commons

Published automatically.

Repository: github.com/OpenG2P/commons

Releases

commons 2.3.3 — 2026-09-03

commit 02dac8c · changes since release 2.3.2

Same artifact as 2.3.3-rc.227 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Charts: openg2p-commons-base 2.3.3 · openg2p-commons-services 2.3.3

Summary

• Version update: bumped openg2p-master-data to 1.1.1 in Chart.yaml.

Changes

• Bump version of openg2p-master-data to 1.1.1 in Chart.yaml (c255a9c)

commons 2.3.2 — 2026-09-02

commit 9f9089b · changes since release 2.3.1

Same artifact as 2.3.2-rc.225 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Charts: openg2p-commons-base 2.3.2 · openg2p-commons-services 2.3.2

Summary

• Dependency update: bumped openg2p-awe to version 1.2.2 in Chart.yaml.

Changes

• Bump version of openg2p-awe to 1.2.2 in Chart.yaml (0d345ed)

commons 2.3.1 — 2026-09-02

commit be192af · changes since release 2.3.0

Same artifact as 2.3.1-rc.223 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Charts: openg2p-commons-base 2.3.1 · openg2p-commons-services 2.3.1

Summary

• Dependency updates: bumped versions of postgres-init to 1.2.0 and openg2p-iam-service to 1.4.1 in Chart.lock and Chart.yaml.

Changes

• Update Chart.lock and Chart.yaml to bump versions of dependencies: postgres-init to 1.2.0 and openg2p-iam-service to 1.4.1. (49adc9b)

commons 2.3.0 — 2026-09-01

commit f7cc7eb · changes since release 2.2.1

Same artifact as 2.3.0-rc.221 — built from the same commit and promoted (retagged), not rebuilt. No code changed between them.

Charts: openg2p-commons-base 2.3.0 · openg2p-commons-services 2.3.0

Summary

• Major: CI transition to GitLab, dropping GitHub Actions; added namespace guard to prevent CI runs in forks.
• Configuration updates: moved image and environment settings to IAM Helm chart; added MinIO configuration to values.yaml.
• Package updates: bumped versions for openg2p-master-data, openg2p-iam-service, and several other components, including MDS and AWE.
• New features: enabled Inji Certify by default in commons-services; added agent portal API overrides for Keycloak URL resolution.
• Enhancements: made country pack a free-text field for better flexibility; enabled EMBEDDED_SUPERSET for iframe support in Insights.
• Maintenance: fixed IAM Keycloak base URL handling in commons-services; improved superset init-db hook to clean up stale pods after success.

Changes

• pre-commit fix (2b18b5b)
• id and inji certify updated on version (ffabcdc)
• updated all the packages to the latest tagged version (f49cef5)
• Move image and env config to IAM Helm chart (ba9633d)
• Add --reset-keymanager to the commons-services uninstall: esignet and mock-identity run PKCS11, so their key material sits in softhsm while their key_alias rows sit in base-owned DBs that the uninstall deliberately keeps, and resetting softhsm alone leaves the aliases pointing at HSM keys that no longer exist so both fail at keymanager init on reinstall; the flag truncates just key_alias+key_store so keys regenerate, leaving application data intact (9fad89d)
• Bump openg2p-master-data to 1.1.0-rc.55 and openg2p-iam-service to 1.4.0-rc.90 (8832184)
• G2P-4929 Ship Inji Certify with commons-services, enabled by default (1653fdb)
• Versions of MDS, Mock ID, IAM bumped up. (460d8e4)
• G2P-4929 Add agent portal API overrides so its Keycloak URL and redirect resolve (2515d20)
• Bumped up version of IAM, and changed its location to Gitlab. (fa817d9)
• Bumped up AWE version to 0.0.0-develop.70 (9850037)
• Fix IAM keycloak base URL in commons-services: set IAM_STAFF_KEYCLOAK_BASE_URL directly under iamStaffPortalApi.envVars with an explicit tpl call, since the subchart's indirection gets only one tpl pass and was emitting the unresolved 'https://keycloak.{{ tpl .Values.global.baseDomain $ }}' into the pod; drop the hardcoded qa keycloakBaseUrl which was dead anyway because a subchart-scoped global loses to the top-level one (055b4d6)
• G2P-4804 Make the country pack a free-text field with short form guidance. The two-value enum let an environment pick only ETH or XKM, so a country adding its own pack to openg2p-data could not select it; the Rancher description now says where to find the directory name and the provenance notes move to values.yaml. (2cabc9c)
• G2P-4804 Enable EMBEDDED_SUPERSET. Insights loads /embedded/<uuid> in an iframe, a route Superset only registers with this flag — without it the embedded UUID and guest token are both issued successfully and only the iframe 404s, which reads as a broken client rather than a missing feature flag. (95dd6fb)
• G2P-5348 CI: refuse to run in forks (namespace guard) (53f78f2)
• Just to trigger a build. No changes (b5b90d8)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (2c340a3)
• G2P-5451 Add MinIO configuration to values.yaml, including existing secret reference and read-only user creation (b766eea)
• Default baseDomain to {{ .Release.Namespace }}.openg2p.org in both commons charts, and make every consumer tpl it (29 values refs plus the keycloak gateway/virtualservice templates) since a single tpl pass does not evaluate a template nested inside a value and would otherwise emit the literal {{ .Release.Namespace }} into hostnames (adc388c)
• Bumped up MDS version (ae68cf6)
• Bumped up MDS version. (d39f5eb)
• G2P-4804 Declare Ethiopia as the country for the commons environment, and surface the choice in the form. This is the one place an environment names its country — registries read the geography, code lists and sample people from Master Data and name none of their own, which is what lets one registry image serve any country. Master Data is installed from here, so the country pack, the code-list and sample switches, and the domain lists are all questions on this chart rather than values only reachable by hand-editing a subchart. (e9fba97)
• Add hook-succeeded to superset init-db hook-delete-policy so the Job and its pods (including a first-attempt deadlock retry) are removed once it succeeds, instead of a stale Error pod making a healthy release look failed; restate the hook keys explicitly since jobAnnotations {} never cleared the subchart defaults. Bumped up consent manager Helm version. (e862fe0)
• Bumped up MDS version to 0.0.0-develop.38 (fcd382e)
• Bumped up MDS version to 0.0.0-develop.36 (e77c23a)
• Bumped up Master Data Service version to 0.0.0-develop.31 (ab1f277)
• Bumped up master data chart to 0.0.0-develop.30 (cf8be83)
• Bumped up Master Data Service version. (0e52ebf)

commons 2.2.1 — 2026-08-06

commit 310bf24 · changes since release 2.2.0

Charts: openg2p-commons-base 2.2.1 · openg2p-commons-services 2.2.1

Release notes

Creating new Tag 2.2.1

Summary

• Major: CI transition to GitLab, replacing GitHub Actions for build and publish processes.
• MinIO integration: added configuration to values.yaml, including secret references and read-only user setup.

Changes

• G2P-5451 Add MinIO configuration to values.yaml, including existing secret reference and read-only user creation (7f68072)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (0988f9b)

commons 2.2.0 — 2026-07-26

commit a8ef10b · changes since release 2.1.0

Charts: openg2p-commons-base 2.2.0 · openg2p-commons-services 2.2.0

Release notes

Stable version; includes consent management, partner management

Summary

• Major: Consent Manager (CM) enabled by default, with version bump and new E2E sanity toggle added to questions.yaml; APIs renamed to -cm-api and -cm-partner-api, requiring adjustments to base URLs.
• AWE token validation fixed by pointing the openg2p-awe issuer to the EXTERNAL Keycloak issuer, resolving previous validation errors; AWE repository and version updated.
• Migration of multiple components (Master Data, AWE, Audit Manager, PM, and CM) to GitLab, with Helm charts now referenced from the GitLab Helm repository.
• Improvements made to uninstall scripts and fixes applied to pre-commit checks and incorrect chart paths.

Changes

• G2P-5335 Use the shared version policy (derive-version.sh) so release-line branches publish RCs and get changelogs (a8ef10b)
• Add "Run Consent Manager E2E Sanity?" toggle (openg2p-consent-manager.sanity.runE2e) to questions.yaml under the Consent Manager group, shown when CM is enabled; default stays false (b8ccf09)
• Bumped up CM version (34c665e)
• The consent-manager APIs are renamed to -cm-api / -cm-partner-api via nameOverride, but the sanity defaulted to -api / -partner-api, so every run failed with "Name or service not known". Override sanity baseUrl/partnerBaseUrl to the cm-prefixed Services, and set sanity.nameOverride=cm so the Jobs render as commons-services-cm-sanity / -cm-pm-seed (consistent with cm-api/cm-ui/...). (d2d865d)
• PM version updated (cf6b753)
• CM enabled by default (032576b)
• Pre-commit fixes. (fd11304)
• Incorrect chart path fixed. (c5962ae)
• Uninstall scripts improved as they were not updated since a while. (af74872)
• G2P-5378 Fix AWE token validation: point openg2p-awe issuer at the EXTERNAL Keycloak issuer (matching PM/CM) so registry-forwarded user tokens validate; jwks stays internal. Resolves AWE-ERR-006 'Invalid issuer' on change-request approvals. And AWE repo and version updated. (cf7a980)
• Master data moved to Gitlab. (9f2a0a6)
• AWE moved to Gitlab. (2195ea8)
• Audit Manager moved to Gitlab. Charts referred from Gitlab Helm repo (5a80b71)
• PM moved to Gitlab. Charts referred from Gitlab Helm repo (7c7dc4e)
• G2P-5348 CM moved to Gitlab. New location of Helm charts now. (f5a12c1)
• G2P-5335 commons: pass DEFAULT_BRANCH to changelog (c087528)

commons 2.1.0 — 2026-07-13

commit 44278e8 · first release

Charts: openg2p-commons-base 2.1.0 · openg2p-commons-services 2.1.0

Summary

• Updated master data and partner management versions.
• Added Consent Manager as an optional service.
• Improved automatic test execution and build workflows.
• Resolved various bugs and configuration issues across multiple services.

Changes

• Master data version updated. (44278e8)
• Master Data version updated. (7328c8c)
• PM, Master data updated. (a8537c6)
• G2P-5335 add bespoke build/publish workflow for commons packaging charts; drop old push_trigger (39580bd)
• Versions updated. (3749358)
• G2P-5222 Add Consent Manager as an optional commons-services subchart (OFF by default, deployed as commons-services-cm-*, surfaced in questions.yaml), mirroring the Partner Management integration. (fdb20b1)
• G2P-5261 Changes for automatic tests running from bridge. (5414c00)
• PM version updated. (38de50b)
• G2P-5261 Partner Management integrated. (cd78e01)
• Softhsm had to be enabled again as esignet and mock id requires them. Develop versioning improved. (c5dabe5)
• Softhsm chart disabled as we are using .p12 (03211c7)
• G2P-5260 AWE installed as part of commons. (e762f72)
• G2P-5127 Reverted previous changes as it was causing issues. (46d75dd)
• G2P-5127 The fix had called hook issues in commons. The hooks overriden in commons base chart. (5ff84d8)
• Fix related to Keycloak-init. (9ea1829)
• Keycloak init chart version corrected. (1d8c473)
• G2P-5139 Reporting removed. (f3c6fcc)
• IAM image version change do develop as it contains latest. (82b291c)
• Minor pre-commit (997e39e)
• Keycloak init version corrected. (5c0c041)
• G2P-5130 IAM version updated. (a65585c)
• G2P-5130 Supeset added to IAM service. (9fdb870)
• G2P-5073 Fixes related to race conditions etc. (b05ca43)
• G2P-5072 Removed all limits. (9a60c90)
• G2P-5065 Reference debezium removed. (f180d52)
• G2P-5065 WIP. (ee03994)
• Chart release names fixed as several services depend on these names and we don't expect to install commons more than once in the same environment. (be756ea)
• G2P-4789 New postgres-init helm chart used to fix the lengthy job name problem. (6b826ab)
• pre-commit errors fixed. (b840924)
• develop branch added for automatic publish. (9f74957)
• Version numbers corrected. (2142dda)
• G2P-4817 Redirect URL fixed. (4a8d6dc)
• Mail version updated. (988bdf9)
• G2P-4793 Prefix removed. (edbcee2)
• G2P-4456 Bug related to minio port fixed. (7f5fdb5)
• G2P-4456 Major restructuing of Keycloak-init to make sure we don't have hardcoding, and clients related to each chart are created in their respective charts. Before this, all clients were being created in the base chart. (ea87204)
• G2P-4688 Fix attempt for external postgres. (4fd43c1)
• G2P-4572 Staff portal ui added to commons. (a6a7a07)
• G2P-4484 Few changes to configure for external Postgres. (74f8d1b)
• G2P-4644 Audit manager added. (35f93f6)
• G2P-4616 Keycloak memory limit removed as it was crashing. (8865303)
• G2P-4644 Kafka production defaults added. (8dcc0d4)
• G2P-4616 Resource constraints applied. (6597ee8)
• G2P-4609 Logging saved search added as Default Log Dashboard. (17a6be9)
• G2P-4632 App Ids added. (13e60bd)
• Minor update. (aae40f2)
• G2P-4609 Further fixes for automatic index pattern creation. (cdfe5e6)
• G2P-4609 Fixed permission issues in opensearch dashboards. (2fedeb7)
• G2P-4616 resources put back in Keycloak. (6ead39b)
• G2P-4616 Cache removed. (202dd5e)
• Keyclaok cache disabled - as there are issues pods coming up. (3ab9d4e)
• G2P-4616 Resources removed as things are not working. (ab08df9)
• G2P-4616 Memories increased. (7513da7)
• G2P-4616 Memory constraint removed from Keycloak - it is creating problems. (695def5)
• G2P-4616 Keycloak memory increased as it was giving OOM. (37baddf)
• G2P-4616 Keycloak issue fixed due to Java append. (980b71b)
• G2P-4616 Resource contraints added. (cc88917)
• G2P-4609 Loging dashboard replaced by just saved search as that is more appropriate for logging than a dashboard. (09fdc9a)
• G2P-4613 Keycloak init version updated. (264876b)
• G2P-4609 Default logs dashboard added. (6900df5)
• G2P-4610 First and last name added. Required to complete profile on Keycloak. (160df44)
• G2P-4610 Default admin user for staff realm created and assigned all roles. (757ae70)
• G2P-4609 Reverted to develop version of master data chart. (a43457a)
• G2P-4609 Log retention policy added. (2d85a85)
• G2P-4609 Logging enabled for a few services. (bf66bc6)
• G2P-4468 Making sure dependencies are updated before installation. (c796998)
• Keycloak init version frozen. (c1cbe2d)
• G2P-4390 Master data version frozen. (9a7d66c)
• G2P-4390 Version of IAM updated (3d31994)
• G2P-4390 Two separate virtual services were required for Minio - for API and console. Implemented. (7ebaebc)
• G2P-4390 /api prefix added for MiniIO api access in virtual service. (b819a54)
• G2P-4477 Keycloak Docker always pulled fresh as it may change if we change themes. In production this needs to be reverted. (dfc1a47)
• G2P-4390 Opensearsh dashboard start probe added for quick start up (e6ee899)
• G2P-4468 Bug in Redis url fixed (5bd8705)
• G2P-4468 Changes related to chages in IAM service deployment. (ba16f48)
• G2P-4477 Keycloak themes added. And Keycloak docker image updated. (2128ac7)
• G2P-4468 Keycloak client added (f630494)
• G2P-4390 IAM docker changed (563728b)
• G2P-4390 IAM names corrected (862353c)
• G2P-4453 Keycloak per environment. Any few bug fixes (6702ddc)
• G2P-4453 Keycloak per environment. (30fcc38)
• G2P-4453 Keycloak per environment. WIP. (06bbda6)
• G2P-4390 Duplicate specification of keycloak base url no longer required. (ce38587)
• G2P-4390 IAM service added. (10246b9)
• G2P-4390 Cleanup. (0d53e47)
• G2P-4390 MAJOR changes in Keycloak client creation. WIP. (86fd678)
• G2P-4390 Bugs related to Keycloak redirect url fixed (714d836)
• G2P-4390 Keycloak internal URL introduced as services are not able to connect keycloak with https as they are trying to verify the cert which is self signed in case of local deployment (d263a6a)
• G2P-4390 Fix attempt for Rancher running issue (23f894e)
• G2P-4390 Fix attempt for Rancher running issue (8b45553)
• Push trigger updated. (bc4c60d)
• 1.x branch removed as we don't want to modify it further. (0d8f497)
• G2P-4390 default names applied to fix installation issues (dd15767)
• Push trigger enabled only for 1.x and 2.x (643f10d)
• G2P-4390 Major restructuring. WIP. (fb63020)
• G2P-4036 Attempt to fix Rancher run issue (9c410bf)
• G2P-4036 bug related to postgres-init fixed (a90ded3)
• G2P-4036 Uninstall made 'cleaner'. (6e0bd01)
• G2P-4036 Minor doc (c103d69)
• G2P-4036 Chart version updated. (a3f0539)
• G2P-4036 All resources deleted in uninstall irrespective of their keep/retain status (433e217)
• G2P-4036 Keycloak init for creation of clients added. (6ac63e1)
• G2P-4036 Plenty of sequencing issues. Got fixed. All pods come up after waiting for a while. (37c5366)
• G2P-4036 Keycloak init for creation of clients added. Most services come up fine. But there are few failures with mock and esgignet. (ee74ecd)
• G2P-4036 Keycloak init for creation of clients added. (e99b202)
• G2P-4036 Keycloak init for creation of clients added. (cb14d9e)
• G2P-4036 Install/uninstall scripts added for convenience. (53530ab)
• G2P-4036 Clean up, improvements - hooks added. (0ed7a66)
• [G2P-4036] Superset keycloak client secret added in questions.yaml as superset does not accept templates. (828e48b)
• [G2P-4036] questions.yaml issues fixed. pre-commit minor changes. (d9e519b)
• [G2P-4036] Mock Identity init issue fixed. (86e57ce)
• [G2P-4036] Annotations added to master data postgres init. (10b8f0e)
• [G2P-4036] Bug related to esignet upgrade fixed. (b99b65f)
• Update README.md (57b69de)
• [G2P-4036] Master data chart added. (06172b0)
• [G2P-4036] questions.yaml updated. (0734ae3)
• [G2P-4036] Chart version updated. (3c4d988)
• [G2P-4036] Pre-commit errors fixed. (fc8e1ef)
• [G2P-4036] eSignet added. Redis auth added. All isntalls fine now. (8ff09df)
• [G2P-4036] mock-identity-system enabled. Installs fine. (4cf2bb1)
• [G2P-4036] Superset installs fine. (712a85a)
• [G2P-4036] Superset bug fixed. WIP. (8d94fbc)
• [G2P-4036] Mock Identity System installs fine. (a4fa517)
• [G2P-4036] Keygen enabled. (d2ac806)
• [G2P-4036] Working version all the modules install fine. Keygen is disabled here. (8f4e99f)
• [G2P-4036] Keymanager values updated. WIP. (01ab9f8)
• [G2P-4036] Few more modules enabled. Install fine. (7e333be)
• [G2P-4056] Hardcoded secrets removed. (be834e7)
• [G2P-4036] Enabled helm upgrade for ODK for first time installation. (3115495)
• [G2P-4036] ODK enabled. (917f651)
• [G2P-4036] MinIO installs fine. ODK central made dependent on MinIO (b843991)
• [G2P-4036] Precommit bugs fixed. (cfdc3dd)
• [G2P-4036] Name bug fixed. (9a47496)
• [G2P-4036] Postgres-init added. Cleanup. (24201b5)
• [G2P-4036] Few modules disabled for testing. Hardcoding of superset params. (0501131)
• [G2P-4036] questions.yaml updated in sync with values.yaml (4438a21)
• [G2P-4036] Minor fixes. WIP. (9287e22)
• [G2P-4036] Fixes. WIP. (613e22d)
• [G2P-4036] Minor, few comments (a5ec66e)
• [G2P-4036] Single instance of Redis. WIP. (d72be59)
• [G2P-3954] Updated values.yaml file for ODK and Esignet JavaOpt changes. (ad4ec6f)
• [G2P-4036] Secret read in superset config. (f542770)
• [G2P-4036] WIP. (a1d65d5)
• [G2P-4036] KafkaUI config updated for reaching from secret. (cf9dd23)
• [G2P-4036] WIP. (06d6aa9)
• [G2P-4036] WIP. (2c5d33a)
• [G2P-4036] WIP. (ca29880)
• [G2P-4036] Version updated. (c3fcb81)
• Minor. (be1b86d)
• [G2P-4036] Chart added to Rancher catalogue. (98332eb)
• Minor edit. (62cd8aa)
• Minor edit. (02b29f6)
• Update README.md (1a3e07d)
• [G2P-3267] Updated values.yaml file to enable softhsm. (cc529bd)
• [G2P-3267] Updated dependencies verion for openg2p-commons. (386eb72)
• Fix end-of-file newline in questions.yaml (2094e52)
• [G2P-3267] Updated dependencies verion for openg2p-commons. (5ac911a)
• [G2P-3267] Updated dependencies verion for openg2p-commons. (aa5ce47)
• [G2P-3267] Added OpenG2P-commons Helm Charts in to openg2p-deployment-commons repo. (bf14317)
• Initial commit (04cc8c6)

Release candidates

commons 2.3.4-rc.245 — 2026-10-08

commit 00477e7 · changes since 2.3.4-rc.244

Charts: openg2p-commons-base 2.3.4-rc.245 · openg2p-commons-services 2.3.4-rc.245

Changes

• Bump version of openg2p-iam-service from 1.4.4-rc.123 to 1.4.4-rc.125 in Chart.yaml (00477e7)

commons 2.3.4-rc.244 — 2026-10-07

commit ad54191 · changes since 2.3.4-rc.243

Charts: openg2p-commons-base 2.3.4-rc.244 · openg2p-commons-services 2.3.4-rc.244

Changes

• Bump version of openg2p-iam-service from 1.4.4-rc.121 to 1.4.4-rc.123 in Chart.yaml (ad54191)

commons 2.3.4-rc.243 — 2026-10-07

commit 8c216b9 · changes since 2.3.4-rc.241

Charts: openg2p-commons-base 2.3.4-rc.243 · openg2p-commons-services 2.3.4-rc.243

Summary

• Dependency update: upgraded openg2p-iam-service from version 1.4.3-rc.118 to 1.4.4-rc.121.

Changes

• Just to trigger CI. Otherwise No code change. (8c216b9)
• update openg2p-iam-service dependency version from 1.4.3-rc.118 to 1.4.4-rc.121 in Chart.yaml (521b536)

commons 2.3.4-rc.241 — 2026-10-07

commit d4bb88e · changes since 2.3.4-rc.240

Charts: openg2p-commons-base 2.3.4-rc.241 · openg2p-commons-services 2.3.4-rc.241

Changes

• fix(commons-services): update openg2p-iam-service dependency version from 1.4.2 to 1.4.3-rc.118 in Chart.yaml (d4bb88e)

commons 2.3.4-rc.240 — 2026-10-05

commit 3a41617 · changes since 2.3.4-rc.238

Charts: openg2p-commons-base 2.3.4-rc.240 · openg2p-commons-services 2.3.4-rc.240

Changes

• fix(commons-services): update openg2p-master-data dependency version from 1.1.4-rc.102 to 1.1.4-rc.104 in Chart.yaml (e903f73)

commons 2.3.4-rc.238 — 2026-10-05

commit c569bf9 · changes since 2.3.4-rc.236

Charts: openg2p-commons-base 2.3.4-rc.238 · openg2p-commons-services 2.3.4-rc.238

Changes

• fix(commons-services): update openg2p-master-data dependency version from 1.1.4-rc.100 to 1.1.4-rc.102 in Chart.yaml (48d1036)

commons 2.3.4-rc.236 — 2026-10-01

commit 7d5deab · changes since 2.3.4-rc.234

Charts: openg2p-commons-base 2.3.4-rc.236 · openg2p-commons-services 2.3.4-rc.236

Changes

• fix(commons-services): downgrade openg2p-iam-service version from 1.4.3-rc.118 to 1.4.2 in Chart.yaml (3a16c52)

commons 2.3.4-rc.234 — 2026-09-30

commit ee6f7e6 · changes since 2.3.3

Charts: openg2p-commons-base 2.3.4-rc.234 · openg2p-commons-services 2.3.4-rc.234

Summary

• Dependency updates: bumped versions for openg2p-master-data to 1.1.3 and openg2p-iam-service to 1.4.3, and updated mock-identity-system in Chart.yaml.
• Configuration enhancement: added keycloak-init configuration to allow overriding job names.
• Fixes: resolved conflict in master-data DB secret and user password key with keycloak client secret, and renamed openg2p-master-data dependency alias to ensure DNS-safe Helm resource names.

Changes

• chore(commons-services): bump dependency versions for openg2p-master-data, mock-identity-system, and openg2p-iam-service in Chart.yaml (155cca3)
• feat(commons-services): add keycloak-init configuration to override job name. (b25126b)
• fix(commons-services): update master-data DB secret and user password key because it was conflicting with master-data keycloak client secret key. (eb5811f)
• fix(commons-services): use DNS-safe master-data chart alias Rename the openg2p-master-data dependency alias from masterData to master-data so Helm-rendered iam-register resource names (e.g. ConfigMap commons-services-master-data-iam-register-payload) stay lowercase RFC 1123. (e260b6a)
• Bump versions of openg2p-master-data to 1.1.3 and openg2p-iam-service to 1.4.3 in Chart.yaml (67c655b)

commons 2.3.3-rc.227 — 2026-09-03

commit 02dac8c · changes since 2.3.2

Charts: openg2p-commons-base 2.3.3-rc.227 · openg2p-commons-services 2.3.3-rc.227

Changes

• Bump version of openg2p-master-data to 1.1.1 in Chart.yaml (c255a9c)

commons 2.3.2-rc.225 — 2026-09-02

commit 9f9089b · changes since 2.3.1

Charts: openg2p-commons-base 2.3.2-rc.225 · openg2p-commons-services 2.3.2-rc.225

Changes

• Bump version of openg2p-awe to 1.2.2 in Chart.yaml (0d345ed)

commons 2.3.1-rc.223 — 2026-09-02

commit be192af · changes since 2.3.0

Charts: openg2p-commons-base 2.3.1-rc.223 · openg2p-commons-services 2.3.1-rc.223

Changes

• Update Chart.lock and Chart.yaml to bump versions of dependencies: postgres-init to 1.2.0 and openg2p-iam-service to 1.4.1. (49adc9b)

commons 2.3.0-rc.221 — 2026-09-01

commit f7cc7eb · changes since 2.3.0-rc.219

Charts: openg2p-commons-base 2.3.0-rc.221 · openg2p-commons-services 2.3.0-rc.221

Changes

• pre-commit fix (2b18b5b)

commons 2.3.0-rc.219 — 2026-09-01

commit ffabcdc · changes since 2.2.1

Charts: openg2p-commons-base 2.3.0-rc.219 · openg2p-commons-services 2.3.0-rc.219

Summary

• Major: CI transition to GitLab with removal of GitHub Actions; added namespace guard to prevent CI runs in forks.
• Configuration updates: moved image and environment settings to IAM Helm chart; added MinIO configuration to values.yaml; set default baseDomain for commons charts.
• Package updates: bumped versions for openg2p-master-data, openg2p-iam-service, and various MDS components; included Inji Certify with commons-services by default.
• Enhancements to API and features: added agent portal API overrides for Keycloak URL resolution; enabled EMBEDDED_SUPERSET for Insights iframe support; made country pack a free-text field for better flexibility.
• Improved uninstall process: added --reset-keymanager flag to commons-services uninstall to ensure proper key regeneration without data loss.

Changes

• id and inji certify updated on version (ffabcdc)
• updated all the packages to the latest tagged version (f49cef5)
• Move image and env config to IAM Helm chart (ba9633d)
• Add --reset-keymanager to the commons-services uninstall: esignet and mock-identity run PKCS11, so their key material sits in softhsm while their key_alias rows sit in base-owned DBs that the uninstall deliberately keeps, and resetting softhsm alone leaves the aliases pointing at HSM keys that no longer exist so both fail at keymanager init on reinstall; the flag truncates just key_alias+key_store so keys regenerate, leaving application data intact (9fad89d)
• Bump openg2p-master-data to 1.1.0-rc.55 and openg2p-iam-service to 1.4.0-rc.90 (8832184)
• G2P-4929 Ship Inji Certify with commons-services, enabled by default (1653fdb)
• Versions of MDS, Mock ID, IAM bumped up. (460d8e4)
• G2P-4929 Add agent portal API overrides so its Keycloak URL and redirect resolve (2515d20)
• Bumped up version of IAM, and changed its location to Gitlab. (fa817d9)
• Bumped up AWE version to 0.0.0-develop.70 (9850037)
• Fix IAM keycloak base URL in commons-services: set IAM_STAFF_KEYCLOAK_BASE_URL directly under iamStaffPortalApi.envVars with an explicit tpl call, since the subchart's indirection gets only one tpl pass and was emitting the unresolved 'https://keycloak.{{ tpl .Values.global.baseDomain $ }}' into the pod; drop the hardcoded qa keycloakBaseUrl which was dead anyway because a subchart-scoped global loses to the top-level one (055b4d6)
• G2P-4804 Make the country pack a free-text field with short form guidance. The two-value enum let an environment pick only ETH or XKM, so a country adding its own pack to openg2p-data could not select it; the Rancher description now says where to find the directory name and the provenance notes move to values.yaml. (2cabc9c)
• G2P-4804 Enable EMBEDDED_SUPERSET. Insights loads /embedded/<uuid> in an iframe, a route Superset only registers with this flag — without it the embedded UUID and guest token are both issued successfully and only the iframe 404s, which reads as a broken client rather than a missing feature flag. (95dd6fb)
• G2P-5348 CI: refuse to run in forks (namespace guard) (53f78f2)
• Just to trigger a build. No changes (b5b90d8)
• G2P-5335 Switch CI to GitLab (.gitlab-ci.yml); drop GitHub Actions build/publish (2c340a3)
• G2P-5451 Add MinIO configuration to values.yaml, including existing secret reference and read-only user creation (b766eea)
• Default baseDomain to {{ .Release.Namespace }}.openg2p.org in both commons charts, and make every consumer tpl it (29 values refs plus the keycloak gateway/virtualservice templates) since a single tpl pass does not evaluate a template nested inside a value and would otherwise emit the literal {{ .Release.Namespace }} into hostnames (adc388c)
• Bumped up MDS version (ae68cf6)
• Bumped up MDS version. (d39f5eb)
• G2P-4804 Declare Ethiopia as the country for the commons environment, and surface the choice in the form. This is the one place an environment names its country — registries read the geography, code lists and sample people from Master Data and name none of their own, which is what lets one registry image serve any country. Master Data is installed from here, so the country pack, the code-list and sample switches, and the domain lists are all questions on this chart rather than values only reachable by hand-editing a subchart. (e9fba97)
• Add hook-succeeded to superset init-db hook-delete-policy so the Job and its pods (including a first-attempt deadlock retry) are removed once it succeeds, instead of a stale Error pod making a healthy release look failed; restate the hook keys explicitly since jobAnnotations {} never cleared the subchart defaults. Bumped up consent manager Helm version. (e862fe0)
• Bumped up MDS version to 0.0.0-develop.38 (fcd382e)
• Bumped up MDS version to 0.0.0-develop.36 (e77c23a)
• Bumped up Master Data Service version to 0.0.0-develop.31 (ab1f277)
• Bumped up master data chart to 0.0.0-develop.30 (cf8be83)
• Bumped up Master Data Service version. (0e52ebf)

Develop builds

commons — develop 0.0.0-develop.316 (2026-10-13)

commit 8cedfd8 · changes since 0.0.0-develop.314

Charts: openg2p-commons-base 0.0.0-develop.316 · openg2p-commons-services 0.0.0-develop.316

Summary

• Consent Manager updates: renamed exchange fields to "consent tokens" for clarity while maintaining existing setting names.
• Dependency management: updated commons version to the latest release for improved functionality and performance.

Changes

• CM bumped up. (8cedfd8)
• G2P-5719 commons-services form: Consent Manager exchange fields labelled "consent tokens" (setting names unchanged) (6a6d513)

commons — develop 0.0.0-develop.314 (2026-10-13)

commit f4adbcd · changes since 0.0.0-develop.312

Charts: openg2p-commons-base 0.0.0-develop.314 · openg2p-commons-services 0.0.0-develop.314

Summary

• Major: Enhanced consent management features: introduced a signing key for the Consent Manager, implemented consent receipts with role-based access, and added national-ID login for the partner portal.
• Improved form handling: required subject identifiers and composite URLs are now enforced in commons-services forms.
• User experience updates: default behavior for "Install Inji Verify?" prompts has been standardized to today's settings.

Changes

• Bumped up CM. (f4adbcd)
• G2P-5719 commons-services form: Consent Manager signing key (own Secret, kid), consent receipts (exchange and department roles), partner portal with national-ID login, required subject identifiers and composite URL; "Install Inji Verify?" — all defaulting to today's behaviour (7e43255)

commons — develop 0.0.0-develop.312 (2026-10-13)

commit 09795ae · changes since 0.0.0-develop.311

Charts: openg2p-commons-base 0.0.0-develop.312 · openg2p-commons-services 0.0.0-develop.312

Changes

• Bumped up Keycloak and CM versions. (09795ae)

commons — develop 0.0.0-develop.311 (2026-10-12)

commit d4aa778 · changes since 0.0.0-develop.310

Charts: openg2p-commons-base 0.0.0-develop.311 · openg2p-commons-services 0.0.0-develop.311

Changes

• Bumped up CM, IAM (d4aa778)

commons — develop 0.0.0-develop.310 (2026-10-12)

commit ccf7372 · changes since 0.0.0-develop.309

Charts: openg2p-commons-base 0.0.0-develop.310 · openg2p-commons-services 0.0.0-develop.310

Changes

• G2P-5719 commons-services Rancher form: "Install Artifactory?" (it has its own switch, on by default, and serves eSignet, mock identity and Keymanager, so it stayed on when they were off); "Install Mock Identity System?" always shown (hidden behind eSignet it stayed on by default when eSignet was off) (ccf7372)

commons — develop 0.0.0-develop.309 (2026-10-10)

commit ce909ef · changes since 0.0.0-develop.305

Charts: openg2p-commons-base 0.0.0-develop.309 · openg2p-commons-services 0.0.0-develop.309

Summary

• Major: G2P-5719 introduces a new consent-evidence bucket in the Consent Manager for uploading consent evidence, enhancing data handling capabilities.
• API restructuring: PM staff API route has been separated to its own host (pm-staff-portal.), resolving conflicts with the inherited IAM's staff-iam. route.
• Dependency updates: CM version has been bumped, ensuring the latest features and fixes are integrated.

Changes

• CM bumped up (ce909ef)
• G2P-5719 commons-base Garage init: consent-evidence bucket (Consent Manager uploaded consent evidence) (3bdfbea)
• G2P-5719 commons-services: PM staff API route on its own host pm-staff-portal.<domain> (it inherited IAM's staff-iam.<domain> via the shared global staffPortalApiHostname, so both routes claimed one host) (5fd1538)

commons — develop 0.0.0-develop.305 (2026-10-08)

commit c35d74e · changes since 0.0.0-develop.301

Charts: openg2p-commons-base 0.0.0-develop.305 · openg2p-commons-services 0.0.0-develop.305

Changes

• G2P-5770 Update WebSub configuration in values.yaml (43582b8)

commons — develop 0.0.0-develop.301 (2026-10-08)

commit 3e8b9cb · changes since 0.0.0-develop.299

Charts: openg2p-commons-base 0.0.0-develop.301 · openg2p-commons-services 0.0.0-develop.301

Summary

• Dependency updates: pinned IAM staff portal API image to a specific version, removing the moving "develop" tag, and performed a general IAM version bump.

Changes

• G2P-5719 commons-services: IAM staff portal API image follows the IAM chart's pinned version (drop the moving "develop" tag override) (3e8b9cb)
• IAM bumped up. (9b770d1)

commons — develop 0.0.0-develop.299 (2026-10-08)

commit a19f9a2 · changes since 0.0.0-develop.293

Charts: openg2p-commons-base 0.0.0-develop.299 · openg2p-commons-services 0.0.0-develop.299

Summary

• Major: G2P-5719 refactor: Garage initialization now runs as a regular Job with per-revision naming and TTL, resolving deadlock issues with Novu's credential Secret during installation.
• Configuration updates: Removed values-agri-stack-exchange.yaml, consolidating Agri Stack exchange overrides into the agri-stack bundle for product neutrality.
• Keymanager adjustments: Standalone Keymanager is now off by default, only required for specific use cases like PBMS or registry with partner key backend.
• Bug fixes: Updated websub hostname configuration to read from global.websubHostname, addressing installation errors related to value types.

Changes

• MDS bumped up. (a19f9a2)
• G2P-5719 commons-base Garage init: regular Job (per-revision name, ttl) instead of a post-install hook — as a hook it ran only after everything was ready, but Novu needs the credentials Secret it writes, so installs deadlocked; idempotent keys — reuse the keys in the commons-minio Secret, create only if none (garage key create never fails on a duplicate name and made a new key each run), exact name match (grep garage-key also matched garage-readonly-key, breaking re-runs). commons-services Rancher form: catalogue wording — "Load Datasets", "Dataset Themes", datasets instead of code lists (variable names unchanged) (374942c)
• G2P-5719 commons-base: Garage init runs as a regular Job (per-revision name, ttl) instead of a post-install hook — as a hook it ran only after everything was ready, but Novu needs the commons-minio credentials Secret it writes, so installs with Novu on deadlocked until the timeout (d9eb00c)
• G2P-5719 commons-services: remove values-agri-stack-exchange.yaml — the Agri Stack exchange overrides now live in the agri-stack Agri Exchange bundle; commons stays product-neutral (ed3cc95)
• G2P-5719 commons-services: standalone Keymanager off by default (only PBMS, or a registry with the keymanager partner key backend, needs it; eSignet, mock identity and Inji Certify embed their own) (816770c)
• G2P-5770 commons-services: websub hostname reads global.websubHostname (the install failed with "wrong type for value" on .Values.websubHostname) (fd61625)

commons — develop 0.0.0-develop.293 (2026-10-07)

commit 9979a89 · changes since 0.0.0-develop.291

Charts: openg2p-commons-base 0.0.0-develop.293 · openg2p-commons-services 0.0.0-develop.293

Changes

• G2P-5770 Add WebSub support to openg2p-commons-services (238cc4e)

commons — develop 0.0.0-develop.291 (2026-10-07)

commit 15ff369 · changes since 0.0.0-develop.289

Charts: openg2p-commons-base 0.0.0-develop.291 · openg2p-commons-services 0.0.0-develop.291

Summary

• Major: Dependency update: bumped openg2p-master-data to version develop.111, introducing an opt-in public catalogue with updated visibility, licensing, and catalogue schema 5.
• Cleanup: removed the unused mail relay and associated dependencies from commons, including the global mail installation name, as ODK Central was the sole consumer and only supports SMTP.
• Configuration refinement: relabeled the base object-store hostname question to be product-neutral, maintaining the global.garageHostname variable for compatibility.

Changes

• G2P-5719 commons-services: bump openg2p-master-data to develop.111 (opt-in public catalogue, visibility and licence, catalogue schema 5) (15ff369)
• Remove the unused mail relay from commons: drop the mail dependency, values and Rancher question from commons-base, and global.mailInstallationName from commons-services and install.sh; ODK Central was its only consumer (it speaks SMTP only and cannot use Novu), so its mailInstallationName is now empty with a note on pointing it at a real SMTP server; also relabel the base object-store hostname question to be product-neutral (Object Store (S3) Hostname), keeping the global.garageHostname variable (775fc99)

commons — develop 0.0.0-develop.289 (2026-10-07)

commit 2548480 · changes since 0.0.0-develop.286

Charts: openg2p-commons-base 0.0.0-develop.289 · openg2p-commons-services 0.0.0-develop.289

Summary

• New feature: added support for Agri Stack exchange receipts with the introduction of the values-agri-stack-exchange.yaml profile, enabling PM and CM exchange roles.
• Dependency update: bumped openg2p-consent-manager to version develop.64, enhancing consent management capabilities.

Changes

• G2P-5719 commons-services: bump openg2p-consent-manager to develop.64 (Agri Stack exchange receipts) (be2147e)
• G2P-5719 commons-services: values-agri-stack-exchange.yaml profile for the agrix exchange (PM, CM exchange role via global.agriStackExchange, master data, audit, IAM; registry-only services off) (8b7b80f)

commons — develop 0.0.0-develop.286 (2026-10-07)

commit 0858457 · changes since 0.0.0-develop.284

Charts: openg2p-commons-base 0.0.0-develop.286 · openg2p-commons-services 0.0.0-develop.286

Changes

• G2P-5736 Add email template for novu (b4780d9)

commons — develop 0.0.0-develop.284 (2026-10-07)

commit daf1466 · changes since 0.0.0-develop.282

Charts: openg2p-commons-base 0.0.0-develop.284 · openg2p-commons-services 0.0.0-develop.284

Summary

• Major: Updated core components: bumped openg2p-master-data, openg2p-awe, and partner-management to their latest development versions, enhancing IAM registration capabilities.
• Streamlined Rancher forms: removed legacy/internal questions, fixed Consent Manager defaults, and added Agent Portal hostname; retained Keymanager for PBMS with usage notes.
• Configuration improvements: enabled Novu by default and integrated it into the Garage initialization process, ensuring better feature management.

Changes

• G2P-5719 commons-services: bump openg2p-master-data to develop.110, openg2p-awe to develop.92, partner-management to develop.29 (IAM registration as regular resources via iamRegister.runAsHook) (daf1466)
• G2P-5719 Rancher forms: drop legacy and internal questions (MinIO, SoftHSM, keystore type, base-release service names), fix Consent Manager default (on), add Agent Portal hostname, show_if per feature; Keymanager kept on (PBMS uses it) with who-needs-it notes; Novu on by default and stored in Garage (novu bucket in the Garage init job) (22c8723)

commons — develop 0.0.0-develop.282 (2026-10-05)

commit 9048a94 · changes since 0.0.0-develop.280

Charts: openg2p-commons-base 0.0.0-develop.282 · openg2p-commons-services 0.0.0-develop.282

Summary

• IAM enhancements: Master Data, AWE, and Partner Management now register as regular resources, addressing previous registration issues.
• Bug fixes: Resolved mock identity-related issues to improve functionality.

Changes

• G2P-5719 commons-services: IAM registration for Master Data, AWE and Partner Management runs as regular resources (iamRegister.runAsHook: false); a failed hook elsewhere had left them unregistered in IAM (9048a94)
• Mock identity related fix. (6105468)

commons — develop 0.0.0-develop.280 (2026-10-05)

commit a1a55ff · changes since 0.0.0-develop.271

Charts: openg2p-commons-base 0.0.0-develop.280 · openg2p-commons-services 0.0.0-develop.280

Summary

• Major: Migration from MinIO to Garage for master data storage, updating configurations to point to the new Garage endpoints and ensuring compatibility with the new object store.
• Dependency updates: Bumped partner-management, consent-manager, and inji libraries to their latest development versions, addressing compatibility issues with SQLAlchemy and ensuring proper installation of required packages.
• Consent Manager enhancements: Implemented AWE wiring with callback secret management and HMAC secret handling, now configurable via Rancher.
• Garage initialization improvements: Created import and export file buckets with appropriate access controls, and fixed wiring for ODK Central to ensure correct credential usage.
• Template restructuring: Moved Garage-related templates from commons-services to commons-base to resolve dependency issues and improve installation reliability.

Changes

• G2P-5719 commons-services: bump partner-management to develop.27, consent-manager to develop.63, inji-certify and inji-verify to develop.17, mock-identity-system to develop.9 (a1a55ff)
• G2P-5719 Consent Manager AWE wiring (still off by default): callback secret id/Secret names, seed job and HMAC secret as plain resources, Rancher toggle (cdb179d)
• G2P-5719 commons-services: Master Data loads the agriculture code lists by default (masterData.geoSeed.domains / Rancher question default "agriculture") (6a8cd09)
• G2P-5719 Garage init: create the registry's import-files and export-files buckets (read-write for garage-key, export-files read-only for garage-readonly-key) (d7651ca)
• Point master-data at Garage instead of the retired MinIO: set masterData.geoSeed.objectStore and masterDataAPI.catalogue.boundaryStore to http://commons-garage:3900 / openg2p-geo as literals (the subchart applies at most one tpl pass), since the defaults http://commons-minio:9000 made geo-seed fail with EndpointConnectionError; fix the masterDataApi key to masterDataAPI so its resource requests actually apply; and add openg2p-geo to the Garage init job's bucket list (e2634c1)
• Fix ODK Central's Garage wiring and close two commons-services uninstall gaps: point odk-central minioInstallationName at the commons-minio credentials secret written by the Garage init job (was commons-garage, which does not exist) and s3ServerUrl at the Garage S3 port 3900 (was MinIO's 9000); in uninstall.sh delete the unlabelled superset-init-db hook Job by name, and delete the unlabelled inji-certify p12-backup Secret (a stale private signing key that survived every uninstall), keeping it under --keep-dbs (09a5809)
• Bump openg2p-consent-manager to 0.0.0-develop.61: develop.60's image was built with SQLAlchemy 2.1, which no longer installs greenlet by default, so cm-api and cm-partner-api crashed on import and the cm-sanity post-install hook failed the install; develop.61 pins sqlalchemy[asyncio]<2.1 (verified: 2.0.54 + greenlet 3.5.6); also add the Garage hostname and install toggle to base questions.yaml, left out of the template-move commit (603f914)
• Bump openg2p-consent-manager to 0.0.0-develop.61: develop.60's image was built with SQLAlchemy 2.1, which no longer installs greenlet by default, so cm-api and cm-partner-api crashed on import and the cm-sanity post-install hook failed the install; develop.61 pins sqlalchemy[asyncio]<2.1 (verified: 2.0.54 + greenlet 3.5.6); also add the Garage hostname and install toggle to base questions.yaml, left out of the template-move commit (eb7aa92)
• Move the garage templates (init-job, init-rbac, virtualservice) from commons-services to commons-base, where the garage dependency and its values live: in services .Values.garage was nil, failing the install with "nil pointer evaluating interface {}.enabled", and the templates' release-name-derived pod/service names only resolve under the base release; also add Garage hostname and install toggle to the base questions.yaml alongside MinIO (5f0b484)

commons — develop 0.0.0-develop.271 (2026-10-03)

commit b39389e · changes since 0.0.0-develop.269

Charts: openg2p-commons-base 0.0.0-develop.271 · openg2p-commons-services 0.0.0-develop.271

Changes

• Bumped up MDS version (0d1d0f5)

commons — develop 0.0.0-develop.269 (2026-10-03)

commit 7d4afed · changes since 0.0.0-develop.265

Charts: openg2p-commons-base 0.0.0-develop.269 · openg2p-commons-services 0.0.0-develop.269

Summary

• Helm chart updates: modified commons-services helm charts to utilize a global domain for IAM, master data, and staff portal.
• Pre-commit fixes implemented to enhance code quality and consistency.

Changes

• pre-commit fixes (bde6107)
• [G2P-5692] Updated commons-services helm charts to take global domain for iam, masterdata, staff portal helm chart. (87b990e)

commons — develop 0.0.0-develop.265 (2026-10-03)

commit 34d4b6b · changes since 0.0.0-develop.261

Charts: openg2p-commons-base 0.0.0-develop.265 · openg2p-commons-services 0.0.0-develop.265

Summary

• Major: Updated MDS version to improve compatibility and functionality.
• CI/build improvements: Fixed Build & Publish process by redirecting the garage dependency to the openg2p-helm mirror, resolving issues with the git+https protocol handler.
• New feature: Added Garage deployment configuration to streamline deployment processes.

Changes

• MDS bumped up. (34d4b6b)
• Fix commons Build & Publish: point the garage dependency at the openg2p-helm mirror instead of git+https://git.deuxfleurs.fr (the git+ scheme needs the helm-git plugin, which the CI runner does not have, so helm dep up failed on commons-base with "could not find protocol handler for: git+https"); the mirrored garage 0.9.2 / v2.2.0 is identical to the v2.2.0 git ref apart from helm-package Chart.yaml normalisation (2df8a89)
• Add Garage deployment configuration (dba77bd)

commons — develop 0.0.0-develop.261 (2026-10-02)

commit 202f23e · changes since 0.0.0-develop.260

Charts: openg2p-commons-base 0.0.0-develop.261 · openg2p-commons-services 0.0.0-develop.261

Changes

• CM bumped up (202f23e)

What's shown here. This catalogue lists every stable release, plus the latest 20 develop builds and the latest 10 release candidates per release line -- candidates are KEPT after their release ships, as the audit trail of the release run. Older develop builds and release candidates are pruned as they are superseded. Those versions still exist in the container and Helm registries — they are simply not listed here. This page is generated automatically from commit history; do not edit it by hand.