fix(common): serviceDiscovery.env derives siblings from legacy configmap.SD_* without global by guimoreirar · Pull Request #1779 · LerianStudio/helm

guimoreirar · 2026-07-31T16:16:51Z

What

One-line gate change in serviceDiscovery.env so the derived SD_* siblings are emitted when the legacy flat configmap.SD_ADDRESS is set, even without global.serviceDiscovery:

- {{- if and .enabled $sd.address -}}
+ {{- if and .enabled (or $sd.address (index $c "SD_ADDRESS")) -}}

Why

A human review of the midaz productization found that an operator using the legacy configmap.SD_* API (SD_ENABLED=true + SD_ADDRESS/SD_TLS/SD_WORKLOAD) but NOT global.serviceDiscovery got only SD_ENABLED emitted — the 15 derived siblings vanished (main emitted all 16). The #1772 configmap passthrough lived INSIDE the and .enabled $sd.address gate, so it only worked when global.serviceDiscovery.address existed. This breaks the documented backward-compat contract for on-prem/client values that use the flat configmap.SD_* API. Gating additionally on configmap.SD_ADDRESS (the one field required when SD is enabled — symmetric with the existing $sd.address sentinel) closes it.

Backward-compatibility (proven against midaz consumer)

configmap-only SD (the fix): now emits SD_ADDRESS/SD_TLS/SD_WORKLOAD + derived SD_INTERNAL_*/SD_PREFER_VIEW (ledger + crm).
global mode: byte-identical to before (gate still true via $sd.address).
no-SD default: byte-identical (block stays inert; only SD_ENABLED: "false").

Scope

charts/lerian-common only (1-chart-per-PR). No manual version bump (release pipeline auto-bumps). helm lint clean.

Follow-up

midaz (#1741) bumps its lerian-common pin to the version this releases (its call sites already pass configmap).

…map.SD_* without global

coderabbitai · 2026-07-31T16:17:10Z

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: a0bb23b6-17ed-4f76-bf48-18bacd725bd2

📥 Commits

Reviewing files that changed from the base of the PR and between 58df8fb and ba61e50.

📒 Files selected for processing (1)

charts/lerian-common/templates/_service_discovery.tpl

📝 Walkthrough

Walkthrough

Service discovery now activates from a global address or a present legacy configmap.SD_ADDRESS. Legacy configmap.SD_* values preserve explicit empty, false, and zero values during resolution. Documentation reflects the updated activation and precedence rules.

Changes

Service discovery configuration

Layer / File(s)	Summary
Service discovery activation and value resolution `charts/lerian-common/templates/_service_discovery.tpl`	The helper accepts global or legacy address activation. Present legacy `configmap.SD_*` values override global or derived values, including empty, false, and zero values.
Resolved output and configuration contract `charts/lerian-common/templates/_service_discovery.tpl`, `charts/lerian-common/README.md`, `charts/lerian-common/values.yaml`	The helper emits resolved internal and optional external settings while omitting `SD_ENABLED`. Documentation describes legacy activation, precedence, and the absence of a default address.

✨ Finishing Touches

✨ Simplify code

Create PR with simplified code
Commit simplified code in branch fix/lerian-common-sd-configmap-gate

_{Comment @coderabbitai help to get the list of available commands.}

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/lerian-common/templates/_service_discovery.tpl`:
- Around line 51-63: The chart documentation must reflect that service-discovery
derivation can activate from either global.serviceDiscovery.address or legacy
configmap.SD_ADDRESS. Update the service-discovery sections in README.md and
values.yaml to document both sources and state the precedence when both are
configured, while preserving the existing enabled gating behavior.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: f4383885-9690-488f-bbdf-7a9c56bdfdca

📥 Commits

Reviewing files that changed from the base of the PR and between 73e532a and a69ec3c.

📒 Files selected for processing (1)

charts/lerian-common/templates/_service_discovery.tpl

…for serviceDiscovery.env The gate now activates derivation from global.serviceDiscovery.address OR legacy configmap.SD_ADDRESS; README + values reflected only the global path. Note the alternative source and the configmap>global precedence (addresses CodeRabbit).

coderabbitai

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@charts/lerian-common/values.yaml`:
- Line 19: The lerian-common.serviceDiscovery.env configuration must use
presence-based precedence for configmap.SD_* values, preserving explicitly
provided empty, false, and zero values. Update activation and each
component/global selection to use hasKey rather than truthiness-based default
fallbacks; apply the corresponding documentation update in
charts/lerian-common/README.md lines 13-15, while
charts/lerian-common/values.yaml line 19 requires the configuration change.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

Push a commit to this branch (recommended)
Create a new PR with the fixes

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: ASSERTIVE

Plan: Pro

Run ID: 0ccb6594-dd3e-414a-a206-149057c3c41f

📥 Commits

Reviewing files that changed from the base of the PR and between a69ec3c and 58df8fb.

📒 Files selected for processing (2)

charts/lerian-common/README.md
charts/lerian-common/values.yaml

…empty/false/0 configmap.SD_* win

Consume the fixed lerian-common helper (#1779): service-discovery block now emits all SD_* siblings when activated via legacy configmap.SD_ADDRESS (hasKey presence gate), resolving reviewer blocker 1. Combined with the multiTenant secret gate (this branch), both RED blockers are addressed.

Apply the same presence-based (hasKey) resolution that #1779 gave serviceDiscovery to streaming.env and multiTenant.env: - streaming.env activation now also triggers from legacy configmap.STREAMING_BROKERS (not only global.streaming.brokers) — mirrors the SD gate fix. - Per-key resolution uses hasKey instead of sprig default for every global/param -derived key, so an explicit configmap value survives even as a YAML false / 0 / empty string. Previously e.g. configmap STREAMING_TLS_ENABLED: false was silently overridden to the global true; MULTI_TENANT_REDIS_PORT: 0 became 6379. - Literal-default keys are left untouched (byte-identical to main). Backward-compat verified: with no configmap the derived/global values render unchanged.

## (2026-07-31) ### Bug Fixes * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a))

## (2026-08-03) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) ### Bug Fixes * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff))

## (2026-08-03) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))

## (2026-08-04) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](e6cfb98)) * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **ci:** add chart standard validation and render gate ([9d4ab59](9d4ab59)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **migrations:** add PostgreSQL migrations job configuration and template ([f6e4695](f6e4695)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](6521ba7)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](9b65378)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **plugin-br-bank-transfer:** default rate-limit off, expose ALLOW_INSECURE_TLS toggle ([4946cb5](4946cb5)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **ci:** enforce single-source infra secrets ([3b787d5](3b787d5)) * **lerian-notification:** expose all MULTI_TENANT_* vars via ConfigMap ([756a1f9](756a1f9)) * **ci:** harden validator with collapse gate ([cc324ee](cc324ee)) * **plugin-br-payments-fakebtg:** initial chart for the BTG provider mock ([e67d89c](e67d89c)), closes [#138](#138) * **plugins:** parameterize bc-correios probes following plugin-fees pattern ([82dbb81](82dbb81)) * **ci:** per-chart values.schema.json generator ([d295433](d295433)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](3e18fa6)) * **plugin-br-bank-transfer:** template CORS_ALLOWED_ORIGINS/METHODS/HEADERS in configmap ([86eb651](86eb651)) * **tracer:** template ENV_NAME in configmap ([50a6f50](50a6f50)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **migrations:** update migration logic and enable migrations job ([643f703](643f703)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](8b24026)) ### Bug Fixes * **migrations:** add migration secret template and update secret resolution logic ([79ef8f5](79ef8f5)) * **product-console:** add MONGO_PARAMETERS to configmap for MongoDB configuration ([d7765b4](d7765b4)) * **plugins:** add plugin-br-payments-fakebtg to README version matrix ([7ba4f9d](7ba4f9d)), closes [#1404](#1404) * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](a649c71)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address CodeRabbit review on revamp PR [#1470](#1470) ([98288a5](98288a5)), closes [#1](#1) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](0d025e9)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](75ad0d4)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **bank-transfer:** clear encryption keys in values.yaml for security ([5ff9c1d](5ff9c1d)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](fcaa3b4)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](14924af)), closes [#1470](#1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](a394658)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](a38dca3)) * **plugin-br-bank-transfer:** emit k8s.pod.ip OTLP resource attribute ([734a38a](734a38a)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](66f2939)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **charts:** fail loud on missing infra creds ([5bfc010](5bfc010)) * **plugin-br-bank-transfer:** gate single-tenant envs by MULTI_TENANT_ENABLED (2.0.0-beta.7) ([9ae56b4](9ae56b4)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **plugin-access-manager,plugin-bc-correios:** handle https URLs in wait-for-dependencies initContainer ([#1467](#1467)) ([7c62a98](7c62a98)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](6a9d958)) * **plugin-br-bank-transfer:** make migrations Job safe for ArgoCD first install ([#1465](#1465)) ([a39f2c6](a39f2c6)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **go-boilerplate-ddd:** set readinessProbe path to /readyz ([#1405](#1405)) ([e0d9084](e0d9084)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](582ea97)) * **plugin-br-bank-transfer:** skip wait-for-dependencies init container and migrations Job in MT mode (2.0.0-beta.8) ([45d152a](45d152a)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **new:** sync migrations job and app versions ([d90d1d7](d90d1d7)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **docs:** update application version mapping for bank transfer in README ([944e1ce](944e1ce)) * **bank-transfer:** update documentation and configuration for bank transfer plugin ([f7aa25b](f7aa25b)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](6214b2a)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-access-manager:** update image tag to 2.6.7 ([68bcd0b](68bcd0b)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](b6dade8)) * **midaz:** update midaz-crm@3.7.2, midaz-ledger@3.7.2 ([3c9bea0](3c9bea0)) * **midaz:** update midaz-crm@3.7.3 ([5ee7f45](5ee7f45)) * **midaz:** update midaz-crm@3.7.6, midaz-ledger@3.7.6 ([67021d4](67021d4)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](4852190)) * **plugin-br-bank-transfer:** update migration image repository and add plugin to PR template ([5c2edb0](5c2edb0)) * **plugin-access-manager:** update plugin-auth@2.6.7 ([b5892a3](b5892a3)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.3, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.3, plugin-br-pix-indirect-btg-worker-inbound@1.7.3, plugin-br-pix-indirect-btg-worker-outbound@1.7.3 ([a3c2b6d](a3c2b6d)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](99e3105)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **product-console:** update readiness probe path to default to root ([2996200](2996200)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](5292a60)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](07ea25b)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **plugin-br-bank-transfer:** update selectorLabels to include component in PodDisruptionBudget ([4492c3d](4492c3d)) * **plugin-br-pix-indirect-btg:** use health readiness probe ([ac4c1e8](ac4c1e8)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b)) * **charts:** value key typo and stale README notes ([91ce16f](91ce16f)) * **plugin-access-manager:** wire resources block into auth-backend deployment ([#1430](#1430)) ([f38d6d9](f38d6d9))

## (2026-08-04) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b))

## (2026-08-04) ### Features * add ALLOW_INSECURE_TLS configuration to multiple charts and update image tags ([e6cfb98](e6cfb98)) * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **charts:** add br-sfn multi-component chart (SPB, SPI, SILOC, SCR, desk, slc-edge, cockpit) ([a8e342d](a8e342d)) * **br-spi:** add br-spi-helm chart for the SPI rail ([82c420c](82c420c)) * **ci:** add chart standard validation and render gate ([9d4ab59](9d4ab59)) * **common:** add flat-passthrough env helpers to lerian-common ([dab66c7](dab66c7)) * **br-sisbajud:** add Helm chart for SISBAJUD plugin ([6b20f50](6b20f50)) * **common:** add lerian-common library chart ([f7a8032](f7a8032)) * **plugin-access-manager:** add optional configurable startupProbe for identity and auth ([c95e7f2](c95e7f2)) * **flowker:** add optional WORKOS_TM_CLIENT_SECRET secret ([5e66bd2](5e66bd2)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sisbajud:** add PreSync Redpanda topics provisioner Job ([484e04e](484e04e)) * **otel-collector-lerian:** apply midaz namespace filter across all signals + deprecation rename ([6521ba7](6521ba7)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **midaz:** decouple otel-collector-lerian from midaz helm chart ([9b65378](9b65378)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) * **common:** default serviceDiscovery to internal view + tls-skip-verify ([b80ab83](b80ab83)) * **ci:** enforce single-source infra secrets ([3b787d5](3b787d5)) * **ci:** harden validator with collapse gate ([cc324ee](cc324ee)) * **ci:** per-chart values.schema.json generator ([d295433](d295433)) * **common:** promote lerian-common to 1.0.0 productization helpers ([cb9643d](cb9643d)) * render streaming SASL/TLS secrets in midaz + plugin-fees Secrets ([ead8417](ead8417)) * **otel-collector-lerian:** standardize processors, pod identity, semconv transform ([3e18fa6](3e18fa6)) * **midaz:** update midaz-crm@3.7.8, midaz-ledger@3.7.8 - new env vars ([0ad123f](0ad123f)) * **midaz:** update midaz-crm@3.8.0, midaz-ledger@3.8.0 ([f38da4c](f38da4c)) * **plugin-fees:** update plugin-fees@3.3.0 - new env vars ([e64d615](e64d615)) * **plugin-fees:** update plugin-fees@3.4.0 ([0237f21](0237f21)) * **pix-switch:** use amqps:// for dict-hub-vsync RabbitMQ connection ([8b24026](8b24026)) ### Bug Fixes * **br-sisbajud:** address CI violations + CodeRabbit review ([41ef02f](41ef02f)) * **templates:** address CodeRabbit blocking findings on infra secret gating ([a649c71](a649c71)) * **charts:** address CodeRabbit on br-spi-helm ([c2fe0ac](c2fe0ac)) * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address CodeRabbit review on revamp PR [#1470](#1470) ([98288a5](98288a5)), closes [#1](#1) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **deployment:** adjust security context for Casdoor container and update logConfig path ([0d025e9](0d025e9)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **br-sisbajud:** align migration Job env with br-sta pattern ([18b02e5](18b02e5)) * **schemas:** allow additional properties in values.schema.json files ([75ad0d4](75ad0d4)) * **charts:** br-sfn — CodeRabbit review round 1 ([7c0c323](7c0c323)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **charts:** collapse-aware infra host fallbacks ([fcaa3b4](fcaa3b4)) * **underwriter:** collapse-aware infra hosts + fixture/doc cleanup ([14924af](14924af)), closes [#1470](#1470) * **charts:** collapse-safe Bitnami name derivation ([a394658](a394658)) * **lerian-common:** configmap passthrough for SD/streaming env + missing streaming knobs ([b508308](b508308)), closes [#1741](#1741) * **br-sisbajud:** correct appVersion to 1.0.0-beta.109 ([59d300e](59d300e)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **common:** default SD_TLS_SKIP_VERIFY to false ([bbef066](bbef066)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **reporter:** drop KEDA authRef on cpu/memory ([a38dca3](a38dca3)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **templates:** enhance validation and error handling for Helm chart processing ([66f2939](66f2939)) * **pipe:** escape Helm template syntax breaking GitHub Pages build ([c875970](c875970)) * **charts:** fail loud on missing infra creds ([5bfc010](5bfc010)) * **plugin-br-pix-indirect-btg:** give schedule worker PDB real disruption protection ([f90ecab](f90ecab)), closes [#1682](#1682) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugin-br-pix-indirect-btg:** guard replicas when autoscaling enabled ([36d29c4](36d29c4)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **templates:** improve mongoHost definition for external MongoDB handling ([6a9d958](6a9d958)) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **common:** per-ingress annotations override global (mergeOverwrite) ([fdf5ead](fdf5ead)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **br-sisbajud:** pin busybox to 1.36 in values.yaml defaults ([eebc7ce](eebc7ce)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **br-sisbajud:** preserve valueFrom env in topics PreSync Job ([4e260aa](4e260aa)), closes [#1666](#1666) * **pipe:** reject absolute file:// dependency paths in render gate ([31135cd](31135cd)) * **pipe:** render-gate resolves file:// local chart dependencies ([d77b69f](d77b69f)) * **common:** respect explicit false/empty in lerian-common resolvers ([ecd0a46](ecd0a46)) * **flowker:** restore 3.1 chart content dropped by the 3.1.0 release ([caff99f](caff99f)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **br-sisbajud:** set HOME=/tmp on topics provisioner Job ([9886085](9886085)) * **pix-indirect-btg:** single-source infra secrets ([582ea97](582ea97)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139)) * **fetcher:** update fetcher-manager@2.0.2, fetcher-worker@2.0.2 ([6214b2a](6214b2a)) * **fetcher:** update fetcher-manager@3.0.2, fetcher-worker@3.0.2 ([3c815a7](3c815a7)) * **deployment:** update logConfig path and add volume for log storage ([b6dade8](b6dade8)) * **midaz:** update midaz-ledger@3.7.7 ([4852190](4852190)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.0 ([3c89507](3c89507)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.1.9 ([a5710e9](a5710e9)) * **plugin-br-bank-transfer:** update plugin-br-bank-transfer@1.2.0 ([034102c](034102c)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.4, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.4, plugin-br-pix-indirect-btg-worker-inbound@1.7.4, plugin-br-pix-indirect-btg-worker-outbound@1.7.4 ([99e3105](99e3105)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.5, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.5, plugin-br-pix-indirect-btg-worker-inbound@1.7.5, plugin-br-pix-indirect-btg-worker-outbound@1.7.5 ([ecbda31](ecbda31)) * **plugin-br-pix-indirect-btg:** update plugin-br-pix-indirect-btg@1.7.6, plugin-br-pix-indirect-btg-worker-reconciliation@1.7.6, plugin-br-pix-indirect-btg-worker-inbound@1.7.6, plugin-br-pix-indirect-btg-worker-outbound@1.7.6 ([bcd81c1](bcd81c1)) * **reporter:** update reporter-manager@2.1.1, reporter-worker@2.1.1 ([5292a60](5292a60)) * **reporter:** update reporter-manager@2.1.2, reporter-worker@2.1.2 ([07ea25b](07ea25b)) * **reporter:** update reporter-manager@2.2.0, reporter-worker@2.2.0 ([cc51d8b](cc51d8b)) * **reporter:** update reporter-manager@2.3.0, reporter-worker@2.3.0 ([7b4ff5b](7b4ff5b)) * **br-sisbajud:** use stringData in app Secret template ([063f33b](063f33b)) * **charts:** value key typo and stale README notes ([91ce16f](91ce16f))

## (2026-08-06) ### Features * **charts:** add br-consignado gateway with operator console ([8c29a8f](8c29a8f)) * **plugin-br-pix-indirect-btg:** add outbound BTG client mTLS via mounted secret ([8776bcf](8776bcf)) * **br-sfn:** add the correios rail as a chart component ([05cdbe9](05cdbe9)) * **plugin-br-pix-indirect-btg:** bump app to 1.9.0 (stable) ([66c2fa6](66c2fa6)), closes [#1811](#1811) [#1811](#1811) * **plugin-access-manager:** bump app to 3.1.0 and sync env vars ([b49b644](b49b644)) * **plugin-br-pix-indirect-btg:** chart can create the mTLS Secret from values (minimal interface) ([736ffe6](736ffe6)) * **plugin-br-pix-indirect-btg:** default mtls.secretName to <fullname>-mtls ([87b96ad](87b96ad)) ### Bug Fixes * **common:** address CodeRabbit review on legacy passthrough hardening ([fc68858](fc68858)) * **charts:** address review feedback on br-consignado-gw chart ([d5fcf9f](d5fcf9f)) * **charts:** align consignado chart directory with publish contract ([b0d4d12](b0d4d12)) * **pipe:** bump helm-upgrade-doc shared workflow to v1.50.1 ([33f0aaa](33f0aaa)) * **common:** coerce null SASL overrides + correct ParseBool comment ([9801c56](9801c56)) * **common:** datastore.value accepts explicit dedicated map for monolithic charts ([7d3a4b9](7d3a4b9)) * **pipe:** drop chart :latest OCI tagging and main->develop back-merge ([215a238](215a238)) * **common:** enforce the full SASL contract in streaming.env ([a368945](a368945)) * **plugin-access-manager:** guard replicas when autoscaling enabled ([ee6e8f1](ee6e8f1)) * **plugins:** guard replicas when autoscaling enabled ([d931d67](d931d67)) * **reporter:** guard replicas when autoscaling enabled ([d32c2f9](d32c2f9)) * **common:** harden streaming/multiTenant legacy configmap passthrough ([27d6eed](27d6eed)), closes [#1779](#1779) * **pipe:** map SLACK_CHANNEL from SLACK_CHANNEL_OPS via explicit secrets ([7125beb](7125beb)) * **common:** match strconv.ParseBool exactly for SASL TLS/plaintext booleans ([680b6cd](680b6cd)) * **common:** nil-only coercion for SASL mechanism (reject false/0, no auth downgrade) ([6adc674](6adc674)), closes [#1741](#1741) * **common:** normalize SASL mechanism in streaming.secret (ConfigMap parity) ([6940159](6940159)) * **common:** normalize SASL mechanism/bools before validating (lib-streaming parity) ([295a0cc](295a0cc)) * **common:** normalize serviceDiscovery .enabled to a strict bool ([e0a133b](e0a133b)) * **charts:** parameterize go-boilerplate-ddd bootstrap-postgres password ([491356f](491356f)) * **common:** pass through legacy SD tuning knobs without grouped param ([475a97a](475a97a)) * **charts:** percent-encode migrations DSN user and database ([3b59302](3b59302)) * **charts:** pin consignado chart to published beta.36 images ([5757b48](5757b48)) * **common:** presence-based resolution for MT tuning + ingress className ([3cbace2](3cbace2)) * **lerian-common:** preserve legacy configmap.SD_EXTERNAL_* without Ingress ([c77496a](c77496a)) * **plugin-br-pix-indirect-btg:** scope mTLS volume to cert keys + bound fsGroup (CodeRabbit) ([4d8e317](4d8e317)), closes [#1768](#1768) * **charts:** scope resource names to Helm release ([7115690](7115690)) * **common:** serviceDiscovery.env derives siblings from legacy configmap.SD_* without global ([a69ec3c](a69ec3c)) * **common:** serviceDiscovery.env emits full contract on SD_ENABLED alone ([0b32d5a](0b32d5a)) * **common:** serviceDiscovery.env uses hasKey precedence so explicit empty/false/0 configmap.SD_* win ([ba61e50](ba61e50)) * **common:** streaming.secret requires SASL username with the mechanism ([3e002ff](3e002ff)) * **common:** trim SASL username + %v mechanism format in streaming.secret ([ba20139](ba20139))

fix(common): serviceDiscovery.env derives siblings from legacy config…

a69ec3c

…map.SD_* without global

guimoreirar requested a review from a team as a code owner July 31, 2026 16:16

github-actions Bot added the common label Jul 31, 2026

coderabbitai Bot requested changes Jul 31, 2026

View reviewed changes

Comment thread charts/lerian-common/templates/_service_discovery.tpl

coderabbitai Bot requested changes Jul 31, 2026

View reviewed changes

Comment thread charts/lerian-common/values.yaml

fix(common): serviceDiscovery.env uses hasKey precedence so explicit …

ba61e50

…empty/false/0 configmap.SD_* win

coderabbitai Bot approved these changes Jul 31, 2026

View reviewed changes

guimoreirar merged commit 5c5569f into main Jul 31, 2026
5 checks passed

guimoreirar deleted the fix/lerian-common-sd-configmap-gate branch July 31, 2026 17:32

This was referenced Jul 31, 2026

fix(common): harden legacy configmap.* passthrough for productized env helpers (SD + streaming + MT) #1791

Merged

feat(midaz): productize chart on lerian-common library (full, no regression) #1741

Closed

coderabbitai Bot mentioned this pull request Jul 31, 2026

fix(common): SD_ENABLED-alone contract + presence-based MT tuning / ingress className #1794

Merged

Navigation Menu

Uh oh!

Uh oh!

fix(common): serviceDiscovery.env derives siblings from legacy configmap.SD_* without global - #1779

fix(common): serviceDiscovery.env derives siblings from legacy configmap.SD_* without global#1779
guimoreirar merged 3 commits into
mainfrom
fix/lerian-common-sd-configmap-gate

guimoreirar commented Jul 31, 2026

Uh oh!

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Uh oh!

Conversation

guimoreirar commented Jul 31, 2026

What

Why

Backward-compatibility (proven against midaz consumer)

Scope

Follow-up

Uh oh!

coderabbitai Bot commented Jul 31, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Walkthrough

Changes

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

coderabbitai Bot left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

coderabbitai Bot commented Jul 31, 2026 •

edited

Loading