Mojaloop Community Central: Samuel Kummary

🚀 Announcing Mojaloop v17: Powering Cross-Border Instant Payments 🌍

Samuel Kummary — Wed, 02 Apr 2025 14:41:33 +0000

The Mojaloop Foundation is excited to announce Mojaloop v17.0.0 — a game-changing update that expands Mojaloop beyond domestic instant payments.

🔥🔥🔥 With cross-border capabilities, including currency conversion and inter-scheme interoperability, Mojaloop now enables seamless transactions across different payment networks. This unlocks regional payment systems, supports cross-border trade, and drives financial inclusion on a global scale. This significant update now also supports FX and ISO20022 messaging.

Discover how v17 will shape a more inclusive future for payments: https://brnw.ch/21wRJED

Welcome thread for new members

Samuel Kummary — Tue, 01 Apr 2025 17:50:45 +0000

Welcome to Mojaloop community central!

Feel free to say hi and ask any questions that can help you get onboarded on to Mojaloop!

PI-25 Platform Quality & Security mid-pi update

Samuel Kummary — Thu, 26 Sep 2024 20:56:02 +0000

One of the goals of the Mojaloop PQS (platform quality and security) work-stream this PI is to understand the nature of dependencies that are used in the Mojaloop components that make up the Mojaloop platform, by generating SBOMs (Software Bill of Materials).

This would mean generating and documenting SBOMs for each repository/service and Automation of periodic generation of SBOMs to help with flagging anomalies and discrepancies in SBOMs such as licensing and maintenance issues.

For a (brief) context: A Software Bill of Materials(SBOM) is a machine and human-readable list of a project's entire software inventory which is even more meaningful for projects based on nodejs. SBOMs help with Transparency, Security, Compliance along with Maintenance.

An SBOM typically contains: the list of Open source components, Third-party components, Licenses, Versions of these components. For this exercise, we've also included date of publication of the version used so as to identify maintenance status. CycloneDX is the tool we used after evaluating several openly available tools.

Currently, the implementation provides capability to generate individual SBOMs (as html files based on csv sources) for core repositories along with a centralized list for all core / critical repositories. In addition, this process has been automated to generate these on a periodic (monthly) basis for evaluation.

We believe that this provides Mojaloop capability to react rapidly for any issues that arise with any of the open source libraries / packages / dependencies used along with helping with maintenance. This can help with regulatory requirements regarding licenses (of the platform) and understanding provenance of components used.

This powerful feature is general enough and can be used by other DPGs to achieve similar goals. Thanks to the PQS team and DMP 2024 program contributor and our team member for this project Shuchita, for contributing.

Mojaloop Congo v16.0.0 and IaC v5.0.0 Now Available!

Samuel Kummary — Sat, 23 Mar 2024 15:12:21 +0000

Mojaloop Congo, version 16.0.0 and the accompanying infrastructure as code (IaC) version 5.0.0 are now official and available for adoption.

Over the past few months, Mojaloop’s Performance Workstream has been hard at work on characterization, profiling, scalability, and improvement of the Mojaloop core engine’s performance. The new release is a culmination of this effort, and it’s now available to the Mojaloop community.

One of Mojaloop’s invariants (operational characteristics) covers the performance of Mojaloop’s clearing engine and Mojaloop Congo (v16.0.0) has helped us get closer to (or better than) the baseline more than any other release in the past.

Along with this, Mojaloop’s infrastructure as code (IaC) gets a next generation implementation with tremendous improvements and new additions. This comes with a new cloud-agnostic modular approach, a new API Gateway Istio, support for a new identity and access management (IAM) framework, upgraded monitoring options and much more. Read below for the full details.

Performance Improvements

The central ledger was enhanced with the enabling of batching on both the “prepare” and “fulfill” legs of the transfer, tremendously increasing performance.
A new architecture to scale and improve the quoting service’s performance was implemented.
The account lookup service (ALS) has been greatly improved with the introduction of caching coupled with several performance related bug fixes.
Several improvements for logging and caching have been commonly applied to all the core services, which help greatly with improving performance for each of the components and collectively of the Mojaloop’s core engine.
The end-to-end performance of the Mojaloop core engine has been improved at least 10x since the beginning of the dedicated workstream.

IaC v5.0.0 for Mojaloop Congo

This next-generation IaC provides a continuous integration and continuous delivery (CI/CD) platform for delivering cloud-agnostic and 100% open-source Kubernetes clusters with Mojaloop or PM4ML automated deployments. The platform also includes out-of-the-box standard components to provide non-functional capabilities such as storage, configuration security, service mesh, and AuthZ and AuthN. The CI/CD platform is called “Control Center”.

Control Center provides the following components:

Gitlab server and CI for storing configuration and building environments.
Wireguard mesh network for secure tunnels between environments and control center as well as providing connectivity for operators to switch environments.
A private registry for docker images and potentially other components such as helm charts, Debian packages, etc.
Vault for securely storing sensitive data for the control center and environments.
Minio for Amazon S3-compatible object storage.

Regarding the IaC for the provisioning of k8s clusters there are three tiers of modules:

Infrastructure (cloud/bare metal dependent modules)
Kubernetes Cluster (k8s distro modules)
Gitops artifact generation (independent of cloud/bare metal and K8s distribution).

This release features

Support for Mojaloop v16.0.0 with integrated post-deployment testing via the TTK.
Bare metal improvements to support node labeling to provide node affinity capabilities as well as the use of taints/tolerations.
Refactored monitoring stack making use of operators for Prometheus and Grafana.
Added Ory stack as a generic authorization framework for the switch including finance portal, MCM and PM4ML. Used in conjunction with Istio and Keycloak.
Onboarding support for external participants using PM4MLs, Connection Manager, Istio and Ory. Addresses MTLS, JWS, IP filtering.
Pre-configured OIDC connectivity for Gitlab users to authenticate/authorize for vault, Grafana and Argocd (new Istio virtual service endpoint now for Argocd as well).
PM4ML IaC improvements to provide for multiple pm4mls with different characteristics to be deployed into the same cluster.

Repo locations for IaC:

https://github.com/mojaloop/control-center-util (for bootstrapping control center).
https://github.com/mojaloop/iac-ansible-collection-roles (Ansible playbook and roles for both control center and Kubernetes clusters).
https://github.com/mojaloop/iac-modules (terraform modules for building control center and Kubernetes clusters as well as the Argocd applications and deployable templates.
Comprehensive documentation with step-by-step instructions for deploying Mojaloop using next generation IaC (including IaC v5.0.0) is here: https://github.com/mojaloop/iacv2-docs . We welcome your feedback and suggestions on this.

More Improvements

In addition to performance, significant improvements in the release process of Mojaloop’s core services have been made. Several steps in the release process such as creating an initial pull request (PR) for the release candidate that involves updating a lot of helm files (charts and values files) are now automated. This will help greatly in reducing the release cycle time to respond quickly to adopter and community needs.

Mojaloop v16.0.0 - Congo coupled with IaC v5.0.0 is a great milestone on the Mojaloop timeline, with much-awaited performance and IaC upgrades. This helps keep Mojaloop current and well-suited to adopter needs on the path of evolution. Mojaloop Acacia (v15.2.0) has served us well so far and we believe that Congo will take it to the next level, helping address even higher and more stringer requirements and further accelerate adoption.

Looking Ahead

Two of the high-priority features on the Mojaloop roadmap are foreign exchange (FX) and next generation (Nextgen) settlement which are coming soon. In addition, other items delivered by active workstreams, such as a merchant work stream, plus further performance improvements and additional bug fixes will be bundled in the next release. While the partner teams and workstreams, with support from the Community, get these ready Mojaloop Congo should keep us in good stead.

We also take this opportunity to profusely thank all the contributors who made this happen.

Please try it out and share your feedback!

Authors: David Fry, Sam Kummary

Path to release quality

Samuel Kummary — Mon, 29 Jan 2024 09:47:30 +0000

Mojaloop guidance on the path from Experimental, Alpha / Beta (quality, processes) to release quality:

Documentation
- Readme page of all repos to follow the template and provide for sections where applicable:
- Overview of functionality
- Instructions to run the service independently
- Instructions to run tests
- Configuration options (env variables, etc to be set)
- Known issues
- Links to documentation for details on product features, functionality
- FAQs
- Sequence diagrams with varying level of detail
- Detailed deployment documentation, stand-alone and where applicable with/alongside Mojaloop platform
Continuous Integration, Continuous Deployment (CI/CD) steps to include
- Unit tests with coverage following Mojaloop standards
- Integration tests
- Functional tests (if applicable)
- Lint checks: link: https://docs.mojaloop.io/community/standards/guide.html#config-files (eslintrc.js)
- Code coverage check (limit doesn’t have to be 90% for Beta, can be lower)
- Vulnerability checks
- Image scan
- License checks / audit
- Note: Can use existing template on other current release level repos for reference
GitHub
- Main branches to be protected (Primary branches to be named “main”)
- PR tiles to use “conventional commit” standard (integrated with CI/CD) (Link: - - https://docs.mojaloop.io/community/standards/creating-new-features.html )
- Codeowners to be added to all repos part of the core platform
- Codeowners approval required for merges
- No skipping CI steps for commits in general
Project issues
- Issues to follow story template
- Well defined acceptance criteria required
- Acceptance criteria and priority of issues to be confirmed during prioritization / refinement meetings with input from Product (owners/managers).
- Encouraged to use: size estimate, task list, sprint / milestone, release, Epic
- Stories to have information needed to navigate through changes needed on GitHub repos (Links to PRs, etc)
- Issues to be closed after Product Owner confirmation
- All artifacts, design decisions to be publicly available on Mojaloop GitHub
Releases & Testing
- Helm charts needed for all services
- Need well defined test collections along with provisioning collections that cover all the features supported.
- Release notes to contain (at a minimum):
- High level summary
- API versions supported
- Individual service versions (with links)
- Bug fixes
- Testing instructions
- Known issues
- Breaking changes if any
- Release cadence to be discussed with Release co-ordinators and Product teams.
- Assess deployment options prior to releases and ensure tests, deployment instructions are in-line with releases as they’re made.

WS: Mojaloop Core maintenance & releases [Quality product]

Samuel Kummary — Mon, 20 Mar 2023 11:24:30 +0000

This is for the Mojaloop Core maintenance and releases workstream that is part of the Foundation (or last of the pillars) of "Quality Product" for Mojaloop PI-21