Bank Transfer (TED) via Helm

Deploy the Brazilian bank transfer (TED) plugin on Kubernetes with the plugin-br-bank-transfer-helm chart, including its required encryption keys.

The Bank Transfer plugin sends and receives Brazilian bank transfers (TED). It settles the movements and reconciles them against the ledger. The chart name is plugin-br-bank-transfer-helm.

The Bank Transfer plugin requires an Enterprise license. Contact Lerian for access to the plugin images and the deployment credentials.

What the chart installs

---

The chart installs one service: a Deployment, a Service, a ConfigMap, a Secret, a ServiceAccount, a HorizontalPodAutoscaler, a PodDisruptionBudget, and an optional Ingress.

It also runs a database migration Job with its own Secret, and bootstrap jobs for PostgreSQL, MongoDB, and RabbitMQ. The chart bundles Valkey, PostgreSQL, MongoDB, and RabbitMQ subcharts. Disable any of them to use an externally managed service instead.

Prerequisites

---

• A running Midaz deployment. Point bankTransfer.configmap.MIDAZ_BASE_URL at it.
• The plugin-access-manager chart. The chart sets PLUGIN_AUTH_ENABLED to true by default and calls Access Manager to authenticate inbound requests.
• Access to the partner channel that carries the transfers.
• Enterprise license and registry credentials.
• Helm 3.8 or later for OCI registry support.

Values you must set

---

In bankTransfer.configmap:

Key	Purpose
JD_BASE_URL	The partner endpoint that carries the transfer messages.
JD_ORIGIN_ISPB	Your institution’s origin ISPB code.
CRM_BASE_URL	The CRM endpoint that resolves the parties on a transfer.
FEES_BASE_URL	The endpoint that prices the transfer.

In bankTransfer.secrets, or in your own Secret through bankTransfer.useExistingSecret:

Key	Purpose
JD_INCOMING_RAW_XML_ENCRYPTION_KEY	Encrypts the stored inbound messages. Use a hex-encoded 32-byte key.
RECIPIENT_DETAILS_ENCRYPTION_KEY	Encrypts the stored recipient details. Use a hex-encoded 32-byte key.
POSTGRES_PASSWORD and REDIS_PASSWORD	Set them only for externally managed databases.
LICENSE_KEY	Enterprise license validation in production.

Leave MONGO_PASSWORD empty while the bundled MongoDB subchart is enabled. The subchart generates the password into its own Secret.

Keep both encryption keys stable across upgrades. A changed key makes the records that the previous key encrypted unreadable.

Install

---

Read the current chart version first, then install:

helm show chart oci://registry-1.docker.io/lerianstudio/plugin-br-bank-transfer-helm

helm install plugin-br-bank-transfer \
  oci://registry-1.docker.io/lerianstudio/plugin-br-bank-transfer-helm \
  --version <version> -n midaz-plugins --create-namespace -f my-values.yaml

Upgrade and uninstall

---

helm upgrade plugin-br-bank-transfer \
  oci://registry-1.docker.io/lerianstudio/plugin-br-bank-transfer-helm \
  --version <new-version> -n midaz-plugins -f my-values.yaml

helm uninstall plugin-br-bank-transfer -n midaz-plugins

Uninstalling removes the Kubernetes resources. It does not delete the database contents or the PersistentVolumeClaims.

Resources

---

• Bank Transfer documentation
• Plugin Helm charts
• Helm chart repository