Midaz components reference

Configure Helm chart components for Midaz — Ledger and CRM — with deployment, service, and ingress settings.

The Midaz Helm chart deploys two service components: Ledger (the unified core service, enabled by default) and CRM (optional). Each component has its own deployment, service, ingress, and autoscaling configuration.

Quick decision: Need CRM? → set crm.enabled: true.

Ledger

The ledger service combines the onboarding and transaction modules in a single deployment. It is the only core service and is enabled by default.

Parameter	Description	Default Value
ledger.enabled	Enable or disable the ledger service.	true
ledger.name	Service name.	"ledger"
ledger.replicaCount	Number of replicas for the ledger service.	2
ledger.revisionHistoryLimit	Number of old ReplicaSets to retain for deployment rollback.	10
ledger.image.repository	Repository for the ledger service container image.	"lerianstudio/midaz-ledger"
ledger.image.pullPolicy	Image pull policy.	"IfNotPresent"
ledger.image.tag	Image tag used for deployment.	Chart appVersion (e.g. "3.8.0"); empty falls back to Chart.AppVersion
ledger.imagePullSecrets	Secrets for pulling images from a private registry.	[]
ledger.nameOverride	Overrides the default generated name by Helm.	""
ledger.fullnameOverride	Overrides the full name generated by Helm.	""
ledger.podAnnotations	Pod annotations for additional metadata.	{}
ledger.podSecurityContext	Security context applied at the pod level.	{}
ledger.securityContext.*	Defines security context settings for the container.	See values.yaml
ledger.pdb.enabled	Specifies whether PodDisruptionBudget is enabled.	true
ledger.pdb.minAvailable	Minimum number of available pods.	1
ledger.pdb.maxUnavailable	Maximum number of unavailable pods.	1
ledger.pdb.annotations	Annotations for the PodDisruptionBudget.	{}
ledger.deploymentUpdate.*	Deployment update strategy.	See values.yaml
ledger.service.type	Kubernetes service type.	"ClusterIP"
ledger.service.port	Port for the HTTP API.	3002
ledger.service.annotations	Annotations for the service.	{}
ledger.ingress.enabled	Specifies whether Ingress is enabled.	false
ledger.ingress.className	Ingress class name.	""
ledger.ingress.annotations	Additional ingress annotations.	{}
ledger.ingress.hosts	Configured hosts for Ingress and associated paths.	[]
ledger.ingress.tls	TLS configurations for Ingress.	[]
ledger.resources.*	CPU/Memory resource requests/limits.	See values.yaml
ledger.livenessProbe.*	Liveness probe fields that override the chart defaults: path: /health, initialDelaySeconds: 0, periodSeconds: 10, timeoutSeconds: 1, successThreshold: 1, failureThreshold: 3.	{}
ledger.readinessProbe.*	Readiness probe fields that override the chart defaults: path: /readyz, initialDelaySeconds: 0, periodSeconds: 10, timeoutSeconds: 1, successThreshold: 1, failureThreshold: 3.	{}
ledger.initContainer.timeoutSeconds	Seconds the init container waits for each database and broker endpoint before the pod fails to start.	300
ledger.autoscaling.enabled	Specifies whether autoscaling is enabled.	true
ledger.autoscaling.minReplicas	Minimum number of replicas for autoscaling.	2
ledger.autoscaling.maxReplicas	Maximum number of replicas for autoscaling.	9
ledger.autoscaling.targetCPUUtilizationPercentage	Target CPU utilization percentage for autoscaling.	80
ledger.autoscaling.targetMemoryUtilizationPercentage	Target memory utilization percentage for autoscaling.	80
ledger.nodeSelector	Node selectors for pod scheduling.	{}
ledger.tolerations	Tolerations for pod scheduling.	{}
ledger.affinity	Affinity rules for pod scheduling.	{}
ledger.configmap.*	Environment variables for the service.	See values.yaml
ledger.secrets.*	Secrets for the service.	See values.yaml
ledger.useExistingSecret	Use an existing secret instead of creating a new one.	false
ledger.existingSecretName	The name of the existing secret to use.	""
ledger.extraEnvVars	A list of extra environment variables.	[]
ledger.serviceAccount.create	Specifies whether the service account should be created.	true
ledger.serviceAccount.annotations	Annotations for the service account.	{}
ledger.serviceAccount.name	Service account name. If not defined, it will be generated automatically.	""

Creating Ledger secret manually

If you want to use an existing Kubernetes Secret for the ledger service, you can create it manually:

kubectl create secret generic midaz-ledger \
  --from-literal=DB_ONBOARDING_PASSWORD='<your-db-onboarding-password>' \
  --from-literal=DB_ONBOARDING_REPLICA_PASSWORD='<your-db-onboarding-replica-password>' \
  --from-literal=MONGO_ONBOARDING_PASSWORD='<your-mongo-onboarding-password>' \
  --from-literal=DB_TRANSACTION_PASSWORD='<your-db-transaction-password>' \
  --from-literal=DB_TRANSACTION_REPLICA_PASSWORD='<your-db-transaction-replica-password>' \
  --from-literal=MONGO_TRANSACTION_PASSWORD='<your-mongo-transaction-password>' \
  --from-literal=REDIS_PASSWORD='<your-redis-password>' \
  --from-literal=RABBITMQ_DEFAULT_PASS='<your-rabbitmq-password>' \
  --from-literal=RABBITMQ_CONSUMER_PASS='<your-rabbitmq-consumer-password>' \
  -n midaz

The ledger service uses module-specific database credentials (onboarding and transaction) since it combines both modules.

Then configure the ledger service to use this existing secret:

ledger:
  enabled: true
  useExistingSecret: true
  existingSecretName: "midaz-ledger"

CRM (Customer relationship management)

The crm service provides APIs for managing holder data and their relationships with ledger accounts. Previously available as a separate chart (plugin-crm) deployed in the midaz-plugins namespace, the CRM is now integrated into the main Midaz Helm chart and deployed in the midaz namespace.

If you are currently using plugin-crm in the midaz-plugins namespace, we recommend migrating to this new integrated CRM workload. See the Upgrading Helm guide for migration steps.

For more details about CRM functionality, refer to the CRM Documentation.

Enabling CRM service:

crm:
  enabled: true
  configmap:
    MONGO_HOST: "midaz-mongodb"  # Use your MongoDB host
    MONGO_NAME: "crm"
    MONGO_USER: "midaz"
  secrets:
    MONGO_PASSWORD: "lerian"

Parameter	Description	Default Value
crm.enabled	Enable or disable the CRM service.	false
crm.name	Service name.	"crm"
crm.replicaCount	Number of replicas for the CRM service.	1
crm.revisionHistoryLimit	Number of old ReplicaSets to retain for deployment rollback.	10
crm.image.repository	Repository for the CRM service container image.	"lerianstudio/midaz-crm"
crm.image.pullPolicy	Image pull policy.	"Always"
crm.image.tag	Image tag used for deployment.	Chart appVersion (e.g. "3.8.0")
crm.imagePullSecrets	Secrets for pulling images from a private registry.	[]
crm.nameOverride	Overrides the default generated name by Helm.	""
crm.fullnameOverride	Overrides the full name generated by Helm.	""
crm.podAnnotations	Pod annotations for additional metadata.	{}
crm.podSecurityContext	Security context applied at the pod level.	{}
crm.securityContext.*	Defines security context settings for the container.	See values.yaml
crm.pdb.enabled	Specifies whether PodDisruptionBudget is enabled.	true
crm.pdb.minAvailable	Minimum number of available pods.	1
crm.pdb.maxUnavailable	Maximum number of unavailable pods.	1
crm.pdb.annotations	Annotations for the PodDisruptionBudget.	{}
crm.deploymentUpdate.type	Type of deployment strategy.	"RollingUpdate"
crm.deploymentUpdate.maxSurge	Maximum number of pods that can be created over the desired number of pods.	1
crm.deploymentUpdate.maxUnavailable	Maximum number of pods that can be unavailable during the update.	1
crm.service.type	Kubernetes service type.	"ClusterIP"
crm.service.port	Service port.	4003
crm.service.annotations	Annotations for the service.	{}
crm.ingress.enabled	Specifies whether Ingress is enabled.	false
crm.ingress.className	Ingress class name.	""
crm.ingress.annotations	Additional ingress annotations.	{}
crm.ingress.hosts	Configured hosts for Ingress and associated paths.	[]
crm.ingress.tls	TLS configurations for Ingress.	[]
crm.resources.*	CPU/Memory resource requests/limits.	See values.yaml
crm.livenessProbe.*	Liveness probe fields that override the chart defaults: path: /health, initialDelaySeconds: 10, periodSeconds: 5, timeoutSeconds: 1, successThreshold: 1, failureThreshold: 3.	{}
crm.readinessProbe.*	Readiness probe fields that override the chart defaults: path: /readyz, initialDelaySeconds: 10, periodSeconds: 5, timeoutSeconds: 1, successThreshold: 1, failureThreshold: 3.	{}
crm.autoscaling.enabled	Specifies whether autoscaling is enabled.	true
crm.autoscaling.minReplicas	Minimum number of replicas for autoscaling.	1
crm.autoscaling.maxReplicas	Maximum number of replicas for autoscaling.	3
crm.autoscaling.targetCPUUtilizationPercentage	Target CPU utilization percentage for autoscaling.	80
crm.autoscaling.targetMemoryUtilizationPercentage	Target memory utilization percentage for autoscaling.	80
crm.nodeSelector	Node selectors for pod scheduling.	{}
crm.tolerations	Tolerations for pod scheduling.	{}
crm.affinity	Affinity rules for pod scheduling.	{}
crm.configmap.*	Environment variables for the service.	See values.yaml
crm.secrets.*	Secrets for the service.	See values.yaml
crm.useExistingSecret	Use an existing secret instead of creating a new one.	false
crm.existingSecretName	The name of the existing secret to use.	""
crm.extraEnvVars	A list of extra environment variables.	{}

Creating CRM secret manually

If you want to use an existing Kubernetes Secret for the CRM service:

kubectl create secret generic midaz-crm \
  --from-literal=LCRYPTO_HASH_SECRET_KEY='<your-hash-secret-key>' \
  --from-literal=LCRYPTO_ENCRYPT_SECRET_KEY='<your-encrypt-secret-key>' \
  --from-literal=MONGO_PASSWORD='<your-mongo-password>' \
  -n midaz

Then configure the CRM service to use this existing secret:

crm:
  enabled: true
  useExistingSecret: true
  existingSecretName: "midaz-crm"