Skip to content

fix(common): harden legacy configmap.* passthrough for productized env helpers (SD + streaming + MT) #1791

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
guimoreirar merged 5 commits into from
Jul 31, 2026
Merged

fix(common): harden legacy configmap.* passthrough for productized env helpers (SD + streaming + MT) #1791

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
5 commits
Select commit Hold shift + click to select a range
c77496a
fix(lerian-common): preserve legacy configmap.SD_EXTERNAL_* without I…
guimoreirar Jul 31, 2026
475a97a
fix(common): pass through legacy SD tuning knobs without grouped param
guimoreirar Jul 31, 2026
27d6eed
fix(common): harden streaming/multiTenant legacy configmap passthrough
guimoreirar Jul 31, 2026
7d3a4b9
fix(common): datastore.value accepts explicit dedicated map for monol…
guimoreirar Jul 31, 2026
fc68858
fix(common): address CodeRabbit review on legacy passthrough hardening
guimoreirar Jul 31, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions charts/lerian-common/README.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -13,6 +13,14 @@ via `include` by the product charts that declare it as a dependency.
each helper stays **inert until `global.*` is set** (backward-compatible);
`serviceDiscovery.env` additionally activates from a legacy `configmap.SD_ADDRESS`,
and a component `configmap.SD_*` value takes precedence over the `global.*` default.
The external endpoint (`SD_EXTERNAL_ADDRESS`/`SD_EXTERNAL_PORT`) is derived from
the Ingress host when present, **and** is preserved when supplied explicitly via
legacy `configmap.SD_EXTERNAL_*` even with no Ingress (on-prem) — honoring the
`configmap.SD_*` → `global.*` → default precedence in that case too. Advanced
tuning knobs with no grouped param (`SD_DIAL_TIMEOUT`, `SD_TLS_HANDSHAKE_TIMEOUT`,
`SD_RESPONSE_HEADER_TIMEOUT`, `SD_SEED_TIMEOUT`, `SD_WATCH_WAIT_TIME`,
`SD_ALLOW_STALE`) pass through from `configmap.SD_*` when set (emitted only when
present, so the block stays clean by default).
Comment thread
guimoreirar marked this conversation as resolved.
- **Env contracts (flat-passthrough):** `lerian-common.serviceDiscovery.envFlat`,
`lerian-common.otel.envFlat`, `lerian-common.multiTenant.envFlat` — reproduce a
chart's EXISTING native env block **byte-for-byte** (same keys, defaults, quoting
Expand Down
17 changes: 11 additions & 6 deletions charts/lerian-common/templates/_multi_tenant.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,29 +55,34 @@ Inputs (dict):
{{- $g := dict -}}
{{- with .context }}{{- $g = ((.Values.global | default dict).multiTenant | default dict) -}}{{- end -}}
{{- if .enabled -}}
{{- /* URL: universal. Component overrides global; then required or default "". */ -}}
{{- $url := index $c "MULTI_TENANT_URL" | default $g.url -}}
{{- /* URL: universal. Component overrides global; then required or default "".
Resolve by PRESENCE (hasKey) so an explicit configmap value survives even as a
YAML false / 0 / "" — sprig `default` would drop those to the global value. */ -}}
{{- $url := $g.url -}}{{- if hasKey $c "MULTI_TENANT_URL" -}}{{- $url = index $c "MULTI_TENANT_URL" -}}{{- end -}}
{{- if .requiredUrl }}
MULTI_TENANT_URL: {{ required "lerian-common: MULTI_TENANT_URL is required when MULTI_TENANT_ENABLED=true (set component configmap.MULTI_TENANT_URL or global.multiTenant.url)" $url | quote }}
{{- else }}
MULTI_TENANT_URL: {{ $url | default "" | quote }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
Outdated
{{- end }}
{{- if .serviceName }}
MULTI_TENANT_SERVICE_NAME: {{ index $c "MULTI_TENANT_SERVICE_NAME" | default .serviceName | quote }}
{{- $svcName := .serviceName -}}{{- if hasKey $c "MULTI_TENANT_SERVICE_NAME" -}}{{- $svcName = index $c "MULTI_TENANT_SERVICE_NAME" -}}{{- end }}
MULTI_TENANT_SERVICE_NAME: {{ $svcName | quote }}
{{- end }}
{{- if not (and (hasKey . "circuitBreaker") (eq .circuitBreaker false)) }}
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ index $c "MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD" | default "5" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ index $c "MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC" | default "30" | quote }}
{{- end }}
{{- if .emitRedis }}
{{- $redisHost := index $c "MULTI_TENANT_REDIS_HOST" | default $g.redisHost -}}
{{- $redisHost := $g.redisHost -}}{{- if hasKey $c "MULTI_TENANT_REDIS_HOST" -}}{{- $redisHost = index $c "MULTI_TENANT_REDIS_HOST" -}}{{- end -}}
{{- if .requiredRedisHost }}
MULTI_TENANT_REDIS_HOST: {{ required "lerian-common: MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true (set component configmap.MULTI_TENANT_REDIS_HOST or global.multiTenant.redisHost)" $redisHost | quote }}
{{- else }}
MULTI_TENANT_REDIS_HOST: {{ $redisHost | default "" | quote }}
{{- end }}
MULTI_TENANT_REDIS_PORT: {{ index $c "MULTI_TENANT_REDIS_PORT" | default $g.redisPort | default "6379" | quote }}
MULTI_TENANT_REDIS_TLS: {{ index $c "MULTI_TENANT_REDIS_TLS" | default $g.redisTls | default (.redisTlsDefault | default "false") | quote }}
{{- $redisPort := ($g.redisPort | default "6379") -}}{{- if hasKey $c "MULTI_TENANT_REDIS_PORT" -}}{{- $redisPort = index $c "MULTI_TENANT_REDIS_PORT" -}}{{- end }}
MULTI_TENANT_REDIS_PORT: {{ $redisPort | quote }}
{{- $redisTls := ($g.redisTls | default (.redisTlsDefault | default "false")) -}}{{- if hasKey $c "MULTI_TENANT_REDIS_TLS" -}}{{- $redisTls = index $c "MULTI_TENANT_REDIS_TLS" -}}{{- end }}
MULTI_TENANT_REDIS_TLS: {{ $redisTls | quote }}
{{- end }}
{{- if .emitPool }}
MULTI_TENANT_MAX_TENANT_POOLS: {{ index $c "MULTI_TENANT_MAX_TENANT_POOLS" | default "100" | quote }}
Expand Down
25 changes: 21 additions & 4 deletions charts/lerian-common/templates/_service_discovery.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -29,8 +29,13 @@ Inputs (dict):
name (req) internal service DNS name (SD_INTERNAL_ADDRESS host)
port (req) internal service port
namespace (req) resolved namespace string
ingressHost (opt) external host; when non-empty, emits SD_EXTERNAL_*
(omit for consumer-only / internal-only instances)
ingressHost (opt) external host; when non-empty, derives SD_EXTERNAL_*
from it. The external endpoint is ALSO emitted (regardless
of ingressHost) when the operator supplies it explicitly via
legacy configmap.SD_EXTERNAL_ADDRESS / SD_EXTERNAL_PORT —
the on-prem-without-Ingress case. Omitted only for
consumer-only / internal-only instances (no ingressHost and
no legacy SD_EXTERNAL_* keys).
configmap (opt) the component's legacy `.configmap` map. When a key is
present here, its flat `configmap.SD_*` value WINS over the
global/derived value below (backward-compat for the flat
Expand Down Expand Up @@ -87,7 +92,7 @@ global.serviceDiscovery (all optional except address when enabled):
{{- $internalAddr := (include "lerian-common.internalHost" (dict "name" .name "namespace" .namespace)) -}}{{- if hasKey $c "SD_INTERNAL_ADDRESS" -}}{{- $internalAddr = index $c "SD_INTERNAL_ADDRESS" -}}{{- end -}}
{{- $internalPort := .port -}}{{- if hasKey $c "SD_INTERNAL_PORT" -}}{{- $internalPort = index $c "SD_INTERNAL_PORT" -}}{{- end -}}
{{- $internalScheme := ($sd.internalScheme | default "http") -}}{{- if hasKey $c "SD_INTERNAL_SCHEME" -}}{{- $internalScheme = index $c "SD_INTERNAL_SCHEME" -}}{{- end -}}
{{- $externalAddr := (printf "https://%s" .ingressHost) -}}{{- if hasKey $c "SD_EXTERNAL_ADDRESS" -}}{{- $externalAddr = index $c "SD_EXTERNAL_ADDRESS" -}}{{- end -}}
{{- $externalAddr := "" -}}{{- if .ingressHost -}}{{- $externalAddr = (printf "https://%s" .ingressHost) -}}{{- end -}}{{- if hasKey $c "SD_EXTERNAL_ADDRESS" -}}{{- $externalAddr = index $c "SD_EXTERNAL_ADDRESS" -}}{{- end -}}
{{- $externalPort := ($sd.externalPort | default 443) -}}{{- if hasKey $c "SD_EXTERNAL_PORT" -}}{{- $externalPort = index $c "SD_EXTERNAL_PORT" -}}{{- end -}}
SD_ADDRESS: {{ $addr | quote }}
SD_TLS: {{ $tls | quote }}
Expand All @@ -97,10 +102,22 @@ SD_PREFER_VIEW: {{ $preferView | quote }}
SD_INTERNAL_ADDRESS: {{ $internalAddr | quote }}
SD_INTERNAL_PORT: {{ $internalPort | quote }}
SD_INTERNAL_SCHEME: {{ $internalScheme | quote }}
{{- if .ingressHost }}
{{- /* Emit the external endpoint when it can be derived from an Ingress host
OR when the operator supplied it explicitly via legacy configmap.SD_EXTERNAL_*
keys (on-prem without Ingress). Honors the configmap.SD_* -> global -> default
precedence contract; omitted only for internal-only / consumer-only instances. */ -}}
{{- if or .ingressHost (hasKey $c "SD_EXTERNAL_ADDRESS") (hasKey $c "SD_EXTERNAL_PORT") }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
SD_EXTERNAL_ADDRESS: {{ $externalAddr | quote }}
SD_EXTERNAL_PORT: {{ $externalPort | quote }}
{{- end }}
{{- /* Advanced tuning knobs: no grouped param / no global default — pure legacy
configmap passthrough. Emitted only when the operator sets them (clean when
absent), preserving backward-compat with the flat configmap.SD_* API. */ -}}
{{- range $tk := (list "SD_DIAL_TIMEOUT" "SD_TLS_HANDSHAKE_TIMEOUT" "SD_RESPONSE_HEADER_TIMEOUT" "SD_SEED_TIMEOUT" "SD_WATCH_WAIT_TIME" "SD_ALLOW_STALE") }}
{{- if hasKey $c $tk }}
{{ $tk }}: {{ index $c $tk | quote }}
{{- end }}
{{- end }}
{{- end -}}
{{- end -}}

Expand Down
40 changes: 28 additions & 12 deletions charts/lerian-common/templates/_streaming.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,21 +49,37 @@ global.streaming (all optional except brokers, which gates emission):
over the global value (mirrors multiTenant.env / serviceDiscovery.env). Empty
dict when omitted. */ -}}
{{- $c := .configmap | default dict -}}
{{- if and .enabled $s.brokers -}}
STREAMING_BROKERS: {{ index $c "STREAMING_BROKERS" | default $s.brokers | quote }}
STREAMING_TLS_ENABLED: {{ index $c "STREAMING_TLS_ENABLED" | default ($s.tlsEnabled | default false) | quote }}
STREAMING_SASL_MECHANISM: {{ index $c "STREAMING_SASL_MECHANISM" | default ($s.saslMechanism | default "") | quote }}
STREAMING_SASL_USERNAME: {{ index $c "STREAMING_SASL_USERNAME" | default ($s.saslUsername | default "") | quote }}
STREAMING_SASL_ALLOW_PLAINTEXT: {{ index $c "STREAMING_SASL_ALLOW_PLAINTEXT" | default ($s.saslAllowPlaintext | default "false") | quote }}
STREAMING_COMPRESSION: {{ index $c "STREAMING_COMPRESSION" | default ($s.compression | default "lz4") | quote }}
STREAMING_REQUIRED_ACKS: {{ index $c "STREAMING_REQUIRED_ACKS" | default ($s.requiredAcks | default "all") | quote }}
STREAMING_BATCH_LINGER_MS: {{ index $c "STREAMING_BATCH_LINGER_MS" | default ($s.batchLingerMs | default "5") | quote }}
STREAMING_IMPORTANT_EMIT_TIMEOUT_MS: {{ index $c "STREAMING_IMPORTANT_EMIT_TIMEOUT_MS" | default ($s.importantEmitTimeoutMs | default "5000") | quote }}
{{- /* Activate when enabled AND brokers are configured — via EITHER the env-wide
global.streaming.brokers OR a legacy flat configmap.STREAMING_BROKERS (mirrors
serviceDiscovery.env). Each key resolves by PRESENCE (hasKey) so an explicit
configmap value survives even when it is a YAML false / 0 / "" — sprig `default`
would treat those as empty and wrongly fall back to the global/derived value. */ -}}
{{- if and .enabled (or $s.brokers (hasKey $c "STREAMING_BROKERS")) -}}
{{- $brokers := $s.brokers -}}{{- if hasKey $c "STREAMING_BROKERS" -}}{{- $brokers = index $c "STREAMING_BROKERS" -}}{{- end -}}
{{- $tlsEnabled := ($s.tlsEnabled | default false) -}}{{- if hasKey $c "STREAMING_TLS_ENABLED" -}}{{- $tlsEnabled = index $c "STREAMING_TLS_ENABLED" -}}{{- end -}}
{{- $saslMechanism := ($s.saslMechanism | default "") -}}{{- if hasKey $c "STREAMING_SASL_MECHANISM" -}}{{- $saslMechanism = index $c "STREAMING_SASL_MECHANISM" -}}{{- end -}}
Comment thread
guimoreirar marked this conversation as resolved.
{{- $saslUsername := ($s.saslUsername | default "") -}}{{- if hasKey $c "STREAMING_SASL_USERNAME" -}}{{- $saslUsername = index $c "STREAMING_SASL_USERNAME" -}}{{- end -}}
{{- $saslAllowPlaintext := ($s.saslAllowPlaintext | default "false") -}}{{- if hasKey $c "STREAMING_SASL_ALLOW_PLAINTEXT" -}}{{- $saslAllowPlaintext = index $c "STREAMING_SASL_ALLOW_PLAINTEXT" -}}{{- end -}}
{{- $compression := ($s.compression | default "lz4") -}}{{- if hasKey $c "STREAMING_COMPRESSION" -}}{{- $compression = index $c "STREAMING_COMPRESSION" -}}{{- end -}}
{{- $requiredAcks := ($s.requiredAcks | default "all") -}}{{- if hasKey $c "STREAMING_REQUIRED_ACKS" -}}{{- $requiredAcks = index $c "STREAMING_REQUIRED_ACKS" -}}{{- end -}}
{{- $batchLingerMs := ($s.batchLingerMs | default "5") -}}{{- if hasKey $c "STREAMING_BATCH_LINGER_MS" -}}{{- $batchLingerMs = index $c "STREAMING_BATCH_LINGER_MS" -}}{{- end -}}
{{- $importantEmitTimeoutMs := ($s.importantEmitTimeoutMs | default "5000") -}}{{- if hasKey $c "STREAMING_IMPORTANT_EMIT_TIMEOUT_MS" -}}{{- $importantEmitTimeoutMs = index $c "STREAMING_IMPORTANT_EMIT_TIMEOUT_MS" -}}{{- end -}}
STREAMING_BROKERS: {{ $brokers | quote }}
STREAMING_TLS_ENABLED: {{ $tlsEnabled | quote }}
STREAMING_SASL_MECHANISM: {{ $saslMechanism | quote }}
STREAMING_SASL_USERNAME: {{ $saslUsername | quote }}
STREAMING_SASL_ALLOW_PLAINTEXT: {{ $saslAllowPlaintext | quote }}
STREAMING_COMPRESSION: {{ $compression | quote }}
STREAMING_REQUIRED_ACKS: {{ $requiredAcks | quote }}
STREAMING_BATCH_LINGER_MS: {{ $batchLingerMs | quote }}
STREAMING_IMPORTANT_EMIT_TIMEOUT_MS: {{ $importantEmitTimeoutMs | quote }}
{{- if hasKey . "clientId" }}
STREAMING_CLIENT_ID: {{ index $c "STREAMING_CLIENT_ID" | default .clientId | quote }}
{{- $clientId := .clientId -}}{{- if hasKey $c "STREAMING_CLIENT_ID" -}}{{- $clientId = index $c "STREAMING_CLIENT_ID" -}}{{- end }}
STREAMING_CLIENT_ID: {{ $clientId | quote }}
{{- end }}
{{- if hasKey . "cloudeventsSource" }}
STREAMING_CLOUDEVENTS_SOURCE: {{ index $c "STREAMING_CLOUDEVENTS_SOURCE" | default .cloudeventsSource | quote }}
{{- $cloudeventsSource := .cloudeventsSource -}}{{- if hasKey $c "STREAMING_CLOUDEVENTS_SOURCE" -}}{{- $cloudeventsSource = index $c "STREAMING_CLOUDEVENTS_SOURCE" -}}{{- end }}
STREAMING_CLOUDEVENTS_SOURCE: {{ $cloudeventsSource | quote }}
{{- end }}
{{- end -}}
{{- end -}}
Expand Down
Loading