single-serviceLICENSE_KEY, MENSAGERIA_CLIENT_ID, MENSAGERIA_CLIENT_SECRET, EXECUTOR_HUB_WEBHOOK_SECRET (webhook transport), the KMS credential (VAULT_TOKEN or VAULT_APPROLE_SECRET_ID; none for AWS KMS), POSTGRES_PASSWORD / REDIS_PASSWORD for external infra, plus, as existing Secrets, the Mensageria server CA (ca.crt; optional in one-way TLS) and, with mTLS only, the executor client pair (tls.crt, tls.key). The default render fails on purpose and names the first missing value.global.datastores, global.kms, global.auth.host, sisbajud.mensageria.*, sisbajud.executor.*, and sisbajud.useExistingSecret + existingSecretName (an existing Secret replaces the chart Secret; it is not merged).The SISBAJUD executor. One process that:
sisbajud.mensageria.mtlsEnabled, which must match the Mensageria’s SISBAJUD_EXECUTION_MTLS_ENABLED);Notices arrive through the Streaming Hub webhook (default, own listener on :9082) or an SQS queue. The regulatory side (STA intake, return files, BACEN) is the Sisbajud Mensageria, a br-sfn rail — it is not part of this chart. This chart replaces br-sisbajud (deprecated).
| Resource | Notes |
|---|---|
| Deployment | ghcr.io/lerianstudio/plugin-br-sisbajud, HTTP API :4029 (liveness /version, readiness /readyz), webhook :9082 |
Service / Service -webhook |
ClusterIP; the webhook Service exposes only the listener |
Ingress / Ingress -webhook |
both optional; expose only the webhook path to the Streaming Hub |
Job -migrations |
ghcr.io/lerianstudio/plugin-br-sisbajud-migrations, pre-install/pre-upgrade hook (ArgoCD PreSync, wave -5) |
| ConfigMap / Secret | env; no credential is ever rendered in the ConfigMap |
kubectl create secret generic sisbajud-mensageria-ca -n sisbajud --from-file=ca.crt=mensageria-ca.pem
# mTLS only (sisbajud.mensageria.mtlsEnabled: true):
kubectl create secret tls sisbajud-mensageria-client -n sisbajud --cert=client.pem --key=client-key.pem
helm install plugin-br-sisbajud oci://ghcr.io/lerianstudio/plugin-br-sisbajud-helm \
-n sisbajud -f my-values.yaml # start from values-template.yaml
See docs/00-getting-start.md (pt-BR) / docs/00-getting-start.en.md.
Precedence per env key: sisbajud.configmap.<KEY> > sisbajud.<group>.<field> > sisbajud.datastores / sisbajud.kms > global.<block> > global.cloud preset > chart default.
| Values | Env | Notes |
|---|---|---|
sisbajud.mensageria.baseUrl |
MENSAGERIA_BASE_URL |
https; turns the process into the executor |
sisbajud.mensageria.mtlsEnabled |
MENSAGERIA_MTLS_ENABLED |
false (one-way TLS). true requires the CA and the client pair. Must match the Mensageria |
sisbajud.mensageria.ca.existingSecret (+ key, mountPath) |
MENSAGERIA_TLS_CA_FILE |
server CA, mounted at <mountPath>/ca.crt. Optional in one-way TLS (empty = system trust store); empty falls back to tls.existingSecret + tls.caKey |
sisbajud.mensageria.tls.existingSecret (+ certKey, keyKey, mountPath) |
MENSAGERIA_TLS_CLIENT_CERT_FILE, MENSAGERIA_TLS_CLIENT_KEY_FILE |
client pair, mounted (at <mountPath>/tls.crt, tls.key) and emitted only with mTLS |
sisbajud.license.isDevelopment |
IS_DEVELOPMENT |
"true" routes the license check to the dev gateway (dev-issued keys) |
sisbajud.executor.m2mSubject |
EXECUTOR_M2M_SUBJECT |
sub of the executor M2M token |
sisbajud.executor.streamingHubTenantId |
STREAMING_HUB_TENANT_ID |
required; same value as the Streaming Hub deployment |
sisbajud.secrets.MENSAGERIA_CLIENT_ID/SECRET |
same | minted at PLUGIN_AUTH_HOST |
sisbajud.executor.heartbeatEvery / responseDeadlineMargin |
EXECUTOR_HEARTBEAT_EVERY / RESPONSE_DEADLINE_MARGIN |
required; margin = same value as the Mensageria |
sisbajud.executor.transport |
EXECUTOR_TRANSPORT |
webhook (default) or sqs |
sisbajud.executor.webhook.* |
EXECUTOR_HUB_WEBHOOK_* |
outside DEPLOYMENT_MODE=local: tls.existingSecret or upstreamTlsValidated: true |
sisbajud.executor.sqs.* |
EXECUTOR_SQS_* |
needs AWS credentials (IRSA annotation or aws.rolesAnywhere) |
global.kms.* |
KMS_PROVIDER, VAULT_*, AWS_REGION |
vault or aws; the app has no in-memory provider |
global.datastores.postgres/redis |
POSTGRES_*, REDIS_* |
REDIS_HOST is rendered as host:port |
sisbajud.app.defaultTenantId |
DEFAULT_TENANT_ID |
must be a UUID |
sisbajud.license.organizationIds |
ORGANIZATION_IDS |
must be global |
global.auth.* |
PLUGIN_AUTH_ENABLED, PLUGIN_AUTH_HOST |
Liveness probes /version (static build info, always 200): the app’s /health stays 503 until its startup self-probe passes, and that self-probe stays degraded while no institution is routed, so a fresh install would be restarted in a loop. Readiness stays on /readyz.
VAULT_ADDR and MENSAGERIA_BASE_URL must be https (VAULT_ADDR may be http only for a loopback host or ENVIRONMENT_NAME local|development|test); argocd-vault-plugin placeholders (<path:...>) are not checked at render.
STREAMING_ENABLED is pinned to false: executor mode starts no producer or consumer. sisbajud.configmap accepts only the executor’s non-credential keys (values.schema.json); credentials go in sisbajud.secrets (emitted only when set) or the existing Secret.
The application (still in 1.0.0) wires a SeaweedFS/S3 client in every mode and its /readyz gates on it; SEAWEEDFS_S3_ENDPOINT defaults to http://localhost:8333 in code, so in executor mode the pod stays NotReady unless that endpoint answers. Executor mode never reads or writes objects. Until the app skips that probe in executor mode, point sisbajud.configmap.SEAWEEDFS_S3_ENDPOINT / SEAWEEDFS_BUCKET / SEAWEEDFS_REGION (and, if needed, sisbajud.secrets.SEAWEEDFS_ACCESS_KEY / SEAWEEDFS_SECRET_KEY) at a reachable S3 endpoint.
postgresql.enabled=true and valkey.enabled=true bundle plaintext infra for development: set sisbajud.app.environmentName=development; the app reads the subchart passwords via secretKeyRef and the schema is applied by a migrations initContainer in the app pod.
global.multiTenant.enabled=true emits the MULTI_TENANT_* group and skips the migrations (per-tenant schemas are migrated outside the chart). The executor serves exactly one tenant: the webhook secret / SQS queue is single-tenant and the app refuses a fleet of more than one.