feat(charts): add IAM Roles Anywhere support to streaming-hub - #1769
Merged
Conversation
Adds the aws-signing-helper credential sidecar to streaming-hub, following the inline pattern the other charts already use (fetcher, reporter, matcher, plugin-fees) rather than the lerian-common library: no chart here declares that dependency yet, and this change should not make streaming-hub the first adopter. Because the three roles share the streaming-hub.deployment define, the four wiring points land in one place instead of being repeated per role: - pod securityContext fsGroup 65532 so the sidecar's non-root user can read the 0440 iam-certs projection (replaces podSecurityContext while enabled) - AWS_EC2_METADATA_SERVICE_ENDPOINT / _MODE pointing the SDK at the sidecar - the aws-signing-helper container, with trustAnchorArn / profileArn / roleArn wrapped in `required` so a misconfigured sidecar fails the render - the iam-certs volume from the kubernetes.io/tls Secret Adds the standard 8-key aws.rolesAnywhere block to values.yaml (default OFF) and declares aws in values.schema.json, matching the three charts that already ship it. Left out of values-template.yaml, since none of them put it there either. Verified: - disabled renders BYTE-IDENTICAL to the published 1.0.0-beta.4 in both mode=all and mode=split, so there is no regression for existing deployments - enabled, all three roles (all / ingest / delivery) get the sidecar, volume, fsGroup and both IMDS env vars - the sidecar, volume, imdsEnv and podSecurityContext fragments are byte-identical to matcher-helm 3.1.0-beta.2 and to the lerian-common helpers, so adopting that library later is a pure refactor - each of the three ARNs fails the render with its own message when left empty - podSecurityContext is still honoured when rolesAnywhere is off, and still omitted entirely when unset - helm lint clean; the repo render gate reports "streaming-hub: ok (render-ok)" The X.509 cert/key stay outside the chart: certificateSecretName names a kubernetes.io/tls Secret, created in the Lerian environments by a cert-manager Certificate in the deploying overlay. Chart.yaml is deliberately untouched — semantic-release owns the version bump. Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughChangesThe streaming-hub Helm chart adds opt-in AWS Roles Anywhere support. It defines configuration values, accepts the AWS configuration in the schema, routes IMDS requests to a signing-helper sidecar, and mounts TLS credentials. AWS Roles Anywhere integration
Sequence Diagram(s)sequenceDiagram
participant StreamingHub as streaming-hub container
participant SigningHelper as aws-signing-helper sidecar
participant IAMCerts as iam-certs Secret
StreamingHub->>SigningHelper: Sends IMDS credential requests to 127.0.0.1
SigningHelper->>IAMCerts: Reads mounted TLS certificate and key
SigningHelper-->>StreamingHub: Returns IMDS-compatible credentials
✨ Finishing Touches✨ Simplify code
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
Caution
Some comments are outside the diff and can’t be posted inline due to platform limitations.
⚠️ Outside diff range comments (1)
charts/streaming-hub/values.yaml (1)
1-1: 🗄️ Data Integrity & Integration | 🟠 Major | ⚡ Quick winRelease-scoped secret-name fallback is dead code due to the values.yaml default.
values.yamldocuments thatcertificateSecretNameshould fall back to a release-scoped name (<release-fullname>-iam-tls) when left empty, and_deployment.tplimplements exactly that fallback — but since the shipped default is the non-empty literal"streaming-hub-iam-tls", the fallback branch never executes under default configuration, so every release resolves to the same hardcoded secret name regardless of release name.
charts/streaming-hub/values.yaml#L468-470: change the default tocertificateSecretName: ""so the release-scoped fallback actually activates as documented.charts/streaming-hub/templates/_deployment.tpl#L189-199: no change needed once the values.yaml default is fixed — the existing| default (printf "%s-iam-tls" (include "streaming-hub.fullname" $))fallback (Line 192) will then work as intended.🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the rest with a brief reason, keep changes minimal, and validate. In `@charts/streaming-hub/values.yaml` at line 1, Change the default value of certificateSecretName in values.yaml from the hardcoded streaming-hub-iam-tls name to an empty string, allowing _deployment.tpl’s existing release-scoped fullname fallback to generate a unique secret name per release.
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/streaming-hub/templates/_deployment.tpl`:
- Line 62: Define a single template variable near the top of the deployment
template’s define block for the AWS Roles Anywhere enabled condition, then
replace the repeated conditions at the four visible if sites with that variable.
Preserve the existing truthiness checks for aws, rolesAnywhere, and
rolesAnywhere.enabled.
- Around line 62-72: Update the securityContext rendering around
$sh.podSecurityContext so Roles Anywhere enforces fsGroup 65532 while preserving
and merging all other configured podSecurityContext fields, including
seccompProfile, sysctls, and supplementalGroups. Keep the existing fallback
behavior when Roles Anywhere is disabled.
In `@charts/streaming-hub/values.yaml`:
- Around line 468-470: Set the chart value certificateSecretName to an empty
string by default so _deployment.tpl can apply its release-specific
<release-fullname>-iam-tls fallback. Preserve the documented override behavior
for users who provide an explicit secret name.
---
Outside diff comments:
In `@charts/streaming-hub/values.yaml`:
- Line 1: Change the default value of certificateSecretName in values.yaml from
the hardcoded streaming-hub-iam-tls name to an empty string, allowing
_deployment.tpl’s existing release-scoped fullname fallback to generate a unique
secret name per release.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 2fe57b98-8a75-4a7d-9499-f1a4771ba35f
📒 Files selected for processing (3)
charts/streaming-hub/templates/_deployment.tplcharts/streaming-hub/values.schema.jsoncharts/streaming-hub/values.yaml
Addresses the three CodeRabbit findings on #1769. 1. fsGroup no longer discards the deployer's podSecurityContext. With Roles Anywhere on, the block used to be replaced wholesale by a bare `fsGroup: 65532`, silently dropping runAsNonRoot, seccompProfile, supplementalGroups and anything else configured. It is now merged, with fsGroup winning so the 0440 iam-certs projection stays readable by the sidecar even when the deployer sets a different fsGroup. 2. certificateSecretName defaults to "" so the documented fallback in _deployment.tpl is reachable. The non-empty literal pinned every install to one name and made fullnameOverride ineffective. The comment also claimed the fallback was release-scoped; it is not — streaming-hub.fullname is the chart name (or fullnameOverride), never the release name. Corrected in place rather than left as a false promise. 3. The Roles Anywhere condition is hoisted into $rolesAnywhere, replacing four verbatim copies that could drift apart. Verified by render, not by inspection: - on + custom podSecurityContext -> fsGroup 65532 AND runAsNonRoot, seccompProfile, supplementalGroups all survive - on + deployer fsGroup 1000 -> 65532 wins (enforcement preserved) - on + no podSecurityContext -> renders fsGroup alone, no error - empty certificateSecretName -> resolves to streaming-hub-iam-tls, which is the name every current consumer already passes explicitly, so no deployed environment changes - off -> zero sidecar, zero iam-certs, prior behaviour byte-identical - helm lint clean Claude-Session: https://claude.ai/code/session_01AQHofhVKKGUbSo959SEn5r
Member
|
All three review findings addressed in 7c11ac2. 1. 2. 3. Duplicated condition, 4 sites (Trivial). Hoisted into Verified by render, not inspection:
No deployed environment changes. Every current consumer of this feature already passes Context on why this is time-sensitive, from outside this repo: |
There was a problem hiding this comment.
Actionable comments posted: 1
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In `@charts/streaming-hub/values.yaml`:
- Around line 469-472: Update the explanatory comment near the empty TLS name
setting to document that streaming-hub.fullname honors nameOverride before
fullnameOverride, so nameOverride: foo produces foo-iam-tls; retain the existing
fullnameOverride and default-name behavior accurately.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: ASSERTIVE
Plan: Pro
Run ID: 02a481e1-37dd-43f9-932a-04055190ecac
📒 Files selected for processing (2)
charts/streaming-hub/templates/_deployment.tplcharts/streaming-hub/values.yaml
Member
|
@BlackSmith -- eh seu. |
|
Got it, I'm checking the PR context first. |
![View with [code]smith](https://pr-comments-assets.blacksmith.sh/codesmith/view-with-codesmith-dark-v2.svg)
… comment Co-authored-by: Codesmith <codesmith-bot@users.noreply.github.com>
Assumido. Estado do PR e o que fiz:
|
lerian-studio-midaz-push-bot Bot
pushed a commit
that referenced
this pull request
Jul 31, 2026
## (2026-07-31) ### Features * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **lerian-common:** add multiTenant and streaming secret helpers ([5817577](5817577)) * **br-slc:** add opt-in ingress disabled by default ([f5cdf05](f5cdf05)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](b548556)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **lerian-common:** add shared Helm library chart ([0f266cd](0f266cd)) * **plugin-br-pix-indirect-btg:** add SWAGGER_ENABLED env var defaulting to true ([62d1d98](62d1d98)) * **charts:** mock-nuclea optional Deployment + prod guard (ADR-23) ([26252ea](26252ea)) * **charts:** model br-ccs snapshot quarantine knobs as configmap keys ([df6bb6c](df6bb6c)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **streaming-hub:** support AWS IAM Roles Anywhere ([3422c6c](3422c6c)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](4b62eb6)) * **helm-standard:** support type: library charts + lerian-common contract ([69b7fdb](69b7fdb)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.8.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.8.0, plugin-br-pix-indirect-btg-worker-schedule@1.8.0, plugin-br-pix-indirect-btg-worker-inbound@1.8.0, plugin-br-pix-indirect-btg-worker-outbound@1.8.0 - new env vars ([ded3bc4](ded3bc4)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * align WEBHOOK_SCHEDULE_CASHOUT_URL default with other CASHOUT keys ([5a4c7b4](5a4c7b4)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **lender:** default consignado dark so eight deployments stop depending on one line ([adef35d](adef35d)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **lerian-common:** fail on conflicting pdb fields in explicit mode ([d7a50d8](d7a50d8)) * **helm-standard:** gate library exemptions on chart.Type + fix messages ([477e4cd](477e4cd)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **charts:** harden mock-nuclea SPB runbook + mountPath schema (PR [#1699](#1699) review) ([4c276aa](4c276aa)) * **charts:** merge fsGroup instead of replacing the pod security context ([7c11ac2](7c11ac2)), closes [#1769](#1769) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * remove duplicate secret.yaml, secrets.yaml already exists ([540c4ad](540c4ad)) * **lerian-common:** render-gate skip for library + honor 0 in pdb/probes ([8ebcaeb](8ebcaeb)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))
This was referenced Jul 31, 2026
lerian-studio-midaz-push-bot Bot
pushed a commit
that referenced
this pull request
Jul 31, 2026
## (2026-07-31) ### Features * **chart:** add adapter-lerian schema, README and values-template entries ([9180459](9180459)) * **chart:** add adapter-lerian template directories ([1882905](1882905)) * **chart:** add adapter-lerian values blocks, ingress routes and database ([328b236](328b236)) * **flowker:** add AWS IRSA and Roles Anywhere signing sidecar ([003b783](003b783)) * **new:** add br-slc BYOC Helm chart ([cc65a6d](cc65a6d)), closes [#99](#99) * **br-slc:** add gated mock-nuclea component ([ed1a9c9](ed1a9c9)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **br-ccs:** add Helm chart ([0fa5f89](0fa5f89)) * **flowker:** add in-pod XSD validator sidecar ([1817bee](1817bee)) * **new:** add lender chart ([#1672](#1672)) ([1540885](1540885)) * **pix-btg:** add missing env defaults to chart values ([ee6841d](ee6841d)) * **lerian-common:** add multiTenant and streaming secret helpers ([5817577](5817577)) * **plugin-br-pix-indirect-btg:** add new develop envs (recurrence collection, terminal events, schedule reconcile, recurring module) ([576992f](576992f)) * **br-slc:** add opt-in ingress disabled by default ([f5cdf05](f5cdf05)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **charts:** add per-upstream M2M OAuth2 client credentials to br-ccs secrets ([b548556](b548556)) * **plugin-br-pix-indirect-btg:** add PIX_RECURRENCE_PAYER inbound entity ([9bc7afc](9bc7afc)) * **br-sta:** add postgres migrations Job to chart ([b9f5bea](b9f5bea)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **plugin-br-pix-indirect-btg:** add RECURRING FlowType entities to outbound configmap ([9d3645d](9d3645d)) * **flowker:** add scheduler worker Deployment and full env surface ([df8f89f](df8f89f)) * **lerian-common:** add shared Helm library chart ([0f266cd](0f266cd)) * **plugin-br-pix-indirect-btg:** add SWAGGER_ENABLED env var defaulting to true ([62d1d98](62d1d98)) * **flowker:** add valkey subchart backing the scheduler queue ([3f5fe0b](3f5fe0b)) * **br-ccs:** expose rate-limit disable and fail-open knobs in values ([25390d4](25390d4)) * **charts:** mock-nuclea optional Deployment + prod guard (ADR-23) ([26252ea](26252ea)) * **charts:** model br-ccs snapshot quarantine knobs as configmap keys ([df6bb6c](df6bb6c)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **flowker:** ship 3.1.0 multi-component release (schema, docs, image tag) ([75f8cdb](75f8cdb)) * **streaming-hub:** support AWS IAM Roles Anywhere ([3422c6c](3422c6c)) * **charts:** support LICENSE_KEY and ORGANIZATION_IDS in br-ccs secrets ([4b62eb6](4b62eb6)) * **helm-standard:** support type: library charts + lerian-common contract ([69b7fdb](69b7fdb)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.8.0, plugin-br-pix-indirect-btg-worker-reconciliation@1.8.0, plugin-br-pix-indirect-btg-worker-schedule@1.8.0, plugin-br-pix-indirect-btg-worker-inbound@1.8.0, plugin-br-pix-indirect-btg-worker-outbound@1.8.0 - new env vars ([ded3bc4](ded3bc4)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-ccs:** add Chart Contract section to README ([a5ba0b3](a5ba0b3)) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **br-slc:** address CodeRabbit review on BYOC helm chart ([fc5659f](fc5659f)) * **br-ccs:** address CodeRabbit review on PR [#1617](#1617) ([b4112dd](b4112dd)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * align WEBHOOK_SCHEDULE_CASHOUT_URL default with other CASHOUT keys ([5a4c7b4](5a4c7b4)) * **chart:** classify adapter-lerian BRSFN_TOKEN_URL as a secret ([c4732a8](c4732a8)) * **flowker:** clear helm-chart-standard strict violations and address review ([6117aeb](6117aeb)) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **pix-indirect-btg:** correct low-throughput defaults for recurrence/terminal entities ([27925f7](27925f7)) * **lender:** default consignado dark so eight deployments stop depending on one line ([adef35d](adef35d)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **lerian-common:** fail on conflicting pdb fields in explicit mode ([d7a50d8](d7a50d8)) * **helm-standard:** gate library exemptions on chart.Type + fix messages ([477e4cd](477e4cd)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **charts:** harden mock-nuclea SPB runbook + mountPath schema (PR [#1699](#1699) review) ([4c276aa](4c276aa)) * **charts:** merge fsGroup instead of replacing the pod security context ([7c11ac2](7c11ac2)), closes [#1769](#1769) * **br-sta:** pass ALLOW_INSECURE_TLS to migrations Job for non-TLS Postgres ([1fd3a50](1fd3a50)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * remove duplicate secret.yaml, secrets.yaml already exists ([540c4ad](540c4ad)) * **charts:** render br-ccs ALLOW_RATELIMIT_FAIL_OPEN, drop dead ALLOW_RATELIMIT_DISABLED ([24efbd2](24efbd2)) * **charts:** render br-ccs RABBITMQ_URL as a secret, not a configmap value ([e54f325](e54f325)) * **lerian-common:** render-gate skip for library + honor 0 in pdb/probes ([8ebcaeb](8ebcaeb)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **charts:** restore the streaming-hub release section in README ([8294e64](8294e64)), closes [#1571](#1571) [#1769](#1769) * **chart:** serve adapter-lerian consumer probes under /lerian ([b4a338a](b4a338a)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **streaming-hub:** the values header still claimed fsGroup replaces the pod security context ([3f4210e](3f4210e)), closes [#1769](#1769) [#1799](#1799) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))
lerian-studio-midaz-push-bot Bot
pushed a commit
that referenced
this pull request
Aug 7, 2026
## (2026-08-07) ### Features * **midaz:** add tracer templates to the umbrella chart ([cb93090](cb93090)) * **charts:** mock-nuclea optional Deployment + prod guard (ADR-23) ([26252ea](26252ea)) * **midaz:** pass CRM, Fees, KMS and tracer config to the ledger ([bed01b2](bed01b2)) * **streaming-hub:** support AWS IAM Roles Anywhere ([3422c6c](3422c6c)) ### Bug Fixes * **midaz:** address review findings on unified ledger and tracer config ([25a3d76](25a3d76)) * **lender:** default consignado dark so eight deployments stop depending on one line ([adef35d](adef35d)) * **midaz:** gate v4 Deployments on migrations, track tracer DB name, tighten semver guard ([368e90c](368e90c)) * **charts:** harden mock-nuclea SPB runbook + mountPath schema (PR [#1699](#1699) review) ([4c276aa](4c276aa)) * **midaz:** make the chart able to actually run midaz v4 tracer and ledger ([d722d48](d722d48)) * **charts:** merge fsGroup instead of replacing the pod security context ([7c11ac2](7c11ac2)), closes [#1769](#1769) * **midaz:** resolve tracer db host per release, fix transport seam, harden validation ([5a56a60](5a56a60)) * **charts:** restore the streaming-hub release section in README ([8294e64](8294e64)), closes [#1571](#1571) [#1769](#1769) * **streaming-hub:** the values header still claimed fsGroup replaces the pod security context ([3f4210e](3f4210e)), closes [#1769](#1769) [#1799](#1799) * **midaz:** wait for CRM/Fees Mongo in init container and honor explicit tracer PDB minAvailable: 0 ([0c3d853](0c3d853))
lerian-studio-midaz-push-bot Bot
pushed a commit
that referenced
this pull request
Aug 7, 2026
## (2026-08-07) ### Features * **midaz:** add tracer templates to the umbrella chart ([cb93090](cb93090)) * **charts:** mock-nuclea optional Deployment + prod guard (ADR-23) ([26252ea](26252ea)) * **midaz:** pass CRM, Fees, KMS and tracer config to the ledger ([bed01b2](bed01b2)) * **streaming-hub:** support AWS IAM Roles Anywhere ([3422c6c](3422c6c)) ### Bug Fixes * **midaz:** address review findings on unified ledger and tracer config ([25a3d76](25a3d76)) * **lender:** default consignado dark so eight deployments stop depending on one line ([adef35d](adef35d)) * **midaz:** gate v4 Deployments on migrations, track tracer DB name, tighten semver guard ([368e90c](368e90c)) * **charts:** harden mock-nuclea SPB runbook + mountPath schema (PR [#1699](#1699) review) ([4c276aa](4c276aa)) * **midaz:** make the chart able to actually run midaz v4 tracer and ledger ([d722d48](d722d48)) * **charts:** merge fsGroup instead of replacing the pod security context ([7c11ac2](7c11ac2)), closes [#1769](#1769) * **midaz:** resolve tracer db host per release, fix transport seam, harden validation ([5a56a60](5a56a60)) * **charts:** restore the streaming-hub release section in README ([8294e64](8294e64)), closes [#1571](#1571) [#1769](#1769) * **streaming-hub:** the values header still claimed fsGroup replaces the pod security context ([3f4210e](3f4210e)), closes [#1769](#1769) [#1799](#1799) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.9.1 ([2ae166a](2ae166a)) * **midaz:** wait for CRM/Fees Mongo in init container and honor explicit tracer PDB minAvailable: 0 ([0c3d853](0c3d853))
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adiciona o sidecar
aws-signing-helperao streaming-hub, seguindo o padrãoinline que os outros charts já usam (fetcher, reporter, matcher, plugin-fees)
em vez da lib
lerian-common: nenhum chart declara essa dependency hoje, e essamudança não deveria fazer do streaming-hub o primeiro adotante.
Wiring
Como os 3 roles compartilham o define
streaming-hub.deployment, os 4 pontosentram num lugar só em vez de repetidos por role:
securityContext.fsGroup: 65532no pod, pro usuário non-root do sidecar ler aprojeção
0440doiam-certs(substituipodSecurityContextenquanto ligado)AWS_EC2_METADATA_SERVICE_ENDPOINT/_MODEapontando o SDK pro sidecaraws-signing-helper, comtrustAnchorArn/profileArn/roleArnem
required— sidecar mal configurado falha o render, não sobe quebradoiam-certsdo Secretkubernetes.io/tlsBloco padrão de 8 chaves
aws.rolesAnywhereemvalues.yaml(default OFF) eawsdeclarado novalues.schema.json, igual aos 3 charts que já têm. Fora dovalues-template.yaml, porque nenhum deles coloca lá.Validação
mode=allemode=split1.0.0-beta.4publicado — zero regressãoall/ingest/delivery)matcher-helm3.1.0-beta.2 e vs helpers dolerian-commonpodSecurityContextcom rolesAnywhere offhelm lintstreaming-hub: ok (render-ok)Como os 4 fragmentos saem idênticos aos helpers do
lerian-common, migrar pralib depois é refactor puro, sem mudança de output.
Notas
certificateSecretNameaponta um Secretkubernetes.io/tls, criado nos ambientes Lerian por umCertificatedocert-manager no overlay que deploya.
Chart.yamlnão foi tocado — o semantic-release é dono do version bump(
chore(release): ...+update-chart-version-readmecomo prepareCmd).rolesAnywhereno seu.--strictdo validador acusa 3 violações (flowker,matcher,underwritersemChart.yaml) — pré-existentes emdevelop, sem relaçãocom essa mudança.
chartsporquepr-title.ymltemrequireScope: truee
streaming-hubnão está na lista de scopes permitidos. Vale adicionar lánum PR separado. O targeting do release não é afetado: a matrix vem de changed
paths (
filter_paths: charts/,path_level: 2), não do scope.🤖 Generated with Claude Code