Skip to main content
The Midaz Helm chart deploys four possible service components: Ledger (unified, recommended), Onboarding (legacy), Transaction (legacy), and CRM (optional). Each component has its own deployment, service, ingress, and autoscaling configuration.
Quick decision: New installations → enable Ledger, disable Onboarding and Transaction. Migrating from v4.x → see Migration guide. Need CRM? → set crm.enabled: true.
Recommended for new installations: Use the unified Ledger service. The separate Onboarding and Transaction services are still supported but will become legacy in a future release.
The ledger service is a unified service that combines the functionality of both onboarding and transaction modules into a single deployment. This service is recommended for new installations and will become mandatory in future releases.
When ledger.enabled is set to true, the onboarding and transaction services are automatically disabled (unless migration.allowAllServices is set to true for testing purposes).
Enabling Ledger service: 
ledger:
  enabled: true

onboarding:
  enabled: false

transaction:
  enabled: false
When ledger is enabled, the onboarding and transaction ingresses will automatically redirect traffic to the ledger service, maintaining backward compatibility with existing DNS configurations.
ParameterDescriptionDefault Value
ledger.enabledEnable or disable the ledger service.false
ledger.nameService name."ledger"
ledger.replicaCountNumber of replicas for the ledger service.1
ledger.image.repositoryRepository for the ledger service container image."lerianstudio/midaz-ledger"
ledger.image.pullPolicyImage pull policy."IfNotPresent"
ledger.image.tagImage tag used for deployment."" (defaults to Chart.AppVersion)
ledger.imagePullSecretsSecrets for pulling images from a private registry.[]
ledger.nameOverrideOverrides the default generated name by Helm.""
ledger.fullnameOverrideOverrides the full name generated by Helm.""
ledger.podAnnotationsPod annotations for additional metadata.{}
ledger.podSecurityContextSecurity context applied at the pod level.{}
ledger.securityContext.*Defines security context settings for the container.See values.yaml
ledger.pdb.enabledSpecifies whether PodDisruptionBudget is enabled.true
ledger.pdb.minAvailableMinimum number of available pods.1
ledger.pdb.maxUnavailableMaximum number of unavailable pods.1
ledger.pdb.annotationsAnnotations for the PodDisruptionBudget.{}
ledger.deploymentUpdate.*Deployment update strategy.See values.yaml
ledger.service.typeKubernetes service type."ClusterIP"
ledger.service.portPort for the HTTP API.3002
ledger.service.annotationsAnnotations for the service.{}
ledger.ingress.enabledSpecifies whether Ingress is enabled.false
ledger.ingress.classNameIngress class name.""
ledger.ingress.annotationsAdditional ingress annotations.{}
ledger.ingress.hostsConfigured hosts for Ingress and associated paths.[]
ledger.ingress.tlsTLS configurations for Ingress.[]
ledger.resources.*CPU/Memory resource requests/limits.See values.yaml
ledger.autoscaling.enabledSpecifies whether autoscaling is enabled.true
ledger.autoscaling.minReplicasMinimum number of replicas for autoscaling.2
ledger.autoscaling.maxReplicasMaximum number of replicas for autoscaling.5
ledger.autoscaling.targetCPUUtilizationPercentageTarget CPU utilization percentage for autoscaling.80
ledger.autoscaling.targetMemoryUtilizationPercentageTarget memory utilization percentage for autoscaling.80
ledger.nodeSelectorNode selectors for pod scheduling.{}
ledger.tolerationsTolerations for pod scheduling.{}
ledger.affinityAffinity rules for pod scheduling.{}
ledger.configmap.*Environment variables for the service.See values.yaml
ledger.secrets.*Secrets for the service.See values.yaml
ledger.useExistingSecretUse an existing secret instead of creating a new one.false
ledger.existingSecretNameThe name of the existing secret to use.""
ledger.extraEnvVarsA list of extra environment variables.[]
ledger.serviceAccount.createSpecifies whether the service account should be created.true
ledger.serviceAccount.annotationsAnnotations for the service account.{}
ledger.serviceAccount.nameService account name. If not defined, it will be generated automatically.""

​
Creating Ledger secret manually

If you want to use an existing Kubernetes Secret for the ledger service, you can create it manually: 
kubectl create secret generic midaz-ledger \
  --from-literal=DB_ONBOARDING_PASSWORD='<your-db-onboarding-password>' \
  --from-literal=DB_ONBOARDING_REPLICA_PASSWORD='<your-db-onboarding-replica-password>' \
  --from-literal=MONGO_ONBOARDING_PASSWORD='<your-mongo-onboarding-password>' \
  --from-literal=DB_TRANSACTION_PASSWORD='<your-db-transaction-password>' \
  --from-literal=DB_TRANSACTION_REPLICA_PASSWORD='<your-db-transaction-replica-password>' \
  --from-literal=MONGO_TRANSACTION_PASSWORD='<your-mongo-transaction-password>' \
  --from-literal=REDIS_PASSWORD='<your-redis-password>' \
  --from-literal=RABBITMQ_DEFAULT_PASS='<your-rabbitmq-password>' \
  --from-literal=RABBITMQ_CONSUMER_PASS='<your-rabbitmq-consumer-password>' \
  -n midaz
The ledger service uses module-specific database credentials (onboarding and transaction) since it combines both modules.
Then configure the ledger service to use this existing secret: 
ledger:
  enabled: true
  useExistingSecret: true
  existingSecretName: "midaz-ledger"

​
Onboarding (legacy)

The Onboarding service is still supported but will become legacy in a future release. We recommend using the unified Ledger service for new installations.
ParameterDescriptionDefault Value
onboarding.nameService name."onboarding"
onboarding.replicaCountNumber of replicas for the onboarding service.2
onboarding.image.repositoryRepository for the onboarding service container image."lerianstudio/midaz-onboarding"
onboarding.image.pullPolicyImage pull policy."IfNotPresent"
onboarding.image.tagImage tag used for deployment."3.5.3"
onboarding.imagePullSecretsSecrets for pulling images from a private registry.[]
onboarding.nameOverrideOverrides the default generated name by Helm.""
onboarding.fullnameOverrideOverrides the full name generated by Helm.""
onboarding.podAnnotationsPod annotations for additional metadata.{}
onboarding.podSecurityContextSecurity context applied at the pod level.{}
onboarding.securityContext.*Defines security context settings for the container.See values.yaml
onboarding.pdb.enabledSpecifies whether PodDisruptionBudget is enabled.true
onboarding.pdb.minAvailableMinimum number of available pods.1
onboarding.pdb.maxUnavailableMaximum number of unavailable pods.1
onboarding.pdb.annotationsAnnotations for the PodDisruptionBudget.{}
onboarding.deploymentUpdate.*Deployment update strategy.See values.yaml
onboarding.service.typeKubernetes service type."ClusterIP"
onboarding.service.portPort for the HTTP API.3000
onboarding.service.annotationsAnnotations for the service.{}
onboarding.ingress.enabledSpecifies whether Ingress is enabled.false
onboarding.ingress.classNameIngress class name.""
onboarding.ingress.annotationsAdditional ingress annotations.{}
onboarding.ingress.hostsConfigured hosts for Ingress and associated paths.""
onboarding.ingress.tlsTLS configurations for Ingress.[]
onboarding.resources.*CPU/Memory resource requests/limits.See values.yaml
onboarding.autoscaling.enabledSpecifies whether autoscaling is enabled.true
onboarding.autoscaling.minReplicasMinimum number of replicas for autoscaling.2
onboarding.autoscaling.maxReplicasMaximum number of replicas for autoscaling.5
onboarding.autoscaling.targetCPUUtilizationPercentageTarget CPU utilization percentage for autoscaling.80
onboarding.autoscaling.targetMemoryUtilizationPercentageTarget memory utilization percentage for autoscaling.80
onboarding.nodeSelectorNode selectors for pod scheduling.{}
onboarding.tolerationsTolerations for pod scheduling.{}
onboarding.affinityAffinity rules for pod scheduling.{}
onboarding.configmap.*Environment variables for the service.See values.yaml
onboarding.secrets.*Secrets for the service.See values.yaml
onboarding.useExistingSecretUse an existing secret instead of creating a new one.false
onboarding.existingSecretNameThe name of the existing secret to use.""
onboarding.extraEnvVarsA list of extra environment variables.[]
onboarding.serviceAccount.createSpecifies whether the service account should be created.true
onboarding.serviceAccount.annotationsAnnotations for the service account.{}
onboarding.serviceAccount.nameService account name. If not defined, it will be generated automatically.""

​
Creating Onboarding secret manually

If you want to use an existing Kubernetes Secret for the onboarding service: 
kubectl create secret generic midaz-onboarding \
  --from-literal=MONGO_PASSWORD='<your-mongo-password>' \
  --from-literal=DB_PASSWORD='<your-db-password>' \
  --from-literal=DB_REPLICA_PASSWORD='<your-db-replica-password>' \
  --from-literal=RABBITMQ_DEFAULT_PASS='<your-rabbitmq-password>' \
  --from-literal=REDIS_PASSWORD='<your-redis-password>' \
  -n midaz
Then configure the onboarding service to use this existing secret: 
onboarding:
  useExistingSecret: true
  existingSecretName: "midaz-onboarding"

​
Transaction (legacy)

The Transaction service is still supported but will become legacy in a future release. We recommend using the unified Ledger service for new installations.
ParameterDescriptionDefault Value
transaction.nameService name."transaction"
transaction.replicaCountNumber of replicas for the transaction service.1
transaction.image.repositoryRepository for the transaction service container image."lerianstudio/midaz-transaction"
transaction.image.pullPolicyImage pull policy."IfNotPresent"
transaction.image.tagImage tag used for deployment."3.5.3"
transaction.imagePullSecretsSecrets for pulling images from a private registry.[]
transaction.nameOverrideOverrides the default generated name by Helm.""
transaction.fullnameOverrideOverrides the full name generated by Helm.""
transaction.podAnnotationsPod annotations for additional metadata.{}
transaction.podSecurityContextSecurity context for the pod.{}
transaction.securityContext.*Defines security context settings for the container.See values.yaml
transaction.pdb.enabledEnable or disable PodDisruptionBudget.true
transaction.pdb.minAvailableMinimum number of available pods.2
transaction.pdb.maxUnavailableMaximum number of unavailable pods.1
transaction.pdb.annotationsAnnotations for the PodDisruptionBudget.{}
transaction.deploymentUpdate.*Deployment update strategy.See values.yaml
transaction.service.typeKubernetes service type."ClusterIP"
transaction.service.portPort for the HTTP API.3001
transaction.service.annotationsAnnotations for the service.{}
transaction.ingress.enabledEnable or disable ingress.false
transaction.ingress.classNameIngress class name.""
transaction.ingress.annotationsAdditional ingress annotations.{}
transaction.ingress.hostsConfigured hosts for ingress and associated paths.[]
transaction.ingress.tlsTLS configuration for ingress.[]
transaction.resources.*CPU/Memory resource requests/limits.See values.yaml
transaction.autoscaling.enabledEnable or disable horizontal pod autoscaling.true
transaction.autoscaling.minReplicasMinimum number of replicas for autoscaling.1
transaction.autoscaling.maxReplicasMaximum number of replicas for autoscaling.5
transaction.autoscaling.targetCPUUtilizationPercentageTarget CPU utilization percentage for autoscaling.80
transaction.autoscaling.targetMemoryUtilizationPercentageTarget memory utilization percentage for autoscaling.80
transaction.nodeSelectorNode selector for scheduling pods on specific nodes.{}
transaction.tolerationsTolerations for scheduling on tainted nodes.{}
transaction.affinityAffinity rules for pod scheduling.{}
transaction.configmap.*Environment variables for the service.See values.yaml
transaction.secrets.*Secrets for the service.See values.yaml
transaction.useExistingSecretUse an existing secret instead of creating a new one.false
transaction.existingSecretNameThe name of the existing secret to use.""
transaction.extraEnvVarsA list of extra environment variables.[]
transaction.serviceAccount.createSpecifies whether a ServiceAccount should be created.true
transaction.serviceAccount.annotationsAnnotations for the ServiceAccount.{}
transaction.serviceAccount.nameName of the service account.""

​
Creating Transaction secret manually

If you want to use an existing Kubernetes Secret for the transaction service: 
kubectl create secret generic midaz-transaction \
  --from-literal=MONGO_PASSWORD='<your-mongo-password>' \
  --from-literal=DB_PASSWORD='<your-db-password>' \
  --from-literal=DB_REPLICA_PASSWORD='<your-db-replica-password>' \
  --from-literal=RABBITMQ_DEFAULT_PASS='<your-rabbitmq-password>' \
  --from-literal=RABBITMQ_CONSUMER_PASS='<your-rabbitmq-consumer-password>' \
  --from-literal=REDIS_PASSWORD='<your-redis-password>' \
  -n midaz
The transaction service requires an additional secret key RABBITMQ_CONSUMER_PASS compared to onboarding.
Then configure the transaction service to use this existing secret: 
transaction:
  useExistingSecret: true
  existingSecretName: "midaz-transaction"

​
CRM (Customer relationship management)

The crm service provides APIs for managing holder data and their relationships with ledger accounts. Previously available as a separate chart (plugin-crm) deployed in the midaz-plugins namespace, the CRM is now integrated into the main Midaz Helm chart and deployed in the midaz namespace.
If you are currently using plugin-crm in the midaz-plugins namespace, we recommend migrating to this new integrated CRM workload. See the Upgrading Helm guide for migration steps.
For more details about CRM functionality, refer to the CRM Documentation.
Enabling CRM service: 
crm:
  enabled: true
  configmap:
    MONGO_HOST: "midaz-mongodb"  # Use your MongoDB host
    MONGO_NAME: "crm"
    MONGO_USER: "midaz"
  secrets:
    MONGO_PASSWORD: "lerian"
ParameterDescriptionDefault Value
crm.enabledEnable or disable the CRM service.false
crm.nameService name."crm"
crm.replicaCountNumber of replicas for the CRM service.1
crm.image.repositoryRepository for the CRM service container image."lerianstudio/midaz-crm"
crm.image.pullPolicyImage pull policy."Always"
crm.image.tagImage tag used for deployment."3.5.3"
crm.imagePullSecretsSecrets for pulling images from a private registry.[]
crm.nameOverrideOverrides the default generated name by Helm.""
crm.fullnameOverrideOverrides the full name generated by Helm.""
crm.podAnnotationsPod annotations for additional metadata.{}
crm.podSecurityContextSecurity context applied at the pod level.{}
crm.securityContext.*Defines security context settings for the container.See values.yaml
crm.pdb.enabledSpecifies whether PodDisruptionBudget is enabled.true
crm.pdb.minAvailableMinimum number of available pods.1
crm.pdb.maxUnavailableMaximum number of unavailable pods.1
crm.pdb.annotationsAnnotations for the PodDisruptionBudget.{}
crm.deploymentUpdate.typeType of deployment strategy."RollingUpdate"
crm.deploymentUpdate.maxSurgeMaximum number of pods that can be created over the desired number of pods.1
crm.deploymentUpdate.maxUnavailableMaximum number of pods that can be unavailable during the update.1
crm.service.typeKubernetes service type."ClusterIP"
crm.service.portService port.4003
crm.ingress.enabledSpecifies whether Ingress is enabled.false
crm.ingress.classNameIngress class name.""
crm.ingress.annotationsAdditional ingress annotations.{}
crm.ingress.hostsConfigured hosts for Ingress and associated paths.[]
crm.ingress.tlsTLS configurations for Ingress.[]
crm.resources.*CPU/Memory resource requests/limits.See values.yaml
crm.autoscaling.enabledSpecifies whether autoscaling is enabled.true
crm.autoscaling.minReplicasMinimum number of replicas for autoscaling.1
crm.autoscaling.maxReplicasMaximum number of replicas for autoscaling.3
crm.autoscaling.targetCPUUtilizationPercentageTarget CPU utilization percentage for autoscaling.80
crm.autoscaling.targetMemoryUtilizationPercentageTarget memory utilization percentage for autoscaling.80
crm.nodeSelectorNode selectors for pod scheduling.{}
crm.tolerationsTolerations for pod scheduling.{}
crm.affinityAffinity rules for pod scheduling.{}
crm.configmap.*Environment variables for the service.See values.yaml
crm.secrets.*Secrets for the service.See values.yaml
crm.useExistingSecretUse an existing secret instead of creating a new one.false
crm.existingSecretNameThe name of the existing secret to use.""
crm.extraEnvVarsA list of extra environment variables.{}

​
Creating CRM secret manually

If you want to use an existing Kubernetes Secret for the CRM service: 
kubectl create secret generic midaz-crm \
  --from-literal=LCRYPTO_HASH_SECRET_KEY='<your-hash-secret-key>' \
  --from-literal=LCRYPTO_ENCRYPT_SECRET_KEY='<your-encrypt-secret-key>' \
  --from-literal=MONGO_PASSWORD='<your-mongo-password>' \
  -n midaz
Then configure the CRM service to use this existing secret: 
crm:
  enabled: true
  useExistingSecret: true
  existingSecretName: "midaz-crm"