feat(midaz): productize chart on lerian-common library (full, no regression)

.github/scripts/validate-helm-charts/main.go

@@ -1101,6 +1101,16 @@ func buildRenderRows(root string, chartSelection map[string]bool, sampleValuesDi
 			return nil, err
 		}
 
+		// Local library dependencies referenced via `file://<relpath>` (e.g.
+		// lerian-common) live outside the copied chart, so `helm dependency
+		// build` cannot resolve them in the isolated temp workspace. Materialize
+		// each such sibling at the same relative location so the file:// path
+		// resolves exactly as it does in the source tree.
+		if err := materializeLocalDependencies(root, chartDir, tmpRoot, tmpChart, deps); err != nil {
+			_ = os.RemoveAll(tmpRoot)
+			return nil, err
+		}
+
 		helmEnv, err := isolatedHelmEnv(tmpRoot)
 		if err != nil {
 			_ = os.RemoveAll(tmpRoot)
@@ -1517,6 +1527,51 @@ func writeRenderInventory(path string, rows []renderRow) error {
 	return os.WriteFile(path, []byte(builder.String()), 0o644)
 }
 
+// materializeLocalDependencies copies each `file://<relpath>` dependency source
+// into the temp workspace at the same relative path the chart references, so an
+// isolated `helm dependency build` resolves local library charts (e.g.
+// lerian-common) exactly as it would in the repository tree. Missing sources are
+// left to `helm dependency build` to report as a normal missing-dependency.
+func materializeLocalDependencies(root, chartDir, tmpRoot, tmpChart string, deps []chartDependency) error {
+	for _, dependency := range deps {
+		repository := strings.TrimSpace(dependency.Repository)
+		if !strings.HasPrefix(repository, "file://") {
+			continue
+		}
+		relPath := strings.TrimPrefix(repository, "file://")
+		srcDir := filepath.Clean(filepath.Join(chartDir, relPath))
+		// Containment: a crafted `file://../../..` path in Chart.yaml must not let
+		// the copy read outside the repository tree or write outside the isolated
+		// render workspace. Legitimate local libraries (e.g. file://../lerian-common)
+		// still resolve to a sibling under root/tmpRoot and pass the check.
+		if !withinDir(root, srcDir) {
+			return fmt.Errorf("local dependency %q resolves outside the repository root (%s)", repository, srcDir)
+		}
+		if !dirExists(srcDir) {
+			continue
+		}
+		destDir := filepath.Clean(filepath.Join(tmpChart, relPath))
+		if !withinDir(tmpRoot, destDir) {
+			return fmt.Errorf("local dependency %q resolves outside the render workspace (%s)", repository, destDir)
+		}
+		if err := copyDir(srcDir, destDir); err != nil {
+			return err
+		}
+	}
+	return nil
+}
+
+// withinDir reports whether target is base itself or nested under it (after path
+// cleaning), used to contain `file://` dependency paths so a crafted Chart.yaml
+// cannot escape the repo/workspace via `..` traversal.
+func withinDir(base, target string) bool {
+	rel, err := filepath.Rel(base, target)
+	if err != nil {
+		return false
+	}
+	return rel == "." || (rel != ".." && !strings.HasPrefix(rel, ".."+string(os.PathSeparator)))
+}
+
 func copyDir(src, dst string) error {
 	return filepath.WalkDir(src, func(path string, d os.DirEntry, err error) error {
 		if err != nil {

charts/midaz/Chart.lock

@@ -1,4 +1,7 @@
 dependencies:
+- name: lerian-common-helm
+  repository: file://../lerian-common
+  version: 1.2.0
 - name: valkey
   repository: oci://registry-1.docker.io/bitnamicharts
   version: 2.4.7
@@ -11,5 +14,5 @@ dependencies:
 - name: rabbitmq
   repository: https://groundhog2k.github.io/helm-charts
   version: 2.1.11
-digest: sha256:2a2522d76f48d28c4bc86bd4c23226346e921eeeba11a217b89b5a71589a7f92
-generated: "2026-06-19T15:26:51.872268447-03:00"
+digest: sha256:eecee81e53f0fd2f74be5957cf2475248333c3a386a80585b20fe47a6913c461
+generated: "2026-07-24T19:02:17.669398-03:00"

charts/midaz/Chart.yaml

@@ -28,6 +28,9 @@ icon: https://avatars.githubusercontent.com/u/148895005?s=200&v=4
 # To understand the purpose and configuration of each dependency, visit:
 # https://docs.lerian.studio/docs/midaz-components
 dependencies:
+  - name: lerian-common-helm
+    version: ">=1.0.0 <2.0.0"
+    repository: "file://../lerian-common"
   - name: valkey
     version: "2.4.7"
     repository: "oci://registry-1.docker.io/bitnamicharts"

charts/midaz/templates/crm/configmap.yaml

@@ -7,8 +7,8 @@ metadata:
     {{- include "midaz-crm.labels" (dict "context" . "name" .Values.crm.name ) | nindent 4 }}
 data:
   # -- Default Environment variables for CRM
-  ALLOW_INSECURE_TLS: {{ .Values.crm.configmap.ALLOW_INSECURE_TLS | default "true" | quote }}
-  ENV_NAME: {{ .Values.crm.configmap.ENV_NAME | default "development" | quote }}
+  ALLOW_INSECURE_TLS: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "ALLOW_INSECURE_TLS" "params" .Values.crm "field" "allowInsecureTls" "default" "true") | quote }}
+  ENV_NAME: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "ENV_NAME" "params" .Values.crm "field" "env" "default" "development") | quote }}
 
   # APP
   APPLICATION_NAME: {{ .Values.crm.configmap.APPLICATION_NAME | default "crm" | quote }}
@@ -17,13 +17,13 @@ data:
   VERSION: {{ .Values.crm.image.tag | default .Chart.AppVersion | quote }}
 
   # Mongo DB
-  MONGO_URI: {{ .Values.crm.configmap.MONGO_URI | default "mongodb" | quote }}
-  MONGO_HOST: {{ .Values.crm.configmap.MONGO_HOST | default "midaz-mongodb" | quote }}
-  MONGO_PORT: {{ .Values.crm.configmap.MONGO_PORT | default "27017" | quote }}
-  MONGO_NAME: {{ .Values.crm.configmap.MONGO_NAME | default "crm" | quote }}
-  MONGO_USER: {{ .Values.crm.configmap.MONGO_USER | default "midaz" | quote }}
-  MONGO_MAX_POOL_SIZE: {{ .Values.crm.configmap.MONGO_MAX_POOL_SIZE | default "1000" | quote }}
-  MONGO_PARAMETERS: {{ .Values.crm.configmap.MONGO_PARAMETERS | default "" | quote }}
+  MONGO_URI: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "MONGO_URI" "params" .Values.crm.mongo "field" "uri" "default" "mongodb") | quote }}
+  MONGO_HOST: {{ include "lerian-common.datastore.value" (dict "context" $ "configmap" .Values.crm.configmap "type" "mongo" "field" "host" "nativeKey" "MONGO_HOST" "default" "midaz-mongodb") | quote }}
+  MONGO_PORT: {{ include "lerian-common.datastore.value" (dict "context" $ "configmap" .Values.crm.configmap "type" "mongo" "field" "port" "nativeKey" "MONGO_PORT" "default" "27017") | quote }}
+  MONGO_NAME: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "MONGO_NAME" "params" .Values.crm.mongo "field" "name" "default" "crm") | quote }}
+  MONGO_USER: {{ include "lerian-common.datastore.value" (dict "context" $ "configmap" .Values.crm.configmap "type" "mongo" "field" "user" "nativeKey" "MONGO_USER" "default" "midaz") | quote }}
+  MONGO_MAX_POOL_SIZE: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "MONGO_MAX_POOL_SIZE" "params" .Values.crm.mongo "field" "maxPoolSize" "default" "1000") | quote }}
+  MONGO_PARAMETERS: {{ include "lerian-common.datastore.value" (dict "context" $ "configmap" .Values.crm.configmap "type" "mongo" "field" "params" "nativeKey" "MONGO_PARAMETERS" "default" "") | quote }}
   MONGO_TLS_CA_CERT: {{ .Values.crm.configmap.MONGO_TLS_CA_CERT | default "" | quote }}
 
   # SWAGGER
@@ -37,45 +37,47 @@ data:
   SWAGGER_RIGHT_DELIMITER: {{ .Values.crm.configmap.SWAGGER_RIGHT_DELIMITER | default "}}" | quote }}
 
   # LOG LEVEL
-  LOG_LEVEL: {{ .Values.crm.configmap.LOG_LEVEL | default "debug" | quote }}
+  LOG_LEVEL: {{ include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "LOG_LEVEL" "params" .Values.crm "field" "logLevel" "default" "debug") | quote }}
 
   # OPEN TELEMETRY
-  OTEL_RESOURCE_SERVICE_NAME: {{ .Values.crm.configmap.OTEL_RESOURCE_SERVICE_NAME | default "midaz-crm" | quote }}
-  OTEL_LIBRARY_NAME: {{ .Values.crm.configmap.OTEL_LIBRARY_NAME | default "github.com/LerianStudio/plugin-crm" | quote }}
-  OTEL_RESOURCE_SERVICE_VERSION: {{ .Values.crm.image.tag | default .Chart.AppVersion | quote }}
-  OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: {{ .Values.crm.configmap.ENV_NAME | default "development" | quote }}
-  OTEL_EXPORTER_OTLP_ENDPOINT_PORT: {{ .Values.crm.configmap.OTEL_EXPORTER_OTLP_ENDPOINT_PORT | default "4317" | quote }}
-  OTEL_EXPORTER_OTLP_ENDPOINT: {{ .Values.crm.configmap.OTEL_EXPORTER_OTLP_ENDPOINT | default "midaz-grafana:4317" | quote }}
+  {{- include "lerian-common.otel.envFlat" (dict
+        "configmap" .Values.crm.configmap
+        "defaults" (dict
+          "OTEL_RESOURCE_SERVICE_NAME" "midaz-crm"
+          "OTEL_LIBRARY_NAME" "github.com/LerianStudio/plugin-crm"
+          "OTEL_RESOURCE_SERVICE_VERSION" (.Values.crm.image.tag | default .Chart.AppVersion)
+          "OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT" (include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "ENV_NAME" "params" .Values.crm "field" "env" "default" "development")))) | nindent 2 }}
   ENABLE_TELEMETRY: {{ .Values.crm.configmap.ENABLE_TELEMETRY | default "true" | quote }}
 
   # AUTH
-  PLUGIN_AUTH_ADDRESS: {{ .Values.crm.configmap.PLUGIN_AUTH_ADDRESS | default "plugin-auth" | quote }}
-  PLUGIN_AUTH_ENABLED: {{ .Values.crm.configmap.PLUGIN_AUTH_ENABLED | default "false" | quote }}
+  PLUGIN_AUTH_ADDRESS: {{ include "lerian-common.globalValue" (dict "context" $ "configmap" .Values.crm.configmap "block" "auth" "field" "host" "nativeKey" "PLUGIN_AUTH_ADDRESS" "default" "http://plugin-access-manager-auth:4000") | quote }}
+  PLUGIN_AUTH_ENABLED: {{ include "lerian-common.globalValue" (dict "context" $ "configmap" .Values.crm.configmap "block" "auth" "field" "enabled" "nativeKey" "PLUGIN_AUTH_ENABLED" "default" "false") | quote }}
 
-  # MULTI-TENANT
-  MULTI_TENANT_ENABLED: {{ .Values.crm.configmap.MULTI_TENANT_ENABLED | default "false" | quote }}
+  # MULTI-TENANT — crm exposes only the toggle (no MT client config on this component)
+  # Legacy configmap.MULTI_TENANT_ENABLED wins over the grouped param (presence-based).
+  MULTI_TENANT_ENABLED: {{ eq (include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "MULTI_TENANT_ENABLED" "params" .Values.crm.multiTenant "field" "enabled" "default" "false")) "true" | quote }}
 
   KMS_VAULT_ADDR: {{ .Values.crm.configmap.KMS_VAULT_ADDR | default "http://midaz-hc-vault:8200" | quote }}
   KMS_VAULT_AUTH_METHOD: {{ .Values.crm.configmap.KMS_VAULT_AUTH_METHOD | default "token" | quote }}
   KMS_VENDOR: {{ .Values.crm.configmap.KMS_VENDOR | default "hashicorp-vault" | quote }}
-  SD_ADDRESS: {{ .Values.crm.configmap.SD_ADDRESS | default "localhost:8500" | quote }}
-  SD_ALLOW_STALE: {{ .Values.crm.configmap.SD_ALLOW_STALE | default "" | quote }}
-  SD_DIAL_TIMEOUT: {{ .Values.crm.configmap.SD_DIAL_TIMEOUT | default "" | quote }}
-  SD_ENABLED: {{ .Values.crm.configmap.SD_ENABLED | default "false" | quote }}
-  SD_EXTERNAL_ADDRESS: {{ .Values.crm.configmap.SD_EXTERNAL_ADDRESS | default "" | quote }}
-  SD_EXTERNAL_PORT: {{ .Values.crm.configmap.SD_EXTERNAL_PORT | default "" | quote }}
-  SD_INTERNAL_ADDRESS: {{ .Values.crm.configmap.SD_INTERNAL_ADDRESS | default "" | quote }}
-  SD_INTERNAL_PORT: {{ .Values.crm.configmap.SD_INTERNAL_PORT | default "" | quote }}
-  SD_INTERNAL_SCHEME: {{ .Values.crm.configmap.SD_INTERNAL_SCHEME | default "" | quote }}
-  SD_PREFER_VIEW: {{ .Values.crm.configmap.SD_PREFER_VIEW | default "" | quote }}
-  SD_RESPONSE_HEADER_TIMEOUT: {{ .Values.crm.configmap.SD_RESPONSE_HEADER_TIMEOUT | default "" | quote }}
-  SD_SEED_TIMEOUT: {{ .Values.crm.configmap.SD_SEED_TIMEOUT | default "" | quote }}
-  SD_TLS: {{ .Values.crm.configmap.SD_TLS | default "false" | quote }}
-  SD_TLS_HANDSHAKE_TIMEOUT: {{ .Values.crm.configmap.SD_TLS_HANDSHAKE_TIMEOUT | default "" | quote }}
-  SD_TLS_SKIP_VERIFY: {{ .Values.crm.configmap.SD_TLS_SKIP_VERIFY | default "false" | quote }}
-  SD_WATCH_WAIT_TIME: {{ .Values.crm.configmap.SD_WATCH_WAIT_TIME | default "" | quote }}
-  SD_WORKLOAD: {{ .Values.crm.configmap.SD_WORKLOAD | default "" | quote }}
-  STREAMING_ENABLED: {{ .Values.crm.configmap.STREAMING_ENABLED | default "false" | quote }}
+  SD_ENABLED: {{ .Values.crm.serviceDiscovery.enabled | default false | quote }}
+  {{- include "lerian-common.serviceDiscovery.env" (dict
+        "context" $
+        "enabled" (.Values.crm.serviceDiscovery.enabled | default false)
+        "name" (include "midaz-crm.fullname" .)
+        "port" .Values.crm.service.port
+        "namespace" (include "global.namespace" .)
+        "ingressHost" (include "lerian-common.firstIngressHost" (dict "ingress" .Values.crm.ingress))) | nindent 2 }}
+  {{- /* Legacy configmap.STREAMING_ENABLED wins over the grouped param
+     (presence-based); compare to "true" so a legacy "false" string does not
+     evaluate truthy. Same resolved bool gates both the env var and the helper. */ -}}
+  {{- $streamingEnabled := eq (include "lerian-common.cfgValue" (dict "configmap" .Values.crm.configmap "nativeKey" "STREAMING_ENABLED" "params" .Values.crm.streaming "field" "enabled" "default" "false")) "true" }}
+  STREAMING_ENABLED: {{ $streamingEnabled | quote }}
+  {{- include "lerian-common.streaming.env" (dict
+        "context" $
+        "enabled" $streamingEnabled
+        "clientId" (include "midaz-crm.fullname" .)
+        "cloudeventsSource" "lerian.midaz.crm") | nindent 2 }}
   # Extra Env Vars
   {{- with .Values.crm.extraEnvVars }}
   {{- toYaml . | nindent 2 }}

charts/midaz/templates/crm/ingress.yaml

@@ -1,61 +1,12 @@
+{{- $gIng := (.Values.global | default dict).ingress | default dict -}}
 {{- if and .Values.crm.enabled .Values.crm.ingress.enabled -}}
-{{- $fullName := include "midaz-crm.fullname" . -}}
-{{- $svcPort := .Values.crm.service.port -}}
-{{- if and .Values.crm.ingress.className (not (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion)) }}
-  {{- if not (hasKey .Values.crm.ingress.annotations "kubernetes.io/ingress.class") }}
-  {{- $_ := set .Values.crm.ingress.annotations "kubernetes.io/ingress.class" .Values.crm.ingress.className}}
-  {{- end }}
-{{- end }}
-{{- if semverCompare ">=1.19-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1
-{{- else if semverCompare ">=1.14-0" .Capabilities.KubeVersion.GitVersion -}}
-apiVersion: networking.k8s.io/v1beta1
-{{- else -}}
-apiVersion: extensions/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: {{ $fullName }}
-  labels:
-    {{- include "midaz-crm.labels" (dict "context" . "name" .Values.crm.name ) | nindent 4 }}
-  {{- with .Values.crm.ingress.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  {{- if and .Values.crm.ingress.className (semverCompare ">=1.18-0" .Capabilities.KubeVersion.GitVersion) }}
-  ingressClassName: {{ .Values.crm.ingress.className }}
-  {{- end }}
-  {{- if .Values.crm.ingress.tls }}
-  tls:
-    {{- range .Values.crm.ingress.tls }}
-    - hosts:
-        {{- range .hosts }}
-        - {{ . | quote }}
-        {{- end }}
-      secretName: {{ .secretName }}
-    {{- end }}
-  {{- end }}
-  rules:
-    {{- range .Values.crm.ingress.hosts }}
-    - host: {{ .host | quote }}
-      http:
-        paths:
-          {{- range .paths }}
-          - path: {{ .path }}
-            {{- if and .pathType (semverCompare ">=1.18-0" $.Capabilities.KubeVersion.GitVersion) }}
-            pathType: {{ .pathType }}
-            {{- end }}
-            backend:
-              {{- if semverCompare ">=1.19-0" $.Capabilities.KubeVersion.GitVersion }}
-              service:
-                name: {{ $fullName }}
-                port:
-                  number: {{ $svcPort }}
-              {{- else }}
-              serviceName: {{ $fullName }}
-              servicePort: {{ $svcPort }}
-              {{- end }}
-          {{- end }}
-    {{- end }}
+{{- include "lerian-common.ingress" (dict
+      "context" .
+      "ingress" .Values.crm.ingress
+      "global" $gIng
+      "subdomain" "crm"
+      "name" (include "midaz-crm.fullname" .)
+      "labels" (include "midaz-crm.labels" (dict "context" . "name" .Values.crm.name))
+      "svcPort" .Values.crm.service.port
+    ) }}
 {{- end }}