Skip to content

feat(midaz): add unified ledger config (CRM/Fees/KMS/tracer) and tracer templates #1838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fredcamaral merged 9 commits into from
Aug 7, 2026
Merged

feat(midaz): add unified ledger config (CRM/Fees/KMS/tracer) and tracer templates #1838

Show file tree
Hide file tree
Changes from 4 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
bed01b2
feat(midaz): pass CRM, Fees, KMS and tracer config to the ledger
fredcamaral Aug 6, 2026
cb93090
feat(midaz): add tracer templates to the umbrella chart
fredcamaral Aug 6, 2026
25a3d76
fix(midaz): address review findings on unified ledger and tracer config
fredcamaral Aug 6, 2026
0c3d853
fix(midaz): wait for CRM/Fees Mongo in init container and honor expli…
fredcamaral Aug 6, 2026
d722d48
fix(midaz): make the chart able to actually run midaz v4 tracer and l…
fredcamaral Aug 6, 2026
368e90c
fix(midaz): gate v4 Deployments on migrations, track tracer DB name, …
fredcamaral Aug 6, 2026
cd62b43
docs(midaz): note the manual tracer database uses the configured DB_NAME
fredcamaral Aug 6, 2026
5a56a60
fix(midaz): resolve tracer db host per release, fix transport seam, h…
fredcamaral Aug 6, 2026
aa8e181
docs(midaz): state the public-image invariant instead of a pull-secre…
fredcamaral Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions charts/midaz/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,51 @@ app.kubernetes.io/name: {{ include "midaz.name" .context }}-{{ .name }}
app.kubernetes.io/instance: {{ .context.Release.Name }}
{{- end }}

{{/*
Create a default fully qualified app name for Tracer.
*/}}
{{- define "midaz-tracer.fullname" -}}
{{- if .Values.tracer.fullnameOverride }}
{{- .Values.tracer.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" (include "midaz.name" .) (default .Values.tracer.name .Values.tracer.nameOverride) | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.

{{/*
Create Tracer app version
*/}}
{{- define "tracer.defaultTag" -}}
{{- default .Chart.AppVersion .Values.tracer.image.tag }}
{{- end -}}

{{/*
Return valid Tracer version label
*/}}
{{- define "tracer.versionLabelValue" -}}
{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "tracer.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }}
{{- end -}}

{{/*
Tracer Common labels
*/}}
{{- define "midaz-tracer.labels" -}}
helm.sh/chart: {{ include "midaz.chart" .context }}
{{ include "midaz-tracer.selectorLabels" (dict "context" .context "name" .name) }}
app.kubernetes.io/version: {{ include "tracer.versionLabelValue" .context }}
app.kubernetes.io/managed-by: {{ .context.Release.Service }}
{{- end }}

{{/*
Tracer Selector labels
*/}}
{{- define "midaz-tracer.selectorLabels" -}}
{{- if .name -}}
app.kubernetes.io/name: {{ include "midaz.name" .context }}-{{ .name }}
{{- end }}
app.kubernetes.io/instance: {{ .context.Release.Name }}
{{- end }}

{{/*
Enable internal dependencies
*/}}
Expand Down
81 changes: 81 additions & 0 deletions charts/midaz/templates/ledger/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ data:
MULTI_TENANT_SERVICE_NAME: {{ .Values.ledger.configmap.MULTI_TENANT_SERVICE_NAME | default "ledger" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ .Values.ledger.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.ledger.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }}
MULTI_TENANT_CACHE_TTL_SEC: {{ .Values.ledger.configmap.MULTI_TENANT_CACHE_TTL_SEC | default "120" | quote }}
MULTI_TENANT_REDIS_HOST: {{ required "ledger.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" .Values.ledger.configmap.MULTI_TENANT_REDIS_HOST | quote }}
MULTI_TENANT_REDIS_PORT: {{ .Values.ledger.configmap.MULTI_TENANT_REDIS_PORT | default "6379" | quote }}
MULTI_TENANT_REDIS_TLS: {{ .Values.ledger.configmap.MULTI_TENANT_REDIS_TLS | default "false" | quote }}
Expand Down Expand Up @@ -128,6 +129,66 @@ data:
MONGO_TRANSACTION_PARAMETERS: {{ .Values.ledger.configmap.MONGO_TRANSACTION_PARAMETERS | default "" | quote }}
MONGO_TRANSACTION_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_TRANSACTION_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# MONGO DB - CRM MODULE (folded into the unified ledger binary)
# =============================================================================
MONGO_CRM_URI: {{ .Values.ledger.configmap.MONGO_CRM_URI | default "mongodb" | quote }}
MONGO_CRM_HOST: {{ .Values.ledger.configmap.MONGO_CRM_HOST | default "midaz-mongodb" | quote }}
MONGO_CRM_NAME: {{ .Values.ledger.configmap.MONGO_CRM_NAME | default "crm" | quote }}
MONGO_CRM_USER: {{ .Values.ledger.configmap.MONGO_CRM_USER | default "midaz" | quote }}
MONGO_CRM_PORT: {{ .Values.ledger.configmap.MONGO_CRM_PORT | default "27017" | quote }}
# MONGO_CRM_PASSWORD lives in the ledger Secret (see templates/ledger/secrets.yaml)
MONGO_CRM_MAX_POOL_SIZE: {{ .Values.ledger.configmap.MONGO_CRM_MAX_POOL_SIZE | default "1000" | quote }}
MONGO_CRM_PARAMETERS: {{ .Values.ledger.configmap.MONGO_CRM_PARAMETERS | default "" | quote }}
MONGO_CRM_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_CRM_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# MONGO DB - FEES MODULE (folded into the unified ledger binary)
# =============================================================================
MONGO_FEES_URI: {{ .Values.ledger.configmap.MONGO_FEES_URI | default "mongodb" | quote }}
MONGO_FEES_HOST: {{ .Values.ledger.configmap.MONGO_FEES_HOST | default "midaz-mongodb" | quote }}
MONGO_FEES_NAME: {{ .Values.ledger.configmap.MONGO_FEES_NAME | default "fees" | quote }}
MONGO_FEES_USER: {{ .Values.ledger.configmap.MONGO_FEES_USER | default "midaz" | quote }}
MONGO_FEES_PORT: {{ .Values.ledger.configmap.MONGO_FEES_PORT | default "27017" | quote }}
# MONGO_FEES_PASSWORD lives in the ledger Secret (see templates/ledger/secrets.yaml)
MONGO_FEES_MAX_POOL_SIZE: {{ .Values.ledger.configmap.MONGO_FEES_MAX_POOL_SIZE | default "100" | quote }}
MONGO_FEES_PARAMETERS: {{ .Values.ledger.configmap.MONGO_FEES_PARAMETERS | default "" | quote }}
MONGO_FEES_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_FEES_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# LCRYPTO — key material lives in the ledger Secret, never here.
# LCRYPTO_HASH_SECRET_KEY and LCRYPTO_ENCRYPT_SECRET_KEY protect CRM holder
# fields (PII); see templates/ledger/secrets.yaml.
# =============================================================================

# =============================================================================
# KMS (encryption vendor selector; see midaz pkg/crypto/resolver.go)
# KMS_VAULT_SECRET_ID is the AppRole credential and lives in the Secret.
# =============================================================================
KMS_VENDOR: {{ .Values.ledger.configmap.KMS_VENDOR | default "none" | quote }}
# Vault fields required only when KMS_VENDOR=hashicorp-vault (envelope encryption)
{{- if eq (.Values.ledger.configmap.KMS_VENDOR | default "none") "hashicorp-vault" }}
KMS_VAULT_ADDR: {{ required "ledger.configmap.KMS_VAULT_ADDR is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_ADDR | quote }}
KMS_VAULT_ROLE_ID: {{ required "ledger.configmap.KMS_VAULT_ROLE_ID is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_ROLE_ID | quote }}
KMS_VAULT_AUTH_METHOD: {{ required "ledger.configmap.KMS_VAULT_AUTH_METHOD is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_AUTH_METHOD | quote }}
{{- else }}
KMS_VAULT_ADDR: {{ .Values.ledger.configmap.KMS_VAULT_ADDR | default "" | quote }}
KMS_VAULT_ROLE_ID: {{ .Values.ledger.configmap.KMS_VAULT_ROLE_ID | default "" | quote }}
KMS_VAULT_AUTH_METHOD: {{ .Values.ledger.configmap.KMS_VAULT_AUTH_METHOD | default "" | quote }}
{{- end }}

# =============================================================================
# TRACER RESERVATION SEAM (ledger -> tracer client side)
# TRACER_BASE_URL empty disables the integration (nil reserver).
# =============================================================================
TRACER_BASE_URL: {{ .Values.ledger.configmap.TRACER_BASE_URL | default "" | quote }}
TRACER_TRANSPORT: {{ .Values.ledger.configmap.TRACER_TRANSPORT | default "grpc" | quote }}

@gandalf-at-lerian gandalf-at-lerian Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Do not default this integration to a transport that the bundled Tracer does not expose. With tracer.enabled=true and TRACER_BASE_URL set, the rendered Ledger selects grpc, but the Tracer ConfigMap does not set TRACER_GRPC_PORT (v4 treats empty as gRPC disabled) and its Service exposes only HTTP 4020. The in-chart Ledger→Tracer path therefore cannot connect with the documented defaults. Either configure/expose the Tracer gRPC port end-to-end, or default this seam to rest while only the HTTP port is available.

TRACER_TLS_MODE: {{ .Values.ledger.configmap.TRACER_TLS_MODE | default "" | quote }}
TRACER_TIMEOUT_MS: {{ .Values.ledger.configmap.TRACER_TIMEOUT_MS | default "" | quote }}
TRACER_TLS_CERT_FILE: {{ .Values.ledger.configmap.TRACER_TLS_CERT_FILE | default "" | quote }}
TRACER_TLS_KEY_FILE: {{ .Values.ledger.configmap.TRACER_TLS_KEY_FILE | default "" | quote }}
TRACER_TLS_CA_FILE: {{ .Values.ledger.configmap.TRACER_TLS_CA_FILE | default "" | quote }}

# =============================================================================
# REDIS (shared between modules)
# =============================================================================
Expand Down Expand Up @@ -268,6 +329,26 @@ data:
SD_WATCH_WAIT_TIME: {{ .Values.ledger.configmap.SD_WATCH_WAIT_TIME | default "" | quote }}
SD_WORKLOAD: {{ .Values.ledger.configmap.SD_WORKLOAD | default "" | quote }}
STREAMING_ENABLED: {{ .Values.ledger.configmap.STREAMING_ENABLED | default "false" | quote }}

# =============================================================================
# STREAMING (lib-streaming producer; disabled by default)
# =============================================================================
STREAMING_BROKERS: {{ .Values.ledger.configmap.STREAMING_BROKERS | default "" | quote }}
STREAMING_CLIENT_ID: {{ .Values.ledger.configmap.STREAMING_CLIENT_ID | default "" | quote }}
STREAMING_CLOUDEVENTS_SOURCE: {{ .Values.ledger.configmap.STREAMING_CLOUDEVENTS_SOURCE | default "" | quote }}
STREAMING_COMPRESSION: {{ .Values.ledger.configmap.STREAMING_COMPRESSION | default "" | quote }}
STREAMING_REQUIRED_ACKS: {{ .Values.ledger.configmap.STREAMING_REQUIRED_ACKS | default "" | quote }}
STREAMING_BATCH_LINGER_MS: {{ .Values.ledger.configmap.STREAMING_BATCH_LINGER_MS | default "" | quote }}

# =============================================================================
# FEE ENGINE
# =============================================================================
DEFAULT_CURRENCY: {{ .Values.ledger.configmap.DEFAULT_CURRENCY | default "USD" | quote }}

# =============================================================================
# CASDOOR
# =============================================================================
CASDOOR_JWK_ADDRESS: {{ .Values.ledger.configmap.CASDOOR_JWK_ADDRESS | default "" | quote }}
SWAGGER_VERSION: {{ .Values.ledger.configmap.SWAGGER_VERSION | default "${VERSION}" | quote }}
# Extra Env Vars
{{- with .Values.ledger.extraEnvVars }}
Expand Down
20 changes: 19 additions & 1 deletion charts/midaz/templates/ledger/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,8 +49,10 @@ spec:
TIMEOUT={{ dig "initContainer" "timeoutSeconds" 300 .Values.ledger }};
MONGO_ONBOARDING_PORT_CLEAN=$(echo "$MONGO_ONBOARDING_PORT" | sed 's/[^0-9].*//');
MONGO_TRANSACTION_PORT_CLEAN=$(echo "$MONGO_TRANSACTION_PORT" | sed 's/[^0-9].*//');
MONGO_CRM_PORT_CLEAN=$(echo "$MONGO_CRM_PORT" | sed 's/[^0-9].*//');
MONGO_FEES_PORT_CLEAN=$(echo "$MONGO_FEES_PORT" | sed 's/[^0-9].*//');
RABBITMQ_PORT_HOST_CLEAN=$(echo "$RABBITMQ_PORT_HOST" | sed 's/[^0-9].*//');
for svc in "$DB_ONBOARDING_HOST:$DB_ONBOARDING_PORT" "$DB_ONBOARDING_REPLICA_HOST:$DB_ONBOARDING_REPLICA_PORT" "$DB_TRANSACTION_HOST:$DB_TRANSACTION_PORT" "$DB_TRANSACTION_REPLICA_HOST:$DB_TRANSACTION_REPLICA_PORT" "$RABBITMQ_HOST:$RABBITMQ_PORT_HOST_CLEAN" "$MONGO_ONBOARDING_HOST:$MONGO_ONBOARDING_PORT_CLEAN" "$MONGO_TRANSACTION_HOST:$MONGO_TRANSACTION_PORT_CLEAN";
for svc in "$DB_ONBOARDING_HOST:$DB_ONBOARDING_PORT" "$DB_ONBOARDING_REPLICA_HOST:$DB_ONBOARDING_REPLICA_PORT" "$DB_TRANSACTION_HOST:$DB_TRANSACTION_PORT" "$DB_TRANSACTION_REPLICA_HOST:$DB_TRANSACTION_REPLICA_PORT" "$RABBITMQ_HOST:$RABBITMQ_PORT_HOST_CLEAN" "$MONGO_ONBOARDING_HOST:$MONGO_ONBOARDING_PORT_CLEAN" "$MONGO_TRANSACTION_HOST:$MONGO_TRANSACTION_PORT_CLEAN" "$MONGO_CRM_HOST:$MONGO_CRM_PORT_CLEAN" "$MONGO_FEES_HOST:$MONGO_FEES_PORT_CLEAN";
do
echo "Checking $svc...";
ELAPSED=0;
Expand Down Expand Up @@ -124,6 +126,8 @@ spec:
{{- if or (and (ne (toString $mongo.enabled) "false") (not $mongo.external)) $mongoAuth.existingSecret }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_ONBOARDING_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_TRANSACTION_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_CRM_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_FEES_PASSWORD") | nindent 12 }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{{- else }}
{{- if .Values.ledger.secrets.MONGO_ONBOARDING_PASSWORD }}
- name: MONGO_ONBOARDING_PASSWORD
Expand All @@ -139,6 +143,20 @@ spec:
name: {{ $secretName }}
key: MONGO_TRANSACTION_PASSWORD
{{- end }}
{{- if .Values.ledger.secrets.MONGO_CRM_PASSWORD }}
- name: MONGO_CRM_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $secretName }}
key: MONGO_CRM_PASSWORD
{{- end }}
{{- if .Values.ledger.secrets.MONGO_FEES_PASSWORD }}
- name: MONGO_FEES_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $secretName }}
key: MONGO_FEES_PASSWORD
{{- end }}
{{- end }}
{{/* Valkey: REDIS_PASSWORD maps to Bitnami key `valkey-password`. */}}
{{- $vk := .Values.valkey | default dict }}
Expand Down
25 changes: 25 additions & 0 deletions charts/midaz/templates/ledger/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,35 @@ data:
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_TRANSACTION_PASSWORD }}
MONGO_TRANSACTION_PASSWORD: {{ .Values.ledger.secrets.MONGO_TRANSACTION_PASSWORD | b64enc | quote }}
{{- end }}
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_CRM_PASSWORD }}
MONGO_CRM_PASSWORD: {{ .Values.ledger.secrets.MONGO_CRM_PASSWORD | b64enc | quote }}
{{- end }}
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_FEES_PASSWORD }}
MONGO_FEES_PASSWORD: {{ .Values.ledger.secrets.MONGO_FEES_PASSWORD | b64enc | quote }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{{- end }}
{{- if and (not $vkInternal) .Values.ledger.secrets.REDIS_PASSWORD }}
REDIS_PASSWORD: {{ .Values.ledger.secrets.REDIS_PASSWORD | b64enc | quote }}
{{- end }}

# =============================================================================
# LCRYPTO (application-level hash/encrypt keys protecting CRM holder PII)
# =============================================================================
{{- if .Values.ledger.secrets.LCRYPTO_HASH_SECRET_KEY }}
LCRYPTO_HASH_SECRET_KEY: {{ .Values.ledger.secrets.LCRYPTO_HASH_SECRET_KEY | b64enc | quote }}
{{- end }}
{{- if .Values.ledger.secrets.LCRYPTO_ENCRYPT_SECRET_KEY }}
LCRYPTO_ENCRYPT_SECRET_KEY: {{ .Values.ledger.secrets.LCRYPTO_ENCRYPT_SECRET_KEY | b64enc | quote }}
{{- end }}

# =============================================================================
# KMS (Vault AppRole credential; only when KMS_VENDOR=hashicorp-vault)
# =============================================================================
{{- if eq (.Values.ledger.configmap.KMS_VENDOR | default "none") "hashicorp-vault" }}
KMS_VAULT_SECRET_ID: {{ required "ledger.secrets.KMS_VAULT_SECRET_ID is required when KMS_VENDOR=hashicorp-vault (or use ledger.useExistingSecret)" .Values.ledger.secrets.KMS_VAULT_SECRET_ID | b64enc | quote }}
{{- else if .Values.ledger.secrets.KMS_VAULT_SECRET_ID }}
KMS_VAULT_SECRET_ID: {{ .Values.ledger.secrets.KMS_VAULT_SECRET_ID | b64enc | quote }}
{{- end }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# =============================================================================
# SHARED SECRETS (RabbitMQ — operator-provided, see README "Known limitation")
# =============================================================================
Expand Down
Loading
Loading