fix: call the real Agmarknet with its token login again

charts/adapter-service/CHANGELOG.md

@@ -5,6 +5,24 @@ All notable changes to this chart are documented here.
 The format follows [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
 and this chart adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
+## [0.8.0] - 2026-10-28
+
+### Added
+- `ingress.allowPublicPublish` (default `false`): in single-adapter mode, lets
+  `/publish` be an ingress path. The publish module signs as the provider
+  without authenticating its caller, so this is for throwaway environments
+  only. `/` and `/_internal*` stay refused.
+
+### Changed
+- **BREAKING.** Mandi prices call the real Agmarknet again: `agmarknet` is back
+  on `authScheme: tokenQuery` in both modes, in place of the no-auth setting
+  the benchmark mock needed. A release must now supply
+  `__AGMARKNET_TOKEN_URL__` (`adapterKeys.extraSubstitutions` in single mode,
+  `keys.existingSecret.extraSubstitutions` in multi), and the provider tier's
+  environment must carry `AGMARKNET_ACCESS_NAME` and `AGMARKNET_PASSWORD`.
+  Without the substitution the init container stops on the unfilled
+  placeholder. Point the registry's `agmarknet` upstream at the real API too.
+
 ## [0.7.0] - 2026-10-26
 
 ### Added

charts/adapter-service/Chart.yaml

@@ -2,7 +2,7 @@ apiVersion: v2
 name: adapter-service
 description: OAN Beckn adapter; role network-adapter runs all three tiers in single-adapter mode (default), or the network tier in multi-adapter.
 type: application
-version: 0.7.0
+version: 0.8.0
 # The adapter binary, not this chart. `/health` reports the build it is
 # actually running, which is the number to trust over this one.
 appVersion: "v1.9.0"

charts/adapter-service/config/multi-adapter/provider-config.yaml

@@ -175,47 +175,19 @@ modules:
           - id: MandiPrice
             config:
               bindingKeys: "agmarknet|openagrinet:MandiPrice"
-              # NO CREDENTIAL, because this environment's agmarknet upstream is
-              # the benchmark mock rather than Agmarknet -- a static nginx with
-              # nothing to authenticate against. See the upstream block in
-              # infra-automation's registry-seed values.
-              #
-              # WHAT THIS REPLACED, and what to put back when the real upstream
-              # returns:
-              #
-              #     authScheme: tokenQuery
-              #     tokenUrl: the AGMARKNET token-url placeholder   <- see below
-              #     tokenUserField: access_name
-              #     tokenUserEnv: AGMARKNET_ACCESS_NAME
-              #     tokenSecretField: password
-              #     tokenSecretEnv: AGMARKNET_PASSWORD
-              #     tokenResponseField: token
-              #     queryName: token
-              #     tokenTtl: 10m
-              #
-              # Agmarknet issues short-lived tokens, so the provider exchanges a
-              # name and password for one and hangs it on the query. tokenTtl is
-              # an estimate -- the response carries no expiry -- and a 401 drops
-              # the held token.
-              #
-              # The placeholder is spelled out rather than written literally
-              # above, because the init container substitutes that marker
-              # ANYWHERE it appears -- including inside a comment. Left intact it
-              # would write the real token URL into a comment in the deployed
-              # ConfigMap, where nobody would think to look for it.
-              #
-              # DROPPED RATHER THAN REPRODUCED. tokenUrl is substituted from the
-              # provider-adapter-keys Secret, which is synced from OpenBao;
-              # pointing it at a mock would mean editing a
-              # shared secret store to run a benchmark. Serving a token endpoint
-              # from the mock instead would measure an exchange that answers the
-              # same string every time.
-              #
-              # IT ALSO KEEPS THE MEASUREMENT HONEST: a real token is cached for
-              # its TTL, so the exchange happens roughly once per ten minutes and
-              # contributes nothing to a per-request figure either way.
               agmarknet:
-                authScheme: none
+                authScheme: tokenQuery
+                # Substituted from the provider Secret (agmarknetTokenUrl) via
+                # keys.existingSecret.extraSubstitutions; the login is read from
+                # AGMARKNET_ACCESS_NAME and AGMARKNET_PASSWORD.
+                tokenUrl: "__AGMARKNET_TOKEN_URL__"
+                tokenUserField: access_name
+                tokenUserEnv: AGMARKNET_ACCESS_NAME
+                tokenSecretField: password
+                tokenSecretEnv: AGMARKNET_PASSWORD
+                tokenResponseField: token
+                queryName: token
+                tokenTtl: 10m
 
           - id: KnowledgeAdvisory
             config:

charts/adapter-service/config/single-adapter/network-adapter-config.yaml

@@ -243,7 +243,18 @@ modules:
             config:
               bindingKeys: "agmarknet|openagrinet:MandiPrice"
               agmarknet:
-                authScheme: none
+                authScheme: tokenQuery
+                # Substituted from the provider Secret (agmarknetTokenUrl) via
+                # adapterKeys.extraSubstitutions; the login is read from
+                # AGMARKNET_ACCESS_NAME and AGMARKNET_PASSWORD.
+                tokenUrl: "__AGMARKNET_TOKEN_URL__"
+                tokenUserField: access_name
+                tokenUserEnv: AGMARKNET_ACCESS_NAME
+                tokenSecretField: password
+                tokenSecretEnv: AGMARKNET_PASSWORD
+                tokenResponseField: token
+                queryName: token
+                tokenTtl: 10m
 
           - id: KnowledgeAdvisory
             config:

charts/adapter-service/templates/ingress.yaml

@@ -16,8 +16,8 @@
 {{- if not (has $pt (list "Prefix" "Exact")) }}
 {{- fail (printf "%s: ingress path %q has pathType %s, which is not allowed in the single deployment mode. Use Prefix or Exact." $.Chart.Name $p $pt) }}
 {{- end }}
-{{- if or (not (regexMatch "^/[A-Za-z0-9_.-]+$" $p)) (hasPrefix "/_internal" $p) (eq $p "/publish") }}
-{{- fail (printf "%s: ingress path %q is not allowed in the single deployment mode. Allowed: one literal segment, /<action> (e.g. /discover, /select). /, /publish and /_internal* are never public." $.Chart.Name $p) }}
+{{- if or (not (regexMatch "^/[A-Za-z0-9_.-]+$" $p)) (hasPrefix "/_internal" $p) (and (eq $p "/publish") (not $.Values.ingress.allowPublicPublish)) }}
+{{- fail (printf "%s: ingress path %q is not allowed in the single deployment mode. Allowed: one literal segment, /<action> (e.g. /discover, /select). / and /_internal* are never public; /publish only with ingress.allowPublicPublish." $.Chart.Name $p) }}
 {{- end }}
 {{- end }}
 {{- end }}

charts/adapter-service/values.yaml

@@ -298,6 +298,11 @@ ingress:
   annotations: {}
   hosts: []
   tls: []
+  # Single-adapter mode only: lets /publish be an ingress path. Off by default,
+  # and for a throwaway environment only. The publish module signs as the
+  # provider without checking who calls it, so a public /publish lets anyone
+  # publish catalogues under the provider's name.
+  allowPublicPublish: false
 
 # ---------------------------------------------------------------------------
 # Wait for the upstreams before starting.

charts/clickstack/CHANGELOG.md

@@ -10,6 +10,20 @@ else. The moment an OAN modification lands, this chart's version has to fork fro
 upstream's and follow [`CONVENTIONS.md`](../../CONVENTIONS.md) instead — record
 that switch in this file when it happens.
 
+## [1.2.0] - 2026-10-28
+
+The first OAN modification. From here this chart's `version` follows
+[`CONVENTIONS.md`](../../CONVENTIONS.md) rather than upstream's; it is based on
+upstream `hyperdx/clickstack` 1.1.1.
+
+### Added
+- `clickhouse.config.users.existingSecret`: the name of a Secret with keys
+  `appUserPassword` and `otelUserPassword`. When set, ClickHouse reads both
+  users' passwords from the environment (`from_env` in `users.xml`), the OTel
+  collector's `CLICKHOUSE_PASSWORD` and HyperDX's default connection come from
+  the same Secret, and the chart renders no `<release>-clickhouse-secrets` of
+  its own. Unset, the chart renders exactly as before.
+
 ## [1.1.1] - 2026-09-09
 
 Initial import [#4]. Upstream `hyperdx/clickstack` 1.1.1 (appVersion 2.8.0),

charts/clickstack/Chart.yaml

@@ -15,4 +15,4 @@ sources:
 - https://github.com/hyperdxio/hyperdx
 - https://github.com/hyperdxio/helm-charts
 type: application
-version: 1.1.1
+version: 1.2.0

charts/clickstack/README.md

@@ -81,8 +81,10 @@ hiding them:
   `clickhouse.config.users.appUserPassword: hyperdx`,
   `otelUserPassword: otelcollectorpass`, and a placeholder `hyperdx.apiKey`.
   Every one of those must be overridden per environment. No repo chart is
-  supposed to render a Secret at all; closing this properly means moving to
-  `hyperdx.useExistingConfigSecret` and externally created Secrets.
+  supposed to render a Secret at all. The ClickHouse passwords are closed:
+  set `clickhouse.config.users.existingSecret` to a Secret holding
+  `appUserPassword` and `otelUserPassword` and the chart reads them from it
+  and renders no ClickHouse Secret. The API key is still open.
 - **No `common` dependency**, so no `app.kubernetes.io/part-of: oan` label
   and none of the shared helpers.
 - **No resource requests or limits by default.** `clickhouse.resources`,

charts/clickstack/data/users.xml

@@ -23,7 +23,11 @@
             <quota>default</quota>
         </default>
         <app>
+            {{- if .Values.clickhouse.config.users.existingSecret }}
+            <password from_env="CLICKHOUSE_APP_PASSWORD"></password>
+            {{- else }}
             <password>{{ .Values.clickhouse.config.users.appUserPassword }}</password>
+            {{- end }}
             <networks>
                 {{- if .Values.clickhouse.config.clusterCidrs }}
                 {{- range .Values.clickhouse.config.clusterCidrs }}
@@ -43,7 +47,11 @@
             </grants>
         </app>
         <{{ .Values.otel.clickhouseUser | default .Values.clickhouse.config.users.otelUserName }}>
+            {{- if .Values.clickhouse.config.users.existingSecret }}
+            <password from_env="CLICKHOUSE_OTEL_PASSWORD"></password>
+            {{- else }}
             <password>{{ .Values.otel.clickhousePassword | default .Values.clickhouse.config.users.otelUserPassword }}</password>
+            {{- end }}
             <networks>
                 {{- if .Values.clickhouse.config.clusterCidrs }}
                 {{- range .Values.clickhouse.config.clusterCidrs }}

charts/clickstack/templates/_helpers.tpl

@@ -46,4 +46,18 @@ Selector labels
 {{- define "clickstack.selectorLabels" -}}
 app.kubernetes.io/name: {{ include "clickstack.name" . }}
 app.kubernetes.io/instance: {{ .Release.Name }}
-{{- end }} 
+{{- end }} 
+
+{{/*
+The ClickHouse app user's password as it appears in HyperDX's connection list:
+the plain value, or, with clickhouse.config.users.existingSecret, a reference
+Kubernetes expands from the CLICKHOUSE_APP_PASSWORD env var the HyperDX
+container defines first.
+*/}}
+{{- define "clickstack.clickhouseAppPassword" -}}
+{{- if .Values.clickhouse.config.users.existingSecret -}}
+$(CLICKHOUSE_APP_PASSWORD)
+{{- else -}}
+{{ .Values.clickhouse.config.users.appUserPassword }}
+{{- end -}}
+{{- end }}

charts/clickstack/templates/clickhouse-deployment.yaml

@@ -43,6 +43,19 @@ spec:
           env:
             - name: CLICKHOUSE_DEFAULT_ACCESS_MANAGEMENT
               value: "1"
+            {{- with .Values.clickhouse.config.users.existingSecret }}
+            # users.xml reads both passwords with from_env.
+            - name: CLICKHOUSE_APP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ . }}
+                  key: appUserPassword
+            - name: CLICKHOUSE_OTEL_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ . }}
+                  key: otelUserPassword
+            {{- end }}
           {{- if .Values.clickhouse.resources }}
           resources:
             {{- toYaml .Values.clickhouse.resources | nindent 12 }}

charts/clickstack/templates/hyperdx-deployment.yaml

@@ -98,6 +98,15 @@ spec:
                 secretKeyRef:
                   name: {{ include "clickstack.fullname" . }}-app-secrets
                   key: api-key
+            {{- with .Values.clickhouse.config.users.existingSecret }}
+            # Before DEFAULT_CONNECTIONS: Kubernetes expands $(CLICKHOUSE_APP_PASSWORD)
+            # there only from variables defined earlier in this list.
+            - name: CLICKHOUSE_APP_PASSWORD
+              valueFrom:
+                secretKeyRef:
+                  name: {{ . }}
+                  key: appUserPassword
+            {{- end }}
             {{- if .Values.hyperdx.useExistingConfigSecret }}
             - name: DEFAULT_CONNECTIONS
               valueFrom:

charts/clickstack/templates/otel-collector-deployment.yaml

@@ -99,7 +99,14 @@ spec:
             - name: CLICKHOUSE_USER
               value: {{ .Values.otel.clickhouseUser | default .Values.clickhouse.config.users.otelUserName }}
             - name: CLICKHOUSE_PASSWORD
+              {{- if .Values.clickhouse.config.users.existingSecret }}
+              valueFrom:
+                secretKeyRef:
+                  name: {{ .Values.clickhouse.config.users.existingSecret }}
+                  key: otelUserPassword
+              {{- else }}
               value: {{ .Values.otel.clickhousePassword | default .Values.clickhouse.config.users.otelUserPassword }}
+              {{- end }}
             {{- if .Values.otel.customConfig }}
             - name: CUSTOM_OTELCOL_CONFIG_FILE
               value: /etc/otelcol-contrib/custom.config.yaml

charts/clickstack/templates/secrets.yaml

@@ -7,7 +7,7 @@ metadata:
 type: Opaque
 data:
   api-key: {{ .Values.hyperdx.apiKey | b64enc }}
-{{- if .Values.clickhouse.enabled }}
+{{- if and .Values.clickhouse.enabled (not .Values.clickhouse.config.users.existingSecret) }}
 ---
 apiVersion: v1
 kind: Secret

charts/clickstack/values.yaml

@@ -96,7 +96,7 @@ hyperdx:
         "host": "http://{{ include "clickstack.fullname" . }}-clickhouse:8123",
         "port": 8123,
         "username": "app",
-        "password": "{{ .Values.clickhouse.config.users.appUserPassword }}"
+        "password": "{{ include "clickstack.clickhouseAppPassword" . }}"
       }
     ]
 
@@ -355,6 +355,11 @@ clickhouse:
     users:
       appUserPassword: "hyperdx"
       otelUserPassword: "otelcollectorpass"
+      # Name of an existing Secret with keys `appUserPassword` and
+      # `otelUserPassword`. When set, both values above are ignored: ClickHouse,
+      # the OTel collector and HyperDX read the passwords from the Secret, and
+      # the chart renders no <release>-clickhouse-secrets of its own.
+      existingSecret: ""
       otelUserName: "otelcollector"
     # Network CIDRs for Kubernetes cluster access control
     # These CIDRs ensure ClickHouse connections are locked down to intra-cluster only