fix(common): harden legacy configmap.* passthrough for productized env helpers (SD + streaming + MT)

charts/lerian-common/README.md

@@ -13,6 +13,14 @@ via `include` by the product charts that declare it as a dependency.
   each helper stays **inert until `global.*` is set** (backward-compatible);
   `serviceDiscovery.env` additionally activates from a legacy `configmap.SD_ADDRESS`,
   and a component `configmap.SD_*` value takes precedence over the `global.*` default.
+  The external endpoint (`SD_EXTERNAL_ADDRESS`/`SD_EXTERNAL_PORT`) is derived from
+  the Ingress host when present, **and** is preserved when supplied explicitly via
+  legacy `configmap.SD_EXTERNAL_*` even with no Ingress (on-prem) — honoring the
+  `configmap.SD_*` → `global.*` → default precedence in that case too. Advanced
+  tuning knobs with no grouped param (`SD_DIAL_TIMEOUT`, `SD_TLS_HANDSHAKE_TIMEOUT`,
+  `SD_RESPONSE_HEADER_TIMEOUT`, `SD_SEED_TIMEOUT`, `SD_WATCH_WAIT_TIME`,
+  `SD_ALLOW_STALE`) pass through from `configmap.SD_*` when set (emitted only when
+  present, so the block stays clean by default).
 - **Env contracts (flat-passthrough):** `lerian-common.serviceDiscovery.envFlat`,
   `lerian-common.otel.envFlat`, `lerian-common.multiTenant.envFlat` — reproduce a
   chart's EXISTING native env block **byte-for-byte** (same keys, defaults, quoting

charts/lerian-common/templates/_service_discovery.tpl

@@ -29,8 +29,13 @@ Inputs (dict):
   name        (req)  internal service DNS name (SD_INTERNAL_ADDRESS host)
   port        (req)  internal service port
   namespace   (req)  resolved namespace string
-  ingressHost (opt)  external host; when non-empty, emits SD_EXTERNAL_*
-                     (omit for consumer-only / internal-only instances)
+  ingressHost (opt)  external host; when non-empty, derives SD_EXTERNAL_*
+                     from it. The external endpoint is ALSO emitted (regardless
+                     of ingressHost) when the operator supplies it explicitly via
+                     legacy configmap.SD_EXTERNAL_ADDRESS / SD_EXTERNAL_PORT —
+                     the on-prem-without-Ingress case. Omitted only for
+                     consumer-only / internal-only instances (no ingressHost and
+                     no legacy SD_EXTERNAL_* keys).
   configmap   (opt)  the component's legacy `.configmap` map. When a key is
                      present here, its flat `configmap.SD_*` value WINS over the
                      global/derived value below (backward-compat for the flat
@@ -87,7 +92,7 @@ global.serviceDiscovery (all optional except address when enabled):
 {{- $internalAddr := (include "lerian-common.internalHost" (dict "name" .name "namespace" .namespace)) -}}{{- if hasKey $c "SD_INTERNAL_ADDRESS" -}}{{- $internalAddr = index $c "SD_INTERNAL_ADDRESS" -}}{{- end -}}
 {{- $internalPort := .port -}}{{- if hasKey $c "SD_INTERNAL_PORT" -}}{{- $internalPort = index $c "SD_INTERNAL_PORT" -}}{{- end -}}
 {{- $internalScheme := ($sd.internalScheme | default "http") -}}{{- if hasKey $c "SD_INTERNAL_SCHEME" -}}{{- $internalScheme = index $c "SD_INTERNAL_SCHEME" -}}{{- end -}}
-{{- $externalAddr := (printf "https://%s" .ingressHost) -}}{{- if hasKey $c "SD_EXTERNAL_ADDRESS" -}}{{- $externalAddr = index $c "SD_EXTERNAL_ADDRESS" -}}{{- end -}}
+{{- $externalAddr := "" -}}{{- if .ingressHost -}}{{- $externalAddr = (printf "https://%s" .ingressHost) -}}{{- end -}}{{- if hasKey $c "SD_EXTERNAL_ADDRESS" -}}{{- $externalAddr = index $c "SD_EXTERNAL_ADDRESS" -}}{{- end -}}
 {{- $externalPort := ($sd.externalPort | default 443) -}}{{- if hasKey $c "SD_EXTERNAL_PORT" -}}{{- $externalPort = index $c "SD_EXTERNAL_PORT" -}}{{- end -}}
 SD_ADDRESS: {{ $addr | quote }}
 SD_TLS: {{ $tls | quote }}
@@ -97,10 +102,22 @@ SD_PREFER_VIEW: {{ $preferView | quote }}
 SD_INTERNAL_ADDRESS: {{ $internalAddr | quote }}
 SD_INTERNAL_PORT: {{ $internalPort | quote }}
 SD_INTERNAL_SCHEME: {{ $internalScheme | quote }}
-{{- if .ingressHost }}
+{{- /* Emit the external endpoint when it can be derived from an Ingress host
+   OR when the operator supplied it explicitly via legacy configmap.SD_EXTERNAL_*
+   keys (on-prem without Ingress). Honors the configmap.SD_* -> global -> default
+   precedence contract; omitted only for internal-only / consumer-only instances. */ -}}
+{{- if or .ingressHost (hasKey $c "SD_EXTERNAL_ADDRESS") (hasKey $c "SD_EXTERNAL_PORT") }}
 SD_EXTERNAL_ADDRESS: {{ $externalAddr | quote }}
 SD_EXTERNAL_PORT: {{ $externalPort | quote }}
 {{- end }}
+{{- /* Advanced tuning knobs: no grouped param / no global default — pure legacy
+   configmap passthrough. Emitted only when the operator sets them (clean when
+   absent), preserving backward-compat with the flat configmap.SD_* API. */ -}}
+{{- range $tk := (list "SD_DIAL_TIMEOUT" "SD_TLS_HANDSHAKE_TIMEOUT" "SD_RESPONSE_HEADER_TIMEOUT" "SD_SEED_TIMEOUT" "SD_WATCH_WAIT_TIME" "SD_ALLOW_STALE") }}
+{{- if hasKey $c $tk }}
+{{ $tk }}: {{ index $c $tk | quote }}
+{{- end }}
+{{- end }}
 {{- end -}}
 {{- end -}}