Skip to content

feat(midaz): add unified ledger config (CRM/Fees/KMS/tracer) and tracer templates #1838

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
fredcamaral merged 9 commits into from
Aug 7, 2026
Merged

feat(midaz): add unified ledger config (CRM/Fees/KMS/tracer) and tracer templates #1838

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
9 commits
Select commit Hold shift + click to select a range
bed01b2
feat(midaz): pass CRM, Fees, KMS and tracer config to the ledger
fredcamaral Aug 6, 2026
cb93090
feat(midaz): add tracer templates to the umbrella chart
fredcamaral Aug 6, 2026
25a3d76
fix(midaz): address review findings on unified ledger and tracer config
fredcamaral Aug 6, 2026
0c3d853
fix(midaz): wait for CRM/Fees Mongo in init container and honor expli…
fredcamaral Aug 6, 2026
d722d48
fix(midaz): make the chart able to actually run midaz v4 tracer and l…
fredcamaral Aug 6, 2026
368e90c
fix(midaz): gate v4 Deployments on migrations, track tracer DB name, …
fredcamaral Aug 6, 2026
cd62b43
docs(midaz): note the manual tracer database uses the configured DB_NAME
fredcamaral Aug 6, 2026
5a56a60
fix(midaz): resolve tracer db host per release, fix transport seam, h…
fredcamaral Aug 6, 2026
aa8e181
docs(midaz): state the public-image invariant instead of a pull-secre…
fredcamaral Aug 6, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
45 changes: 45 additions & 0 deletions charts/midaz/templates/_helpers.tpl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -166,6 +166,51 @@ app.kubernetes.io/name: {{ include "midaz.name" .context }}-{{ .name }}
app.kubernetes.io/instance: {{ .context.Release.Name }}
{{- end }}

{{/*
Create a default fully qualified app name for Tracer.
*/}}
{{- define "midaz-tracer.fullname" -}}
{{- if .Values.tracer.fullnameOverride }}
{{- .Values.tracer.fullnameOverride | trunc 63 | trimSuffix "-" }}
{{- else }}
{{- printf "%s-%s" (include "midaz.name" .) (default .Values.tracer.name .Values.tracer.nameOverride) | trunc 63 | trimSuffix "-" }}
{{- end }}
{{- end }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.

{{/*
Create Tracer app version
*/}}
{{- define "tracer.defaultTag" -}}
{{- default .Chart.AppVersion .Values.tracer.image.tag }}
{{- end -}}

{{/*
Return valid Tracer version label
*/}}
{{- define "tracer.versionLabelValue" -}}
{{ regexReplaceAll "[^-A-Za-z0-9_.]" (include "tracer.defaultTag" .) "-" | trunc 63 | trimAll "-" | trimAll "_" | trimAll "." | quote }}
{{- end -}}

{{/*
Tracer Common labels
*/}}
{{- define "midaz-tracer.labels" -}}
helm.sh/chart: {{ include "midaz.chart" .context }}
{{ include "midaz-tracer.selectorLabels" (dict "context" .context "name" .name) }}
app.kubernetes.io/version: {{ include "tracer.versionLabelValue" .context }}
app.kubernetes.io/managed-by: {{ .context.Release.Service }}
{{- end }}

{{/*
Tracer Selector labels
*/}}
{{- define "midaz-tracer.selectorLabels" -}}
{{- if .name -}}
app.kubernetes.io/name: {{ include "midaz.name" .context }}-{{ .name }}
{{- end }}
app.kubernetes.io/instance: {{ .context.Release.Name }}
{{- end }}

{{/*
Enable internal dependencies
*/}}
Expand Down
81 changes: 81 additions & 0 deletions charts/midaz/templates/ledger/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -55,6 +55,7 @@ data:
MULTI_TENANT_SERVICE_NAME: {{ .Values.ledger.configmap.MULTI_TENANT_SERVICE_NAME | default "ledger" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ .Values.ledger.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.ledger.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }}
MULTI_TENANT_CACHE_TTL_SEC: {{ .Values.ledger.configmap.MULTI_TENANT_CACHE_TTL_SEC | default "120" | quote }}
MULTI_TENANT_REDIS_HOST: {{ required "ledger.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" .Values.ledger.configmap.MULTI_TENANT_REDIS_HOST | quote }}
MULTI_TENANT_REDIS_PORT: {{ .Values.ledger.configmap.MULTI_TENANT_REDIS_PORT | default "6379" | quote }}
MULTI_TENANT_REDIS_TLS: {{ .Values.ledger.configmap.MULTI_TENANT_REDIS_TLS | default "false" | quote }}
Expand Down Expand Up @@ -128,6 +129,66 @@ data:
MONGO_TRANSACTION_PARAMETERS: {{ .Values.ledger.configmap.MONGO_TRANSACTION_PARAMETERS | default "" | quote }}
MONGO_TRANSACTION_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_TRANSACTION_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# MONGO DB - CRM MODULE (folded into the unified ledger binary)
# =============================================================================
MONGO_CRM_URI: {{ .Values.ledger.configmap.MONGO_CRM_URI | default "mongodb" | quote }}
MONGO_CRM_HOST: {{ .Values.ledger.configmap.MONGO_CRM_HOST | default "midaz-mongodb" | quote }}
MONGO_CRM_NAME: {{ .Values.ledger.configmap.MONGO_CRM_NAME | default "crm" | quote }}
MONGO_CRM_USER: {{ .Values.ledger.configmap.MONGO_CRM_USER | default "midaz" | quote }}
MONGO_CRM_PORT: {{ .Values.ledger.configmap.MONGO_CRM_PORT | default "27017" | quote }}
# MONGO_CRM_PASSWORD lives in the ledger Secret (see templates/ledger/secrets.yaml)
MONGO_CRM_MAX_POOL_SIZE: {{ .Values.ledger.configmap.MONGO_CRM_MAX_POOL_SIZE | default "1000" | quote }}
MONGO_CRM_PARAMETERS: {{ .Values.ledger.configmap.MONGO_CRM_PARAMETERS | default "" | quote }}
MONGO_CRM_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_CRM_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# MONGO DB - FEES MODULE (folded into the unified ledger binary)
# =============================================================================
MONGO_FEES_URI: {{ .Values.ledger.configmap.MONGO_FEES_URI | default "mongodb" | quote }}
MONGO_FEES_HOST: {{ .Values.ledger.configmap.MONGO_FEES_HOST | default "midaz-mongodb" | quote }}
MONGO_FEES_NAME: {{ .Values.ledger.configmap.MONGO_FEES_NAME | default "fees" | quote }}
MONGO_FEES_USER: {{ .Values.ledger.configmap.MONGO_FEES_USER | default "midaz" | quote }}
MONGO_FEES_PORT: {{ .Values.ledger.configmap.MONGO_FEES_PORT | default "27017" | quote }}
# MONGO_FEES_PASSWORD lives in the ledger Secret (see templates/ledger/secrets.yaml)
MONGO_FEES_MAX_POOL_SIZE: {{ .Values.ledger.configmap.MONGO_FEES_MAX_POOL_SIZE | default "100" | quote }}
MONGO_FEES_PARAMETERS: {{ .Values.ledger.configmap.MONGO_FEES_PARAMETERS | default "" | quote }}
MONGO_FEES_TLS_CA_CERT: {{ .Values.ledger.configmap.MONGO_FEES_TLS_CA_CERT | default "" | quote }}

# =============================================================================
# LCRYPTO — key material lives in the ledger Secret, never here.
# LCRYPTO_HASH_SECRET_KEY and LCRYPTO_ENCRYPT_SECRET_KEY protect CRM holder
# fields (PII); see templates/ledger/secrets.yaml.
# =============================================================================

# =============================================================================
# KMS (encryption vendor selector; see midaz pkg/crypto/resolver.go)
# KMS_VAULT_SECRET_ID is the AppRole credential and lives in the Secret.
# =============================================================================
KMS_VENDOR: {{ .Values.ledger.configmap.KMS_VENDOR | default "none" | quote }}
# Vault fields required only when KMS_VENDOR=hashicorp-vault (envelope encryption)
{{- if eq (.Values.ledger.configmap.KMS_VENDOR | default "none") "hashicorp-vault" }}
KMS_VAULT_ADDR: {{ required "ledger.configmap.KMS_VAULT_ADDR is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_ADDR | quote }}
KMS_VAULT_ROLE_ID: {{ required "ledger.configmap.KMS_VAULT_ROLE_ID is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_ROLE_ID | quote }}
KMS_VAULT_AUTH_METHOD: {{ required "ledger.configmap.KMS_VAULT_AUTH_METHOD is required when KMS_VENDOR=hashicorp-vault" .Values.ledger.configmap.KMS_VAULT_AUTH_METHOD | quote }}
{{- else }}
KMS_VAULT_ADDR: {{ .Values.ledger.configmap.KMS_VAULT_ADDR | default "" | quote }}
KMS_VAULT_ROLE_ID: {{ .Values.ledger.configmap.KMS_VAULT_ROLE_ID | default "" | quote }}
KMS_VAULT_AUTH_METHOD: {{ .Values.ledger.configmap.KMS_VAULT_AUTH_METHOD | default "" | quote }}
{{- end }}

# =============================================================================
# TRACER RESERVATION SEAM (ledger -> tracer client side)
# TRACER_BASE_URL empty disables the integration (nil reserver).
# =============================================================================
TRACER_BASE_URL: {{ .Values.ledger.configmap.TRACER_BASE_URL | default "" | quote }}
TRACER_TRANSPORT: {{ .Values.ledger.configmap.TRACER_TRANSPORT | default "grpc" | quote }}

@gandalf-at-lerian gandalf-at-lerian Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Do not default this integration to a transport that the bundled Tracer does not expose. With tracer.enabled=true and TRACER_BASE_URL set, the rendered Ledger selects grpc, but the Tracer ConfigMap does not set TRACER_GRPC_PORT (v4 treats empty as gRPC disabled) and its Service exposes only HTTP 4020. The in-chart Ledger→Tracer path therefore cannot connect with the documented defaults. Either configure/expose the Tracer gRPC port end-to-end, or default this seam to rest while only the HTTP port is available.

TRACER_TLS_MODE: {{ .Values.ledger.configmap.TRACER_TLS_MODE | default "" | quote }}
TRACER_TIMEOUT_MS: {{ .Values.ledger.configmap.TRACER_TIMEOUT_MS | default "" | quote }}
TRACER_TLS_CERT_FILE: {{ .Values.ledger.configmap.TRACER_TLS_CERT_FILE | default "" | quote }}
TRACER_TLS_KEY_FILE: {{ .Values.ledger.configmap.TRACER_TLS_KEY_FILE | default "" | quote }}
TRACER_TLS_CA_FILE: {{ .Values.ledger.configmap.TRACER_TLS_CA_FILE | default "" | quote }}

# =============================================================================
# REDIS (shared between modules)
# =============================================================================
Expand Down Expand Up @@ -268,6 +329,26 @@ data:
SD_WATCH_WAIT_TIME: {{ .Values.ledger.configmap.SD_WATCH_WAIT_TIME | default "" | quote }}
SD_WORKLOAD: {{ .Values.ledger.configmap.SD_WORKLOAD | default "" | quote }}
STREAMING_ENABLED: {{ .Values.ledger.configmap.STREAMING_ENABLED | default "false" | quote }}

# =============================================================================
# STREAMING (lib-streaming producer; disabled by default)
# =============================================================================
STREAMING_BROKERS: {{ .Values.ledger.configmap.STREAMING_BROKERS | default "" | quote }}
STREAMING_CLIENT_ID: {{ .Values.ledger.configmap.STREAMING_CLIENT_ID | default "" | quote }}
STREAMING_CLOUDEVENTS_SOURCE: {{ .Values.ledger.configmap.STREAMING_CLOUDEVENTS_SOURCE | default "" | quote }}
STREAMING_COMPRESSION: {{ .Values.ledger.configmap.STREAMING_COMPRESSION | default "" | quote }}
STREAMING_REQUIRED_ACKS: {{ .Values.ledger.configmap.STREAMING_REQUIRED_ACKS | default "" | quote }}
STREAMING_BATCH_LINGER_MS: {{ .Values.ledger.configmap.STREAMING_BATCH_LINGER_MS | default "" | quote }}

# =============================================================================
# FEE ENGINE
# =============================================================================
DEFAULT_CURRENCY: {{ .Values.ledger.configmap.DEFAULT_CURRENCY | default "USD" | quote }}

# =============================================================================
# CASDOOR
# =============================================================================
CASDOOR_JWK_ADDRESS: {{ .Values.ledger.configmap.CASDOOR_JWK_ADDRESS | default "" | quote }}
SWAGGER_VERSION: {{ .Values.ledger.configmap.SWAGGER_VERSION | default "${VERSION}" | quote }}
# Extra Env Vars
{{- with .Values.ledger.extraEnvVars }}
Expand Down
16 changes: 16 additions & 0 deletions charts/midaz/templates/ledger/deployment.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -124,6 +124,8 @@ spec:
{{- if or (and (ne (toString $mongo.enabled) "false") (not $mongo.external)) $mongoAuth.existingSecret }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_ONBOARDING_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_TRANSACTION_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_CRM_PASSWORD") | nindent 12 }}
{{- include "midaz.infraSecretRef" (dict "context" $ "subchart" "mongodb" "key" "mongodb-root-password" "envName" "MONGO_FEES_PASSWORD") | nindent 12 }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{{- else }}
{{- if .Values.ledger.secrets.MONGO_ONBOARDING_PASSWORD }}
- name: MONGO_ONBOARDING_PASSWORD
Expand All @@ -139,6 +141,20 @@ spec:
name: {{ $secretName }}
key: MONGO_TRANSACTION_PASSWORD
{{- end }}
{{- if .Values.ledger.secrets.MONGO_CRM_PASSWORD }}
- name: MONGO_CRM_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $secretName }}
key: MONGO_CRM_PASSWORD
{{- end }}
{{- if .Values.ledger.secrets.MONGO_FEES_PASSWORD }}
- name: MONGO_FEES_PASSWORD
valueFrom:
secretKeyRef:
name: {{ $secretName }}
key: MONGO_FEES_PASSWORD
{{- end }}
{{- end }}
{{/* Valkey: REDIS_PASSWORD maps to Bitnami key `valkey-password`. */}}
{{- $vk := .Values.valkey | default dict }}
Expand Down
25 changes: 25 additions & 0 deletions charts/midaz/templates/ledger/secrets.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,10 +43,35 @@ data:
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_TRANSACTION_PASSWORD }}
MONGO_TRANSACTION_PASSWORD: {{ .Values.ledger.secrets.MONGO_TRANSACTION_PASSWORD | b64enc | quote }}
{{- end }}
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_CRM_PASSWORD }}
MONGO_CRM_PASSWORD: {{ .Values.ledger.secrets.MONGO_CRM_PASSWORD | b64enc | quote }}
{{- end }}
{{- if and (not $mongoInternal) .Values.ledger.secrets.MONGO_FEES_PASSWORD }}
MONGO_FEES_PASSWORD: {{ .Values.ledger.secrets.MONGO_FEES_PASSWORD | b64enc | quote }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.
{{- end }}
{{- if and (not $vkInternal) .Values.ledger.secrets.REDIS_PASSWORD }}
REDIS_PASSWORD: {{ .Values.ledger.secrets.REDIS_PASSWORD | b64enc | quote }}
{{- end }}

# =============================================================================
# LCRYPTO (application-level hash/encrypt keys protecting CRM holder PII)
# =============================================================================
{{- if .Values.ledger.secrets.LCRYPTO_HASH_SECRET_KEY }}
LCRYPTO_HASH_SECRET_KEY: {{ .Values.ledger.secrets.LCRYPTO_HASH_SECRET_KEY | b64enc | quote }}
{{- end }}
{{- if .Values.ledger.secrets.LCRYPTO_ENCRYPT_SECRET_KEY }}
LCRYPTO_ENCRYPT_SECRET_KEY: {{ .Values.ledger.secrets.LCRYPTO_ENCRYPT_SECRET_KEY | b64enc | quote }}
{{- end }}

# =============================================================================
# KMS (Vault AppRole credential; only when KMS_VENDOR=hashicorp-vault)
# =============================================================================
{{- if eq (.Values.ledger.configmap.KMS_VENDOR | default "none") "hashicorp-vault" }}
KMS_VAULT_SECRET_ID: {{ required "ledger.secrets.KMS_VAULT_SECRET_ID is required when KMS_VENDOR=hashicorp-vault (or use ledger.useExistingSecret)" .Values.ledger.secrets.KMS_VAULT_SECRET_ID | b64enc | quote }}
{{- else if .Values.ledger.secrets.KMS_VAULT_SECRET_ID }}
KMS_VAULT_SECRET_ID: {{ .Values.ledger.secrets.KMS_VAULT_SECRET_ID | b64enc | quote }}
{{- end }}
Comment thread
coderabbitai[bot] marked this conversation as resolved.

# =============================================================================
# SHARED SECRETS (RabbitMQ — operator-provided, see README "Known limitation")
# =============================================================================
Expand Down
87 changes: 87 additions & 0 deletions charts/midaz/templates/tracer/configmap.yaml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,87 @@
{{- if .Values.tracer.enabled }}
apiVersion: v1
kind: ConfigMap
metadata:
name: {{ include "midaz-tracer.fullname" . }}
labels:
{{- include "midaz-tracer.labels" (dict "context" . "name" .Values.tracer.name ) | nindent 4 }}
data:
# -- Default Environment variables for Tracer
ALLOW_INSECURE_TLS: {{ .Values.tracer.configmap.ALLOW_INSECURE_TLS | default "true" | quote }}
ENV_NAME: {{ .Values.tracer.configmap.ENV_NAME | default "development" | quote }}

# APP
SERVER_PORT: {{ .Values.tracer.configmap.SERVER_PORT | default "4020" | quote }}
SERVER_ADDRESS: {{ .Values.tracer.configmap.SERVER_ADDRESS | default ":4020" | quote }}
VERSION: {{ .Values.tracer.image.tag | default .Chart.AppVersion | quote }}

# LOG LEVEL
LOG_LEVEL: {{ .Values.tracer.configmap.LOG_LEVEL | default "info" | quote }}

# AUTHENTICATION
API_KEY_ENABLED: {{ .Values.tracer.configmap.API_KEY_ENABLED | default "false" | quote }}

@gandalf-at-lerian gandalf-at-lerian Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Mirror the v4 API-key validation at render time. ValidateAuthConfig rejects API_KEY_ENABLED=true when API_KEY is missing and also rejects it with CORS_ALLOWED_ORIGINS="*". This chart accepts both, and wildcard CORS is the default; I reproduced a successful Helm render with API-key auth enabled that the v4 process deterministically rejects at boot. Require the inline key (or an existing Secret) and fail/override wildcard CORS when API-key auth is enabled.


# CORS
CORS_ALLOWED_ORIGINS: {{ .Values.tracer.configmap.CORS_ALLOWED_ORIGINS | default "*" | quote }}

# AUTH PLUGIN (Access Manager)
PLUGIN_AUTH_ENABLED: {{ .Values.tracer.configmap.PLUGIN_AUTH_ENABLED | default "false" | quote }}
PLUGIN_AUTH_ADDRESS: {{ .Values.tracer.configmap.PLUGIN_AUTH_ADDRESS | default "http://plugin-access-manager-auth:4000" | quote }}

# PostgreSQL Database
DB_HOST: {{ .Values.tracer.configmap.DB_HOST | default "midaz-postgresql" | quote }}
DB_PORT: {{ .Values.tracer.configmap.DB_PORT | default "5432" | quote }}
DB_NAME: {{ .Values.tracer.configmap.DB_NAME | default "tracer" | quote }}
DB_USER: {{ .Values.tracer.configmap.DB_USER | default "tracer" | quote }}
DB_SSL_MODE: {{ .Values.tracer.configmap.DB_SSL_MODE | default "disable" | quote }}
MIGRATIONS_PATH: {{ .Values.tracer.configmap.MIGRATIONS_PATH | default "./migrations" | quote }}

@gandalf-at-lerian gandalf-at-lerian Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Render the dedicated migration runner instead of passing MIGRATIONS_PATH to the app. Midaz v4 explicitly no longer consumes this variable: the service boots against an already-migrated schema, and the release publishes midaz-tracer-migrations. This chart renders no migration Job, so even a pre-created Tracer database remains schema-empty. Add the migrations image values and a pre-sync/pre-install Job before the Deployment. The same lifecycle gap needs to be closed for the v4 Ledger migration image.


# SWAGGER
SWAGGER_TITLE: {{ .Values.tracer.configmap.SWAGGER_TITLE | default "Tracer API" | quote }}
SWAGGER_DESCRIPTION: {{ .Values.tracer.configmap.SWAGGER_DESCRIPTION | default "Real-time transaction validation and fraud prevention API" | quote }}
SWAGGER_HOST: {{ .Values.tracer.configmap.SWAGGER_HOST | default ":4020" | quote }}
SWAGGER_BASE_PATH: {{ .Values.tracer.configmap.SWAGGER_BASE_PATH | default "/" | quote }}
SWAGGER_SCHEMES: {{ .Values.tracer.configmap.SWAGGER_SCHEMES | default "http" | quote }}

# CEL Expression Engine
CEL_COST_LIMIT: {{ .Values.tracer.configmap.CEL_COST_LIMIT | default "10000" | quote }}

# OPEN TELEMETRY
OTEL_RESOURCE_SERVICE_NAME: {{ .Values.tracer.configmap.OTEL_RESOURCE_SERVICE_NAME | default "midaz-tracer" | quote }}
OTEL_LIBRARY_NAME: {{ .Values.tracer.configmap.OTEL_LIBRARY_NAME | default "github.com/LerianStudio/tracer" | quote }}
OTEL_RESOURCE_SERVICE_VERSION: {{ .Values.tracer.image.tag | default .Chart.AppVersion | quote }}
OTEL_RESOURCE_DEPLOYMENT_ENVIRONMENT: {{ .Values.tracer.configmap.ENV_NAME | default "development" | quote }}
OTEL_EXPORTER_OTLP_ENDPOINT: {{ .Values.tracer.configmap.OTEL_EXPORTER_OTLP_ENDPOINT | default "" | quote }}
ENABLE_TELEMETRY: {{ .Values.tracer.configmap.ENABLE_TELEMETRY | default "false" | quote }}

# CLEANUP WORKER
CLEANUP_WORKER_ENABLED: {{ .Values.tracer.configmap.CLEANUP_WORKER_ENABLED | default "false" | quote }}
CLEANUP_INTERVAL_HOURS: {{ .Values.tracer.configmap.CLEANUP_INTERVAL_HOURS | default "24" | quote }}

# MULTI-TENANT
MULTI_TENANT_ENABLED: {{ .Values.tracer.configmap.MULTI_TENANT_ENABLED | default "false" | quote }}
{{- if eq (.Values.tracer.configmap.MULTI_TENANT_ENABLED | default "false" | toString) "true" }}

@gandalf-at-lerian gandalf-at-lerian Aug 6, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

[P1] Complete the multi-tenant fail-fast validation. The v4 bootstrap requires PLUGIN_AUTH_ENABLED=true whenever MULTI_TENANT_ENABLED=true because API-key-only mode cannot verify tenant JWT signatures. The chart currently validates URL, Redis host, and service key but renders successfully with plugin auth disabled, after which the process exits during bootstrap. Enforce the plugin-auth invariant here as well (and reject API_KEY_ENABLED_ONLY_VALIDATION=true if exposed through extraEnvVars).

MULTI_TENANT_URL: {{ required "tracer.configmap.MULTI_TENANT_URL is required when MULTI_TENANT_ENABLED=true" .Values.tracer.configmap.MULTI_TENANT_URL | quote }}
MULTI_TENANT_ALLOW_INSECURE_HTTP: {{ .Values.tracer.configmap.MULTI_TENANT_ALLOW_INSECURE_HTTP | default "false" | quote }}
MULTI_TENANT_REDIS_HOST: {{ required "tracer.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" .Values.tracer.configmap.MULTI_TENANT_REDIS_HOST | quote }}
MULTI_TENANT_REDIS_PORT: {{ .Values.tracer.configmap.MULTI_TENANT_REDIS_PORT | default "6379" | quote }}
MULTI_TENANT_REDIS_TLS: {{ .Values.tracer.configmap.MULTI_TENANT_REDIS_TLS | default "true" | quote }}
MULTI_TENANT_MAX_TENANT_POOLS: {{ .Values.tracer.configmap.MULTI_TENANT_MAX_TENANT_POOLS | default "100" | quote }}
MULTI_TENANT_IDLE_TIMEOUT_SEC: {{ .Values.tracer.configmap.MULTI_TENANT_IDLE_TIMEOUT_SEC | default "300" | quote }}
MULTI_TENANT_TIMEOUT: {{ .Values.tracer.configmap.MULTI_TENANT_TIMEOUT | default "30" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ .Values.tracer.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }}
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.tracer.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }}
MULTI_TENANT_CACHE_TTL_SEC: {{ .Values.tracer.configmap.MULTI_TENANT_CACHE_TTL_SEC | default "120" | quote }}
MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC: {{ .Values.tracer.configmap.MULTI_TENANT_CONNECTIONS_CHECK_INTERVAL_SEC | default "30" | quote }}
{{- if .Values.tracer.configmap.MULTI_TENANT_MAX_OPEN_CONNS_PER_TENANT }}
MULTI_TENANT_MAX_OPEN_CONNS_PER_TENANT: {{ .Values.tracer.configmap.MULTI_TENANT_MAX_OPEN_CONNS_PER_TENANT | quote }}
{{- end }}
{{- if .Values.tracer.configmap.MULTI_TENANT_MAX_IDLE_CONNS_PER_TENANT }}
MULTI_TENANT_MAX_IDLE_CONNS_PER_TENANT: {{ .Values.tracer.configmap.MULTI_TENANT_MAX_IDLE_CONNS_PER_TENANT | quote }}
{{- end }}
{{- end }}
# Extra Env Vars
{{- with .Values.tracer.extraEnvVars }}
{{- toYaml . | nindent 2 }}
{{- end }}
{{- end }}
Loading
Loading