Skip to content

Commit 04e12ac

Browse files
prymax10prymax10
authored
feat(plugin-fees): add multi-tenant support and fix AVP secret rendering (#1229)
Adds MULTI_TENANT_* configmap and secret fields (conditional on MULTI_TENANT_ENABLED=true) following the matcher and plugin-br-bank-transfer chart patterns. Includes required validation for critical fields, useExistingSecret guard on the in-tree Secret, and checksum annotations to trigger pod restarts on config/secret changes. Migrates the fees Secret from `data:` + `b64enc` to `stringData:` to fix silent argocd-vault-plugin substitution failures. The previous pattern base64-encoded the `<path:...>` placeholder before AVP could resolve it, causing chart defaults to be used in production instead of the actual Vault values.
1 parent 0676ed2 commit 04e12ac

6 files changed

Lines changed: 79 additions & 6 deletions

File tree

‎charts/plugin-fees/CHANGELOG.md‎

Lines changed: 18 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1,5 +1,23 @@
11
# Plugin-fees Changelog
22

3+
## [5.1.0](https://github.com/LerianStudio/helm/releases/tag/plugin-fees-v5.1.0)
4+
5+
- Features:
6+
- Added multi-tenant support via tenant-manager. New configmap fields (rendered when `MULTI_TENANT_ENABLED=true`): `MULTI_TENANT_URL`, `MULTI_TENANT_ENVIRONMENT`, `MULTI_TENANT_MAX_TENANT_POOLS`, `MULTI_TENANT_IDLE_TIMEOUT_SEC`, `MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD`, `MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC`, `MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC`, `MULTI_TENANT_REDIS_HOST`, `MULTI_TENANT_REDIS_PORT`, `MULTI_TENANT_REDIS_TLS`. New secret fields: `MULTI_TENANT_SERVICE_API_KEY` (required when enabled), `MULTI_TENANT_REDIS_PASSWORD` (optional).
7+
- Added `useExistingSecret` guard on the in-tree Secret manifest to avoid creating a default Secret when an external one is provided.
8+
- Added `checksum/config` and `checksum/secret` pod annotations so ConfigMap/Secret changes automatically trigger pod rollouts.
9+
10+
- Fixes:
11+
- Migrated `fees` Secret from `data:` + `b64enc` to `stringData:`. The previous pattern silently broke argocd-vault-plugin (AVP) substitution because Helm encoded the `<path:...>` placeholder before AVP could resolve it. Existing deployments that relied on AVP for `MONGO_PASSWORD`, `CLIENT_SECRET`, `LICENSE_KEY`, or `ORGANIZATION_IDS` will now receive the actual Vault values on the next sync (was previously falling back to chart defaults).
12+
13+
- Breaking notes:
14+
- **Behavior change for AVP users:** Secret values that were silently falling back to chart defaults (e.g. `MONGO_PASSWORD: lerian`) will now be replaced by the real Vault values on first sync. Operators must verify that downstream services (MongoDB user, OAuth client) are provisioned with the credentials stored in Vault before upgrading.
15+
- **Pre-encoded secrets in Vault are no longer supported:** if any consumer was storing base64-pre-encoded values in Vault, switch them to plaintext.
16+
17+
[Compare changes](https://github.com/LerianStudio/helm/compare/plugin-fees-v5.0.0...plugin-fees-v5.1.0)
18+
19+
---
20+
321
## [4.1.2](https://github.com/LerianStudio/helm/releases/tag/plugin-fees-v4.1.2)
422

523
- Fixes:

‎charts/plugin-fees/Chart.yaml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -9,7 +9,7 @@ maintainers:
99
email: "support@lerian.studio"
1010
# This is the chart version. This version number should be incremented each time you make changes
1111
# to the chart and its templates, including the app version.
12-
version: 5.0.0
12+
version: 5.1.0
1313
# This is the version number of the application being deployed.
1414
appVersion: "3.1.0"
1515
# A list of keywords about the chart. This helps others discover the chart.

‎charts/plugin-fees/templates/fees/configmap.yaml‎

Lines changed: 15 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -75,6 +75,21 @@ data:
7575
ACCOUNT_CACHE_ENABLED: {{ .Values.fees.configmap.ACCOUNT_CACHE_ENABLED | default "true" | quote }}
7676
ACCOUNT_CACHE_TTL_SECONDS: {{ .Values.fees.configmap.ACCOUNT_CACHE_TTL_SECONDS | default "300" | quote }}
7777

78+
# MULTI TENANT
79+
MULTI_TENANT_ENABLED: {{ .Values.fees.configmap.MULTI_TENANT_ENABLED | default "false" | quote }}
80+
{{- if eq (.Values.fees.configmap.MULTI_TENANT_ENABLED | default "false" | toString) "true" }}
81+
MULTI_TENANT_URL: {{ required "fees.configmap.MULTI_TENANT_URL is required when MULTI_TENANT_ENABLED=true" .Values.fees.configmap.MULTI_TENANT_URL | quote }}
82+
MULTI_TENANT_ENVIRONMENT: {{ .Values.fees.configmap.MULTI_TENANT_ENVIRONMENT | default "" | quote }}
83+
MULTI_TENANT_MAX_TENANT_POOLS: {{ .Values.fees.configmap.MULTI_TENANT_MAX_TENANT_POOLS | default "100" | quote }}
84+
MULTI_TENANT_IDLE_TIMEOUT_SEC: {{ .Values.fees.configmap.MULTI_TENANT_IDLE_TIMEOUT_SEC | default "300" | quote }}
85+
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: {{ .Values.fees.configmap.MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD | default "5" | quote }}
86+
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: {{ .Values.fees.configmap.MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC | default "30" | quote }}
87+
MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC: {{ .Values.fees.configmap.MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC | default "60" | quote }}
88+
MULTI_TENANT_REDIS_HOST: {{ required "fees.configmap.MULTI_TENANT_REDIS_HOST is required when MULTI_TENANT_ENABLED=true" .Values.fees.configmap.MULTI_TENANT_REDIS_HOST | quote }}
89+
MULTI_TENANT_REDIS_PORT: {{ .Values.fees.configmap.MULTI_TENANT_REDIS_PORT | default "6379" | quote }}
90+
MULTI_TENANT_REDIS_TLS: {{ .Values.fees.configmap.MULTI_TENANT_REDIS_TLS | default "false" | quote }}
91+
{{- end }}
92+
7893
# Extra Env Vars
7994
{{- with .Values.fees.extraEnvVars }}
8095
{{- toYaml . | nindent 2 }}

‎charts/plugin-fees/templates/fees/deployment.yaml‎

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -16,6 +16,11 @@ spec:
1616
metadata:
1717
labels:
1818
{{- include "plugin-fees.labels" (dict "context" . "name" .Values.fees.name ) | nindent 8 }}
19+
annotations:
20+
checksum/config: {{ include (print $.Template.BasePath "/fees/configmap.yaml") . | sha256sum }}
21+
{{- if not .Values.fees.useExistingSecret }}
22+
checksum/secret: {{ include (print $.Template.BasePath "/fees/secrets.yaml") . | sha256sum }}
23+
{{- end }}
1924
spec:
2025
{{- with .Values.fees.imagePullSecrets }}
2126
imagePullSecrets:

‎charts/plugin-fees/templates/fees/secrets.yaml‎

Lines changed: 14 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,15 +1,24 @@
1+
{{- if not .Values.fees.useExistingSecret }}
12
apiVersion: v1
23
kind: Secret
34
metadata:
45
name: {{ include "plugin-fees.fullname" . }}
56
labels:
67
{{- include "plugin-fees.labels" (dict "context" . "name" .Values.fees.name ) | nindent 4 }}
78
type: Opaque
8-
data:
9+
stringData:
910
# -- Default sensitive variables for the plugin-fees
1011
# MONGO Secrets
11-
MONGO_PASSWORD: {{ .Values.fees.secrets.MONGO_PASSWORD | default "lerian" | b64enc| quote }}
12-
CLIENT_SECRET: {{ .Values.fees.secrets.CLIENT_SECRET | default "6add4bc64f394456a77fa85708ad8c9b67e39e4c" | b64enc | quote }}
12+
MONGO_PASSWORD: {{ .Values.fees.secrets.MONGO_PASSWORD | default "lerian" | quote }}
13+
CLIENT_SECRET: {{ .Values.fees.secrets.CLIENT_SECRET | default "6add4bc64f394456a77fa85708ad8c9b67e39e4c" | quote }}
1314
# LICENSE Secrets
14-
LICENSE_KEY: {{ .Values.fees.secrets.LICENSE_KEY | b64enc | quote }}
15-
ORGANIZATION_IDS: {{ .Values.fees.secrets.ORGANIZATION_IDS | b64enc | quote }}
15+
LICENSE_KEY: {{ .Values.fees.secrets.LICENSE_KEY | quote }}
16+
ORGANIZATION_IDS: {{ .Values.fees.secrets.ORGANIZATION_IDS | quote }}
17+
# Multi-Tenant Secrets
18+
{{- if eq (.Values.fees.configmap.MULTI_TENANT_ENABLED | default "false" | toString) "true" }}
19+
MULTI_TENANT_SERVICE_API_KEY: {{ required "fees.secrets.MULTI_TENANT_SERVICE_API_KEY is required when MULTI_TENANT_ENABLED=true" .Values.fees.secrets.MULTI_TENANT_SERVICE_API_KEY | quote }}
20+
{{- if .Values.fees.secrets.MULTI_TENANT_REDIS_PASSWORD }}
21+
MULTI_TENANT_REDIS_PASSWORD: {{ .Values.fees.secrets.MULTI_TENANT_REDIS_PASSWORD | quote }}
22+
{{- end }}
23+
{{- end }}
24+
{{- end }}

‎charts/plugin-fees/values.yaml‎

Lines changed: 26 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -174,6 +174,28 @@ fees:
174174
ACCOUNT_CACHE_ENABLED: "true"
175175
ACCOUNT_CACHE_TTL_SECONDS: "300"
176176
TRUSTED_PROXIES: ""
177+
# -- Enable multi-tenant support via tenant-manager
178+
MULTI_TENANT_ENABLED: "false"
179+
# -- URL of the tenant-manager service (required when MULTI_TENANT_ENABLED=true)
180+
MULTI_TENANT_URL: ""
181+
# -- Environment label sent to tenant-manager for tenant scoping
182+
MULTI_TENANT_ENVIRONMENT: ""
183+
# -- Maximum number of per-tenant MongoDB connection pools
184+
MULTI_TENANT_MAX_TENANT_POOLS: "100"
185+
# -- Seconds before an idle tenant connection pool is released
186+
MULTI_TENANT_IDLE_TIMEOUT_SEC: "300"
187+
# -- Number of failures before the circuit breaker opens
188+
MULTI_TENANT_CIRCUIT_BREAKER_THRESHOLD: "5"
189+
# -- Seconds the circuit breaker stays open before retrying
190+
MULTI_TENANT_CIRCUIT_BREAKER_TIMEOUT_SEC: "30"
191+
# -- Interval in seconds to re-check tenant-manager settings
192+
MULTI_TENANT_SETTINGS_CHECK_INTERVAL_SEC: "60"
193+
# -- Hostname of the Redis/Valkey instance used for tenant cache
194+
MULTI_TENANT_REDIS_HOST: ""
195+
# -- Port of the Redis/Valkey instance
196+
MULTI_TENANT_REDIS_PORT: "6379"
197+
# -- Enable TLS for the Redis/Valkey connection
198+
MULTI_TENANT_REDIS_TLS: "false"
177199
extraEnvVars: {}
178200
# -- Secrets for storing sensitive data
179201
# -- All secrets are declared in the templates/secrets.yaml
@@ -186,6 +208,10 @@ fees:
186208
CLIENT_SECRET: "6add4bc64f394456a77fa85708ad8c9b67e39e4c"
187209
LICENSE_KEY: ""
188210
ORGANIZATION_IDS: ""
211+
# -- API key used to authenticate with the tenant-manager service (required when MULTI_TENANT_ENABLED=true)
212+
MULTI_TENANT_SERVICE_API_KEY: ""
213+
# -- Password for the Redis/Valkey instance used by the multi-tenant cache (required when MULTI_TENANT_ENABLED=true)
214+
MULTI_TENANT_REDIS_PASSWORD: ""
189215
frontend:
190216
# -- Service name
191217
name: plugin-fees-ui

0 commit comments

Comments
 (0)