From 63b8857b0a5ec141d7a54334e32ad50fb94ef408 Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Fri, 18 Sep 2026 16:04:22 +0200
Subject: [PATCH 1/7] feat(regions): add opt-in Connectivity Operator

Add connectivity-operator 0.2.0 (oci://ghcr.io/formancehq/helm) as an
optional dependency of the regions chart behind
operator.connectivity.enabled (default false), mirroring the Ledger
Operator opt-in. Rendering fails when the flag is set without
operator.enabled or operator.ledger.enabled, because the Formance
Operator's Connectivity module delegates to the Connectivity operator
and needs the Ledger operator's Credentials CRD and a Ledger v3.

Pin the operator and default connectivity images to 1.0.0-alpha.1, the
minimum version required by Formance Operator >= v3.15 and the only
tagged connectivity-operator image published on ghcr; chart 0.2.0 is
the connectivity operator chart source at that tag.

Cascade: regions 3.19.0 -> 3.20.0, formance 3.0.2 -> 3.1.0.
---
 charts/formance/Chart.yaml               |  2 +-
 charts/formance/values.yaml              |  4 ++++
 charts/regions/Chart.yaml                |  6 ++++-
 charts/regions/templates/validation.yaml |  6 +++++
 charts/regions/values.schema.json        | 29 ++++++++++++++++++++++++
 charts/regions/values.yaml               | 15 ++++++++++++
 6 files changed, 60 insertions(+), 2 deletions(-)

diff --git a/charts/formance/Chart.yaml b/charts/formance/Chart.yaml
index 844e9c5c..d4941093 100644
--- a/charts/formance/Chart.yaml
+++ b/charts/formance/Chart.yaml
@@ -10,7 +10,7 @@ maintainers:
 icon: "https://avatars.githubusercontent.com/u/84325077?s=200&v=4"
 
 type: application
-version: 3.2.4
+version: 3.3.0
 appVersion: "latest"
 # The "-0" suffix is required for GKE compatibility. GKE versions contain
 # build metadata like "v1.33.5-gke.2392000" which semver treats as pre-release.
diff --git a/charts/formance/values.yaml b/charts/formance/values.yaml
index ed294415..9f0bed36 100644
--- a/charts/formance/values.yaml
+++ b/charts/formance/values.yaml
@@ -321,6 +321,10 @@ regions:
       # -- Enable the Ledger v3 Operator (requires operator.enabled)
       # @section -- Regions configuration
       enabled: false
+    connectivity:
+      # -- Enable the Connectivity Operator (requires operator.enabled and operator.ledger.enabled)
+      # @section -- Regions configuration
+      enabled: false
     operator-crds:
       create: false
 
diff --git a/charts/regions/Chart.yaml b/charts/regions/Chart.yaml
index 897221fe..e08d359f 100644
--- a/charts/regions/Chart.yaml
+++ b/charts/regions/Chart.yaml
@@ -11,7 +11,7 @@ maintainers:
 icon: "https://avatars.githubusercontent.com/u/84325077?s=200&v=4"
 
 type: application
-version: 3.20.6
+version: 3.21.0
 appVersion: "latest"
 
 dependencies:
@@ -27,6 +27,10 @@ dependencies:
     version: 3.0.0-beta.1
     repository: "oci://ghcr.io/formancehq/helm"
     condition: operator.ledger.enabled
+  - name: connectivity-operator
+    version: 0.2.0
+    repository: "oci://ghcr.io/formancehq/helm"
+    condition: operator.connectivity.enabled
   - name: core
     version: "1.X"
     repository: file://../core
diff --git a/charts/regions/templates/validation.yaml b/charts/regions/templates/validation.yaml
index 3ebac84f..b9b048ab 100644
--- a/charts/regions/templates/validation.yaml
+++ b/charts/regions/templates/validation.yaml
@@ -1,6 +1,12 @@
 {{- if and .Values.operator.ledger.enabled (not .Values.operator.enabled) }}
 {{- fail "operator.ledger.enabled requires operator.enabled=true" }}
 {{- end }}
+{{- if and .Values.operator.connectivity.enabled (not .Values.operator.enabled) }}
+{{- fail "operator.connectivity.enabled requires operator.enabled=true" }}
+{{- end }}
+{{- if and .Values.operator.connectivity.enabled (not .Values.operator.ledger.enabled) }}
+{{- fail "operator.connectivity.enabled requires operator.ledger.enabled=true" }}
+{{- end }}
 {{- range $name, $stack := .Values.stacks }}
 {{- if and (eq ($stack.versionsFromFile | default "") "v4.0-beta") (not $.Values.operator.ledger.enabled) }}
 {{- fail (printf "stack %q requires operator.ledger.enabled=true to use versionsFromFile=v4.0-beta" $name) }}
diff --git a/charts/regions/values.schema.json b/charts/regions/values.schema.json
index 61116b08..53a8255e 100644
--- a/charts/regions/values.schema.json
+++ b/charts/regions/values.schema.json
@@ -65,6 +65,27 @@
                 }
             }
         },
+        "connectivity-operator": {
+            "type": "object",
+            "properties": {
+                "defaultConnectivityImage": {
+                    "type": "object",
+                    "properties": {
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                },
+                "image": {
+                    "type": "object",
+                    "properties": {
+                        "tag": {
+                            "type": "string"
+                        }
+                    }
+                }
+            }
+        },
         "fullnameOverride": {
             "type": "string"
         },
@@ -175,6 +196,14 @@
         "operator": {
             "type": "object",
             "properties": {
+                "connectivity": {
+                    "type": "object",
+                    "properties": {
+                        "enabled": {
+                            "type": "boolean"
+                        }
+                    }
+                },
                 "enabled": {
                     "type": "boolean"
                 },
diff --git a/charts/regions/values.yaml b/charts/regions/values.yaml
index 894adc60..b29fbf48 100644
--- a/charts/regions/values.yaml
+++ b/charts/regions/values.yaml
@@ -59,6 +59,11 @@ operator:
     # @section -- Ledger Operator configuration
     enabled: false
 
+  connectivity:
+    # -- Enable the Connectivity Operator (requires operator.enabled and operator.ledger.enabled)
+    # @section -- Connectivity Operator configuration
+    enabled: false
+
   fullnameOverride: "operator"
   nameOverride: "operator"
 
@@ -89,6 +94,16 @@ ledger-operator:
   ledgerImage:
     tag: "v3.0.0-beta.1"
 
+# Chart 0.2.0 is the only published connectivity-operator chart; it matches the
+# operator source at tag v1.0.0-alpha.1, whose images are tagged without the
+# leading "v". The Formance Operator requires Connectivity v1.0.0-alpha.1 or later.
+connectivity-operator:
+  image:
+    tag: "1.0.0-alpha.1"
+
+  defaultConnectivityImage:
+    tag: "1.0.0-alpha.1"
+
 agent:
   enabled: false
 

From ace4d89009dd321611bc60b92e7d682674de1f51 Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Fri, 18 Sep 2026 16:06:42 +0200
Subject: [PATCH 2/7] chore(formance): regenerate values schema for
 regions.operator.connectivity

---
 charts/formance/values.schema.json | 8 ++++++++
 1 file changed, 8 insertions(+)

diff --git a/charts/formance/values.schema.json b/charts/formance/values.schema.json
index 557adbc3..5ae9ba2a 100644
--- a/charts/formance/values.schema.json
+++ b/charts/formance/values.schema.json
@@ -535,6 +535,14 @@
                 "operator": {
                     "type": "object",
                     "properties": {
+                        "connectivity": {
+                            "type": "object",
+                            "properties": {
+                                "enabled": {
+                                    "type": "boolean"
+                                }
+                            }
+                        },
                         "enabled": {
                             "type": "boolean"
                         },

From 5338864da539aa44fc16ecd000aecb4605c3cd57 Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:32:11 +0200
Subject: [PATCH 3/7] chore(regions): align Connectivity Operator with beta.2

---
 README.md                         |  4 ++--
 charts/formance/Chart.lock        |  6 +++---
 charts/formance/README.md         | 12 ++++++++++--
 charts/regions/Chart.lock         |  7 +++++--
 charts/regions/Chart.yaml         |  2 +-
 charts/regions/README.md          | 28 +++++++++++++++++++++++++++-
 charts/regions/README.md.gotmpl   | 18 ++++++++++++++++++
 charts/regions/values.schema.json |  8 --------
 charts/regions/values.yaml        | 11 ++++-------
 9 files changed, 70 insertions(+), 26 deletions(-)

diff --git a/README.md b/README.md
index dc9a7e77..2b05c367 100644
--- a/README.md
+++ b/README.md
@@ -8,12 +8,12 @@
 | [Cloudprem](./charts/cloudprem/README.md) | 6.1.0 | latest | Formance control-plane | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) |
 | [Console-V3](./charts/console-v3/README.md) | 5.0.2 | v4.0.2 | Formance Console | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/console-v3)](https://artifacthub.io/packages/search?repo=console-v3) |
 | [Core](./charts/core/README.md) | 1.6.0 | latest | Formance Core Library | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/core)](https://artifacthub.io/packages/search?repo=core) |
-| [Formance](./charts/formance/README.md) | 3.2.4 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) |
+| [Formance](./charts/formance/README.md) | 3.3.0 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) |
 | [Identity](./charts/identity/README.md) | 0.1.0 | 4a542c9f48b3799fe4a7f06c75c62a75b83afd0b | Formance Identity service | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/identity)](https://artifacthub.io/packages/search?repo=identity) |
 | [Ledger-Ui](./charts/ledger-ui/README.md) | 0.1.0 | latest | Formance Ledger UI | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/ledger-ui)](https://artifacthub.io/packages/search?repo=ledger-ui) |
 | [Membership](./charts/membership/README.md) | 3.7.2 | v2.5.0 | Formance EE Membership API. Manage stacks, organizations, regions, invitations, users, roles, and permissions. | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/membership)](https://artifacthub.io/packages/search?repo=membership) |
 | [Portal](./charts/portal/README.md) | 5.0.2 | v4.0.2 | Formance Portal | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/portal)](https://artifacthub.io/packages/search?repo=portal) |
-| [Regions](./charts/regions/README.md) | 3.20.6 | latest | Formance Private Regions Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/regions)](https://artifacthub.io/packages/search?repo=regions) |
+| [Regions](./charts/regions/README.md) | 3.21.0 | latest | Formance Private Regions Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/regions)](https://artifacthub.io/packages/search?repo=regions) |
 | [Stargate](./charts/stargate/README.md) | 0.11.0 | latest | Formance EE Stargate gRPC Gateway | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/stargate)](https://artifacthub.io/packages/search?repo=stargate) |
 
 ## How to contribute
diff --git a/charts/formance/Chart.lock b/charts/formance/Chart.lock
index 23e54a59..a303bea9 100644
--- a/charts/formance/Chart.lock
+++ b/charts/formance/Chart.lock
@@ -4,9 +4,9 @@ dependencies:
   version: 18.12.4
 - name: regions
   repository: file://../regions
-  version: 3.20.6
+  version: 3.21.0
 - name: cloudprem
   repository: file://../cloudprem
   version: 6.1.0
-digest: sha256:fd01db0ef06fbf71dcd747e5dc20adc697f11ca64f1682f5a0c14ab220d05eed
-generated: "2026-10-08T12:19:12+02:00"
+digest: sha256:aa82afaa5c0522891d3b9b0325327f0e77ee379033c78ead87e2ae666fa84b77
+generated: "2026-10-08T17:30:13.522746+02:00"
diff --git a/charts/formance/README.md b/charts/formance/README.md
index 80a334af..94173f17 100644
--- a/charts/formance/README.md
+++ b/charts/formance/README.md
@@ -1,6 +1,6 @@
 # formance
 
-![Version: 3.2.4](https://img.shields.io/badge/Version-3.2.4-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
+![Version: 3.3.0](https://img.shields.io/badge/Version-3.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
 
 Formance Platform - Unified Helm Chart
 
@@ -192,7 +192,8 @@ Kubernetes: `>=1.14.0-0`
 | regions.agent.server.address | string | `"app.formance.cloud:443"` | Formance Cloud server address |
 | regions.agent.server.tls.enabled | bool | `true` | Enable TLS |
 | regions.agent.server.tls.insecureSkipVerify | bool | `true` | Skip TLS verification |
-| regions.operator | object | `{"enabled":true,"ledger":{"enabled":false},"operator-crds":{"create":false}}` | Operator configuration |
+| regions.operator | object | `{"connectivity":{"enabled":false},"enabled":true,"ledger":{"enabled":false},"operator-crds":{"create":false}}` | Operator configuration |
+| regions.operator.connectivity.enabled | bool | `false` | Enable the Connectivity Operator (requires operator.enabled and operator.ledger.enabled) |
 | regions.operator.enabled | bool | `true` | Enable the Formance Operator |
 | regions.operator.ledger.enabled | bool | `false` | Enable the Ledger v3 Operator (requires operator.enabled) |
 | regions.versions | object | `{"allowDefaultVersion":false,"create":true}` | Stack versions configuration |
@@ -313,6 +314,12 @@ Kubernetes: `>=1.14.0-0`
 |-----|------|---------|-------------|
 | cloudprem.portal.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) |
 
+### Connectivity Operator configuration
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| regions.operator.connectivity.enabled | bool | `false` | Enable the Connectivity Operator (requires operator.enabled and operator.ledger.enabled) |
+
 ### Ledger Operator configuration
 
 | Key | Type | Default | Description |
@@ -737,6 +744,7 @@ Kubernetes: `>=1.14.0-0`
 | regions.agent.server.address | string | `"app.formance.cloud:443"` |  |
 | regions.agent.server.tls.enabled | bool | `true` |  |
 | regions.agent.server.tls.insecureSkipVerify | bool | `true` |  |
+| regions.connectivity-operator.image.tag | string | `"1.0.0-beta.2"` |  |
 | regions.fullnameOverride | string | `""` |  |
 | regions.ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
 | regions.ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
diff --git a/charts/regions/Chart.lock b/charts/regions/Chart.lock
index 06956fda..5e8b23b2 100644
--- a/charts/regions/Chart.lock
+++ b/charts/regions/Chart.lock
@@ -8,8 +8,11 @@ dependencies:
 - name: ledger-operator
   repository: oci://ghcr.io/formancehq/helm
   version: 3.0.0-beta.1
+- name: connectivity-operator
+  repository: oci://ghcr.io/formancehq/helm
+  version: 1.0.0-beta.2
 - name: core
   repository: file://../core
   version: 1.6.0
-digest: sha256:93f4b839219e582ec556bcc74ad29380b5a41725e8354dfa1b667755bd45b91a
-generated: "2026-09-26T20:30:43.025664+02:00"
+digest: sha256:13dd4cf48477e062d217e23555d4deb0af8b10b1ff182e660eccb94fd523f0ba
+generated: "2026-10-08T17:29:43.680229+02:00"
diff --git a/charts/regions/Chart.yaml b/charts/regions/Chart.yaml
index e08d359f..6cb6109f 100644
--- a/charts/regions/Chart.yaml
+++ b/charts/regions/Chart.yaml
@@ -28,7 +28,7 @@ dependencies:
     repository: "oci://ghcr.io/formancehq/helm"
     condition: operator.ledger.enabled
   - name: connectivity-operator
-    version: 0.2.0
+    version: 1.0.0-beta.2
     repository: "oci://ghcr.io/formancehq/helm"
     condition: operator.connectivity.enabled
   - name: core
diff --git a/charts/regions/README.md b/charts/regions/README.md
index 59077e50..a3b50695 100644
--- a/charts/regions/README.md
+++ b/charts/regions/README.md
@@ -1,6 +1,6 @@
 # Formance regions Helm chart
 
-![Version: 3.20.6](https://img.shields.io/badge/Version-3.20.6-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
+![Version: 3.21.0](https://img.shields.io/badge/Version-3.21.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square)
 Formance Private Regions Helm Chart
 
 ## Requirements
@@ -9,6 +9,7 @@ Formance Private Regions Helm Chart
 |------------|------|---------|
 | file://../agent | agent | 2.X |
 | file://../core | core | 1.X |
+| oci://ghcr.io/formancehq/helm | connectivity-operator | 1.0.0-beta.2 |
 | oci://ghcr.io/formancehq/helm | ledger-operator | 3.0.0-beta.1 |
 | oci://ghcr.io/formancehq/helm | operator | 3.X |
 
@@ -22,6 +23,24 @@ Formance Private Regions Helm Chart
 
 * <https://github.com/formancehq/helm/tree/main/charts/regions>
 
+## Connectivity Operator
+
+Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
+and `operator.ledger.enabled=true` to install the Connectivity Operator and its
+CRDs. The opt-in is disabled by default. The dependency and Operator image are
+pinned to `1.0.0-beta.2`; the chart includes the matching CRDs.
+
+Core and API are separate published components. Their images are selected by the
+Stack Operator from the Connectivity module version, not from this Operator
+chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or its
+Versions resource. Stack Operator `3.16.0` uses the same module version for both
+images and overwrites delegated image fields during reconciliation.
+
+Before enabling the module, qualify the target Ledger, Credentials CRD, and key
+registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
+matching reflected BucketService descriptors before each Apply. Installing this
+chart does not establish runtime compatibility or change Ledger defaults.
+
 ## Migration
 
 #### EE Licence
@@ -71,6 +90,12 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | global.monitoring.support.resourceAttributes | object | `{}` | Resource attributes added to all signals sent to this endpoint |
 | global.monitoring.support.stackSelector | object | `{"matchExpressions":[{"key":"formance.com/stack","operator":"Exists"}]}` | Stack selector for the support OtelExporterEndpoint |
 
+### Connectivity Operator configuration
+
+| Key | Type | Default | Description |
+|-----|------|---------|-------------|
+| operator.connectivity.enabled | bool | `false` | Enable the Connectivity Operator (requires operator.enabled and operator.ledger.enabled) |
+
 ### Ledger Operator configuration
 
 | Key | Type | Default | Description |
@@ -95,6 +120,7 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | agent.server.address | string | `"app.formance.cloud:443"` |  |
 | agent.server.tls.enabled | bool | `true` |  |
 | agent.server.tls.insecureSkipVerify | bool | `true` |  |
+| connectivity-operator.image.tag | string | `"1.0.0-beta.2"` |  |
 | fullnameOverride | string | `""` |  |
 | ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
 | ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
diff --git a/charts/regions/README.md.gotmpl b/charts/regions/README.md.gotmpl
index ca967c32..020c1036 100644
--- a/charts/regions/README.md.gotmpl
+++ b/charts/regions/README.md.gotmpl
@@ -9,6 +9,24 @@
 
 {{ template "chart.sourcesSection" . }}
 
+## Connectivity Operator
+
+Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
+and `operator.ledger.enabled=true` to install the Connectivity Operator and its
+CRDs. The opt-in is disabled by default. The dependency and Operator image are
+pinned to `1.0.0-beta.2`; the chart includes the matching CRDs.
+
+Core and API are separate published components. Their images are selected by the
+Stack Operator from the Connectivity module version, not from this Operator
+chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or its
+Versions resource. Stack Operator `3.16.0` uses the same module version for both
+images and overwrites delegated image fields during reconciliation.
+
+Before enabling the module, qualify the target Ledger, Credentials CRD, and key
+registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
+matching reflected BucketService descriptors before each Apply. Installing this
+chart does not establish runtime compatibility or change Ledger defaults.
+
 ## Migration
 
 #### EE Licence
diff --git a/charts/regions/values.schema.json b/charts/regions/values.schema.json
index 53a8255e..9783e98c 100644
--- a/charts/regions/values.schema.json
+++ b/charts/regions/values.schema.json
@@ -68,14 +68,6 @@
         "connectivity-operator": {
             "type": "object",
             "properties": {
-                "defaultConnectivityImage": {
-                    "type": "object",
-                    "properties": {
-                        "tag": {
-                            "type": "string"
-                        }
-                    }
-                },
                 "image": {
                     "type": "object",
                     "properties": {
diff --git a/charts/regions/values.yaml b/charts/regions/values.yaml
index b29fbf48..6d8e5eb4 100644
--- a/charts/regions/values.yaml
+++ b/charts/regions/values.yaml
@@ -94,15 +94,12 @@ ledger-operator:
   ledgerImage:
     tag: "v3.0.0-beta.1"
 
-# Chart 0.2.0 is the only published connectivity-operator chart; it matches the
-# operator source at tag v1.0.0-alpha.1, whose images are tagged without the
-# leading "v". The Formance Operator requires Connectivity v1.0.0-alpha.1 or later.
+# Operator chart and image are independently published component artifacts.
+# Core and API images are selected by the Stack Operator from the Connectivity
+# module version; configure that module explicitly to avoid floating images.
 connectivity-operator:
   image:
-    tag: "1.0.0-alpha.1"
-
-  defaultConnectivityImage:
-    tag: "1.0.0-alpha.1"
+    tag: "1.0.0-beta.2"
 
 agent:
   enabled: false

From 0225e6f76e0fad164dfa4c19053a11dd8fd305e5 Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:36:07 +0200
Subject: [PATCH 4/7] fix(regions): pin Connectivity in the beta Versions
 profile

---
 charts/formance/README.md         | 1 +
 charts/regions/README.md          | 1 +
 charts/regions/values.schema.json | 3 +++
 charts/regions/values.yaml        | 1 +
 4 files changed, 6 insertions(+)

diff --git a/charts/formance/README.md b/charts/formance/README.md
index 94173f17..68bd67e6 100644
--- a/charts/formance/README.md
+++ b/charts/formance/README.md
@@ -827,6 +827,7 @@ Kubernetes: `>=1.14.0-0`
 | regions.versions.files."v3.2".wallets | string | `"v2.2.1"` |  |
 | regions.versions.files."v3.2".webhooks | string | `"v2.5.4"` |  |
 | regions.versions.files."v4.0-beta".auth | string | `"v2.5.1"` |  |
+| regions.versions.files."v4.0-beta".connectivity | string | `"1.0.0-beta.2"` |  |
 | regions.versions.files."v4.0-beta".gateway | string | `"v2.3.2"` |  |
 | regions.versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.5"` |  |
 | regions.versions.files."v4.0-beta".mcp | string | `"v0.3.0"` |  |
diff --git a/charts/regions/README.md b/charts/regions/README.md
index a3b50695..f7ca0753 100644
--- a/charts/regions/README.md
+++ b/charts/regions/README.md
@@ -203,6 +203,7 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | versions.files."v3.2".wallets | string | `"v2.2.1"` |  |
 | versions.files."v3.2".webhooks | string | `"v2.5.4"` |  |
 | versions.files."v4.0-beta".auth | string | `"v2.5.1"` |  |
+| versions.files."v4.0-beta".connectivity | string | `"1.0.0-beta.2"` |  |
 | versions.files."v4.0-beta".gateway | string | `"v2.3.2"` |  |
 | versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.5"` |  |
 | versions.files."v4.0-beta".mcp | string | `"v0.3.0"` |  |
diff --git a/charts/regions/values.schema.json b/charts/regions/values.schema.json
index 9783e98c..f86926c8 100644
--- a/charts/regions/values.schema.json
+++ b/charts/regions/values.schema.json
@@ -532,6 +532,9 @@
                                 "auth": {
                                     "type": "string"
                                 },
+                                "connectivity": {
+                                    "type": "string"
+                                },
                                 "gateway": {
                                     "type": "string"
                                 },
diff --git a/charts/regions/values.yaml b/charts/regions/values.yaml
index 6d8e5eb4..1fe28856 100644
--- a/charts/regions/values.yaml
+++ b/charts/regions/values.yaml
@@ -210,6 +210,7 @@ versions:
       webhooks: v2.5.4
     v4.0-beta:
       auth: v2.5.1
+      connectivity: 1.0.0-beta.2
       gateway: v2.3.2
       ledger: v3.0.0-beta.5
       mcp: v0.3.0

From 1322c42044dd6e4333c0d49ca7fc9060d1afda9d Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Thu, 8 Oct 2026 17:50:28 +0200
Subject: [PATCH 5/7] chore(regions): use the packaged Connectivity Operator
 image default

---
 charts/formance/README.md         |  1 -
 charts/regions/README.md          |  4 ++--
 charts/regions/README.md.gotmpl   |  3 ++-
 charts/regions/values.schema.json | 13 -------------
 charts/regions/values.yaml        |  7 -------
 5 files changed, 4 insertions(+), 24 deletions(-)

diff --git a/charts/formance/README.md b/charts/formance/README.md
index 68bd67e6..3805b154 100644
--- a/charts/formance/README.md
+++ b/charts/formance/README.md
@@ -744,7 +744,6 @@ Kubernetes: `>=1.14.0-0`
 | regions.agent.server.address | string | `"app.formance.cloud:443"` |  |
 | regions.agent.server.tls.enabled | bool | `true` |  |
 | regions.agent.server.tls.insecureSkipVerify | bool | `true` |  |
-| regions.connectivity-operator.image.tag | string | `"1.0.0-beta.2"` |  |
 | regions.fullnameOverride | string | `""` |  |
 | regions.ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
 | regions.ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
diff --git a/charts/regions/README.md b/charts/regions/README.md
index f7ca0753..31cf609e 100644
--- a/charts/regions/README.md
+++ b/charts/regions/README.md
@@ -28,7 +28,8 @@ Formance Private Regions Helm Chart
 Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
 and `operator.ledger.enabled=true` to install the Connectivity Operator and its
 CRDs. The opt-in is disabled by default. The dependency and Operator image are
-pinned to `1.0.0-beta.2`; the chart includes the matching CRDs.
+pinned to `1.0.0-beta.2`; the image uses the packaged `appVersion` default.
+The chart includes the matching CRDs.
 
 Core and API are separate published components. Their images are selected by the
 Stack Operator from the Connectivity module version, not from this Operator
@@ -120,7 +121,6 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | agent.server.address | string | `"app.formance.cloud:443"` |  |
 | agent.server.tls.enabled | bool | `true` |  |
 | agent.server.tls.insecureSkipVerify | bool | `true` |  |
-| connectivity-operator.image.tag | string | `"1.0.0-beta.2"` |  |
 | fullnameOverride | string | `""` |  |
 | ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
 | ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
diff --git a/charts/regions/README.md.gotmpl b/charts/regions/README.md.gotmpl
index 020c1036..0da2287b 100644
--- a/charts/regions/README.md.gotmpl
+++ b/charts/regions/README.md.gotmpl
@@ -14,7 +14,8 @@
 Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
 and `operator.ledger.enabled=true` to install the Connectivity Operator and its
 CRDs. The opt-in is disabled by default. The dependency and Operator image are
-pinned to `1.0.0-beta.2`; the chart includes the matching CRDs.
+pinned to `1.0.0-beta.2`; the image uses the packaged `appVersion` default.
+The chart includes the matching CRDs.
 
 Core and API are separate published components. Their images are selected by the
 Stack Operator from the Connectivity module version, not from this Operator
diff --git a/charts/regions/values.schema.json b/charts/regions/values.schema.json
index f86926c8..c1161d88 100644
--- a/charts/regions/values.schema.json
+++ b/charts/regions/values.schema.json
@@ -65,19 +65,6 @@
                 }
             }
         },
-        "connectivity-operator": {
-            "type": "object",
-            "properties": {
-                "image": {
-                    "type": "object",
-                    "properties": {
-                        "tag": {
-                            "type": "string"
-                        }
-                    }
-                }
-            }
-        },
         "fullnameOverride": {
             "type": "string"
         },
diff --git a/charts/regions/values.yaml b/charts/regions/values.yaml
index 1fe28856..34400006 100644
--- a/charts/regions/values.yaml
+++ b/charts/regions/values.yaml
@@ -94,13 +94,6 @@ ledger-operator:
   ledgerImage:
     tag: "v3.0.0-beta.1"
 
-# Operator chart and image are independently published component artifacts.
-# Core and API images are selected by the Stack Operator from the Connectivity
-# module version; configure that module explicitly to avoid floating images.
-connectivity-operator:
-  image:
-    tag: "1.0.0-beta.2"
-
 agent:
   enabled: false
 

From 37eec2a8efaf1314ec3dde18110bae0fbb2f923a Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:02:56 +0200
Subject: [PATCH 6/7] chore(regions): align Ledger v3 dependencies with beta.10

---
 charts/formance/README.md       |  6 +++---
 charts/regions/Chart.lock       |  6 +++---
 charts/regions/Chart.yaml       |  2 +-
 charts/regions/README.md        | 17 +++++++++++++----
 charts/regions/README.md.gotmpl |  9 +++++++++
 charts/regions/values.yaml      |  8 +++++---
 6 files changed, 34 insertions(+), 14 deletions(-)

diff --git a/charts/formance/README.md b/charts/formance/README.md
index 3805b154..2da12d92 100644
--- a/charts/formance/README.md
+++ b/charts/formance/README.md
@@ -745,8 +745,8 @@ Kubernetes: `>=1.14.0-0`
 | regions.agent.server.tls.enabled | bool | `true` |  |
 | regions.agent.server.tls.insecureSkipVerify | bool | `true` |  |
 | regions.fullnameOverride | string | `""` |  |
-| regions.ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
-| regions.ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
+| regions.ledger-operator.image.tag | string | `"v3.0.0-beta.10"` |  |
+| regions.ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.10"` |  |
 | regions.nameOverride | string | `""` |  |
 | regions.operator.fullnameOverride | string | `"operator"` |  |
 | regions.operator.image.repository | string | `"ghcr.io/formancehq/operator"` |  |
@@ -828,7 +828,7 @@ Kubernetes: `>=1.14.0-0`
 | regions.versions.files."v4.0-beta".auth | string | `"v2.5.1"` |  |
 | regions.versions.files."v4.0-beta".connectivity | string | `"1.0.0-beta.2"` |  |
 | regions.versions.files."v4.0-beta".gateway | string | `"v2.3.2"` |  |
-| regions.versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.5"` |  |
+| regions.versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.10"` |  |
 | regions.versions.files."v4.0-beta".mcp | string | `"v0.3.0"` |  |
 | regions.versions.files."v4.0-beta".orchestration | string | `"v2.7.0"` |  |
 | regions.versions.files."v4.0-beta".payments | string | `"v3.4.8"` |  |
diff --git a/charts/regions/Chart.lock b/charts/regions/Chart.lock
index 5e8b23b2..83eafae5 100644
--- a/charts/regions/Chart.lock
+++ b/charts/regions/Chart.lock
@@ -7,12 +7,12 @@ dependencies:
   version: 3.16.0
 - name: ledger-operator
   repository: oci://ghcr.io/formancehq/helm
-  version: 3.0.0-beta.1
+  version: 3.0.0-beta.10
 - name: connectivity-operator
   repository: oci://ghcr.io/formancehq/helm
   version: 1.0.0-beta.2
 - name: core
   repository: file://../core
   version: 1.6.0
-digest: sha256:13dd4cf48477e062d217e23555d4deb0af8b10b1ff182e660eccb94fd523f0ba
-generated: "2026-10-08T17:29:43.680229+02:00"
+digest: sha256:795e6bf9119267ccb34f4dcb83cfa5b9858f0c0f379b31a247eb91b485e141a6
+generated: "2026-10-08T18:00:41.994534+02:00"
diff --git a/charts/regions/Chart.yaml b/charts/regions/Chart.yaml
index 6cb6109f..4ffd77f9 100644
--- a/charts/regions/Chart.yaml
+++ b/charts/regions/Chart.yaml
@@ -24,7 +24,7 @@ dependencies:
     repository: "oci://ghcr.io/formancehq/helm"
     condition: operator.enabled
   - name: ledger-operator
-    version: 3.0.0-beta.1
+    version: 3.0.0-beta.10
     repository: "oci://ghcr.io/formancehq/helm"
     condition: operator.ledger.enabled
   - name: connectivity-operator
diff --git a/charts/regions/README.md b/charts/regions/README.md
index 31cf609e..bff1eb27 100644
--- a/charts/regions/README.md
+++ b/charts/regions/README.md
@@ -10,7 +10,7 @@ Formance Private Regions Helm Chart
 | file://../agent | agent | 2.X |
 | file://../core | core | 1.X |
 | oci://ghcr.io/formancehq/helm | connectivity-operator | 1.0.0-beta.2 |
-| oci://ghcr.io/formancehq/helm | ledger-operator | 3.0.0-beta.1 |
+| oci://ghcr.io/formancehq/helm | ledger-operator | 3.0.0-beta.10 |
 | oci://ghcr.io/formancehq/helm | operator | 3.X |
 
 ## Maintainers
@@ -37,6 +37,15 @@ chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or it
 Versions resource. Stack Operator `3.16.0` uses the same module version for both
 images and overwrites delegated image fields during reconciliation.
 
+The `v4.0-beta` Versions profile selects Ledger `v3.0.0-beta.10` together with
+Connectivity `1.0.0-beta.2`. Ledger Operator chart and images also select beta.10;
+its published chart uses `latest` image defaults, so these tags remain explicit.
+Both components use Ledger protocol `20`; this alone does not establish descriptor
+or credential compatibility. Ledger Operator beta.10 replaces `Credentials.spec.god`
+with `superuser`. Qualify the Stack producer's credential contract before rollout.
+This profile change can affect existing consumers using the shared Versions resource,
+independently of this chart's Connectivity Operator installation opt-in.
+
 Before enabling the module, qualify the target Ledger, Credentials CRD, and key
 registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
 matching reflected BucketService descriptors before each Apply. Installing this
@@ -122,8 +131,8 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | agent.server.tls.enabled | bool | `true` |  |
 | agent.server.tls.insecureSkipVerify | bool | `true` |  |
 | fullnameOverride | string | `""` |  |
-| ledger-operator.image.tag | string | `"v3.0.0-beta.1"` |  |
-| ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.1"` |  |
+| ledger-operator.image.tag | string | `"v3.0.0-beta.10"` |  |
+| ledger-operator.ledgerImage.tag | string | `"v3.0.0-beta.10"` |  |
 | nameOverride | string | `""` |  |
 | operator.fullnameOverride | string | `"operator"` |  |
 | operator.image.repository | string | `"ghcr.io/formancehq/operator"` |  |
@@ -205,7 +214,7 @@ Then configure it through the `global.licence.token` and `global.licence.cluster
 | versions.files."v4.0-beta".auth | string | `"v2.5.1"` |  |
 | versions.files."v4.0-beta".connectivity | string | `"1.0.0-beta.2"` |  |
 | versions.files."v4.0-beta".gateway | string | `"v2.3.2"` |  |
-| versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.5"` |  |
+| versions.files."v4.0-beta".ledger | string | `"v3.0.0-beta.10"` |  |
 | versions.files."v4.0-beta".mcp | string | `"v0.3.0"` |  |
 | versions.files."v4.0-beta".orchestration | string | `"v2.7.0"` |  |
 | versions.files."v4.0-beta".payments | string | `"v3.4.8"` |  |
diff --git a/charts/regions/README.md.gotmpl b/charts/regions/README.md.gotmpl
index 0da2287b..6eea4122 100644
--- a/charts/regions/README.md.gotmpl
+++ b/charts/regions/README.md.gotmpl
@@ -23,6 +23,15 @@ chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or it
 Versions resource. Stack Operator `3.16.0` uses the same module version for both
 images and overwrites delegated image fields during reconciliation.
 
+The `v4.0-beta` Versions profile selects Ledger `v3.0.0-beta.10` together with
+Connectivity `1.0.0-beta.2`. Ledger Operator chart and images also select beta.10;
+its published chart uses `latest` image defaults, so these tags remain explicit.
+Both components use Ledger protocol `20`; this alone does not establish descriptor
+or credential compatibility. Ledger Operator beta.10 replaces `Credentials.spec.god`
+with `superuser`. Qualify the Stack producer's credential contract before rollout.
+This profile change can affect existing consumers using the shared Versions resource,
+independently of this chart's Connectivity Operator installation opt-in.
+
 Before enabling the module, qualify the target Ledger, Credentials CRD, and key
 registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
 matching reflected BucketService descriptors before each Apply. Installing this
diff --git a/charts/regions/values.yaml b/charts/regions/values.yaml
index 34400006..42d3b676 100644
--- a/charts/regions/values.yaml
+++ b/charts/regions/values.yaml
@@ -87,12 +87,14 @@ operator:
   operator-crds:
     create: false
 
+# The published beta.10 chart uses latest for both image tags, not appVersion.
+# Keep explicit release tags until the upstream chart defaults are versioned.
 ledger-operator:
   image:
-    tag: "v3.0.0-beta.1"
+    tag: "v3.0.0-beta.10"
 
   ledgerImage:
-    tag: "v3.0.0-beta.1"
+    tag: "v3.0.0-beta.10"
 
 agent:
   enabled: false
@@ -205,7 +207,7 @@ versions:
       auth: v2.5.1
       connectivity: 1.0.0-beta.2
       gateway: v2.3.2
-      ledger: v3.0.0-beta.5
+      ledger: v3.0.0-beta.10
       mcp: v0.3.0
       orchestration: v2.7.0
       payments: v3.4.8

From 9f427ca64aeb1c1fa0f00a9fee745bd42999ec74 Mon Sep 17 00:00:00 2001
From: David Ragot <35502263+Dav-14@users.noreply.github.com>
Date: Thu, 8 Oct 2026 18:10:03 +0200
Subject: [PATCH 7/7] chore(regions): consume Stack Operator 3.17.0

---
 charts/regions/Chart.lock       |  6 +++---
 charts/regions/README.md        | 28 ----------------------------
 charts/regions/README.md.gotmpl | 28 ----------------------------
 3 files changed, 3 insertions(+), 59 deletions(-)

diff --git a/charts/regions/Chart.lock b/charts/regions/Chart.lock
index 83eafae5..81674345 100644
--- a/charts/regions/Chart.lock
+++ b/charts/regions/Chart.lock
@@ -4,7 +4,7 @@ dependencies:
   version: 2.17.0
 - name: operator
   repository: oci://ghcr.io/formancehq/helm
-  version: 3.16.0
+  version: 3.17.0
 - name: ledger-operator
   repository: oci://ghcr.io/formancehq/helm
   version: 3.0.0-beta.10
@@ -14,5 +14,5 @@ dependencies:
 - name: core
   repository: file://../core
   version: 1.6.0
-digest: sha256:795e6bf9119267ccb34f4dcb83cfa5b9858f0c0f379b31a247eb91b485e141a6
-generated: "2026-10-08T18:00:41.994534+02:00"
+digest: sha256:96269e95f11118790fdf21d1158b5347c2b75d207d443e927abc5bc73f9fd2c4
+generated: "2026-10-08T18:15:09.407005+02:00"
diff --git a/charts/regions/README.md b/charts/regions/README.md
index bff1eb27..ada9bb38 100644
--- a/charts/regions/README.md
+++ b/charts/regions/README.md
@@ -23,34 +23,6 @@ Formance Private Regions Helm Chart
 
 * <https://github.com/formancehq/helm/tree/main/charts/regions>
 
-## Connectivity Operator
-
-Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
-and `operator.ledger.enabled=true` to install the Connectivity Operator and its
-CRDs. The opt-in is disabled by default. The dependency and Operator image are
-pinned to `1.0.0-beta.2`; the image uses the packaged `appVersion` default.
-The chart includes the matching CRDs.
-
-Core and API are separate published components. Their images are selected by the
-Stack Operator from the Connectivity module version, not from this Operator
-chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or its
-Versions resource. Stack Operator `3.16.0` uses the same module version for both
-images and overwrites delegated image fields during reconciliation.
-
-The `v4.0-beta` Versions profile selects Ledger `v3.0.0-beta.10` together with
-Connectivity `1.0.0-beta.2`. Ledger Operator chart and images also select beta.10;
-its published chart uses `latest` image defaults, so these tags remain explicit.
-Both components use Ledger protocol `20`; this alone does not establish descriptor
-or credential compatibility. Ledger Operator beta.10 replaces `Credentials.spec.god`
-with `superuser`. Qualify the Stack producer's credential contract before rollout.
-This profile change can affect existing consumers using the shared Versions resource,
-independently of this chart's Connectivity Operator installation opt-in.
-
-Before enabling the module, qualify the target Ledger, Credentials CRD, and key
-registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
-matching reflected BucketService descriptors before each Apply. Installing this
-chart does not establish runtime compatibility or change Ledger defaults.
-
 ## Migration
 
 #### EE Licence
diff --git a/charts/regions/README.md.gotmpl b/charts/regions/README.md.gotmpl
index 6eea4122..ca967c32 100644
--- a/charts/regions/README.md.gotmpl
+++ b/charts/regions/README.md.gotmpl
@@ -9,34 +9,6 @@
 
 {{ template "chart.sourcesSection" . }}
 
-## Connectivity Operator
-
-Set `operator.connectivity.enabled=true` together with `operator.enabled=true`
-and `operator.ledger.enabled=true` to install the Connectivity Operator and its
-CRDs. The opt-in is disabled by default. The dependency and Operator image are
-pinned to `1.0.0-beta.2`; the image uses the packaged `appVersion` default.
-The chart includes the matching CRDs.
-
-Core and API are separate published components. Their images are selected by the
-Stack Operator from the Connectivity module version, not from this Operator
-chart. Select `1.0.0-beta.2` explicitly for the target Connectivity module or its
-Versions resource. Stack Operator `3.16.0` uses the same module version for both
-images and overwrites delegated image fields during reconciliation.
-
-The `v4.0-beta` Versions profile selects Ledger `v3.0.0-beta.10` together with
-Connectivity `1.0.0-beta.2`. Ledger Operator chart and images also select beta.10;
-its published chart uses `latest` image defaults, so these tags remain explicit.
-Both components use Ledger protocol `20`; this alone does not establish descriptor
-or credential compatibility. Ledger Operator beta.10 replaces `Credentials.spec.god`
-with `superuser`. Qualify the Stack producer's credential contract before rollout.
-This profile change can affect existing consumers using the shared Versions resource,
-independently of this chart's Connectivity Operator installation opt-in.
-
-Before enabling the module, qualify the target Ledger, Credentials CRD, and key
-registration contract. Core `1.0.0-beta.2` requires Ledger protocol `20` and
-matching reflected BucketService descriptors before each Apply. Installing this
-chart does not establish runtime compatibility or change Ledger defaults.
-
 ## Migration
 
 #### EE Licence