helm

Plugin BR Bank Transfer Helm Chart

Chart Contract

Chart type: single-service
Required secrets: bankTransfer.secrets.JD_INCOMING_RAW_XML_ENCRYPTION_KEY and RECIPIENT_DETAILS_ENCRYPTION_KEY; JD and webhook fields are required when their non-sandbox features are enabled. The PostgreSQL, Valkey, and MongoDB passwords are not operator-provided with the bundled subcharts: each is auto-generated into its <release>-{postgresql,valkey,mongodb} Secret and read via secretKeyRef. The app is MongoDB-URI-only, so MONGO_URI is assembled on the deployment as mongodb://bank_transfer:$(MONGO_PASSWORD)@<release>-mongodb… where MONGO_PASSWORD is sourced from the subchart Secret (mongodb-passwords). For external infra, set the relevant <subchart>.external=true plus <subchart>.auth.existingSecret (and bankTransfer.secrets.MONGO_URI for an external Mongo). See docs/helm-chart-standard.md “Single-Source Infra Secrets”.
Dependency notes: Uses local PostgreSQL and MongoDB dependency charts unless external services are configured.
Production overrides: Provide bank-transfer credentials through chart secrets or bankTransfer.useExistingSecret; override Midaz/CRM/Fees/JD endpoints, image tags, ingress, resources, and persistence.
Source/license: Source is in github.com/LerianStudio/helm; license is Apache-2.0.

This Helm chart installs Plugin BR Bank Transfer for Midaz, a high-performance and open-source ledger.

Install Plugin BR Bank Transfer Helm Chart

To install Plugin BR Bank Transfer using Helm, run the following command:

$ helm install plugin-br-bank-transfer oci://registry-1.docker.io/lerianstudio/plugin-br-bank-transfer-helm --version <version> -n midaz-plugins --create-namespace

This will create a new namespace called midaz-plugins if it doesn’t already exist and deploy the Plugin BR Bank Transfer Helm chart.

After installation, you can verify that the release was successful by listing the Helm releases in the midaz-plugins namespace:

$ helm list -n midaz-plugins

Upgrading

To upgrade the chart to a new version:

$ helm upgrade plugin-br-bank-transfer oci://registry-1.docker.io/lerianstudio/plugin-br-bank-transfer-helm --version <new-version> -n midaz-plugins

Uninstalling

To uninstall the chart:

$ helm uninstall plugin-br-bank-transfer -n midaz-plugins

Configuring Ingress for Different Controllers

The Plugin Bank Transfer Helm Chart optionally supports different Ingress Controllers for exposing services when necessary.

NGINX Ingress Controller

To use the NGINX Ingress Controller, configure the values.yaml as follows:

bankTransfer:
  ingress:
    enabled: true
    className: "nginx"
    annotations: {}
    hosts:
      - host: bank-transfer.example.com
        paths:
          - path: /
            pathType: Prefix
    tls:
      - secretName: bank-transfer-tls
        hosts:
          - bank-transfer.example.com

Parameters

Bank Transfer Service

Parameter	Description	Default
`bankTransfer.enabled`	Enable or disable the bank-transfer service	`true`
`bankTransfer.replicaCount`	Number of replicas for the deployment	`2`
`bankTransfer.image.repository`	Repository for the container image	`ghcr.io/lerianstudio/plugin-br-bank-transfer`
`bankTransfer.image.pullPolicy`	Image pull policy	`IfNotPresent`
`bankTransfer.image.tag`	Image tag used for deployment	`2.4.0`
`bankTransfer.imagePullSecrets`	Secrets for pulling images from a private registry	`[]`
`bankTransfer.revisionHistoryLimit`	Old ReplicaSets to retain	`10`
`bankTransfer.nameOverride`	Overrides the default generated name by Helm	`""`
`bankTransfer.fullnameOverride`	Overrides the full name generated by Helm	`""`
`bankTransfer.ingress.enabled`	Enable or disable ingress	`false`
`bankTransfer.ingress.className`	Ingress class name	`""`
`bankTransfer.ingress.annotations`	Additional ingress annotations	`{}`
`bankTransfer.ingress.hosts`	Ingress host configuration	See `values.yaml`
`bankTransfer.ingress.tls`	TLS configuration for ingress	`[]`
`bankTransfer.service.type`	Kubernetes service type	`ClusterIP`
`bankTransfer.service.port`	Service port	`4027`
`bankTransfer.deploymentUpdate.type`	Deployment strategy type	`RollingUpdate`
`bankTransfer.podSecurityContext`	Pod security context	`{}`
`bankTransfer.securityContext`	Security context for the container	See `values.yaml`
`bankTransfer.pdb.enabled`	Enable or disable PodDisruptionBudget	`true`
`bankTransfer.pdb.minAvailable`	Minimum number of available pods	`1`
`bankTransfer.pdb.maxUnavailable`	Maximum number of unavailable pods	`1`
`bankTransfer.resources`	CPU and memory limits for pods	See `values.yaml`
`bankTransfer.autoscaling.enabled`	Enable or disable horizontal pod autoscaling	`true`
`bankTransfer.autoscaling.minReplicas`	Minimum number of replicas	`2`
`bankTransfer.autoscaling.maxReplicas`	Maximum number of replicas	`5`
`bankTransfer.nodeSelector`	Node selector for scheduling pods	`{}`
`bankTransfer.tolerations`	Tolerations for scheduling on tainted nodes	`[]`
`bankTransfer.affinity`	Affinity rules for pod scheduling	`{}`
`bankTransfer.useExistingSecret`	Use an existing secret instead of creating a new one	`false`
`bankTransfer.existingSecretName`	The name of the existing secret to use	`""`

PostgreSQL Dependency

Parameter	Description	Default
`postgresql.enabled`	Enable the PostgreSQL dependency	`true`
`postgresql.external`	Use an external PostgreSQL instance	`false`
`postgresql.auth.postgresPassword`	PostgreSQL admin password. Leave empty to let the subchart auto-generate it into the `<release>-postgresql` Secret (read via `secretKeyRef`).	`""`
`postgresql.auth.username`	Application DB user	`bank_transfer`
`postgresql.auth.password`	Application DB password. Leave empty to let the subchart auto-generate it.	`""`
`postgresql.auth.database`	Application DB name	`bank_transfer`

Valkey (Redis-compatible) Dependency

Parameter	Description	Default
`valkey.enabled`	Enable the Valkey dependency	`true`
`valkey.architecture`	Valkey architecture	`standalone`
`valkey.auth.enabled`	Enable authentication	`true`
`valkey.auth.password`	Valkey password. Leave empty to let the subchart auto-generate it into the `<release>-valkey` Secret (read via `secretKeyRef`).	`""`
`valkey.auth.username`	Valkey username	`bank_transfer`

MongoDB Dependency

Parameter	Description	Default
`mongodb.enabled`	Enable the MongoDB dependency	`true`
`mongodb.auth.rootPassword`	MongoDB admin password. Leave empty to let the subchart auto-generate it into the `<release>-mongodb` Secret.	`""`
`mongodb.auth.usernames`	Application DB users	`["bank_transfer"]`
`mongodb.auth.passwords`	Application DB passwords. Leave empty to let the subchart auto-generate them (read via `secretKeyRef`, key `mongodb-passwords`).	`[""]`
`mongodb.auth.databases`	Application databases	`["plugin_br_bank_transfer_jd"]`

RabbitMQ Dependency (Optional)

Parameter	Description	Default
`rabbitmq.enabled`	Enable the RabbitMQ dependency	`false`
`rabbitmq.authentication.user.value`	RabbitMQ username	`bank_transfer`
`rabbitmq.authentication.password.value`	RabbitMQ password (operator-provided).	`""`
`rabbitmq.authentication.erlangCookie.value`	RabbitMQ Erlang cookie (operator-provided; e.g. `openssl rand -base64 32`). Must be set when `rabbitmq.enabled=true`.	`""`

IMPORTANT - Security Warning:

The bundled dependencies (PostgreSQL, Valkey, MongoDB) are NOT intended for production

For the bundled PostgreSQL/Valkey/MongoDB the password is auto-generated by each Bitnami subchart into its own Secret and read by the app via secretKeyRef — operators do not supply these passwords. Pin them only by setting the <dependency>.auth.* values or <dependency>.auth.existingSecret.

The RabbitMQ password and Erlang cookie have no default and are operator-provided; set them when rabbitmq.enabled=true.

For production, use external/managed services and set <dependency>.enabled=false plus <dependency>.external=true

Use useExistingSecret / <dependency>.auth.existingSecret options to reference pre-created Kubernetes secrets for sensitive data

ConfigMap Environment Variables

Key environment variables configured via bankTransfer.configmap:

Variable	Description	Default
`ENV_NAME`	Environment name	`production`
`LOG_LEVEL`	Log level	`info`
`SERVER_ADDRESS`	Server listen address	`:4027`
`POSTGRES_HOST`	PostgreSQL host	Dynamic based on release
`REDIS_HOST`	Redis/Valkey host	Dynamic based on release
`PLUGIN_AUTH_ENABLED`	Enable authentication	`true`
`JD_SANDBOX_MODE`	Enable JD sandbox mode (fake adapter)	`false`
`MIDAZ_BASE_URL`	Midaz API base URL	Required
`CRM_BASE_URL`	CRM adapter base URL	Required
`FEES_BASE_URL`	Fees adapter base URL	Required
`JD_BASE_URL`	JD SPB SOAP API URL	Required (unless `JD_SANDBOX_MODE=true`)
`JD_ORIGIN_ISPB`	Bank ISPB code for JD	Required (unless `JD_SANDBOX_MODE=true`)
`LICENSE_SERVICE_ADDRESS`	License validation service URL	Optional
`TENANT_IDS`	Tenant IDs for license validation	Optional

For a complete list, see values.yaml.

Secrets

Key secrets configured via bankTransfer.secrets:

Secret	Description
`POSTGRES_PASSWORD`	PostgreSQL password. With the bundled subchart it is auto-generated and read via `secretKeyRef`; set only for an external PostgreSQL without `postgresql.auth.existingSecret`.
`REDIS_PASSWORD`	Redis/Valkey password. With the bundled subchart it is auto-generated and read via `secretKeyRef`; set only for an external Valkey without `valkey.auth.existingSecret`.
`MONGO_PASSWORD`	MongoDB password. With the bundled subchart it is read from the subchart Secret (key `mongodb-passwords`); set only for an external MongoDB without `mongodb.auth.existingSecret`.
`MONGO_URI`	MongoDB connection URI. Auto-assembled on the deployment from `MONGO_PASSWORD`; set explicitly only to override (e.g. external MongoDB).
`JD_INCOMING_RAW_XML_ENCRYPTION_KEY`	Encryption key (hex-encoded 32-byte AES-256, 64 hex chars). Required.
`RECIPIENT_DETAILS_ENCRYPTION_KEY`	Encryption key (hex-encoded 32-byte AES-256, 64 hex chars). Required.

Development Mode

For local development/testing, you can disable authentication and use sandbox mode:

bankTransfer:
  configmap:
    ENV_NAME: "development"
    PLUGIN_AUTH_ENABLED: "false"
    POSTGRES_SSLMODE: "disable"
    JD_SANDBOX_MODE: "true"  # Uses fake JD adapter (no real bank calls)

Note: License validation is controlled via LICENSE_SERVICE_ADDRESS and TENANT_IDS. When these are not set, license validation is skipped.

Support

For more information, see the Lerian Studio Documentation or contact the maintainers.

This site is open source. Improve this page.