preserve.
+scenarios:
+  # RED 1 — the full legacy Service Discovery contract must survive, including the
+  # external endpoint WITHOUT an Ingress (on-prem) and the advanced tuning knobs.
+  - name: sd-legacy-full-contract-on-prem-no-ingress
+    set:
+      ledger.ingress.enabled: "false"
+      ledger.configmap.SD_ENABLED: "true"
+      ledger.configmap.SD_ADDRESS: "consul.onprem:8500"
+      ledger.configmap.SD_TLS: "true"
+      ledger.configmap.SD_WORKLOAD: "midaz-stg"
+      ledger.configmap.SD_EXTERNAL_ADDRESS: "https://ledger.onprem.local"
+      ledger.configmap.SD_EXTERNAL_PORT: "8443"
+      ledger.configmap.SD_DIAL_TIMEOUT: "5s"
+      ledger.configmap.SD_WATCH_WAIT_TIME: "10s"
+      ledger.configmap.SD_ALLOW_STALE: "false"
+    expect:
+      - 'SD_ADDRESS: "consul.onprem:8500"'
+      - 'SD_EXTERNAL_ADDRESS: "https://ledger.onprem.local"'
+      - 'SD_EXTERNAL_PORT: "8443"'
+      - 'SD_DIAL_TIMEOUT: "5s"'
+      - 'SD_WATCH_WAIT_TIME: "10s"'
+      - 'SD_ALLOW_STALE: "false"'
+      - 'SD_WORKLOAD: "midaz-stg"'
+
+  # RED 2 — the documented per-component dedicated datastore mask must resolve
+  # (previously ignored because the helper only read .context.Values.datastores).
+  - name: datastore-dedicated-mask-ledger
+    set:
+      ledger.datastores.postgres.host: "ledger-dedicated-db"
+    expect:
+      - 'DB_ONBOARDING_HOST: "ledger-dedicated-db"'
+      - 'DB_TRANSACTION_HOST: "ledger-dedicated-db"'
+
+  # RED 3 — streaming activates from legacy configmap.STREAMING_BROKERS (no global
+  # broker), and an explicit configmap boolean `false` wins over a global `true`
+  # (presence-based precedence, not sprig-default truthiness).
+  - name: streaming-configmap-activation-and-false-precedence
+    set:
+      global.streaming.tlsEnabled: "true"
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka.onprem:9092"
+      ledger.configmap.STREAMING_TLS_ENABLED: "false"
+    expect:
+      - 'STREAMING_BROKERS: "kafka.onprem:9092"'
+      - 'STREAMING_TLS_ENABLED: "false"'
+
+  # Same presence-based precedence for multi-tenant: an explicit configmap boolean
+  # `false` for REDIS_TLS must survive a global `true`.
+  - name: multitenant-configmap-false-precedence
+    set:
+      global.multiTenant.url: "http://mt-svc:8080"
+      global.multiTenant.redisHost: "redis"
+      global.multiTenant.redisTls: "true"
+      ledger.multiTenant.enabled: "true"
+      ledger.configmap.MULTI_TENANT_REDIS_TLS: "false"
+      ledger.secrets.MULTI_TENANT_SERVICE_API_KEY: "sample"
+    expect:
+      - 'MULTI_TENANT_REDIS_TLS: "false"'
+      - 'MULTI_TENANT_ENABLED: "true"'
+
+  # RED (SASL) — a SASL mechanism without a password is a boot-crashing config;
+  # the render must FAIL fast (lib-streaming requires username+password for SASL)
+  # rather than emit a Secret with no STREAMING_SASL_PASSWORD.
+  - name: streaming-sasl-without-password-fails
+    set:
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      global.streaming.saslMechanism: "SCRAM-SHA-512"
+      global.streaming.saslUsername: "user"
+      global.streaming.tlsEnabled: "true"
+    expectRenderError: "STREAMING_SASL_PASSWORD"
+
+  # ...and with the password supplied, the Ledger Secret renders it.
+  - name: streaming-sasl-with-password-renders-secret
+    set:
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      global.streaming.saslMechanism: "SCRAM-SHA-512"
+      global.streaming.saslUsername: "user"
+      global.streaming.tlsEnabled: "true"
+      ledger.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expect:
+      - 'STREAMING_SASL_PASSWORD:'
+
+  # A SASL mechanism needs BOTH credentials — a mechanism + password but no username is
+  # a boot-crashing config; the render must FAIL fast (Ledger).
+  - name: streaming-sasl-without-username-fails-ledger
+    set:
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      global.streaming.saslMechanism: "SCRAM-SHA-512"
+      ledger.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "STREAMING_SASL_USERNAME"
+
+  # ...same for CRM.
+  - name: streaming-sasl-without-username-fails-crm
+    set:
+      crm.configmap.STREAMING_ENABLED: "true"
+      crm.configmap.STREAMING_BROKERS: "kafka:9092"
+      global.streaming.saslMechanism: "SCRAM-SHA-512"
+      crm.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "STREAMING_SASL_USERNAME"
+
+  # CRM DEPLOYMENT_MODE knob (was ledger-only) — CRM can now go byoc/saas.
+  - name: crm-deployment-mode-knob
+    set:
+      crm.deploymentMode: "byoc"
+    expect:
+      - 'DEPLOYMENT_MODE: "byoc"'
+
+  # CRM KMS AppRole — a Vault approle posture without the secret id is a boot-crashing
+  # config (app fails closed); the render must FAIL fast.
+  - name: crm-kms-approle-without-secret-id-fails
+    set:
+      crm.kms.vaultAuthMethod: "approle"
+      crm.kms.vaultRoleId: "role-abc"
+    expectRenderError: "KMS_VAULT_SECRET_ID"
+
+  # ...and a missing role id also fails.
+  - name: crm-kms-approle-without-role-id-fails
+    set:
+      crm.kms.vaultAuthMethod: "approle"
+      crm.secrets.KMS_VAULT_SECRET_ID: "secret-xyz"
+    expectRenderError: "KMS_VAULT_ROLE_ID is required"
+
+  # ...with both, the role id (ConfigMap) and secret id (Secret) render.
+  - name: crm-kms-approle-renders
+    set:
+      crm.kms.vaultAuthMethod: "approle"
+      crm.kms.vaultRoleId: "role-abc"
+      crm.secrets.KMS_VAULT_SECRET_ID: "secret-xyz"
+    expect:
+      - 'KMS_VAULT_ROLE_ID: "role-abc"'
+      - 'KMS_VAULT_SECRET_ID:'
+
+  # PDB accepts an explicit 0 (maxUnavailable: 0 = block all voluntary disruptions).
+  - name: pdb-maxunavailable-zero
+    set:
+      ledger.pdb.enabled: "true"
+      ledger.pdb.maxUnavailable: "0"
+    expect:
+      - 'maxUnavailable: 0'
+
+  # revisionHistoryLimit accepts an explicit 0.
+  - name: revision-history-limit-zero
+    set:
+      ledger.revisionHistoryLimit: "0"
+    expect:
+      - 'revisionHistoryLimit: 0'
+
+  # SD_ENABLED alone (no address, no global.serviceDiscovery) must render the full SD
+  # contract with SD_ADDRESS defaulting to localhost:8500 (pre-productization parity).
+  - name: sd-enabled-alone-emits-full-contract
+    set:
+      ledger.configmap.SD_ENABLED: "true"
+    expect:
+      - 'SD_ADDRESS: "localhost:8500"'
+      - 'SD_TLS: "false"'
+      - 'SD_INTERNAL_SCHEME: "http"'
+
+  # Multi-tenant circuit-breaker threshold accepts an explicit 0 (presence-based, not
+  # sprig-default) — proves the remaining MT tuning-key footgun is closed.
+  - name: multitenant-circuit-breaker-threshold-zero
+    set:
+      ledger.multiTenant.enabled: "true"
+      global.multiTenant.url: "http://mt-svc:8080"
+      global.multiTenant.redisHost: "redis"
+      ledger.secrets.MULTI_TENANT_SERVICE_API_KEY: "sample"
+      ledger.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "0"
+    expect:
+      - 'MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "0"'
+
+  # ===========================================================================
+  # SASL contract — lib-streaming fails closed; the render must fail fast.
+  # Three scenarios × two components (Ledger + CRM).
+  # ===========================================================================
+  # 1) Unsupported mechanism (only PLAIN / SCRAM-SHA-256 / SCRAM-SHA-512).
+  - name: streaming-sasl-invalid-mechanism-fails-ledger
+    set:
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      ledger.configmap.STREAMING_SASL_MECHANISM: "GSSAPI"
+      ledger.configmap.STREAMING_SASL_USERNAME: "u"
+      ledger.configmap.STREAMING_TLS_ENABLED: "true"
+      ledger.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "Unsupported STREAMING_SASL_MECHANISM"
+  - name: streaming-sasl-invalid-mechanism-fails-crm
+    set:
+      crm.configmap.STREAMING_ENABLED: "true"
+      crm.configmap.STREAMING_BROKERS: "kafka:9092"
+      crm.configmap.STREAMING_SASL_MECHANISM: "GSSAPI"
+      crm.configmap.STREAMING_SASL_USERNAME: "u"
+      crm.configmap.STREAMING_TLS_ENABLED: "true"
+      crm.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "Unsupported STREAMING_SASL_MECHANISM"
+
+  # 2) SASL without TLS and without the explicit plaintext opt-in.
+  - name: streaming-sasl-without-tls-fails-ledger
+    set:
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      ledger.configmap.STREAMING_SASL_MECHANISM: "SCRAM-SHA-512"
+      ledger.configmap.STREAMING_SASL_USERNAME: "u"
+      ledger.configmap.STREAMING_TLS_ENABLED: "false"
+      ledger.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "SASL requires TLS"
+  - name: streaming-sasl-without-tls-fails-crm
+    set:
+      crm.configmap.STREAMING_ENABLED: "true"
+      crm.configmap.STREAMING_BROKERS: "kafka:9092"
+      crm.configmap.STREAMING_SASL_MECHANISM: "SCRAM-SHA-512"
+      crm.configmap.STREAMING_SASL_USERNAME: "u"
+      crm.configmap.STREAMING_TLS_ENABLED: "false"
+      crm.secrets.STREAMING_SASL_PASSWORD: "s3cr3t"
+    expectRenderError: "SASL requires TLS"
+
+  # 3) useExistingSecret bypasses the Secret, but the username (a ConfigMap value)
+  #    is still validated — a mechanism without a username must fail.
+  - name: streaming-sasl-existingsecret-without-username-fails-ledger
+    set:
+      ledger.useExistingSecret: "true"
+      ledger.configmap.STREAMING_ENABLED: "true"
+      ledger.configmap.STREAMING_BROKERS: "kafka:9092"
+      ledger.configmap.STREAMING_SASL_MECHANISM: "SCRAM-SHA-512"
+      ledger.configmap.STREAMING_TLS_ENABLED: "true"
+    expectRenderError: "STREAMING_SASL_USERNAME"
+  - name: streaming-sasl-existingsecret-without-username-fails-crm
+    set:
+      crm.useExistingSecret: "true"
+      crm.configmap.STREAMING_ENABLED: "true"
+      crm.configmap.STREAMING_BROKERS: "kafka:9092"
+      crm.configmap.STREAMING_SASL_MECHANISM: "SCRAM-SHA-512"
+      crm.configmap.STREAMING_TLS_ENABLED: "true"
+    expectRenderError: "STREAMING_SASL_USERNAME"

.github/configs/helm-render-values/midaz.yaml

@@ -1,8 +1,14 @@
 crm:
+  # Render both components in the gate (CRM is off by default) so the CRM manifests
+  # are exercised too.
+  enabled: true
   secrets:
     # App crypto material — operator-provided (external boundary).
     LCRYPTO_HASH_SECRET_KEY: "sample"
     LCRYPTO_ENCRYPT_SECRET_KEY: "sample"
+    # RabbitMQ — operator-provided (same as ledger).
+    RABBITMQ_DEFAULT_PASS: "sample"
+    RABBITMQ_CONSUMER_PASS: "sample"
 ledger:
   secrets:
     # RabbitMQ — operator-provided; not yet single-sourced (see chart README