diff --git a/README.md b/README.md index 2b05c367..e9450814 100644 --- a/README.md +++ b/README.md @@ -5,10 +5,11 @@ | Readme | Chart Version | App Version | Description | Hub | |--------|---------------|-------------|-------------|-----| | [Agent](./charts/agent/README.md) | 2.17.0 | v2.12.0 | Formance Membership Agent Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/agent)](https://artifacthub.io/packages/search?repo=agent) | -| [Cloudprem](./charts/cloudprem/README.md) | 6.1.0 | latest | Formance control-plane | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) | +| [Cloudprem](./charts/cloudprem/README.md) | 6.2.0 | latest | Formance control-plane | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) | +| [Console](./charts/console/README.md) | 0.1.0 | latest | Formance Console (v4) | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/console)](https://artifacthub.io/packages/search?repo=console) | | [Console-V3](./charts/console-v3/README.md) | 5.0.2 | v4.0.2 | Formance Console | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/console-v3)](https://artifacthub.io/packages/search?repo=console-v3) | | [Core](./charts/core/README.md) | 1.6.0 | latest | Formance Core Library | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/core)](https://artifacthub.io/packages/search?repo=core) | -| [Formance](./charts/formance/README.md) | 3.3.0 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) | +| [Formance](./charts/formance/README.md) | 3.4.0 | latest | Formance Platform - Unified Helm Chart | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/formance)](https://artifacthub.io/packages/search?repo=formance) | | [Identity](./charts/identity/README.md) | 0.1.0 | 4a542c9f48b3799fe4a7f06c75c62a75b83afd0b | Formance Identity service | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/identity)](https://artifacthub.io/packages/search?repo=identity) | | [Ledger-Ui](./charts/ledger-ui/README.md) | 0.1.0 | latest | Formance Ledger UI | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/ledger-ui)](https://artifacthub.io/packages/search?repo=ledger-ui) | | [Membership](./charts/membership/README.md) | 3.7.2 | v2.5.0 | Formance EE Membership API. Manage stacks, organizations, regions, invitations, users, roles, and permissions. | [![Artifact HUB](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/membership)](https://artifacthub.io/packages/search?repo=membership) | diff --git a/charts/cloudprem/Chart.lock b/charts/cloudprem/Chart.lock index 2b897354..6e42730b 100644 --- a/charts/cloudprem/Chart.lock +++ b/charts/cloudprem/Chart.lock @@ -14,5 +14,8 @@ dependencies: - name: ledger-ui repository: file://../ledger-ui version: 0.1.0 -digest: sha256:940feee67523dace4d6ca9840a2e7b834ec16b17334c9b8ce7d7574fb72066bd -generated: "2026-09-29T14:13:43.392383+02:00" +- name: console + repository: file://../console + version: 0.1.0 +digest: sha256:84384e334a053ba46c5012dfcfd5021a36f04a2fd5cad17f1fd8b09aa2460569 +generated: "2026-10-12T20:13:31.52604768+02:00" diff --git a/charts/cloudprem/Chart.yaml b/charts/cloudprem/Chart.yaml index da268bb0..aac6dcc2 100644 --- a/charts/cloudprem/Chart.yaml +++ b/charts/cloudprem/Chart.yaml @@ -32,7 +32,7 @@ type: application # This is the chart version. This version number should be incremented each time you make changes # to the chart and its templates, including the app version. # Versions are expected to follow Semantic Versioning (https://semver.org/) -version: 6.1.0 +version: 6.2.0 # This is the version number of the application being deployed. This version number should be # incremented each time you make changes to the application. Versions are not expected to @@ -69,3 +69,8 @@ dependencies: version: 0.X repository: file://../ledger-ui condition: global.platform.ledgerUi.enabled + +- name: console + version: 0.X + repository: file://../console + condition: global.platform.console.enabled diff --git a/charts/cloudprem/README.md b/charts/cloudprem/README.md index 5bea2cca..5e91a7d2 100644 --- a/charts/cloudprem/README.md +++ b/charts/cloudprem/README.md @@ -1,7 +1,7 @@ # Formance cloudprem Helm chart [![Artifact Hub](https://img.shields.io/endpoint?url=https://artifacthub.io/badge/repository/cloudprem)](https://artifacthub.io/packages/search?repo=cloudprem) -![Version: 6.1.0](https://img.shields.io/badge/Version-6.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) +![Version: 6.2.0](https://img.shields.io/badge/Version-6.2.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) Formance control-plane @@ -14,6 +14,7 @@ Kubernetes: `>=1.14.0-0` | Repository | Name | Version | |------------|------|---------| | file://../console-v3 | console-v3 | 5.X | +| file://../console | console | 0.X | | file://../identity | identity | 0.X | | file://../ledger-ui | ledger-ui | 0.X | | file://../membership | membership | 3.X | @@ -420,6 +421,14 @@ Dex: | global.monitoring.traces.insecure | bool | `true` | Insecure | | global.monitoring.traces.mode | string | `"grpc"` | Mode | | global.monitoring.traces.port | int | `4317` | Port | +| global.platform.console | object | `{"host":"console.{{ .Values.global.serviceHost }}","oauth":{"client":{"existingSecret":"console-secrets","id":"console","postLogoutRedirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/logout\n","redirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login\n- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login-by-org\n","scopes":["accesses","remember_me","keep_refresh_token","on_behalf"],"secret":"","secretKeys":{"secret":"oauth"}}},"scheme":"https"}` | Console | +| global.platform.console.enabled | bool | `false` | Enable the Console for v4 stacks | +| global.platform.console.host | string | `"console.{{ .Values.global.serviceHost }}"` | Public Console host | +| global.platform.console.oauth.client.existingSecret | string | `"console-secrets"` | is the name of the secret | +| global.platform.console.oauth.client.id | string | `"console"` | is the id of the client | +| global.platform.console.oauth.client.secret | string | `""` | is the secret of the client | +| global.platform.console.oauth.client.secretKeys | object | `{"secret":"oauth"}` | is the key contained within the secret | +| global.platform.console.scheme | string | `"https"` | Public Console URL scheme | | global.platform.consoleV3 | object | `{"host":"console.v3.{{ .Values.global.serviceHost }}","oauth":{"client":{"existingSecret":"","id":"console-v3","postLogoutRedirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/logout\n","redirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/login\n- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/login-by-org\n","scopes":["accesses","remember_me","keep_refresh_token","on_behalf"],"secret":"changeMe2","secretKeys":{"secret":""}}},"scheme":"https"}` | Console V3: EXPERIMENTAL | | global.platform.consoleV3.enabled | bool | `true` | Enable console-v3 | | global.platform.consoleV3.host | string | `"console.v3.{{ .Values.global.serviceHost }}"` | is the host for the console | @@ -498,24 +507,29 @@ Dex: | global.platform.stargate.enabled | bool | `false` | if enabled, the stackApiUrl is not required It will be templated with `{{ printf "http://%s-%s:8080/#{organizationId}/#{stackId}/api" .Release.Name "stargate" -}}` | | global.platform.stargate.stackApiUrl | string | `""` | if stargate is disabled, the stackApiUrl is defaulted to the `http://gateway.#{organizationId}-#{stackId}.svc:8080/api` To allow external access sets the stackApiUrl to an external url | -### Migration configuration +### Console configuration | Key | Type | Default | Description | |-----|------|---------|-------------| -| console-v3.config.migration.enabled | bool | `true` | Enable migration job with a separated user | -| ledger-ui.config.migration.enabled | bool | `true` | Enable migration job with a separated user | -| portal.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| console.config.authenticationEnabled | string | `"1"` | Toggle OAuth/DB sessions on the app. `"1"` = stack mode (default): the app uses Membership/OAuth and reaches the stack API through API_STACK_URL. `"0"` = micro-stack / auth-less mode: the app skips OAuth and reads API_STACK_URL directly. | +| console.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | +| console-v3.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | -### Console configuration +### Migration configuration | Key | Type | Default | Description | |-----|------|---------|-------------| -| console-v3.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | +| console.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| console-v3.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| ledger-ui.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| portal.config.migration.enabled | bool | `true` | Enable migration job with a separated user | ### Publisher configuration | Key | Type | Default | Description | |-----|------|---------|-------------| +| console.config.publisher.clientID | string | `"console"` | NATS client ID | +| console.config.publisher.topicMapping | string | `"console"` | NATS topic mapping | | console-v3.config.publisher.clientID | string | `"console-v3"` | NATS client ID | | console-v3.config.publisher.topicMapping | string | `"console-v3"` | NATS topic mapping | | ledger-ui.config.publisher.clientID | string | `"ledger-ui"` | NATS client ID | @@ -523,25 +537,32 @@ Dex: | portal.config.publisher.clientID | string | `"portal"` | NATS client ID | | portal.config.publisher.topicMapping | string | `"portal"` | NATS topic mapping | -### Membership Feature +### Console Feature | Key | Type | Default | Description | |-----|------|---------|-------------| -| console-v3.feature.migrationHooks | bool | `false` | Run migration in a hook | -| membership.feature.disableEvents | bool | `true` | Membership feature disable events | -| membership.feature.managedStacks | bool | `true` | Membership feature managed stacks | -| membership.feature.migrationHooks | bool | `false` | Run migration in a hook | -| portal.feature.migrationHooks | bool | `false` | Run migration in a hook | +| console.feature.migrationHooks | bool | `true` | Run migration in a hook | ### Postgresql configuration | Key | Type | Default | Description | |-----|------|---------|-------------| +| console.postgresql.enabled | bool | `false` | Enable postgresql | | console-v3.postgresql.enabled | bool | `false` | Enable postgresql | | ledger-ui.postgresql.enabled | bool | `false` | Enable postgresql | | membership.postgresql.enabled | bool | `true` | Enable postgresql | | portal.postgresql.enabled | bool | `false` | Enable postgresql | +### Membership Feature + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| console-v3.feature.migrationHooks | bool | `false` | Run migration in a hook | +| membership.feature.disableEvents | bool | `true` | Membership feature disable events | +| membership.feature.managedStacks | bool | `true` | Membership feature managed stacks | +| membership.feature.migrationHooks | bool | `false` | Run migration in a hook | +| portal.feature.migrationHooks | bool | `false` | Run migration in a hook | + ### Ledger UI configuration | Key | Type | Default | Description | @@ -616,6 +637,69 @@ Dex: | global.platform.portal.oauth.client.scopes[3] | string | `"on_behalf"` | | | global.platform.stargate.serverURL | string | `""` | | | global.platform.stargate.tls.disable | bool | `false` | | +| console.affinity | object | `{}` | Console affinity | +| console.annotations | object | `{}` | Console annotations | +| console.autoscaling.enabled | bool | `false` | | +| console.autoscaling.maxReplicas | int | `100` | | +| console.autoscaling.minReplicas | int | `1` | | +| console.autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| console.aws.targetGroups.http.ipAddressType | string | `"ipv4"` | Target group IP address type | +| console.aws.targetGroups.http.serviceRef.name | string | `"{{ include \"core.fullname\" $ }}"` | Target group service reference name | +| console.aws.targetGroups.http.serviceRef.port | string | `"{{ .Values.service.ports.http.port }}"` | Target group service reference port | +| console.aws.targetGroups.http.targetGroupARN | string | `""` | Target group ARN | +| console.aws.targetGroups.http.targetGroupName | string | `""` | Target group name, used when its ARN is not known before provisioning | +| console.aws.targetGroups.http.targetType | string | `"ip"` | Target group target type | +| console.config.additionalEnv | list | `[]` | Console additional environment variables | +| console.config.cookie.encryptionKey | string | `""` | is used to encrypt a cookie value | +| console.config.cookie.existingSecret | string | `"console-secrets"` | is the name of the secret | +| console.config.cookie.secretKeys | object | `{"encryptionKey":"cookie"}` | is the key contained within the secret | +| console.config.environment | string | `"production"` | Console environment | +| console.config.migration.annotations | object | `{}` | Console job migration annotations Argo CD translate `pre-install,pre-upgrade` to: argocd.argoproj.io/hook: PreSync | +| console.config.migration.serviceAccount.annotations | object | `{}` | | +| console.config.migration.serviceAccount.create | bool | `true` | | +| console.config.migration.serviceAccount.name | string | `""` | | +| console.config.migration.ttlSecondsAfterFinished | string | `""` | | +| console.config.migration.volumeMounts | list | `[]` | | +| console.config.migration.volumes | list | `[]` | | +| console.config.postgresql.auth.database | string | `"console"` | | +| console.config.sentry.authToken | object | `{"existingSecret":"","secretKeys":{"value":""},"value":""}` | Sentry Auth Token | +| console.config.sentry.dsn | string | `""` | Sentry DSN | +| console.config.sentry.enabled | bool | `false` | Sentry enabled | +| console.config.sentry.environment | string | `""` | Sentry environment | +| console.config.sentry.release | string | `""` | Sentry release | +| console.config.stargate_url | string | `""` | Deprecated | +| console.image.pullPolicy | string | `"IfNotPresent"` | image pull policy | +| console.image.repository | string | `"ghcr.io/formancehq/console"` | image repository | +| console.image.tag | string | `""` | image tag | +| console.imagePullSecrets | list | `[]` | image pull secrets | +| console.ingress.annotations | object | `{}` | ingress annotations | +| console.ingress.className | string | `""` | ingress class name | +| console.ingress.enabled | bool | `true` | ingress enabled | +| console.ingress.hosts[0] | object | `{"host":"{{ tpl .Values.global.platform.console.host $ }}","paths":[{"path":"/","pathType":"Prefix"}]}` | ingress host | +| console.ingress.hosts[0].paths[0] | object | `{"path":"/","pathType":"Prefix"}` | ingress path | +| console.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | ingress path type | +| console.ingress.labels | object | `{}` | ingress labels | +| console.ingress.tls | list | `[]` | ingress tls | +| console.livenessProbe | object | `{}` | Console liveness probe | +| console.nodeSelector | object | `{}` | Console node selector | +| console.podDisruptionBudget.enabled | bool | `false` | Enable pod disruption budget | +| console.podDisruptionBudget.maxUnavailable | int | `0` | Maximum unavailable pods | +| console.podDisruptionBudget.minAvailable | int | `1` | Minimum available pods | +| console.podSecurityContext | object | `{}` | Pod Security Context | +| console.readinessProbe | object | `{}` | Console readiness probe | +| console.replicas | int | `1` | Number of replicas | +| console.resources | object | `{}` | Console resources | +| console.securityContext | object | `{}` | Container Security Context | +| console.service.annotations | object | `{}` | service annotations | +| console.service.clusterIP | string | `""` | service cluster IP | +| console.service.ports.http | object | `{"port":3000}` | service http port | +| console.service.type | string | `"ClusterIP"` | service type | +| console.serviceAccount.annotations | object | `{}` | Service account annotations | +| console.serviceAccount.create | bool | `true` | Service account creation | +| console.serviceAccount.name | string | `""` | Service account name | +| console.tolerations | list | `[]` | Console tolerations | +| console.volumeMounts | list | `[]` | Console volume mounts | +| console.volumes | list | `[]` | Console volumes | | console-v3.affinity | object | `{}` | Console affinity | | console-v3.annotations | object | `{}` | Console annotations | | console-v3.autoscaling.enabled | bool | `false` | | diff --git a/charts/cloudprem/values.schema.json b/charts/cloudprem/values.schema.json index 86ea58f5..91352c45 100644 --- a/charts/cloudprem/values.schema.json +++ b/charts/cloudprem/values.schema.json @@ -115,6 +115,20 @@ "platform": { "type": "object", "properties": { + "console": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "host": { + "type": "string" + }, + "scheme": { + "type": "string" + } + } + }, "consoleV3": { "type": "object", "properties": { diff --git a/charts/cloudprem/values.yaml b/charts/cloudprem/values.yaml index e5ec7aa5..0c713ddd 100644 --- a/charts/cloudprem/values.yaml +++ b/charts/cloudprem/values.yaml @@ -74,6 +74,16 @@ global: # -- Key containing the Membership client secret. # @section -- Global configuration secret: "" + console: + # -- Enable the Console for v4 stacks + # @section -- Global configuration + enabled: false + # -- Public Console URL scheme + # @section -- Global configuration + scheme: "https" + # -- Public Console host + # @section -- Global configuration + host: "console.{{ .Values.global.serviceHost }}" consoleV3: # -- Enable console-v3 # @section -- Global configuration diff --git a/charts/console/.helmignore b/charts/console/.helmignore new file mode 100644 index 00000000..0e8a0eb3 --- /dev/null +++ b/charts/console/.helmignore @@ -0,0 +1,23 @@ +# Patterns to ignore when building packages. +# This supports shell glob matching, relative path matching, and +# negation (prefixed with !). Only one pattern per line. +.DS_Store +# Common VCS dirs +.git/ +.gitignore +.bzr/ +.bzrignore +.hg/ +.hgignore +.svn/ +# Common backup files +*.swp +*.bak +*.tmp +*.orig +*~ +# Various IDEs +.project +.idea/ +*.tmproj +.vscode/ diff --git a/charts/console/Chart.lock b/charts/console/Chart.lock new file mode 100644 index 00000000..24a2a441 --- /dev/null +++ b/charts/console/Chart.lock @@ -0,0 +1,9 @@ +dependencies: +- name: core + repository: file://../core + version: 1.6.0 +- name: postgresql + repository: oci://registry-1.docker.io/bitnamicharts + version: 18.12.4 +digest: sha256:5457fc098855d743bb2670c9016833fb6c703922dd49ca80476bd66d0074af04 +generated: "2026-09-29T14:13:23.660336+02:00" diff --git a/charts/console/Chart.yaml b/charts/console/Chart.yaml new file mode 100644 index 00000000..d6d27e25 --- /dev/null +++ b/charts/console/Chart.yaml @@ -0,0 +1,55 @@ +apiVersion: v2 +name: console +description: Formance Console (v4) + +annotations: + formance.com/monorepo: "apps/console" + artifacthub.io/images: | + - name: console + image: ghcr.io/formancehq/console + whitelisted: true + +home: "https://formance.com" + +maintainers: +- name: "Formance Team" + email: "support@formance.com" +icon: "https://avatars.githubusercontent.com/u/84325077?s=200&v=4" + +# A chart can be either an 'application' or a 'library' chart. +# +# Application charts are a collection of templates that can be packaged into versioned archives +# to be deployed. +# +# Library charts provide useful utilities or functions for the chart developer. They're included as +# a dependency of application charts to inject those utilities and functions into the rendering +# pipeline. Library charts do not define any templates and therefore cannot be deployed. +type: application + +# This is the chart version. This version number should be incremented each time you make changes +# to the chart and its templates, including the app version. +# Versions are expected to follow Semantic Versioning (https://semver.org/) +version: 0.1.0 + +# This is the version number of the application being deployed. This version number should be +# incremented each time you make changes to the application. Versions are not expected to +# follow Semantic Versioning. They should reflect the version the application is using. +# It is recommended to use it with quotes. +appVersion: "latest" +# The "-0" suffix is required for GKE compatibility. GKE versions contain +# build metadata like "v1.33.5-gke.2392000" which semver treats as pre-release. +# Without "-0", Helm rejects these versions as incompatible. +# See: https://codeengineered.com/blog/2022/helm-kubeversion-gke/ +kubeVersion: ">=1.14.0-0" +sources: +- "https://github.com/formancehq/helm/tree/main/charts/console" +- "https://github.com/formancehq/platform-ui" + +dependencies: +- name: core + version: "1.X" + repository: file://../core +- name: postgresql + repository: oci://registry-1.docker.io/bitnamicharts + version: 18.X + condition: postgresql.enabled diff --git a/charts/console/Earthfile b/charts/console/Earthfile new file mode 100644 index 00000000..f897bb67 --- /dev/null +++ b/charts/console/Earthfile @@ -0,0 +1,41 @@ +VERSION --wildcard-builds --wildcard-copy 0.8 + +IMPORT ../ AS charts +IMPORT ../core AS core + +schema: + FROM charts+schema-base + WORKDIR /src + DO --pass-args charts+SCHEMA + +readme: + FROM charts+readme-base + WORKDIR /src/core + COPY --dir (core+dependencies/*) . + WORKDIR /src/console + COPY --dir (+dependencies/*) . + DO --pass-args charts+README_GENERATOR + +sources: + DO --pass-args charts+BASE + WORKDIR /src/console + COPY (+schema/*) . + DO --pass-args charts+SOURCES + +dependencies: + FROM +sources + WORKDIR /src/core + COPY --dir (core+dependencies/*) . + WORKDIR /src/console + DO --pass-args charts+DEPENDENCIES + +validate: + FROM +dependencies + WORKDIR /src/console + COPY (+readme/*) . + DO --pass-args charts+VALIDATE + +package: + FROM +validate + WORKDIR /src/console + DO --pass-args charts+PACKAGE diff --git a/charts/console/README.md b/charts/console/README.md new file mode 100644 index 00000000..10fae515 --- /dev/null +++ b/charts/console/README.md @@ -0,0 +1,191 @@ +# console + +![Version: 0.1.0](https://img.shields.io/badge/Version-0.1.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) + +Formance Console (v4) + +**Homepage:** + +## Maintainers + +| Name | Email | Url | +| ---- | ------ | --- | +| Formance Team | | | + +## Source Code + +* +* + +## Requirements + +Kubernetes: `>=1.14.0-0` + +| Repository | Name | Version | +|------------|------|---------| +| file://../core | core | 1.X | +| oci://registry-1.docker.io/bitnamicharts | postgresql | 18.X | + +## Values + +### Global AWS configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.aws.elb | bool | `false` | Enable AWS ELB across all services, appropriate .aws.targertGroup must be set | +| global.aws.iam | bool | `false` | Enable AWS IAM Authentification | + +### Global configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.debug | bool | `false` | Enable debug mode | +| global.monitoring.traces.batch | bool | `false` | Enable otel batching | +| global.monitoring.traces.enabled | bool | `false` | Enable otel tracing | +| global.monitoring.traces.endpoint | string | `""` | Endpoint | +| global.monitoring.traces.exporter | string | `"otlp"` | Exporter | +| global.monitoring.traces.insecure | bool | `true` | Insecure | +| global.monitoring.traces.mode | string | `"grpc"` | Mode | +| global.monitoring.traces.port | int | `4317` | Port | +| global.platform.console | object | `{"host":"console.{{ .Values.global.serviceHost }}","oauth":{"client":{"existingSecret":"console-secrets","id":"console","postLogoutRedirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/logout\n","redirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login\n- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login-by-org\n","scopes":["accesses","remember_me","keep_refresh_token","on_behalf"],"secret":"","secretKeys":{"secret":"oauth"}}},"scheme":"https"}` | Console | +| global.platform.console.host | string | `"console.{{ .Values.global.serviceHost }}"` | is the host for the ledger UI | +| global.platform.console.oauth.client.existingSecret | string | `"console-secrets"` | is the name of the secret | +| global.platform.console.oauth.client.id | string | `"console"` | is the id of the client | +| global.platform.console.oauth.client.secret | string | `""` | is the secret of the client | +| global.platform.console.oauth.client.secretKeys | object | `{"secret":"oauth"}` | is the key contained within the secret | +| global.platform.console.scheme | string | `"https"` | is the scheme for the ledger UI | +| global.platform.membership.host | string | `"membership.{{ .Values.global.serviceHost }}"` | is the host for the membership | +| global.platform.membership.scheme | string | `"https"` | is the scheme for the membership | +| global.platform.portal.host | string | `"portal.{{ .Values.global.serviceHost }}"` | is the host for the portal | +| global.platform.portal.scheme | string | `"https"` | is the scheme for the portal | +| global.postgresql.additionalArgs | string | `"sslmode=disable"` | Additional arguments for PostgreSQL Connection URI | +| global.postgresql.auth.database | string | `"formance"` | Name for a custom database to create (overrides `auth.database`) | +| global.postgresql.auth.existingSecret | string | `""` | Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). | +| global.postgresql.auth.password | string | `"formance"` | Password for the "postgres" admin user (overrides `auth.postgresPassword`) | +| global.postgresql.auth.postgresPassword | string | `"formance"` | Password for the custom user to create (overrides `auth.password`) | +| global.postgresql.auth.secretKeys.adminPasswordKey | string | `""` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | +| global.postgresql.auth.secretKeys.userPasswordKey | string | `""` | Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. | +| global.postgresql.auth.username | string | `"formance"` | Name for a custom user to create (overrides `auth.username`) | +| global.postgresql.host | string | `""` | Host for PostgreSQL (overrides included postgreql `host`) | +| global.postgresql.service.ports.postgresql | int | `5432` | PostgreSQL service port (overrides `service.ports.postgresql`) | +| global.serviceHost | string | `""` | is the base domain for portal and console | + +### Global Nats configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.nats.enabled | bool | `false` | Enable NATS | +| global.nats.url | string | `""` | URL for NATS | + +### Stargate configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.platform.stargate.enabled | bool | `false` | if enabled, the stackApiUrl is not required It will be templated with `{{ printf "http://%s-%s:8080/#{organizationId}/#{stackId}/api" .Release.Name "stargate" -}}` | +| global.platform.stargate.stackApiUrl | string | `""` | if stargate is disabled, the stackApiUrl is defaulted to the `http://gateway.#{organizationId}-#{stackId}.svc:8080/api` To allow external access sets the stackApiUrl to an external url | + +### Console configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| config.authenticationEnabled | string | `"1"` | Toggle OAuth/DB sessions on the app. `"1"` = stack mode (default): the app uses Membership/OAuth and reaches the stack API through API_STACK_URL. `"0"` = micro-stack / auth-less mode: the app skips OAuth and reads API_STACK_URL directly. | +| config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | + +### Migration configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| config.migration.enabled | bool | `true` | Enable migration job with a separated user | + +### Publisher configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| config.publisher.clientID | string | `"console"` | NATS client ID | +| config.publisher.topicMapping | string | `"console"` | NATS topic mapping | + +### Console Feature + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| feature.migrationHooks | bool | `true` | Run migration in a hook | + +### Postgresql configuration + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| postgresql.enabled | bool | `false` | Enable postgresql | + +### Other Values + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| global.nats.auth.existingSecret | string | `""` | | +| global.nats.auth.password | string | `""` | | +| global.nats.auth.secretKeys.password | string | `"password"` | | +| global.nats.auth.secretKeys.username | string | `"username"` | | +| global.nats.auth.user | string | `""` | | +| global.nats.requestTimeout | string | `"60s"` | | +| affinity | object | `{}` | Console affinity | +| annotations | object | `{}` | Console annotations | +| autoscaling.enabled | bool | `false` | | +| autoscaling.maxReplicas | int | `100` | | +| autoscaling.minReplicas | int | `1` | | +| autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| aws.targetGroups.http.ipAddressType | string | `"ipv4"` | Target group IP address type | +| aws.targetGroups.http.serviceRef.name | string | `"{{ include \"core.fullname\" $ }}"` | Target group service reference name | +| aws.targetGroups.http.serviceRef.port | string | `"{{ .Values.service.ports.http.port }}"` | Target group service reference port | +| aws.targetGroups.http.targetGroupARN | string | `""` | Target group ARN | +| aws.targetGroups.http.targetGroupName | string | `""` | Target group name, used when its ARN is not known before provisioning | +| aws.targetGroups.http.targetType | string | `"ip"` | Target group target type | +| config.additionalEnv | list | `[]` | Console additional environment variables | +| config.cookie.encryptionKey | string | `""` | is used to encrypt a cookie value | +| config.cookie.existingSecret | string | `"console-secrets"` | is the name of the secret | +| config.cookie.secretKeys | object | `{"encryptionKey":"cookie"}` | is the key contained within the secret | +| config.environment | string | `"production"` | Console environment | +| config.migration.annotations | object | `{}` | Console job migration annotations Argo CD translate `pre-install,pre-upgrade` to: argocd.argoproj.io/hook: PreSync | +| config.migration.serviceAccount.annotations | object | `{}` | | +| config.migration.serviceAccount.create | bool | `true` | | +| config.migration.serviceAccount.name | string | `""` | | +| config.migration.ttlSecondsAfterFinished | string | `""` | | +| config.migration.volumeMounts | list | `[]` | | +| config.migration.volumes | list | `[]` | | +| config.postgresql.auth.database | string | `"console"` | | +| config.sentry.authToken | object | `{"existingSecret":"","secretKeys":{"value":""},"value":""}` | Sentry Auth Token | +| config.sentry.dsn | string | `""` | Sentry DSN | +| config.sentry.enabled | bool | `false` | Sentry enabled | +| config.sentry.environment | string | `""` | Sentry environment | +| config.sentry.release | string | `""` | Sentry release | +| config.stargate_url | string | `""` | Deprecated | +| image.pullPolicy | string | `"IfNotPresent"` | image pull policy | +| image.repository | string | `"ghcr.io/formancehq/console"` | image repository | +| image.tag | string | `""` | image tag | +| imagePullSecrets | list | `[]` | image pull secrets | +| ingress.annotations | object | `{}` | ingress annotations | +| ingress.className | string | `""` | ingress class name | +| ingress.enabled | bool | `true` | ingress enabled | +| ingress.hosts[0] | object | `{"host":"{{ tpl .Values.global.platform.console.host $ }}","paths":[{"path":"/","pathType":"Prefix"}]}` | ingress host | +| ingress.hosts[0].paths[0] | object | `{"path":"/","pathType":"Prefix"}` | ingress path | +| ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | ingress path type | +| ingress.labels | object | `{}` | ingress labels | +| ingress.tls | list | `[]` | ingress tls | +| livenessProbe | object | `{}` | Console liveness probe | +| nodeSelector | object | `{}` | Console node selector | +| podDisruptionBudget.enabled | bool | `false` | Enable pod disruption budget | +| podDisruptionBudget.maxUnavailable | int | `0` | Maximum unavailable pods | +| podDisruptionBudget.minAvailable | int | `1` | Minimum available pods | +| podSecurityContext | object | `{}` | Pod Security Context | +| readinessProbe | object | `{}` | Console readiness probe | +| replicas | int | `1` | Number of replicas | +| resources | object | `{}` | Console resources | +| securityContext | object | `{}` | Container Security Context | +| service.annotations | object | `{}` | service annotations | +| service.clusterIP | string | `""` | service cluster IP | +| service.ports.http | object | `{"port":3000}` | service http port | +| service.type | string | `"ClusterIP"` | service type | +| serviceAccount.annotations | object | `{}` | Service account annotations | +| serviceAccount.create | bool | `true` | Service account creation | +| serviceAccount.name | string | `""` | Service account name | +| tolerations | list | `[]` | Console tolerations | +| volumeMounts | list | `[]` | Console volume mounts | +| volumes | list | `[]` | Console volumes | diff --git a/charts/console/templates/_helpers.tpl b/charts/console/templates/_helpers.tpl new file mode 100644 index 00000000..bd1e2f06 --- /dev/null +++ b/charts/console/templates/_helpers.tpl @@ -0,0 +1,88 @@ + +{{/** + + # Stargate + # API_STACK_URL is either Stargate gRPC Gateway or the stack gateway to stacks. + # It can be external or internal, and carries the #{organizationId}/#{stackId} + # placeholders (see .Values.config.stargate_url or global.platform.stargate). + # + # Console: + # NODE_ENV is the environment of the app + # AUTHENTICATION_ENABLED toggles OAuth/DB sessions (1 = stack mode, 0 = + # micro-stack / auth-less mode reading API_STACK_URL directly). + # POSTGRES_URI (+ POSTGRES_AWS_ENABLE_IAM / AWS_REGION when IAM auth is on) + # COOKIE_SECRET is the secret to encrypt the auth cookies + # COOKIE_DOMAIN is the domain to set the auth cookies + # MEMBERSHIP_CLIENT_ID / MEMBERSHIP_CLIENT_SECRET / MEMBERSHIP_URL_API for OAuth + # REDIRECT_URI is the OAuth redirect URI back to this app + # PORTAL_UI is the url of the portal app (app switcher) + # CONSOLE_UI is the public url of this app (self-reference for outbound links) + # Other cross-app URLs (CONSOLE_V3_UI, STUDIO_UI, BANKING_BRIDGE_UI, + # LEDGER_UI) are optional and provided via + # .Values.config.additionalEnv. + # + # Monitoring: + # OTEL_TRACES* + OTEL_SERVICE_NAME + OTEL_RESOURCE_ATTRIBUTES via core.monitoring + # SENTRY_* via core.sentry when enabled + +**/}} + +{{- define "console.cookie" }} +- name: COOKIE_SECRET + {{- if or .Values.config.cookie.existingSecret }} + valueFrom: + secretKeyRef: + name: {{ .Values.config.cookie.existingSecret }} + key: {{ .Values.config.cookie.secretKeys.encryptionKey }} + {{- else }} + value: {{ .Values.config.cookie.encryptionKey | quote }} + {{- end }} +- name: COOKIE_DOMAIN + value: {{ tpl .Values.global.platform.console.host $ }} +{{- end -}} + + +{{- define "console.oauth.client" }} +- name: REDIRECT_URI + value: {{ tpl (default (printf "%s://%s" .Values.global.platform.console.scheme .Values.global.platform.console.host) .Values.config.redirect_url) $ }} +- name: MEMBERSHIP_CLIENT_ID + value: "{{ .Values.global.platform.console.oauth.client.id }}" +- name: MEMBERSHIP_CLIENT_SECRET + {{- if gt (len .Values.global.platform.console.oauth.client.existingSecret) 0 }} + valueFrom: + secretKeyRef: + name: {{ .Values.global.platform.console.oauth.client.existingSecret }} + key: {{ .Values.global.platform.console.oauth.client.secretKeys.secret }} + {{- else }} + value: {{ .Values.global.platform.console.oauth.client.secret | quote }} + {{- end }} +- name: MEMBERSHIP_URL_API + value: {{ tpl (printf "%s://%s/api" .Values.global.platform.membership.scheme .Values.global.platform.membership.host) $}} +{{- end }} + + +{{- define "console.env" -}} +- name: NODE_ENV + value: {{ .Values.config.environment }} +- name: AUTHENTICATION_ENABLED + value: {{ .Values.config.authenticationEnabled | quote }} +- name: API_STACK_URL +{{- if .Values.global.platform.stargate.enabled }} + value: {{ printf "http://%s-%s:8080/#{organizationId}/#{stackId}/api" .Release.Name "stargate" -}} +{{- else }} + value: {{ default "http://gateway.#{organizationId}-#{stackId}.svc:8080/api" (default .Values.global.platform.stargate.stackApiUrl .Values.config.stargate_url) }} +{{- end }} +- name: PORTAL_UI + value: {{ tpl (default (printf "%s://%s" .Values.global.platform.portal.scheme .Values.global.platform.portal.host) .Values.config.platform_url) $ }} +- name: CONSOLE_UI + value: {{ tpl (printf "%s://%s" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }} +{{ include "core.env.common" . }} +{{- include "console.cookie" . }} +{{- include "console.oauth.client" . }} +{{- include "core.postgres.uri" . }} +{{- include "core.sentry" . }} +{{- include "core.monitoring" . }} +{{ with .Values.config.additionalEnv }} +{{- tpl (toYaml .) $ }} +{{- end }} +{{- end -}} diff --git a/charts/console/templates/deployment.yaml b/charts/console/templates/deployment.yaml new file mode 100644 index 00000000..40b69dff --- /dev/null +++ b/charts/console/templates/deployment.yaml @@ -0,0 +1,78 @@ +apiVersion: apps/v1 +kind: Deployment +metadata: + name: {{ include "core.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "core.labels" . | nindent 4 }} + annotations: + {{- with .Values.annotations }} + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + replicas: {{ .Values.replicas }} + selector: + matchLabels: + {{- include "core.selectorLabels" . | nindent 6 }} + template: + metadata: + labels: + {{- include "core.selectorLabels" . | nindent 8 }} + spec: + serviceAccountName: {{ include "core.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + containers: + - name: console + resources: + {{- toYaml .Values.resources | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + imagePullPolicy: {{.Values.image.pullPolicy}} + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + command: + - node + args: + - server.js + ports: + - containerPort: 3000 + protocol: TCP + name: http + readinessProbe: + httpGet: + path: /_info + port: 3000 + initialDelaySeconds: {{ .Values.readinessProbe.initialDelaySeconds | default 30}} + periodSeconds: 3 + livenessProbe: + httpGet: + path: /_info + port: 3000 + initialDelaySeconds: {{ .Values.livenessProbe.initialDelaySeconds | default 30}} + periodSeconds: 3 + env: + {{- include "console.env" . | nindent 12 }} + {{ with .Values.volumeMounts }} + volumeMounts: + {{- toYaml . | nindent 12 }} + {{- end }} + {{ with .Values.volumes }} + volumes: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} diff --git a/charts/console/templates/hpa.yaml b/charts/console/templates/hpa.yaml new file mode 100644 index 00000000..a1370245 --- /dev/null +++ b/charts/console/templates/hpa.yaml @@ -0,0 +1 @@ +{{ include "core.hpa" . }} \ No newline at end of file diff --git a/charts/console/templates/ingress.yaml b/charts/console/templates/ingress.yaml new file mode 100644 index 00000000..37f22945 --- /dev/null +++ b/charts/console/templates/ingress.yaml @@ -0,0 +1 @@ +{{ include "core.ingress" . }} diff --git a/charts/console/templates/job.yaml b/charts/console/templates/job.yaml new file mode 100644 index 00000000..b08b2452 --- /dev/null +++ b/charts/console/templates/job.yaml @@ -0,0 +1,61 @@ +{{- if .Values.config.migration.enabled -}} +apiVersion: batch/v1 +kind: Job +metadata: + name: {{ include "core.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "core.labels" . | nindent 4 }} + {{- with merge .Values.config.migration.annotations (include "core.job.annotations" . | fromYaml) }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + ttlSecondsAfterFinished: {{ .Values.config.migration.ttlSecondsAfterFinished }} + template: + metadata: + labels: + {{- include "core.selectorLabels" . | nindent 8 }} + spec: + restartPolicy: OnFailure + securityContext: + {{- toYaml .Values.podSecurityContext | nindent 8 }} + serviceAccountName: {{ include "core.postgres.job.serviceAccountName" . }} + {{- with .Values.imagePullSecrets }} + imagePullSecrets: + {{- toYaml . | nindent 8 }} + {{- end }} + containers: + - name: migrate + securityContext: + {{- toYaml .Values.securityContext | nindent 12 }} + image: "{{ .Values.image.repository }}:{{ .Values.image.tag | default .Chart.AppVersion }}" + {{- with .Values.config.migration.volumeMounts }} + volumeMounts: + {{- toYaml . | nindent 12 }} + {{- end }} + command: + - node + args: + - dist/migrate.cjs + env: + {{- include "core.env.common" . | nindent 12 }} + {{- include "core.monitoring" . | nindent 12 }} + {{- include "core.postgres.job.uri" . | nindent 12 }} + {{- with .Values.nodeSelector }} + nodeSelector: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.affinity }} + affinity: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.tolerations }} + tolerations: + {{- toYaml . | nindent 8 }} + {{- end }} + {{- with .Values.config.migration.volumes}} + volumes: + {{- toYaml . | nindent 8 }} + {{- end }} +{{- end -}} \ No newline at end of file diff --git a/charts/console/templates/job_sa.yaml b/charts/console/templates/job_sa.yaml new file mode 100644 index 00000000..4048280c --- /dev/null +++ b/charts/console/templates/job_sa.yaml @@ -0,0 +1,13 @@ +{{- if .Values.config.migration.serviceAccount.create -}} +apiVersion: v1 +kind: ServiceAccount +metadata: + name: {{ include "core.postgres.job.serviceAccountName" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "core.labels" . | nindent 4 }} + {{- with merge .Values.config.migration.serviceAccount.annotations (include "core.postgres.job.sa.annotations" . | fromYaml) }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +{{- end }} diff --git a/charts/console/templates/pdp.yaml b/charts/console/templates/pdp.yaml new file mode 100644 index 00000000..fb601550 --- /dev/null +++ b/charts/console/templates/pdp.yaml @@ -0,0 +1 @@ +{{ include "core.podDisruptionBudget" . }} \ No newline at end of file diff --git a/charts/console/templates/service.yaml b/charts/console/templates/service.yaml new file mode 100644 index 00000000..40d29a92 --- /dev/null +++ b/charts/console/templates/service.yaml @@ -0,0 +1,29 @@ +apiVersion: v1 +kind: Service +metadata: + name: {{ include "core.fullname" . }} + namespace: {{ .Release.Namespace }} + labels: + {{- include "core.labels" . | nindent 4 }} + {{- with .Values.service.annotations }} + annotations: + {{- toYaml . | nindent 4 }} + {{- end }} +spec: + type: {{ .Values.service.type }} + {{- with .Values.service.clusterIP }} + clusterIP: {{ . }} + {{- end }} + ports: + - name: http + port: {{ .Values.service.ports.http.port }} + {{- if and (or (eq .Values.service.type "NodePort") (eq .Values.service.type "LoadBalancer")) .Values.service.ports.http.nodePort }} + nodePort: {{ .Values.service.ports.http.nodePort }} + {{- end }} + targetPort: http + protocol: TCP + {{- if semverCompare ">=1.20-0" .Capabilities.KubeVersion.GitVersion }} + appProtocol: http + {{- end }} + selector: + {{- include "core.selectorLabels" . | nindent 4 }} \ No newline at end of file diff --git a/charts/console/templates/serviceaccount.yaml b/charts/console/templates/serviceaccount.yaml new file mode 100644 index 00000000..b4c7924d --- /dev/null +++ b/charts/console/templates/serviceaccount.yaml @@ -0,0 +1 @@ +{{- include "core.serviceAccount" . -}} diff --git a/charts/console/templates/tgb.yaml b/charts/console/templates/tgb.yaml new file mode 100644 index 00000000..9681c1da --- /dev/null +++ b/charts/console/templates/tgb.yaml @@ -0,0 +1,23 @@ +{{- if .Values.global.aws.elb }} +{{- range $name, $group := .Values.aws.targetGroups }} +apiVersion: elbv2.k8s.aws/v1beta1 +kind: TargetGroupBinding +metadata: + name: {{ include "core.fullname" $ }}-{{ $name }} + namespace: {{ $.Release.Namespace }} + labels: + {{- include "core.labels" $ | nindent 4 }} +spec: + ipAddressType: {{ $group.ipAddressType }} + serviceRef: + name: {{ tpl $group.serviceRef.name $ }} + port: {{ tpl $group.serviceRef.port $ }} + {{- if $group.targetGroupARN }} + targetGroupARN: {{ $group.targetGroupARN }} + {{- else }} + targetGroupName: {{ required "console requires a targetGroupARN or targetGroupName when global.aws.elb is enabled" $group.targetGroupName }} + {{- end }} + targetType: {{ $group.targetType }} +--- +{{- end }} +{{- end }} diff --git a/charts/console/values.schema.json b/charts/console/values.schema.json new file mode 100644 index 00000000..79587eae --- /dev/null +++ b/charts/console/values.schema.json @@ -0,0 +1,598 @@ +{ + "$schema": "https://json-schema.org/draft/2020-12/schema", + "type": "object", + "properties": { + "affinity": { + "type": "object" + }, + "annotations": { + "type": "object" + }, + "autoscaling": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "maxReplicas": { + "type": "integer" + }, + "minReplicas": { + "type": "integer" + }, + "targetCPUUtilizationPercentage": { + "type": "integer" + } + } + }, + "aws": { + "type": "object", + "properties": { + "targetGroups": { + "type": "object", + "properties": { + "http": { + "type": "object", + "properties": { + "ipAddressType": { + "type": "string" + }, + "serviceRef": { + "type": "object", + "properties": { + "name": { + "type": "string" + }, + "port": { + "type": "string" + } + } + }, + "targetGroupARN": { + "type": "string" + }, + "targetGroupName": { + "type": "string" + }, + "targetType": { + "type": "string" + } + } + } + } + } + } + }, + "config": { + "type": "object", + "properties": { + "additionalEnv": { + "type": "array" + }, + "authenticationEnabled": { + "type": "string" + }, + "cookie": { + "type": "object", + "properties": { + "encryptionKey": { + "type": "string" + }, + "existingSecret": { + "type": "string" + }, + "secretKeys": { + "type": "object", + "properties": { + "encryptionKey": { + "type": "string" + } + } + } + } + }, + "environment": { + "type": "string" + }, + "migration": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "enabled": { + "type": "boolean" + }, + "serviceAccount": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "create": { + "type": "boolean" + }, + "name": { + "type": "string" + } + } + }, + "ttlSecondsAfterFinished": { + "type": "string" + }, + "volumeMounts": { + "type": "array" + }, + "volumes": { + "type": "array" + } + } + }, + "postgresql": { + "type": "object", + "properties": { + "auth": { + "type": "object", + "properties": { + "database": { + "type": "string" + } + } + } + } + }, + "postgresqlUrl": { + "type": "string" + }, + "publisher": { + "type": "object", + "properties": { + "clientID": { + "type": "string" + }, + "topicMapping": { + "type": "string" + } + } + }, + "sentry": { + "type": "object", + "properties": { + "authToken": { + "type": "object", + "properties": { + "existingSecret": { + "type": "string" + }, + "secretKeys": { + "type": "object", + "properties": { + "value": { + "type": "string" + } + } + }, + "value": { + "type": "string" + } + } + }, + "dsn": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "environment": { + "type": "string" + }, + "release": { + "type": "string" + } + } + }, + "stargate_url": { + "type": "string" + } + } + }, + "feature": { + "type": "object", + "properties": { + "migrationHooks": { + "type": "boolean" + } + } + }, + "global": { + "type": "object", + "properties": { + "aws": { + "type": "object", + "properties": { + "elb": { + "type": "boolean" + }, + "iam": { + "type": "boolean" + } + } + }, + "debug": { + "type": "boolean" + }, + "monitoring": { + "type": "object", + "properties": { + "traces": { + "type": "object", + "properties": { + "batch": { + "type": "boolean" + }, + "enabled": { + "type": "boolean" + }, + "endpoint": { + "type": "string" + }, + "exporter": { + "type": "string" + }, + "insecure": { + "type": "boolean" + }, + "mode": { + "type": "string" + }, + "port": { + "type": "integer" + } + } + } + } + }, + "nats": { + "type": "object", + "properties": { + "auth": { + "type": "object", + "properties": { + "existingSecret": { + "type": "string" + }, + "password": { + "type": "string" + }, + "secretKeys": { + "type": "object", + "properties": { + "password": { + "type": "string" + }, + "username": { + "type": "string" + } + } + }, + "user": { + "type": "string" + } + } + }, + "enabled": { + "type": "boolean" + }, + "requestTimeout": { + "type": "string" + }, + "url": { + "type": "string" + } + } + }, + "platform": { + "type": "object", + "properties": { + "console": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "oauth": { + "type": "object", + "properties": { + "client": { + "type": "object", + "properties": { + "existingSecret": { + "type": "string" + }, + "id": { + "type": "string" + }, + "postLogoutRedirectUris": { + "type": "string" + }, + "redirectUris": { + "type": "string" + }, + "scopes": { + "type": "array", + "items": { + "type": "string" + } + }, + "secret": { + "type": "string" + }, + "secretKeys": { + "type": "object", + "properties": { + "secret": { + "type": "string" + } + } + } + } + } + } + }, + "scheme": { + "type": "string" + } + } + }, + "membership": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "scheme": { + "type": "string" + } + } + }, + "portal": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "scheme": { + "type": "string" + } + } + }, + "stargate": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "stackApiUrl": { + "type": "string" + } + } + } + } + }, + "postgresql": { + "type": "object", + "properties": { + "additionalArgs": { + "type": "string" + }, + "auth": { + "type": "object", + "properties": { + "database": { + "type": "string" + }, + "existingSecret": { + "type": "string" + }, + "password": { + "type": "string" + }, + "postgresPassword": { + "type": "string" + }, + "secretKeys": { + "type": "object", + "properties": { + "adminPasswordKey": { + "type": "string" + }, + "userPasswordKey": { + "type": "string" + } + } + }, + "username": { + "type": "string" + } + } + }, + "host": { + "type": "string" + }, + "service": { + "type": "object", + "properties": { + "ports": { + "type": "object", + "properties": { + "postgresql": { + "type": "integer" + } + } + } + } + } + } + }, + "serviceHost": { + "type": "string" + } + } + }, + "image": { + "type": "object", + "properties": { + "pullPolicy": { + "type": "string" + }, + "repository": { + "type": "string" + }, + "tag": { + "type": "string" + } + } + }, + "imagePullSecrets": { + "type": "array" + }, + "ingress": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "className": { + "type": "string" + }, + "enabled": { + "type": "boolean" + }, + "hosts": { + "type": "array", + "items": { + "type": "object", + "properties": { + "host": { + "type": "string" + }, + "paths": { + "type": "array", + "items": { + "type": "object", + "properties": { + "path": { + "type": "string" + }, + "pathType": { + "type": "string" + } + } + } + } + } + } + }, + "labels": { + "type": "object" + }, + "tls": { + "type": "array" + } + } + }, + "livenessProbe": { + "type": "object" + }, + "nodeSelector": { + "type": "object" + }, + "podDisruptionBudget": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + }, + "maxUnavailable": { + "type": "integer" + }, + "minAvailable": { + "type": "integer" + } + } + }, + "podSecurityContext": { + "type": "object" + }, + "postgresql": { + "type": "object", + "properties": { + "enabled": { + "type": "boolean" + } + } + }, + "readinessProbe": { + "type": "object" + }, + "replicas": { + "type": "integer" + }, + "resources": { + "type": "object" + }, + "securityContext": { + "type": "object" + }, + "service": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "clusterIP": { + "type": "string" + }, + "ports": { + "type": "object", + "properties": { + "http": { + "type": "object", + "properties": { + "port": { + "type": "integer" + } + } + } + } + }, + "type": { + "type": "string" + } + } + }, + "serviceAccount": { + "type": "object", + "properties": { + "annotations": { + "type": "object" + }, + "create": { + "type": "boolean" + }, + "name": { + "type": "string" + } + } + }, + "tolerations": { + "type": "array" + }, + "volumeMounts": { + "type": "array" + }, + "volumes": { + "type": "array" + } + } +} diff --git a/charts/console/values.yaml b/charts/console/values.yaml new file mode 100644 index 00000000..63819b8b --- /dev/null +++ b/charts/console/values.yaml @@ -0,0 +1,410 @@ +global: + # -- Enable debug mode + # @section -- Global configuration + debug: false + # -- is the base domain for portal and console + # @section -- Global configuration + serviceHost: "" + + aws: + # -- Enable AWS IAM Authentification + # @section -- Global AWS configuration + iam: false + # -- Enable AWS ELB across all services, appropriate .aws.targertGroup must be set + # @section -- Global AWS configuration + elb: false + + postgresql: + # -- Host for PostgreSQL (overrides included postgreql `host`) + # @section -- Global configuration + host: "" + # -- Additional arguments for PostgreSQL Connection URI + # @section -- Global configuration + additionalArgs: "sslmode=disable" + auth: + # -- Name for a custom user to create (overrides `auth.username`) + # @section -- Global configuration + username: formance + # -- Password for the "postgres" admin user (overrides `auth.postgresPassword`) + # @section -- Global configuration + password: formance + # -- Name for a custom database to create (overrides `auth.database`) + # @section -- Global configuration + database: formance + # -- Password for the custom user to create (overrides `auth.password`) + # @section -- Global configuration + postgresPassword: formance + # -- Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). + # @section -- Global configuration + existingSecret: "" + secretKeys: + # -- Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + # @section -- Global configuration + adminPasswordKey: "" + # -- Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.userPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + # @section -- Global configuration + userPasswordKey: "" + service: + ports: + # -- PostgreSQL service port (overrides `service.ports.postgresql`) + # @section -- Global configuration + postgresql: 5432 + + nats: + # -- Enable NATS + # @section -- Global Nats configuration + enabled: false + requestTimeout: "60s" + + # -- URL for NATS + # @section -- Global Nats configuration + url: "" + auth: + user: "" + password: "" + existingSecret: "" + secretKeys: + password: password + username: username + + monitoring: + traces: + # -- Enable otel tracing + # @section -- Global configuration + enabled: false + # -- Enable otel batching + # @section -- Global configuration + batch: false + # -- Endpoint + # @section -- Global configuration + endpoint: "" + # -- Exporter + # @section -- Global configuration + exporter: "otlp" + # -- Insecure + # @section -- Global configuration + insecure: true + # -- Mode + # @section -- Global configuration + mode: "grpc" + # -- Port + # @section -- Global configuration + port: 4317 + + platform: + portal: + # -- is the scheme for the portal + # @section -- Global configuration + scheme: "https" + # -- is the host for the portal + # @section -- Global configuration + host: "portal.{{ .Values.global.serviceHost }}" + + # -- Console + # @section -- Global configuration + console: + # -- is the scheme for the ledger UI + # @section -- Global configuration + scheme: "https" + # -- is the host for the ledger UI + # @section -- Global configuration + host: "console.{{ .Values.global.serviceHost }}" + oauth: + client: + # -- is the id of the client + # @section -- Global configuration + id: "console" + # -- is the secret of the client + # @section -- Global configuration + secret: "" + # -- is the name of the secret + # @section -- Global configuration + existingSecret: "console-secrets" + # -- is the key contained within the secret + # @section -- Global configuration + secretKeys: + secret: "oauth" + scopes: + - accesses + - remember_me + - keep_refresh_token + - on_behalf + redirectUris: | + - {{ tpl (printf "%s://%s" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login + - {{ tpl (printf "%s://%s" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login-by-org + postLogoutRedirectUris: | + - {{ tpl (printf "%s://%s" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/logout + stargate: + # -- if enabled, the stackApiUrl is not required + # It will be templated with `{{ printf "http://%s-%s:8080/#{organizationId}/#{stackId}/api" .Release.Name "stargate" -}}` + # @section -- Stargate configuration + enabled: false + # -- if stargate is disabled, the stackApiUrl is defaulted to the `http://gateway.#{organizationId}-#{stackId}.svc:8080/api` + # To allow external access sets the stackApiUrl to an external url + # @section -- Stargate configuration + stackApiUrl: "" + + membership: + # -- is the scheme for the membership + # @section -- Global configuration + scheme: "https" + # -- is the host for the membership + # @section -- Global configuration + host: "membership.{{ .Values.global.serviceHost }}" + +# -- Number of replicas +replicas: 1 + +podDisruptionBudget: + # -- Enable pod disruption budget + enabled: false + # -- Minimum available pods + minAvailable: 1 + # -- Maximum unavailable pods + maxUnavailable: 0 + +# -- Pod Security Context +podSecurityContext: {} + +# -- Container Security Context +securityContext: {} + +autoscaling: + enabled: false + minReplicas: 1 + maxReplicas: 100 + targetCPUUtilizationPercentage: 80 + # targetMemoryUtilizationPercentage: 80 + +serviceAccount: + # -- Service account creation + create: true + # -- Service account name + name: "" + # -- Service account annotations + annotations: {} + +image: + # -- image repository + repository: ghcr.io/formancehq/console + # -- image pull policy + pullPolicy: IfNotPresent + # -- image tag + tag: "" + +# -- image pull secrets +imagePullSecrets: [] + +# -- Console resources +resources: {} + # requests: + # cpu: 250m + # memory: 512Mi + # limits: + # cpu: 500m + # memory: 2048Mi + +# -- Console readiness probe +readinessProbe: {} + +# -- Console liveness probe +livenessProbe: {} + +service: + # -- service annotations + annotations: {} + # -- service type + type: ClusterIP + # -- service cluster IP + clusterIP: "" + ports: + # -- service http port + http: + port: 3000 + # -- service node port + # nodePort: + + # -- AWS Console target groups + # @section -- Global AWS configuration +aws: + targetGroups: + http: + # -- Target group IP address type + ipAddressType: "ipv4" + # -- Target group target type + targetType: "ip" + # -- Target group ARN + targetGroupARN: "" + # -- Target group name, used when its ARN is not known before provisioning + targetGroupName: "" + serviceRef: + # -- Target group service reference name + name: '{{ include "core.fullname" $ }}' + # -- Target group service reference port + port: "{{ .Values.service.ports.http.port }}" + +ingress: + # -- ingress enabled + enabled: true + # -- ingress class name + className: "" + # -- ingress annotations + annotations: {} + # -- ingress labels + labels: {} + hosts: + # -- ingress host + - host: "{{ tpl .Values.global.platform.console.host $ }}" + paths: + # -- ingress path + - path: / + # -- ingress path type + pathType: Prefix + # -- ingress tls + tls: [] + # -- ingress tls secret name + # - secretName: YOUR_TLS_SECRET_NAME + +# -- Console volume mounts +volumeMounts: [] + +# -- Console annotations +annotations: {} + +# -- Console volumes +volumes: [] + +# -- Console node selector +nodeSelector: {} + +# -- Console tolerations +tolerations: [] + +# -- Console affinity +affinity: {} + +# TODO: See helm tags for more information +# https://helm.sh/docs/chart_template_guide/variables/#tags +feature: + # -- Run migration in a hook + # @section -- Console Feature + migrationHooks: true + +config: + postgresql: + auth: + database: console + + # -- Toggle OAuth/DB sessions on the app. + # `"1"` = stack mode (default): the app uses Membership/OAuth and reaches + # the stack API through API_STACK_URL. `"0"` = micro-stack / auth-less mode: + # the app skips OAuth and reads API_STACK_URL directly. + # @section -- Console configuration + authenticationEnabled: "1" + + publisher: + # -- NATS client ID + # @section -- Publisher configuration + clientID: "console" + # -- NATS topic mapping + # @section -- Publisher configuration + topicMapping: "console" + # -- Deprecated + stargate_url: "" + migration: + # -- Enable migration job with a separated user + # @section -- Migration configuration + enabled: true + # postgresql: + # auth: + # # -- Name for a custom user to create (overrides `auth.username`) + # # @section -- Migration configuration + # username: "" + # # -- Password for the "postgres" admin user (overrides `auth.postgresPassword`) + # # @section -- Migration configuration + # password: "" + # # -- Name of existing secret to use for PostgreSQL credentials (overrides `auth.existingSecret`). + # # @section -- Migration configuration + # existingSecret: "" + # secretKeys: + # # -- Name of key in existing secret to use for PostgreSQL credentials (overrides `auth.secretKeys.adminPasswordKey`). Only used when `global.postgresql.auth.existingSecret` is set. + # # @section -- Migration configuration + # adminPasswordKey: "" + + serviceAccount: + create: true + name: "" + annotations: {} + + # -- Console job migration annotations + # Argo CD translate `pre-install,pre-upgrade` to: argocd.argoproj.io/hook: PreSync + annotations: {} + + ttlSecondsAfterFinished: "" + volumes: [] + volumeMounts: [] + + # -- PostgreSQL connection URL override (if not set, will be generated from global.postgresql) + # @section -- Console configuration + postgresqlUrl: "" + + cookie: + # -- is used to encrypt a cookie value + encryptionKey: "" + # -- is the name of the secret + existingSecret: "console-secrets" + # -- is the key contained within the secret + secretKeys: + encryptionKey: "cookie" + + # -- Console environment + environment: production + # -- Console additional environment variables + additionalEnv: [] + # - name: HOST + # value: "0.0.0.0" + sentry: + # -- Sentry enabled + enabled: false + # -- Sentry DSN + dsn: "" + # -- Sentry environment + environment: "" + # -- Sentry release + release: "" + # -- Sentry Auth Token + authToken: + value: "" + existingSecret: "" + secretKeys: + value: "" + # -- Override global configuration + # monitoring: + # # -- Override otel service name + # serviceName: "" + # # -- Override otel resources attributes + # attributes: "" + # traces: + # # -- Enable otel tracing + # # @section -- Global configuration + # enabled: false + # # -- Endpoint + # # @section -- Global configuration + # endpoint: "localhost" + # # -- Exporter + # # @section -- Global configuration + # exporter: "otlp" + # # -- Insecure + # # @section -- Global configuration + # insecure: true + # # -- Mode + # # @section -- Global configuration + # mode: "grpc" + # # -- Port + # # @section -- Global configuration + # port: 4317 + +postgresql: + # -- Enable postgresql + # @section -- Postgresql configuration + enabled: false diff --git a/charts/formance/Chart.lock b/charts/formance/Chart.lock index a303bea9..00289e14 100644 --- a/charts/formance/Chart.lock +++ b/charts/formance/Chart.lock @@ -7,6 +7,6 @@ dependencies: version: 3.21.0 - name: cloudprem repository: file://../cloudprem - version: 6.1.0 -digest: sha256:aa82afaa5c0522891d3b9b0325327f0e77ee379033c78ead87e2ae666fa84b77 -generated: "2026-10-08T17:30:13.522746+02:00" + version: 6.2.0 +digest: sha256:5c569a07589c95186cc8c2d3ab2469e1c6aefa6e2020f986dfe2faeaf60883f3 +generated: "2026-10-12T20:17:38.565954426+02:00" diff --git a/charts/formance/Chart.yaml b/charts/formance/Chart.yaml index d4941093..fcfba3f4 100644 --- a/charts/formance/Chart.yaml +++ b/charts/formance/Chart.yaml @@ -10,7 +10,7 @@ maintainers: icon: "https://avatars.githubusercontent.com/u/84325077?s=200&v=4" type: application -version: 3.3.0 +version: 3.4.0 appVersion: "latest" # The "-0" suffix is required for GKE compatibility. GKE versions contain # build metadata like "v1.33.5-gke.2392000" which semver treats as pre-release. diff --git a/charts/formance/README.md b/charts/formance/README.md index 2da12d92..8941ddcc 100644 --- a/charts/formance/README.md +++ b/charts/formance/README.md @@ -1,6 +1,6 @@ # formance -![Version: 3.3.0](https://img.shields.io/badge/Version-3.3.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) +![Version: 3.4.0](https://img.shields.io/badge/Version-3.4.0-informational?style=flat-square) ![Type: application](https://img.shields.io/badge/Type-application-informational?style=flat-square) ![AppVersion: latest](https://img.shields.io/badge/AppVersion-latest-informational?style=flat-square) Formance Platform - Unified Helm Chart @@ -41,6 +41,14 @@ Kubernetes: `>=1.14.0-0` | Key | Type | Default | Description | |-----|------|---------|-------------| | global.debug | bool | `false` | Enable debug mode | +| global.platform.console | object | `{"host":"console.{{ .Values.global.serviceHost }}","oauth":{"client":{"existingSecret":"console-secrets","id":"console","postLogoutRedirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/logout\n","redirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login\n- {{ tpl (printf \"%s://%s\" .Values.global.platform.console.scheme .Values.global.platform.console.host) $ }}/auth/login-by-org\n","scopes":["accesses","remember_me","keep_refresh_token","on_behalf"],"secret":"","secretKeys":{"secret":"oauth"}}},"scheme":"https"}` | Console | +| global.platform.console.enabled | bool | `false` | Enable the Console for v4 stacks | +| global.platform.console.host | string | `"console.{{ .Values.global.serviceHost }}"` | Public Console host | +| global.platform.console.oauth.client.existingSecret | string | `"console-secrets"` | is the name of the secret | +| global.platform.console.oauth.client.id | string | `"console"` | is the id of the client | +| global.platform.console.oauth.client.secret | string | `""` | is the secret of the client | +| global.platform.console.oauth.client.secretKeys | object | `{"secret":"oauth"}` | is the key contained within the secret | +| global.platform.console.scheme | string | `"https"` | Public Console URL scheme | | global.platform.consoleV3 | object | `{"host":"console.v3.{{ .Values.global.serviceHost }}","oauth":{"client":{"existingSecret":"","id":"console-v3","postLogoutRedirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/logout\n","redirectUris":"- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/login\n- {{ tpl (printf \"%s://%s\" .Values.global.platform.consoleV3.scheme .Values.global.platform.consoleV3.host) $ }}/auth/login-by-org\n","scopes":["accesses","remember_me","keep_refresh_token","on_behalf"],"secret":"changeMe2","secretKeys":{"secret":""}}},"scheme":"https"}` | Console V3: EXPERIMENTAL | | global.platform.consoleV3.oauth.client.existingSecret | string | `""` | is the name of the secret | | global.platform.consoleV3.oauth.client.id | string | `"console-v3"` | is the id of the client | @@ -214,24 +222,29 @@ Kubernetes: `>=1.14.0-0` | tags.EnterpriseEdition | bool | `false` | Choose deployment edition - EE: Enterprise (requires a Licence) - CE: Community | | tags.EntrepriseEdition | bool | `false` | Deprecated misspelling of `tags.EnterpriseEdition`, still honoured. Will be removed in the next major. Prefer `tags.EnterpriseEdition`. | -### Migration configuration +### Console configuration | Key | Type | Default | Description | |-----|------|---------|-------------| -| cloudprem.console-v3.config.migration.enabled | bool | `true` | Enable migration job with a separated user | -| cloudprem.ledger-ui.config.migration.enabled | bool | `true` | Enable migration job with a separated user | -| cloudprem.portal.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| cloudprem.console.config.authenticationEnabled | string | `"1"` | Toggle OAuth/DB sessions on the app. `"1"` = stack mode (default): the app uses Membership/OAuth and reaches the stack API through API_STACK_URL. `"0"` = micro-stack / auth-less mode: the app skips OAuth and reads API_STACK_URL directly. | +| cloudprem.console.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | +| cloudprem.console-v3.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | -### Console configuration +### Migration configuration | Key | Type | Default | Description | |-----|------|---------|-------------| -| cloudprem.console-v3.config.postgresqlUrl | string | `""` | PostgreSQL connection URL override (if not set, will be generated from global.postgresql) | +| cloudprem.console.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| cloudprem.console-v3.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| cloudprem.ledger-ui.config.migration.enabled | bool | `true` | Enable migration job with a separated user | +| cloudprem.portal.config.migration.enabled | bool | `true` | Enable migration job with a separated user | ### Publisher configuration | Key | Type | Default | Description | |-----|------|---------|-------------| +| cloudprem.console.config.publisher.clientID | string | `"console"` | NATS client ID | +| cloudprem.console.config.publisher.topicMapping | string | `"console"` | NATS topic mapping | | cloudprem.console-v3.config.publisher.clientID | string | `"console-v3"` | NATS client ID | | cloudprem.console-v3.config.publisher.topicMapping | string | `"console-v3"` | NATS topic mapping | | cloudprem.ledger-ui.config.publisher.clientID | string | `"ledger-ui"` | NATS client ID | @@ -239,25 +252,32 @@ Kubernetes: `>=1.14.0-0` | cloudprem.portal.config.publisher.clientID | string | `"portal"` | NATS client ID | | cloudprem.portal.config.publisher.topicMapping | string | `"portal"` | NATS topic mapping | -### Membership Feature +### Console Feature | Key | Type | Default | Description | |-----|------|---------|-------------| -| cloudprem.console-v3.feature.migrationHooks | bool | `false` | Run migration in a hook | -| cloudprem.membership.feature.disableEvents | bool | `true` | Membership feature disable events | -| cloudprem.membership.feature.managedStacks | bool | `true` | Membership feature managed stacks | -| cloudprem.membership.feature.migrationHooks | bool | `false` | Run migration in a hook | -| cloudprem.portal.feature.migrationHooks | bool | `false` | Run migration in a hook | +| cloudprem.console.feature.migrationHooks | bool | `true` | Run migration in a hook | ### Postgresql configuration | Key | Type | Default | Description | |-----|------|---------|-------------| +| cloudprem.console.postgresql.enabled | bool | `false` | Enable postgresql | | cloudprem.console-v3.postgresql.enabled | bool | `false` | Enable postgresql | | cloudprem.ledger-ui.postgresql.enabled | bool | `false` | Enable postgresql | | cloudprem.membership.postgresql.enabled | bool | `true` | Enable postgresql | | cloudprem.portal.postgresql.enabled | bool | `false` | Enable postgresql | +### Membership Feature + +| Key | Type | Default | Description | +|-----|------|---------|-------------| +| cloudprem.console-v3.feature.migrationHooks | bool | `false` | Run migration in a hook | +| cloudprem.membership.feature.disableEvents | bool | `true` | Membership feature disable events | +| cloudprem.membership.feature.managedStacks | bool | `true` | Membership feature managed stacks | +| cloudprem.membership.feature.migrationHooks | bool | `false` | Run migration in a hook | +| cloudprem.portal.feature.migrationHooks | bool | `false` | Run migration in a hook | + ### Ledger UI configuration | Key | Type | Default | Description | @@ -354,6 +374,69 @@ Kubernetes: `>=1.14.0-0` | postgresql.nameOverride | string | `""` | | | regions.settings | object | `{}` | | | regions.stacks | object | `{}` | | +| cloudprem.console.affinity | object | `{}` | Console affinity | +| cloudprem.console.annotations | object | `{}` | Console annotations | +| cloudprem.console.autoscaling.enabled | bool | `false` | | +| cloudprem.console.autoscaling.maxReplicas | int | `100` | | +| cloudprem.console.autoscaling.minReplicas | int | `1` | | +| cloudprem.console.autoscaling.targetCPUUtilizationPercentage | int | `80` | | +| cloudprem.console.aws.targetGroups.http.ipAddressType | string | `"ipv4"` | Target group IP address type | +| cloudprem.console.aws.targetGroups.http.serviceRef.name | string | `"{{ include \"core.fullname\" $ }}"` | Target group service reference name | +| cloudprem.console.aws.targetGroups.http.serviceRef.port | string | `"{{ .Values.service.ports.http.port }}"` | Target group service reference port | +| cloudprem.console.aws.targetGroups.http.targetGroupARN | string | `""` | Target group ARN | +| cloudprem.console.aws.targetGroups.http.targetGroupName | string | `""` | Target group name, used when its ARN is not known before provisioning | +| cloudprem.console.aws.targetGroups.http.targetType | string | `"ip"` | Target group target type | +| cloudprem.console.config.additionalEnv | list | `[]` | Console additional environment variables | +| cloudprem.console.config.cookie.encryptionKey | string | `""` | is used to encrypt a cookie value | +| cloudprem.console.config.cookie.existingSecret | string | `"console-secrets"` | is the name of the secret | +| cloudprem.console.config.cookie.secretKeys | object | `{"encryptionKey":"cookie"}` | is the key contained within the secret | +| cloudprem.console.config.environment | string | `"production"` | Console environment | +| cloudprem.console.config.migration.annotations | object | `{}` | Console job migration annotations Argo CD translate `pre-install,pre-upgrade` to: argocd.argoproj.io/hook: PreSync | +| cloudprem.console.config.migration.serviceAccount.annotations | object | `{}` | | +| cloudprem.console.config.migration.serviceAccount.create | bool | `true` | | +| cloudprem.console.config.migration.serviceAccount.name | string | `""` | | +| cloudprem.console.config.migration.ttlSecondsAfterFinished | string | `""` | | +| cloudprem.console.config.migration.volumeMounts | list | `[]` | | +| cloudprem.console.config.migration.volumes | list | `[]` | | +| cloudprem.console.config.postgresql.auth.database | string | `"console"` | | +| cloudprem.console.config.sentry.authToken | object | `{"existingSecret":"","secretKeys":{"value":""},"value":""}` | Sentry Auth Token | +| cloudprem.console.config.sentry.dsn | string | `""` | Sentry DSN | +| cloudprem.console.config.sentry.enabled | bool | `false` | Sentry enabled | +| cloudprem.console.config.sentry.environment | string | `""` | Sentry environment | +| cloudprem.console.config.sentry.release | string | `""` | Sentry release | +| cloudprem.console.config.stargate_url | string | `""` | Deprecated | +| cloudprem.console.image.pullPolicy | string | `"IfNotPresent"` | image pull policy | +| cloudprem.console.image.repository | string | `"ghcr.io/formancehq/console"` | image repository | +| cloudprem.console.image.tag | string | `""` | image tag | +| cloudprem.console.imagePullSecrets | list | `[]` | image pull secrets | +| cloudprem.console.ingress.annotations | object | `{}` | ingress annotations | +| cloudprem.console.ingress.className | string | `""` | ingress class name | +| cloudprem.console.ingress.enabled | bool | `true` | ingress enabled | +| cloudprem.console.ingress.hosts[0] | object | `{"host":"{{ tpl .Values.global.platform.console.host $ }}","paths":[{"path":"/","pathType":"Prefix"}]}` | ingress host | +| cloudprem.console.ingress.hosts[0].paths[0] | object | `{"path":"/","pathType":"Prefix"}` | ingress path | +| cloudprem.console.ingress.hosts[0].paths[0].pathType | string | `"Prefix"` | ingress path type | +| cloudprem.console.ingress.labels | object | `{}` | ingress labels | +| cloudprem.console.ingress.tls | list | `[]` | ingress tls | +| cloudprem.console.livenessProbe | object | `{}` | Console liveness probe | +| cloudprem.console.nodeSelector | object | `{}` | Console node selector | +| cloudprem.console.podDisruptionBudget.enabled | bool | `false` | Enable pod disruption budget | +| cloudprem.console.podDisruptionBudget.maxUnavailable | int | `0` | Maximum unavailable pods | +| cloudprem.console.podDisruptionBudget.minAvailable | int | `1` | Minimum available pods | +| cloudprem.console.podSecurityContext | object | `{}` | Pod Security Context | +| cloudprem.console.readinessProbe | object | `{}` | Console readiness probe | +| cloudprem.console.replicas | int | `1` | Number of replicas | +| cloudprem.console.resources | object | `{}` | Console resources | +| cloudprem.console.securityContext | object | `{}` | Container Security Context | +| cloudprem.console.service.annotations | object | `{}` | service annotations | +| cloudprem.console.service.clusterIP | string | `""` | service cluster IP | +| cloudprem.console.service.ports.http | object | `{"port":3000}` | service http port | +| cloudprem.console.service.type | string | `"ClusterIP"` | service type | +| cloudprem.console.serviceAccount.annotations | object | `{}` | Service account annotations | +| cloudprem.console.serviceAccount.create | bool | `true` | Service account creation | +| cloudprem.console.serviceAccount.name | string | `""` | Service account name | +| cloudprem.console.tolerations | list | `[]` | Console tolerations | +| cloudprem.console.volumeMounts | list | `[]` | Console volume mounts | +| cloudprem.console.volumes | list | `[]` | Console volumes | | cloudprem.console-v3.affinity | object | `{}` | Console affinity | | cloudprem.console-v3.annotations | object | `{}` | Console annotations | | cloudprem.console-v3.autoscaling.enabled | bool | `false` | |