From a1df83a2365d9a92d567668d06f07183032a295a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?C=C3=A9dric=20Verstraeten?= <1546779+cedricve@users.noreply.github.com> Date: Wed, 4 Nov 2026 10:14:06 +0000 Subject: [PATCH] Align promoted frontend values with hardened Hub chart Remove the invalid Docker Hub prefix on GHCR images, use frontend port 8080 and named NodePort routing, and add a pre-infrastructure runtime preflight for chart 0.170.0+. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/kind.yaml | 4 +++ README.md | 15 ++++++++++ base/hub/kerberos-hub-nodeports.yaml | 2 +- base/hub/kerberos-hub-values.yaml | 4 ++- scripts/check-hub-runtime.sh | 44 ++++++++++++++++++++++++++++ 5 files changed, 67 insertions(+), 2 deletions(-) create mode 100644 scripts/check-hub-runtime.sh diff --git a/.github/workflows/kind.yaml b/.github/workflows/kind.yaml index c7d5973..36518dd 100644 --- a/.github/workflows/kind.yaml +++ b/.github/workflows/kind.yaml @@ -27,6 +27,10 @@ jobs: kubectl get sc - name: Checkout repository uses: actions/checkout@v2 + - name: Check promoted Hub runtime + run: | + helm repo add kerberos https://charts.kerberos.io + bash scripts/check-hub-runtime.sh - name: Install OpenEBS run: | kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml diff --git a/README.md b/README.md index 48b385c..a9f6d91 100644 --- a/README.md +++ b/README.md @@ -17,6 +17,21 @@ The Kerberos.io stack offers flexible installation options, supporting deploymen This repository continuously tests the Kerberos.io deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider. +### Hardened Hub frontend + +The promoted frontend image requires Hub chart **0.170.0 or newer**, which +provides port `8080`, non-root/read-only runtime settings and a writable `/tmp` +mount. Both primary and demo frontends use these settings; Admin remains on its +legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied +fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend +NodePort remains `32080`, targeting the container port named `http`. + +Run `bash scripts/check-hub-runtime.sh` to check the published chart with these +values before installation, or pass a local chart path as the first argument. +When adding custom branding mounts, preserve the chart's `frontend-tmp` volume +and `/tmp` mount. Existing deployments may require the explicit +[HTTP port migration](https://github.com/kerberos-io/helm-charts/blob/main/charts/hub/README.md#recovering-a-duplicate-http-port-during-upgrades). + ## Architecture As previously indicated, several integral components, including Object Storage, Database, and Message Brokers, are deployed and configured to ensure the proper functionality of Kerberos.io. The architecture diagrams below aims to provide a visual representation of these components and their interactions with one another depending the deployment; self-hosted or managed cloud deployment. diff --git a/base/hub/kerberos-hub-nodeports.yaml b/base/hub/kerberos-hub-nodeports.yaml index fee0c95..df8f50b 100644 --- a/base/hub/kerberos-hub-nodeports.yaml +++ b/base/hub/kerberos-hub-nodeports.yaml @@ -9,7 +9,7 @@ spec: type: NodePort ports: - port: 80 - targetPort: 80 + targetPort: http nodePort: 32080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically name: frontend protocol: TCP diff --git a/base/hub/kerberos-hub-values.yaml b/base/hub/kerberos-hub-values.yaml index cb3cbcd..62c2f3f 100644 --- a/base/hub/kerberos-hub-values.yaml +++ b/base/hub/kerberos-hub-values.yaml @@ -19,7 +19,7 @@ licenseServer: # When using a private registry, you can specify the registry here. global: - imageRegistry: "docker.io/" + imageRegistry: "" # Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'. # Set to 'true' if this is a private deployment. environment: "production" @@ -241,6 +241,8 @@ kerberoshub: repository: ghcr.io/uug-ai/hub-frontend pullPolicy: IfNotPresent tag: "v1.19.28" + # Requires Hub chart 0.170.0+ for the matching hardened runtime defaults. + containerPort: 8080 replicas: 1 schema: "http" url: "yourdomain.com" diff --git a/scripts/check-hub-runtime.sh b/scripts/check-hub-runtime.sh new file mode 100644 index 0000000..16ff1e2 --- /dev/null +++ b/scripts/check-hub-runtime.sh @@ -0,0 +1,44 @@ +#!/usr/bin/env bash +set -euo pipefail + +ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)" +CHART="${1:-kerberos/hub}" + +assert_contains() { + if ! grep -Eq -- "$2" <<< "$1"; then + printf 'Missing expected deployment runtime setting: %s\n' "$2" >&2 + exit 1 + fi +} + +nodeport="$(awk ' + /^---/ { selected=0 } + /name: hub-frontend-nodeport$/ { selected=1 } + selected { print } +' "$ROOT/base/hub/kerberos-hub-nodeports.yaml")" +assert_contains "$nodeport" 'targetPort: http$' +assert_contains "$nodeport" 'nodePort: 32080' + +rendered="$(helm template hub "$CHART" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \ + --set mode=ui --set kerberoshub.frontend.demoEnabled=true)" +if grep -q 'image: "docker.io/ghcr.io/' <<< "$rendered"; then + echo "Fully qualified GHCR image was prefixed with docker.io" >&2 + exit 1 +fi +for name in hub-frontend hub-frontend-demo; do + deployment="$(awk -v name="$name" ' + function emit() { if (deployment && matched) printf "%s", block } + /^---$/ { emit(); block=""; deployment=0; matched=0 } + { block=block $0 "\n" } + /^kind: Deployment$/ { deployment=1 } + $0 == " name: " name { matched=1 } + END { emit() } + ' <<< "$rendered")" + for setting in 'containerPort: 8080' 'runAsNonRoot: true' 'runAsUser: 65532' \ + 'readOnlyRootFilesystem: true' 'mountPath: /tmp' 'name: frontend-tmp'; do + assert_contains "$deployment" "^[[:space:]]*(- )?$setting$" + done + assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$' + echo "OK: $name uses the promoted image and matching hardened runtime" +done +echo "Deployment Hub runtime preflight passed."