Helm Chart Release Notes

Changelog for the bighammer Helm chart, aligned with chart version and your mirrored ACR tag.

Chart OCI name: bighammer (repository path bh-helm-release/bighammer in your ACR after mirror)

---

[1.0.0] — baseline

Chart

• Chart: bighammer 1.0.0
• Minimum: AKS 1.28+, Helm 3.10+, ESO 0.18.x
• Edge mode: NGINX Ingress

Features

• Azure Key Vault via ESO + Workload Identity (no service principal secret in cluster)
• Configurable global.remoteSecrets for per-environment Key Vault names
• PostgreSQL Flexible Server private access + SSL (postgresSSLMode: require)
• Dual-role DB users (bh_dev_user / bh_app_user)

Known fixes included in 1.0.0 line

Area	Fix
PostgreSQL SSL	postgresSSLMode: require for Azure Flexible Server
Workload Identity	Empty credential file paths — ADC via WI
Keycloak TLS key	PEM in Key Vault for HTTPS listeners
App DB password	bh-app-user-password in Key Vault must match PostgreSQL bh_app_user
Keycloak DB	keycloak_db_<env> + keycloak_db_user; password in Key Vault bh-kcdbpwd
Audit API image	Dockerfile --ignore-installed for pip deps

Image tags (verify values-release.yaml sample overlay or your env file at release)

Service	Example tag
bh-ui	<tag-from-release-manifest>
bh-catalog-api	<tag-from-release-manifest>
bh-audit-api	<tag-from-release-manifest>
bh-keycloak	<tag-from-release-manifest>
bh-ai-agent	<tag-from-release-manifest>

Upgrade notes

1. Mirror the new chart version and image tags to your ACR — Release Manifest & Distribution.
2. Update values-<env>.yaml and your release manifest pins.
3. Run helm upgrade from your ACR OCI URI.

---

Template for future releases

## [x.y.z] — YYYY-MM-DD

### Added
- ...

### Changed
- ...

### Fixed
- ...

### Breaking changes
- ...

### Promoted to customers
- Customer <name>: chart x.y.z + images <tags>

Update this page when a new chart version is published. Customers mirror new versions per Release Manifest & Distribution.