diff --git a/.github/workflows/k3d.yaml b/.github/workflows/k3d.yaml index 7e9fe54..d2539c2 100644 --- a/.github/workflows/k3d.yaml +++ b/.github/workflows/k3d.yaml @@ -84,8 +84,7 @@ jobs: kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault - sleep 10 - kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s + kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s kubectl get pods -A -o wide kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1) - name: Install Agent diff --git a/.github/workflows/kind.yaml b/.github/workflows/kind.yaml index 43c28b2..9a7ed58 100644 --- a/.github/workflows/kind.yaml +++ b/.github/workflows/kind.yaml @@ -86,8 +86,7 @@ jobs: kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault - sleep 10 - kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s + kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s kubectl get pods -A -o wide kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1) - name: Install Agent diff --git a/.github/workflows/microk8s.yaml b/.github/workflows/microk8s.yaml index 9092991..40e78b2 100644 --- a/.github/workflows/microk8s.yaml +++ b/.github/workflows/microk8s.yaml @@ -75,8 +75,7 @@ jobs: kubectl apply -f ./base/vault/mongodb-configmap.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-deployment.yaml -n kerberos-vault kubectl apply -f ./base/vault/kerberos-vault-service.yaml -n kerberos-vault - sleep 10 - kubectl wait --for=condition=available deployment/vault -n kerberos-vault --timeout=300s + kubectl rollout status deployment/vault -n kerberos-vault --timeout=300s kubectl get pods -A -o wide kubectl get pods -A -o wide | grep vault | awk '{print $3}' | grep -q '1/1' && echo "vault pod is running with status 1/1" || (echo "vault pod is not running with status 1/1" && exit 1) - name: Install Agent diff --git a/README.extensions.md b/README.extensions.md index 75807af..8b35a53 100644 --- a/README.extensions.md +++ b/README.extensions.md @@ -1,8 +1,8 @@ ### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance -Once your Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained. +Once your Agents are properly connected and all recordings are stored in the Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained. -Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Kerberos Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions. +Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions. Please note that if you do not have a GPU on the device, you will need to disable the resource limit of the nvidia/gpu. Once done the filtering will run on the CPU. @@ -18,7 +18,7 @@ Let's deploy the data filtering pod (with or without GPU support). kubectl apply -f data-filtering-deployment.yaml ``` -Each time a recording is stored in the Kerberos Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Kerberos Vault, trigger alerts, or send notifications. +Each time a recording is stored in the Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Vault, trigger alerts, or send notifications. Ensure that the `data-filtering` workload is actively running, receiving messages from the integration, and performing the necessary processing tasks. @@ -27,7 +27,7 @@ kubectl get po -w -A kubectl logs -f data... ``` -You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Kerberos Vault. +You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Vault. ```bash Persons: 0, Cars: 0, Trucks: 0 @@ -49,27 +49,27 @@ Delete media from http://vault-lb.kerberos-vault/api 8) Releasing video writer and closing video capture ``` -As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Kerberos Vaults`. Currently, only one `Kerberos Vault` is available. To enable this feature, you will need to [install a second `Kerberos Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage. +As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Vaults`. Currently, only one `Vault` is available. To enable this feature, you will need to [install a second `Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage. ### Add forwarding integration -If you have setup a secondary Kerberos Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI. +If you have setup a secondary Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI. ```bash ssh -L 8080:localhost:30080 user@server-ip -p 22 ``` -Navigate to the `Kerberos Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Kerberos Vault to the remote Kerberos Vault, and will tell the system to set recordings in a `forwarding state`. +Navigate to the `Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Vault to the remote Vault, and will tell the system to set recordings in a `forwarding state`. - Add an integration - - Kerberos Vault + - Vault - Enabled: true - Integration name: remote-vault - Forwarding mode: continuous - Url: http(s)://yourvault.com/api - Provider: The name of the remote storage provider - - Access Key: The access key of the account you have created on the remote Kerberos Vault - - Secret Access Key: The secret access key of the account you have created on the remote Kerberos Vault + - Access Key: The access key of the account you have created on the remote Vault + - Secret Access Key: The secret access key of the account you have created on the remote Vault If the integration is functioning correctly, you should observe that recordings are initially marked in gray as "To be forwarded." After a short period, some recordings will be updated to green, indicating they have been "Forwarded by." diff --git a/README.k8s.md b/README.k8s.md index 43b2491..4972a30 100644 --- a/README.k8s.md +++ b/README.k8s.md @@ -10,7 +10,7 @@ Kubernetes is an open-source platform for automating the deployment, scaling, and management of containerized applications. It provides features like automated deployment, self-healing, service discovery, and storage orchestration. Kubernetes is essential for modern cloud-native application development and operations. -In this tutorial, we will guide you through the installation of the Kerberos.io edge stack, which includes the Agent, Kerberos Vault, and the Data Filtering Service. This setup enables the storage of recordings from multiple cameras at the edge, facilitating local data processing and ensuring secure and efficient management of video streams. +In this tutorial, we will guide you through installing the edge stack, which includes Agent, Vault, and the Data Filtering Service. This setup enables the storage of recordings from multiple cameras at the edge, facilitating local data processing and ensuring secure and efficient management of video streams. ## Install Kubernetes on Ubuntu with kubeadm @@ -112,7 +112,7 @@ Ensure that all nodes are in the Ready state and all pods are in the Running sta ## Dependencies -When installing the Kerberos.io stack, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Kerberos Vault. +When installing the ecosystem, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Vault. ### Clone repository @@ -145,7 +145,7 @@ Skip the following legacy section when using the default installation. MinIO is a high-performance, distributed object storage system that is compatible with Amazon S3 cloud storage service. It is designed to handle large-scale data storage and retrieval, making it an ideal choice for modern cloud-native applications. -In the context of the Kerberos.io stack, MinIO will be used to store recordings from the Agents. These recordings are crucial for surveillance and monitoring purposes, and having a reliable storage solution like MinIO ensures that the data is stored securely and can be accessed efficiently. +In the context of the ecosystem, MinIO will be used to store recordings from the Agents. These recordings are crucial for surveillance and monitoring purposes, and having a reliable storage solution like MinIO ensures that the data is stored securely and can be accessed efficiently. ```bash git clone --depth 1 --branch v6.0.1 https://github.com/minio/operator.git && kubectl apply -k operator/ @@ -227,7 +227,7 @@ To access the application, open your browser and navigate to `localhost:8080`. U ### Database: MongoDB -When using Kerberos Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Kerberos Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x). +When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x). Have a look into the `./mongodb-values.yaml` file, you will find plenty of configurations for the MongoDB helm chart. To change the username and password of the MongoDB instance, go ahead and [find the attribute where](https://github.com/kerberos-io/vault/blob/master/kubernetes/mongodb/values.yaml#L148) you can change the root password. Please note that we are using the official [Bitnami Mongodb helm chart](https://github.com/bitnami/charts/tree/main/bitnami/mongodb), so please use their repository for more indepth configuration. @@ -276,9 +276,9 @@ View the RabbitMQ status and wait until it's properly running kubectl get po -w -A ``` -### Kerberos Vault +### Vault -Kerberos Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc. +Vault requires a configuration to connect to the MongoDB instance. To handle this a `configmap` is defined in the `./mongodb-configmap.yaml` file. Modify the MongoDB credentials in the `./mongodb-configmap.yaml` file, and make sure they match the credentials of your MongoDB instance, as described above. There are two ways of configuring the MongoDB connection, either you provide a `MONGODB_URI` or you specify the individual variables `MONGODB_USERNAME`, `MONGODB_PASSWORD`, etc. As mentioned above a managed MongoDB is easier to setup and manage, for example for MongoDB Atlas, you will get a MongoDB URI in the form of `"mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"`. By applying this value into the `MONGODB_URI` field, you will have setup your MongoDB connection successfully. @@ -302,7 +302,7 @@ Create the `kerberos-vault` namespace. kubectl create namespace kerberos-vault ``` -Apply the manifests, so the Kerberos Vault application is deployed and knows how to connect to the MongoDB. +Apply the manifests, so the Vault application is deployed and knows how to connect to the MongoDB. ```bash kubectl apply -f ./mongodb-configmap.yaml -n kerberos-vault @@ -318,15 +318,15 @@ kubectl get po -w -A #### Access the UI -If you have opted for the `NodePort` configuration, you can access the Kerberos Vault via the `http://localhost:30080` endpoint in your browser. For server installations without a GUI, consider setting up a reverse proxy to enable browser access from your local machine. Alternatively, you may utilize a `LoadBalancer` if one is available or if you are deploying on a managed Kubernetes service. +If you have opted for the `NodePort` configuration, you can access the Vault via the `http://localhost:30080` endpoint in your browser. For server installations without a GUI, consider setting up a reverse proxy to enable browser access from your local machine. Alternatively, you may utilize a `LoadBalancer` if one is available or if you are deploying on a managed Kubernetes service. ```bash ssh -L 8080:localhost:30080 user@server-ip -p 22 ``` -#### Configure the Kerberos Vault +#### Configure the Vault -With the Kerberos Vault installed, we can proceed to configure the various components. Currently, this must be done through the Kerberos Vault UI, but we plan to make it configurable via environment variables, eliminating the need for manual UI configurations. +With the Vault installed, we can proceed to configure the various components. Currently, this must be done through the Vault UI, but we plan to make it configurable via environment variables, eliminating the need for manual UI configurations. ![Configure Vault](./assets/images/configure-vault.gif) @@ -370,26 +370,26 @@ before switching an existing installation. ### Create an Agent -After deploying the Kerberos Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Agents. **_(Please note if you generated new the keys in the previous Kerberos Vault account creation, you need to update those in the Agent deployment)_** +After deploying the Vault and configuring the necessary services for storage, database, and integration, you can proceed to deploy the Agent with the appropriate configuration. Review the `kerberos-agent-deployment.yaml` file and adjust the relevant settings, such as the RTSP URL, to ensure proper functionality. As mentioned below note that you can opt for the [Factory](https://github.com/kerberos-io/factory/tree/master/kubernetes) which gives you a UI to manage the creation of Agents. **_(Please note if you generated new the keys in the previous Vault account creation, you need to update those in the Agent deployment)_** ```bash kubectl apply -f kerberos-agent-deployment.yaml ``` -Review the creation of the Agent and review the logs of the container to validate the Agent is able to connect to the IP camera, and if a recording is being created and transferred to the Kerberos Vault +Review the creation of the Agent and review the logs of the container to validate the Agent is able to connect to the IP camera, and if a recording is being created and transferred to the Vault ```bash kubectl get po -w -A kubectl logs -f kerberos-agent... ``` -To validate the Kerberos Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel). +To validate the Vault and review any stored recordings, access the user interface at `http://localhost:30080` (after establishing the reverse tunnel). ### Create Agents through Factory Managing Agents through seperate configuration files might feel cumbersome, especially for non-technical users. This is where Factory comes into the picture. Factory provides a visual view that allows you to rapidly connect cameras through a user interface, which allows users without any technical background about cameras and kubernetes create Agents. -Factory also requires a mongodb, just like Kerberos Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace. +Factory also requires a mongodb, just like Vault. Luckily you can reuse the mongodb installation we have deployed earlier, the only thing we'll need to do is to create another `configmap.yaml` in the `kerberos-factory` namespace. Create the `kerberos-factory` namespace. @@ -419,9 +419,9 @@ kubectl get po -w -A ### Optimized Data Filtering for Enhanced Bandwidth Efficiency and Relevance -Once your Agents are properly connected and all recordings are stored in the Kerberos Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained. +Once your Agents are properly connected and all recordings are stored in the Vault, you may encounter additional challenges such as bandwidth limitations, storage constraints, and the need to efficiently locate relevant data. To accomplish this, we can configure an integration to filter the recordings, ensuring that only the relevant ones are retained. -Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Kerberos Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions. +Assuming all configurations are correctly set and all Kubernetes deployments are operational, you can apply the `data-filtering-deployment.yaml` deployment. This deployment will schedule a pod that listens to the configured integration in Vault and runs a YOLOv8 model to evaluate the recordings and match them against specified conditions. Please note that if you do not have a GPU on the device, you will need to disable the resource limit of the nvidia/gpu. Once done the filtering will run on the CPU. @@ -437,7 +437,7 @@ Let's deploy the data filtering pod (with or without GPU support). kubectl apply -f data-filtering-deployment.yaml ``` -Each time a recording is stored in the Kerberos Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Kerberos Vault, trigger alerts, or send notifications. +Each time a recording is stored in the Vault, the `data-filtering` pod will receive a notification and execute the specified model (YOLOv8 by default). Based on the defined conditions, the `data-filtering` pod may forward the recording to a remote Vault, trigger alerts, or send notifications. Ensure that the `data-filtering` workload is actively running, receiving messages from the integration, and performing the necessary processing tasks. @@ -446,7 +446,7 @@ kubectl get po -w -A kubectl logs -f data... ``` -You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Kerberos Vault. +You might see something like below, whereas the `data-filtering` pod is iterating over recordings and frames, looking for a person. Once it finds the person it will try to `forward` the recording to a remote Vault. ```bash Persons: 0, Cars: 0, Trucks: 0 @@ -468,34 +468,34 @@ Delete media from http://vault-lb.kerberos-vault/api 8) Releasing video writer and closing video capture ``` -As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Kerberos Vaults`. Currently, only one `Kerberos Vault` is available. To enable this feature, you will need to [install a second `Kerberos Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage. +As indicated by the logs `Something went wrong while forwarding media`, the forwarding process failed due to the absence of an integration between the two `Vaults`. Currently, only one `Vault` is available. To enable this feature, you will need to [install a second `Vault` in the cloud](./README.k8s-managed.md) with access to cloud storage. ### Add forwarding integration -If you have setup a secondary Kerberos Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI. +If you have setup a secondary Vault in the cloud, attached cloud Object storage to it, we can continue and add an additional integration through the UI. ```bash ssh -L 8080:localhost:30080 user@server-ip -p 22 ``` -Navigate to the `Kerberos Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Kerberos Vault to the remote Kerberos Vault, and will tell the system to set recordings in a `forwarding state`. +Navigate to the `Vault` application in your browser, access the `Integration` section, and add a new integration. This integration will connect your local Vault to the remote Vault, and will tell the system to set recordings in a `forwarding state`. - Add an integration - - Kerberos Vault + - Vault - Enabled: true - Integration name: remote-vault - Forwarding mode: continuous - Url: http(s)://yourvault.com/api - Provider: The name of the remote storage provider - - Access Key: The access key of the account you have created on the remote Kerberos Vault - - Secret Access Key: The secret access key of the account you have created on the remote Kerberos Vault + - Access Key: The access key of the account you have created on the remote Vault + - Secret Access Key: The secret access key of the account you have created on the remote Vault If the integration is functioning correctly, you should observe that recordings are initially marked in gray as "To be forwarded." After a short period, some recordings will be updated to green, indicating they have been "Forwarded by." ## Cleanup -If you consider to remove the Kerberos.io stack you might just disable the microk8s installation +If you consider to remove the ecosystem you might just disable the microk8s installation ```bash microk8s reset diff --git a/README.md b/README.md index eea077c..661a94b 100644 --- a/README.md +++ b/README.md @@ -1,21 +1,23 @@ # Deployment -Deploying the Kerberos.io stack may initially appear to be a complex task due to its design for scalability from the outset. This entails the integration of several scalable components within a distributed deployment architecture. To streamline the installation process, we have established this repository to offer comprehensive guidance. Our objective is to incorporate as much automation as possible within this repository, thereby ensuring that the installation process is straightforward and user-friendly. At the same time, we remain committed to delivering a scalable and highly available video surveillance system. +Deploying the ecosystem may initially appear to be a complex task due to its design for scalability from the outset. This entails the integration of several scalable components within a distributed deployment architecture. To streamline the installation process, we have established this repository to offer comprehensive guidance. Our objective is to incorporate as much automation as possible within this repository, thereby ensuring that the installation process is straightforward and user-friendly. At the same time, we remain committed to delivering a scalable and highly available video surveillance system. -![How it works](./assets/images/how-it-works.svg) +[![How it works: cameras feed Agents, Factory manages Agents on Kubernetes, Vault stores recordings, and Hub analyses events.](./assets/images/how-it-works.svg)][draw-how-it-works] -The Kerberos.io stack offers flexible installation options, supporting deployment in hybrid environments, fully in the cloud, or entirely at the edge. This deployment guide covers the installation of various Kerberos.io components. For detailed information on each component, please refer to their respective repositories. +[Edit in Draw][draw-how-it-works] · [Diagram source](./assets/diagrams/how-it-works.json) -- [Agent](https://github.com/kerberos-io/agent) -- [Factory](https://github.com/kerberos-io/factory) -- [Kerberos Vault](https://github.com/kerberos-io/vault) -- [Kerberos Hub](https://github.com/kerberos-io/hub) +The ecosystem offers flexible installation options, supporting deployment in hybrid environments, fully in the cloud, or entirely at the edge. This deployment guide covers installing its components. For detailed component documentation, please refer to the links below. + +- [Agent](https://learn.uug.ai/docs/agent/) +- [Factory](https://learn.uug.ai/docs/factory/) +- [Vault](https://github.com/kerberos-io/vault) +- [Hub](https://github.com/kerberos-io/hub) ## Continuous deployment [](https://github.com/kerberos-io/deployment/actions/workflows/microk8s.yaml) [](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml) -This repository continuously tests the Kerberos.io deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider. +This repository continuously tests the ecosystem deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider. Kubernetes examples and CI now use **Garage S3** for local object storage. See the [Garage setup guide](./base/garage/README.md) for generated credentials, @@ -47,7 +49,7 @@ and `/tmp` mount. Existing deployments may require the explicit ## Architecture -As previously indicated, several integral components, including Object Storage, Database, and Message Brokers, are deployed and configured to ensure the proper functionality of Kerberos.io. The architecture diagrams below aims to provide a visual representation of these components and their interactions with one another depending the deployment; self-hosted or managed cloud deployment. +As previously indicated, several integral components, including object storage, databases, and message brokers, are deployed and configured to support the ecosystem. The architecture diagrams below provide a visual representation of these components and how they interact in self-hosted and managed cloud deployments. It is important to note that the ease of installation may vary depending on the chosen Kubernetes distribution and platform. For instance, distributions like Microk8s, which offer an addons feature, may simplify the installation process significantly. Managed Kubernetes services on platforms such as AWS, Azure, GCP, and others offer a range of supplementary services. These include, but are not limited to, cloud-based object storage, load balancers, persistent volumes, and additional resources that enhance the deployment experience. On the other hand running a self-hosted vanilla Kubernetes deployment will come with additinal work as it misses the out-of-the-box components from a managed deployment or the self-hosted Microk8s add-ons feature. @@ -55,17 +57,28 @@ Given these differences, we have created specific architectural frameworks for s ## Edge (self-hosted) deployment -Edge (self-hosted) deployments are typically used for camera processing and edge storage. In this setup, Agents are deployed and connected to cameras, with recordings stored in the Kerberos Vault. Additionally, you may want to create integrations, such as [data filtering](https://github.com/uug-ai/data-filtering), to ensure only relevant recordings are retained, or set up custom notifications to your first or third-party platforms. In this edge scenario, hardware is being deployed in the local network to handle the workloads; for example AMD64 or ARM64 processors. +Edge (self-hosted) deployments are typically used for camera processing and edge storage. In this setup, Agents are deployed and connected to cameras, with recordings stored in the Vault. Additionally, you may want to create integrations, such as [data filtering](https://github.com/uug-ai/data-filtering), to ensure only relevant recordings are retained, or set up custom notifications to your first or third-party platforms. In this edge scenario, hardware is being deployed in the local network to handle the workloads; for example AMD64 or ARM64 processors. -![Edge - self-hosted deployment](./assets/images/deployment-self-hosted.svg) +[![Self-hosted deployment: one Agent per camera uploads to Vault, backed by MongoDB and object storage. Optional RabbitMQ events feed custom integrations.](./assets/images/deployment-self-hosted.svg)][draw-deployment-self-hosted] -A key aspect of this deployment is the scaling of Agents. Each camera is assigned a dedicated Agent container, which is linked to a central Kerberos Vault. The Kerberos Vault stores metadata in MongoDB, recordings in Garage (or another S3-compliant object storage), and can generate events in a message broker like RabbitMQ. This approach enables you to develop custom applications/logic that can respond to the creation of new recordings. +[Edit in Draw][draw-deployment-self-hosted] · [Diagram source](./assets/diagrams/deployment-self-hosted.json) + +Factory is optional and manages Agents when using Kubernetes. Event publishing +and custom integrations are optional; recordings can stay entirely within the +private edge network. + +A key aspect of this deployment is the scaling of Agents. Each camera is +assigned a dedicated Agent container, which is linked to a central Vault. Vault +stores metadata in MongoDB, recordings in Garage (or another S3-compatible +object storage), and can generate events in a message broker like RabbitMQ. +This approach enables you to develop custom applications or logic that can +respond to new recordings. Based on your technology experience and preferences, you can choose from the following deployment guides: -- [[Easy] Install Kerberos.io on Docker](/README.docker.md) -- [[Medium] Install Kerberos.io on Microk8s](/README.microk8s.md) -- [[Advanced] Install Kerberos.io on Kubernetes](/README.k8s.md) +- [[Easy] Install the ecosystem with Docker](/README.docker.md) +- [[Medium] Install the ecosystem with Microk8s](/README.microk8s.md) +- [[Advanced] Install the ecosystem with Kubernetes](/README.k8s.md) ## Managed deployment @@ -87,13 +100,54 @@ As previously discussed, a managed deployment enhances resilience and high avail The primary objective of maintaining a managed, public-facing deployment is to centralize multiple edge deployments through a unified interface. Typically, edge deployments are distributed across various environments such as hospitals, retail stores, and factories. These edge deployments are inherently secure and non-public facing, preventing direct internet access to these environments. To address this challenge, we operate a managed, public-facing environment that consolidates all recordings, live camera views, and permissions into a single, cohesive platform. -![Managed deployment](./assets/images/deployment-managed.svg) +[![Managed deployment: Agents at private sites upload over HTTPS to cloud Vault. Object storage holds recordings, MongoDB holds metadata, and RabbitMQ feeds Hub processing.](./assets/images/deployment-managed.svg)][draw-deployment-managed] + +[Edit in Draw][draw-deployment-managed] · [Diagram source](./assets/diagrams/deployment-managed.json) + +This example shows Agents uploading directly to cloud Vault, without exposing +the camera networks to inbound internet traffic. Hybrid deployments can retain +an edge Vault and forward selected recordings to cloud Vault instead. The +backing services can be self-hosted or compatible managed services; their logical +roles stay the same. Based on your technology experience and preferences, you can choose from the following deployment guides: -- [[Medium] Install Kerberos.io on Kubernetes (AWS, GCP, Azure, etc.)](/README.k8s-managed.md) +- [[Medium] Install the ecosystem with Kubernetes (AWS, GCP, Azure, etc.)](/README.k8s-managed.md) Or provision the infrastructure yourself with infrastructure as code: - [[AWS] Terraform: EKS cluster + Amazon DocumentDB](./modules/amazon-eks-documentdb/README.md) - [[Azure] Terraform: Event Hub with 10 partitions](./modules/azure-event-hub/README.md) + +## Updating architecture diagrams + +These diagrams use the same editable `groups`, `nodes`, and `connections` JSON +format as the [Learn diagrams](https://learn.uug.ai/docs/prologue/how/) and +[Draw](https://draw.uug.ai/). GitHub cannot run Learn's interactive renderer, so +the README uses self-contained SVG exports from Draw, with an **Edit in Draw** +link carrying the source in a base64-encoded UTF-8 URL fragment. + +1. Update the corresponding JSON in [assets/diagrams](./assets/diagrams). + Keep the product colours, labelled zones, cards and orthogonal connectors + consistent with Learn; the overview follows Learn's solution stack. +2. Run `node scripts/update-diagram-links.mjs` (Node.js 20+) to refresh the + README's Draw links. Open the updated **Edit in Draw** link, or paste the + JSON into Draw's **Templates** import. +3. Use Draw's **Export board** action to download an SVG in light mode and + replace the matching file in [assets/images](./assets/images). Export the + whole diagram, not a screenshot of the editor. Draw embeds its image assets + so GitHub does not need external icons or scripts. +4. Run `node scripts/update-diagram-links.mjs --check` and preview the README. + The check validates source bounds/connections, SVG presence and link + freshness; also check the exported diagram visually. + +Edits on a Draw board do not automatically update this repository. Mirror any +board changes into the JSON source before refreshing the links and SVG. Commit +the source, preview and README links together; do not hand-edit the generated +links below. + + +[draw-how-it-works]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiY2FwdHVyZSIsImxhYmVsIjoiMS4gQ2FtZXJhIHByb2Nlc3NpbmcgLSBlZGdlIC8gY2xvdWQiLCJ4IjowLCJ5IjoyMCwidyI6NTQwLCJoIjo1MjB9LHsiaWQiOiJwZXJzaXN0ZW5jZSIsImxhYmVsIjoiMi4gUGVyc2lzdGVuY2UgLSBlZGdlIC8gY2xvdWQiLCJ4Ijo2MjAsInkiOjIwLCJ3IjozMDAsImgiOjUyMH0seyJpZCI6ImFuYWx5c2lzIiwibGFiZWwiOiIzLiBBbmFseXNlIC0gZWRnZSAvIGNsb3VkIiwieCI6MTAwMCwieSI6MjAsInciOjMwMCwiaCI6NTIwfV0sIm5vZGVzIjpbeyJpZCI6ImNhbWVyYS0xIiwia2luZCI6ImNhbWVyYSIsIngiOjMwLCJ5IjoyMzAsInciOjE4MCwiaCI6MTQwLCJoZWFkZXIiOiJDQU1FUkEiLCJ0aXRsZSI6IkNhbWVyYSAxIiwic3VidGl0bGUiOiJSVFNQIHN0cmVhbSJ9LHsiaWQiOiJjYW1lcmEtMiIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6MzkwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiQ0FNRVJBIiwidGl0bGUiOiJDYW1lcmEgMiIsInN1YnRpdGxlIjoiUlRTUCBzdHJlYW0ifSx7ImlkIjoiZmFjdG9yeSIsImtpbmQiOiJmYWN0b3J5IiwieCI6MjgwLCJ5Ijo2MCwidyI6MjMwLCJoIjoxNDAsImhlYWRlciI6Ik9SQ0hFU1RSQVRFIiwidGl0bGUiOiJGYWN0b3J5Iiwic3VidGl0bGUiOiJNYW5hZ2Ugb24gS3ViZXJuZXRlcyJ9LHsiaWQiOiJhZ2VudC0xIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjoyMzAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDEiLCJzdWJ0aXRsZSI6IlByb2Nlc3Mgb25lIGNhbWVyYSJ9LHsiaWQiOiJhZ2VudC0yIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjozOTAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDIiLCJzdWJ0aXRsZSI6IlByb2Nlc3Mgb25lIGNhbWVyYSJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjY1MCwieSI6MjMwLCJ3IjoyNDAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJTdG9yZSBhbmQgaW50ZWdyYXRlIn0seyJpZCI6InN0b3JhZ2UiLCJraW5kIjoic3RvcmFnZSIsIngiOjY1MCwieSI6MzkwLCJ3IjoyNDAsImgiOjE0MCwiaGVhZGVyIjoiT0JKRUNUIFNUT1JBR0UiLCJ0aXRsZSI6IlN0b3JhZ2UgYmFja2VuZCIsInN1YnRpdGxlIjoiQ2xvdWQgLyBlZGdlIn0seyJpZCI6Imh1YiIsImtpbmQiOiJodWIiLCJ4IjoxMDMwLCJ5IjoyMzAsInciOjI0MCwiaCI6MTQwLCJoZWFkZXIiOiJBTkFMWVNFIiwidGl0bGUiOiJIdWIiLCJzdWJ0aXRsZSI6Ik1vbml0b3IgYW5kIGFuYWx5c2UifV0sImNvbm5lY3Rpb25zIjpbeyJmcm9tIjoiY2FtZXJhLTEiLCJ0byI6ImFnZW50LTEiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6ImNhbWVyYS0yIiwidG8iOiJhZ2VudC0yIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJmYWN0b3J5IiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJib3R0b20iLCJ0b1NpZGUiOiJ0b3AiLCJraW5kIjoiZGFzaGVkIn0seyJmcm9tIjoiZmFjdG9yeSIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJyaWdodCIsImtpbmQiOiJkYXNoZWQifSx7ImZyb20iOiJhZ2VudC0xIiwidG8iOiJ2YXVsdCIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0In0seyJmcm9tIjoiYWdlbnQtMiIsInRvIjoidmF1bHQiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJzdG9yYWdlIiwiZnJvbVNpZGUiOiJib3R0b20iLCJ0b1NpZGUiOiJ0b3AifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoiaHViIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkV2ZW50cyJ9XX0= +[draw-deployment-self-hosted]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiZWRnZSIsImxhYmVsIjoiUHJpdmF0ZSBlZGdlIG5ldHdvcmsgLSBEb2NrZXIgLyBLdWJlcm5ldGVzIiwieCI6MCwieSI6MjAsInciOjEyNDAsImgiOjY4MH1dLCJub2RlcyI6W3siaWQiOiJjYW1lcmEtMSIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6MjgwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiQ0FNRVJBIiwidGl0bGUiOiJDYW1lcmEgMSIsInN1YnRpdGxlIjoiUlRTUCBzdHJlYW0ifSx7ImlkIjoiY2FtZXJhLTIiLCJraW5kIjoiY2FtZXJhIiwieCI6MzAsInkiOjUxMCwidyI6MTgwLCJoIjoxNDAsImhlYWRlciI6IkNBTUVSQSIsInRpdGxlIjoiQ2FtZXJhIDIiLCJzdWJ0aXRsZSI6IlJUU1Agc3RyZWFtIn0seyJpZCI6ImZhY3RvcnkiLCJraW5kIjoiZmFjdG9yeSIsIngiOjI4MCwieSI6ODAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJPUFRJT05BTCBPUkNIRVNUUkFUSU9OIiwidGl0bGUiOiJGYWN0b3J5Iiwic3VidGl0bGUiOiJNYW5hZ2Ugb24gS3ViZXJuZXRlcyJ9LHsiaWQiOiJhZ2VudC0xIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5IjoyODAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDEiLCJzdWJ0aXRsZSI6Ik9uZSBjYW1lcmEgcGVyIGNvbnRhaW5lciJ9LHsiaWQiOiJhZ2VudC0yIiwia2luZCI6ImFnZW50IiwieCI6MjgwLCJ5Ijo1MTAsInciOjIyMCwiaCI6MTQwLCJoZWFkZXIiOiJSRUNPUkQiLCJ0aXRsZSI6IkFnZW50IDIiLCJzdWJ0aXRsZSI6Ik9uZSBjYW1lcmEgcGVyIGNvbnRhaW5lciJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjYyMCwieSI6MjgwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJDZW50cmFsaXNlIGVkZ2UgcmVjb3JkaW5ncyJ9LHsiaWQiOiJtb25nb2RiIiwia2luZCI6ImRhdGFiYXNlIiwieCI6OTcwLCJ5Ijo4MCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6Ik1FVEFEQVRBIiwidGl0bGUiOiJNb25nb0RCIiwic3VidGl0bGUiOiJWYXVsdCBtZXRhZGF0YSJ9LHsiaWQiOiJzdG9yYWdlIiwia2luZCI6InN0b3JhZ2UiLCJ4Ijo5NzAsInkiOjI4MCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6IlJFQ09SRElOR1MiLCJ0aXRsZSI6Ik9iamVjdCBzdG9yYWdlIiwic3VidGl0bGUiOiJNaW5JTyAvIFMzLWNvbXBhdGlibGUifSx7ImlkIjoiYnJva2VyIiwia2luZCI6ImFtcXAiLCJ4Ijo5NzAsInkiOjUxMCwidyI6MjQwLCJoIjoxNDAsImhlYWRlciI6Ik9QVElPTkFMIEVWRU5UUyIsInRpdGxlIjoiUmFiYml0TVEiLCJzdWJ0aXRsZSI6IlJlY29yZGluZyBldmVudHMifSx7ImlkIjoiaW50ZWdyYXRpb24iLCJraW5kIjoiZGVmYXVsdCIsIngiOjYyMCwieSI6NTEwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiT1BUSU9OQUwgSU5URUdSQVRJT04iLCJ0aXRsZSI6IkN1c3RvbSBhcHBsaWNhdGlvbiIsInN1YnRpdGxlIjoiRmlsdGVyLCBub3RpZnkgb3IgaW50ZWdyYXRlIn1dLCJjb25uZWN0aW9ucyI6W3siZnJvbSI6ImNhbWVyYS0xIiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IlJUU1AifSx7ImZyb20iOiJjYW1lcmEtMiIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJSVFNQIn0seyJmcm9tIjoiZmFjdG9yeSIsInRvIjoiYWdlbnQtMSIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwia2luZCI6ImRhc2hlZCJ9LHsiZnJvbSI6ImZhY3RvcnkiLCJ0byI6ImFnZW50LTIiLCJmcm9tU2lkZSI6ImxlZnQiLCJ0b1NpZGUiOiJsZWZ0Iiwia2luZCI6ImRhc2hlZCJ9LHsiZnJvbSI6ImFnZW50LTIiLCJ0byI6InZhdWx0IiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJhZ2VudC0xIiwidG8iOiJ2YXVsdCIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJVcGxvYWQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoibW9uZ29kYiIsImZyb21TaWRlIjoidG9wIiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJzdG9yYWdlIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoiYnJva2VyIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkV2ZW50cyJ9LHsiZnJvbSI6ImJyb2tlciIsInRvIjoiaW50ZWdyYXRpb24iLCJmcm9tU2lkZSI6ImxlZnQiLCJ0b1NpZGUiOiJyaWdodCIsImxhYmVsIjoiQ29uc3VtZSJ9XX0= +[draw-deployment-managed]: https://draw.uug.ai/#diagram=eyJncm91cHMiOlt7ImlkIjoiZWRnZSIsImxhYmVsIjoiUHJpdmF0ZSBlZGdlIHNpdGVzIC0gb3V0Ym91bmQgdXBsb2FkcyIsIngiOjAsInkiOjIwLCJ3Ijo1MDAsImgiOjc2MH0seyJpZCI6ImNsb3VkIiwibGFiZWwiOiJDbG91ZCAtIG1hbmFnZWQgS3ViZXJuZXRlcyBhbmQgYmFja2luZyBzZXJ2aWNlcyIsIngiOjYyMCwieSI6MjAsInciOjcwMCwiaCI6NzYwfV0sIm5vZGVzIjpbeyJpZCI6ImNhbWVyYS0xIiwia2luZCI6ImNhbWVyYSIsIngiOjMwLCJ5IjoxNzAsInciOjE4MCwiaCI6MTQwLCJoZWFkZXIiOiJTSVRFIEEiLCJ0aXRsZSI6IkNhbWVyYXMiLCJzdWJ0aXRsZSI6IlByaXZhdGUgbmV0d29yayJ9LHsiaWQiOiJjYW1lcmEtMiIsImtpbmQiOiJjYW1lcmEiLCJ4IjozMCwieSI6NTMwLCJ3IjoxODAsImgiOjE0MCwiaGVhZGVyIjoiU0lURSBCIiwidGl0bGUiOiJDYW1lcmFzIiwic3VidGl0bGUiOiJQcml2YXRlIG5ldHdvcmsifSx7ImlkIjoiYWdlbnQtMSIsImtpbmQiOiJhZ2VudCIsIngiOjI3MCwieSI6MTcwLCJ3IjoyMDAsImgiOjE0MCwiaGVhZGVyIjoiUkVDT1JEIiwidGl0bGUiOiJBZ2VudHMiLCJzdWJ0aXRsZSI6Ik9uZSBwZXIgY2FtZXJhIn0seyJpZCI6ImFnZW50LTIiLCJraW5kIjoiYWdlbnQiLCJ4IjoyNzAsInkiOjUzMCwidyI6MjAwLCJoIjoxNDAsImhlYWRlciI6IlJFQ09SRCIsInRpdGxlIjoiQWdlbnRzIiwic3VidGl0bGUiOiJPbmUgcGVyIGNhbWVyYSJ9LHsiaWQiOiJ2YXVsdCIsImtpbmQiOiJ2YXVsdCIsIngiOjY1MCwieSI6MTcwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiU1RPUkUiLCJ0aXRsZSI6IlZhdWx0Iiwic3VidGl0bGUiOiJSZWNlaXZlIHJlY29yZGluZ3MifSx7ImlkIjoic3RvcmFnZSIsImtpbmQiOiJzdG9yYWdlIiwieCI6MTA0MCwieSI6MTcwLCJ3IjoyNTAsImgiOjE0MCwiaGVhZGVyIjoiUkVDT1JESU5HUyIsInRpdGxlIjoiT2JqZWN0IHN0b3JhZ2UiLCJzdWJ0aXRsZSI6IlMzIC8gQXp1cmUgQmxvYiAvIEdDUyJ9LHsiaWQiOiJicm9rZXIiLCJraW5kIjoiYW1xcCIsIngiOjY1MCwieSI6MzgwLCJ3IjoyMzAsImgiOjE0MCwiaGVhZGVyIjoiRVZFTlRTIiwidGl0bGUiOiJSYWJiaXRNUSIsInN1YnRpdGxlIjoiUXVldWUgcmVjb3JkaW5nIGV2ZW50cyJ9LHsiaWQiOiJtb25nb2RiIiwia2luZCI6ImRhdGFiYXNlIiwieCI6MTA0MCwieSI6MzgwLCJ3IjoyNTAsImgiOjE0MCwiaGVhZGVyIjoiTUVUQURBVEEiLCJ0aXRsZSI6Ik1vbmdvREIiLCJzdWJ0aXRsZSI6IlZhdWx0IC8gSHViIGRhdGFiYXNlcyJ9LHsiaWQiOiJodWIiLCJraW5kIjoiaHViIiwieCI6NjUwLCJ5Ijo2MDAsInciOjIzMCwiaCI6MTQwLCJoZWFkZXIiOiJBTkFMWVNFIiwidGl0bGUiOiJIdWIiLCJzdWJ0aXRsZSI6IlBpcGVsaW5lLCBBUEkgYW5kIFVJIn1dLCJjb25uZWN0aW9ucyI6W3siZnJvbSI6ImNhbWVyYS0xIiwidG8iOiJhZ2VudC0xIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJjYW1lcmEtMiIsInRvIjoiYWdlbnQtMiIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0In0seyJmcm9tIjoiYWdlbnQtMiIsInRvIjoidmF1bHQiLCJmcm9tU2lkZSI6InJpZ2h0IiwidG9TaWRlIjoibGVmdCJ9LHsiZnJvbSI6ImFnZW50LTEiLCJ0byI6InZhdWx0IiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQiLCJsYWJlbCI6IkhUVFBTIHVwbG9hZCJ9LHsiZnJvbSI6InZhdWx0IiwidG8iOiJtb25nb2RiIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImxlZnQifSx7ImZyb20iOiJ2YXVsdCIsInRvIjoic3RvcmFnZSIsImZyb21TaWRlIjoicmlnaHQiLCJ0b1NpZGUiOiJsZWZ0IiwibGFiZWwiOiJSZWNvcmRpbmdzIn0seyJmcm9tIjoidmF1bHQiLCJ0byI6ImJyb2tlciIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwibGFiZWwiOiJFdmVudHMifSx7ImZyb20iOiJicm9rZXIiLCJ0byI6Imh1YiIsImZyb21TaWRlIjoiYm90dG9tIiwidG9TaWRlIjoidG9wIiwibGFiZWwiOiJQcm9jZXNzIn0seyJmcm9tIjoiaHViIiwidG8iOiJtb25nb2RiIiwiZnJvbVNpZGUiOiJyaWdodCIsInRvU2lkZSI6ImJvdHRvbSJ9XX0= + diff --git a/README.microk8s.md b/README.microk8s.md index 34c49fe..b551e0b 100644 --- a/README.microk8s.md +++ b/README.microk8s.md @@ -71,7 +71,7 @@ For more detailed instructions and troubleshooting, please refer to the official ## Dependencies -Before installing, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Kerberos Vault. +Before installing, several dependencies are required for storage, such as a database (e.g., MongoDB) and a message broker (e.g., RabbitMQ) for asynchronous behavior. We will install these components before setting up the Agents and Vault. One of the key advantages of MicroK8s is its out-of-the-box addons, which can be enabled with a single command. This eliminates the need for complex Helm charts or operators, simplifying the setup process. We will enable some common services, such as DNS, GPU support, and storage, to streamline the installation. @@ -204,7 +204,7 @@ To access the application, open your browser and navigate to `localhost:8080`. U ### Database: MongoDB -When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Kerberos Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x). +When using Vault, it will persist references to the recordings stored in your storage provider in a MongoDB database. As used before, we are using `helm` to install MongoDB in our Kubernetes cluster. Within the Vault project we are using the latest official mongodb driver, so we support all major MongoDB versions (4.x, 5.x, 6.x, 7.x). Have a look into the `./mongodb-values.yaml` file, you will find plenty of configurations for the MongoDB helm chart. To change the username and password of the MongoDB instance, go ahead and [find the attribute where](https://github.com/kerberos-io/vault/blob/master/kubernetes/mongodb/values.yaml#L148) you can change the root password. Please note that we are using the official [Bitnami Mongodb helm chart](https://github.com/bitnami/charts/tree/main/bitnami/mongodb), so please use their repository for more indepth configuration. @@ -431,7 +431,7 @@ kubectl apply -f kerberos-hub-create-database-job.yaml -n kerberos-hub ## Cleanup -If you consider to remove the Kerberos.io stack you might just disable the microk8s installation +If you consider to remove the ecosystem you might just disable the microk8s installation ```bash microk8s reset diff --git a/assets/diagrams/deployment-managed.json b/assets/diagrams/deployment-managed.json new file mode 100644 index 0000000..eab72b9 --- /dev/null +++ b/assets/diagrams/deployment-managed.json @@ -0,0 +1,37 @@ +{ + "groups": [ + { "id": "edge", "label": "Private edge sites - outbound uploads", "x": 0, "y": 20, "w": 500, "h": 760 }, + { "id": "cloud", "label": "Cloud - managed Kubernetes and backing services", "x": 620, "y": 20, "w": 700, "h": 760 } + ], + "nodes": [ + { "id": "camera-1", "kind": "camera", "x": 30, "y": 170, "w": 180, "h": 140, + "header": "SITE A", "title": "Cameras", "subtitle": "Private network" }, + { "id": "camera-2", "kind": "camera", "x": 30, "y": 530, "w": 180, "h": 140, + "header": "SITE B", "title": "Cameras", "subtitle": "Private network" }, + { "id": "agent-1", "kind": "agent", "x": 270, "y": 170, "w": 200, "h": 140, + "header": "RECORD", "title": "Agents", "subtitle": "One per camera" }, + { "id": "agent-2", "kind": "agent", "x": 270, "y": 530, "w": 200, "h": 140, + "header": "RECORD", "title": "Agents", "subtitle": "One per camera" }, + { "id": "vault", "kind": "vault", "x": 650, "y": 170, "w": 230, "h": 140, + "header": "STORE", "title": "Vault", "subtitle": "Receive recordings" }, + { "id": "storage", "kind": "storage", "x": 1040, "y": 170, "w": 250, "h": 140, + "header": "RECORDINGS", "title": "Object storage", "subtitle": "S3 / Azure Blob / GCS" }, + { "id": "broker", "kind": "amqp", "x": 650, "y": 380, "w": 230, "h": 140, + "header": "EVENTS", "title": "RabbitMQ", "subtitle": "Queue recording events" }, + { "id": "mongodb", "kind": "database", "x": 1040, "y": 380, "w": 250, "h": 140, + "header": "METADATA", "title": "MongoDB", "subtitle": "Vault / Hub databases" }, + { "id": "hub", "kind": "hub", "x": 650, "y": 600, "w": 230, "h": 140, + "header": "ANALYSE", "title": "Hub", "subtitle": "Pipeline, API and UI" } + ], + "connections": [ + { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left" }, + { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left" }, + { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" }, + { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left", "label": "HTTPS upload" }, + { "from": "vault", "to": "mongodb", "fromSide": "right", "toSide": "left" }, + { "from": "vault", "to": "storage", "fromSide": "right", "toSide": "left", "label": "Recordings" }, + { "from": "vault", "to": "broker", "fromSide": "bottom", "toSide": "top", "label": "Events" }, + { "from": "broker", "to": "hub", "fromSide": "bottom", "toSide": "top", "label": "Process" }, + { "from": "hub", "to": "mongodb", "fromSide": "right", "toSide": "bottom" } + ] +} diff --git a/assets/diagrams/deployment-self-hosted.json b/assets/diagrams/deployment-self-hosted.json new file mode 100644 index 0000000..12e0b3b --- /dev/null +++ b/assets/diagrams/deployment-self-hosted.json @@ -0,0 +1,39 @@ +{ + "groups": [ + { "id": "edge", "label": "Private edge network - Docker / Kubernetes", "x": 0, "y": 20, "w": 1240, "h": 680 } + ], + "nodes": [ + { "id": "camera-1", "kind": "camera", "x": 30, "y": 280, "w": 180, "h": 140, + "header": "CAMERA", "title": "Camera 1", "subtitle": "RTSP stream" }, + { "id": "camera-2", "kind": "camera", "x": 30, "y": 510, "w": 180, "h": 140, + "header": "CAMERA", "title": "Camera 2", "subtitle": "RTSP stream" }, + { "id": "factory", "kind": "factory", "x": 280, "y": 80, "w": 220, "h": 140, + "header": "OPTIONAL ORCHESTRATION", "title": "Factory", "subtitle": "Manage on Kubernetes" }, + { "id": "agent-1", "kind": "agent", "x": 280, "y": 280, "w": 220, "h": 140, + "header": "RECORD", "title": "Agent 1", "subtitle": "One camera per container" }, + { "id": "agent-2", "kind": "agent", "x": 280, "y": 510, "w": 220, "h": 140, + "header": "RECORD", "title": "Agent 2", "subtitle": "One camera per container" }, + { "id": "vault", "kind": "vault", "x": 620, "y": 280, "w": 230, "h": 140, + "header": "STORE", "title": "Vault", "subtitle": "Centralise edge recordings" }, + { "id": "mongodb", "kind": "database", "x": 970, "y": 80, "w": 240, "h": 140, + "header": "METADATA", "title": "MongoDB", "subtitle": "Vault metadata" }, + { "id": "storage", "kind": "storage", "x": 970, "y": 280, "w": 240, "h": 140, + "header": "RECORDINGS", "title": "Object storage", "subtitle": "MinIO / S3-compatible" }, + { "id": "broker", "kind": "amqp", "x": 970, "y": 510, "w": 240, "h": 140, + "header": "OPTIONAL EVENTS", "title": "RabbitMQ", "subtitle": "Recording events" }, + { "id": "integration", "kind": "default", "x": 620, "y": 510, "w": 230, "h": 140, + "header": "OPTIONAL INTEGRATION", "title": "Custom application", "subtitle": "Filter, notify or integrate" } + ], + "connections": [ + { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left", "label": "RTSP" }, + { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left", "label": "RTSP" }, + { "from": "factory", "to": "agent-1", "fromSide": "bottom", "toSide": "top", "kind": "dashed" }, + { "from": "factory", "to": "agent-2", "fromSide": "left", "toSide": "left", "kind": "dashed" }, + { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" }, + { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left", "label": "Upload" }, + { "from": "vault", "to": "mongodb", "fromSide": "top", "toSide": "left" }, + { "from": "vault", "to": "storage", "fromSide": "right", "toSide": "left" }, + { "from": "vault", "to": "broker", "fromSide": "right", "toSide": "left", "label": "Events" }, + { "from": "broker", "to": "integration", "fromSide": "left", "toSide": "right", "label": "Consume" } + ] +} diff --git a/assets/diagrams/how-it-works.json b/assets/diagrams/how-it-works.json new file mode 100644 index 0000000..76610f4 --- /dev/null +++ b/assets/diagrams/how-it-works.json @@ -0,0 +1,35 @@ +{ + "groups": [ + { "id": "capture", "label": "1. Camera processing - edge / cloud", "x": 0, "y": 20, "w": 540, "h": 520 }, + { "id": "persistence", "label": "2. Persistence - edge / cloud", "x": 620, "y": 20, "w": 300, "h": 520 }, + { "id": "analysis", "label": "3. Analyse - edge / cloud", "x": 1000, "y": 20, "w": 300, "h": 520 } + ], + "nodes": [ + { "id": "camera-1", "kind": "camera", "x": 30, "y": 230, "w": 180, "h": 140, + "header": "CAMERA", "title": "Camera 1", "subtitle": "RTSP stream" }, + { "id": "camera-2", "kind": "camera", "x": 30, "y": 390, "w": 180, "h": 140, + "header": "CAMERA", "title": "Camera 2", "subtitle": "RTSP stream" }, + { "id": "factory", "kind": "factory", "x": 280, "y": 60, "w": 230, "h": 140, + "header": "ORCHESTRATE", "title": "Factory", "subtitle": "Manage on Kubernetes" }, + { "id": "agent-1", "kind": "agent", "x": 280, "y": 230, "w": 230, "h": 140, + "header": "RECORD", "title": "Agent 1", "subtitle": "Process one camera" }, + { "id": "agent-2", "kind": "agent", "x": 280, "y": 390, "w": 230, "h": 140, + "header": "RECORD", "title": "Agent 2", "subtitle": "Process one camera" }, + { "id": "vault", "kind": "vault", "x": 650, "y": 230, "w": 240, "h": 140, + "header": "STORE", "title": "Vault", "subtitle": "Store and integrate" }, + { "id": "storage", "kind": "storage", "x": 650, "y": 390, "w": 240, "h": 140, + "header": "OBJECT STORAGE", "title": "Storage backend", "subtitle": "Cloud / edge" }, + { "id": "hub", "kind": "hub", "x": 1030, "y": 230, "w": 240, "h": 140, + "header": "ANALYSE", "title": "Hub", "subtitle": "Monitor and analyse" } + ], + "connections": [ + { "from": "camera-1", "to": "agent-1", "fromSide": "right", "toSide": "left" }, + { "from": "camera-2", "to": "agent-2", "fromSide": "right", "toSide": "left" }, + { "from": "factory", "to": "agent-1", "fromSide": "bottom", "toSide": "top", "kind": "dashed" }, + { "from": "factory", "to": "agent-2", "fromSide": "right", "toSide": "right", "kind": "dashed" }, + { "from": "agent-1", "to": "vault", "fromSide": "right", "toSide": "left" }, + { "from": "agent-2", "to": "vault", "fromSide": "right", "toSide": "left" }, + { "from": "vault", "to": "storage", "fromSide": "bottom", "toSide": "top" }, + { "from": "vault", "to": "hub", "fromSide": "right", "toSide": "left", "label": "Events" } + ] +} diff --git a/assets/images/deployment-managed.svg b/assets/images/deployment-managed.svg index 2ac75ea..22c383b 100644 --- a/assets/images/deployment-managed.svg +++ b/assets/images/deployment-managed.svg @@ -1,3883 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +PRIVATE EDGE SITES - OUTBOUND UPLOADSCLOUD - MANAGED KUBERNETES AND BACKING SERVICESHTTPS UPLOADRECORDINGSEVENTSPROCESSSITE ACamerasPrivate networkSITE BCamerasPrivate networkRECORDAgentsOne per cameraRECORDAgentsOne per cameraSTOREVaultReceive recordingsRECORDINGSObject storageS3 / Azure Blob / GCSEVENTSRabbitMQQueue recording eventsMETADATAMongoDBVault / Hub databasesANALYSEHubPipeline, API and UI diff --git a/assets/images/deployment-self-hosted.svg b/assets/images/deployment-self-hosted.svg index e2dc567..8ff4c12 100644 --- a/assets/images/deployment-self-hosted.svg +++ b/assets/images/deployment-self-hosted.svg @@ -1,2943 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +PRIVATE EDGE NETWORK - DOCKER / KUBERNETESRTSPRTSPUPLOADEVENTSCONSUMECAMERACamera 1RTSP streamCAMERACamera 2RTSP streamOPTIONAL ORCHESTRATIONFactoryManage on KubernetesRECORDAgent 1One camera per containerRECORDAgent 2One camera per containerSTOREVaultCentralise edge recordingsMETADATAMongoDBVault metadataRECORDINGSObject storageMinIO / S3-compatibleOPTIONAL EVENTSRabbitMQRecording eventsOPTIONAL INTEGRATIONCustom applicationFilter, notify or integrate diff --git a/assets/images/how-it-works.svg b/assets/images/how-it-works.svg index 959fffb..c3ee929 100644 --- a/assets/images/how-it-works.svg +++ b/assets/images/how-it-works.svg @@ -1,4363 +1 @@ - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +1. CAMERA PROCESSING - EDGE / CLOUD2. PERSISTENCE - EDGE / CLOUD3. ANALYSE - EDGE / CLOUDEVENTSCAMERACamera 1RTSP streamCAMERACamera 2RTSP streamORCHESTRATEFactoryManage on KubernetesRECORDAgent 1Process one cameraRECORDAgent 2Process one cameraSTOREVaultStore and integrateOBJECT STORAGEStorage backendCloud / edgeANALYSEHubMonitor and analyse diff --git a/base/hub/kerberos-hub-values.yaml b/base/hub/kerberos-hub-values.yaml index a749d4c..f6913bf 100644 --- a/base/hub/kerberos-hub-values.yaml +++ b/base/hub/kerberos-hub-values.yaml @@ -3,7 +3,7 @@ # Declare variables to be passed into your templates. ########################################################################### -# LICENSING information: you will a license to run Kerberos Hub. +# LICENSING information: you will a license to run Hub. # ---- # Get your license from support@kerberos.io #license: "---ENTER-YOUR-LICENSE-HERE---" @@ -11,7 +11,7 @@ license: "L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA" licenseServer: url: "https://license.kerberos.io/verify" - token: "214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM" # do not change otherwise Kerberos Hub will not work. + token: "214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM" # do not change otherwise Hub will not work. # Private Docker Registry: The registry secret is required if you have your Docker images behind a private registry. # By default it will pull from Docker hub (https://hub.docker.com/r/kerberos). #imagePullSecrets: @@ -26,7 +26,7 @@ environment: "production" # Set to 'true' if this is a private deployment. isPrivate: true # If you plan a migration or doing maintenance, you can enable readonly. -# This will stop any write process to mongodb or any processing done in the Kerberos Hub pipeline. +# This will stop any write process to mongodb or any processing done in the Hub pipeline. readOnly: false # Which network ingress you are using in your Kubernetes Cluster # Leaving the ingress empty will disable the ingress. @@ -42,10 +42,10 @@ mongodb: username: "root" password: "yourpassword" # A MQTT broker (vernemq or other like mosquitto) is used to have a bi-directional -# communication between Agents and Kerberos Hub. +# communication between Agents and Hub. # we recommend to use vernemq (as part of this installation), but a stand-alone mosquitto broker is also possible. mqtt: - host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Kerberos Hub) + host: "mqtt.yourdomain.com" # this needs to be a public accessible DNS name (it's used to communicate between Agents and Hub) port: "31443" protocol: "wss" username: "yourusername" @@ -85,8 +85,8 @@ turn: openai: enabled: false apikey: "xxx" -# We have a kerberos vault component installed which contains all the -# recordings. Kerberos vault is queried to retrieve the recordings +# We have a Vault component installed which contains all the +# recordings. Vault is queried to retrieve the recordings # from the appropriate provider. kerberosvault: @@ -124,23 +124,23 @@ email: password: "yourpassword" templates: welcome: "welcome" - welcomeTitle: "Welcome to Kerberos Hub" + welcomeTitle: "Welcome to Hub" activate: "activate" - activateTitle: "Wonderful! Your Kerberos Hub is now active" + activateTitle: "Wonderful! Your Hub is now active" forgot: "forgot" - forgotTitle: "Password reset Kerberos Hub. You forgot your password" + forgotTitle: "Password reset Hub. You forgot your password" share: "share" - shareTitle: "[Action] You received a recording from Kerberos Hub" + shareTitle: "[Action] You received a recording from Hub" caseShare: "share_case" - caseShareTitle: "[Action] A case has been shared with you on Kerberos Hub" + caseShareTitle: "[Action] A case has been shared with you on Hub" detection: "detection" disabled: "disabled" highupload: "highupload" device: "device" - alertTitle: "[Alert] Kerberos Hub detected something an event" + alertTitle: "[Alert] Hub detected something an event" deviceTitle: "[Device] An Agent's status has been changed" # Following are all the different deployments needed to make -# Kerberos hub properly working. +# Hub properly working. kerberoshub: admin: repository: uugai/admin @@ -182,8 +182,8 @@ kerberoshub: #legacyUrl: "api.legacy.yourdomain.com" # MFA issuer name - mfaIssuer: "Kerberos.io" - # Admin API's are made available for automation of Kerberos Hub. + mfaIssuer: "Hub" + # Admin API's are made available for automation of Hub. # To access those API's (e.g. creation of owner users), an API key needs to be provided. apiKey: "Z6GPfDdYj8mxLyy6iUJVf9yBlri9lhsW" ## Certificates @@ -199,20 +199,20 @@ kerberoshub: # secretName: kerberoshub-admin language: "english" fallbackLanguage: "english" - # Legacy (reseller) it is possible to link to AWS S3 and IAM (however Kerberos Vault is now the recommended option). - # This is primarily used for creation of subscriptions, and not needed if you are using mainly Kerberos Vault. + # Legacy (reseller) it is possible to link to AWS S3 and IAM (however Vault is now the recommended option). + # This is primarily used for creation of subscriptions, and not needed if you are using mainly Vault. aws: region: "xxx" bucket: "xxx" accessKey: "xxx" secretKey: "xxx" - stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed. + stripe: # We use stripe for billing, so it's possible to resell Hub if agreed. privateKey: "xxx" slack: # Slack is used in the api, to send logs to a specific Slack channel. enabled: "true" hook: "yourslackhook" # https://hooks.slack.com/services/T08Q2Q9V5/xxKT/JALxxAk26bHtuqTfZ - username: "Kerberos Hub" # The slack username - elasticsearch: # Logs of the kerberos hub will be send to an elastic search cluster. + username: "Hub" # The slack username + elasticsearch: # Logs of the Hub will be send to an elastic search cluster. enabled: "false" protocol: "http" host: "yourelasticsearchinstance.com" @@ -275,7 +275,7 @@ kerberoshub: apikey: "xxx" sentry: # We can trace errors in Sentry url: "https://xxx@sentry.io/xxx" - stripe: # We use stripe for billing, so it's possible to resell Kerberos Hub if agreed. + stripe: # We use stripe for billing, so it's possible to resell Hub if agreed. publicKey: "" googlemaps: # Google maps is used inside the application to visualise cameras and sites. apikey: "xxxx" @@ -288,15 +288,15 @@ kerberoshub: # in a white-label setup, or where you are managing the Agents for your customers. hideAddAgent: "true" # Multi tenancy (domains) - # By default the Kerberos Hub allows multi-tenancy through the concept + # By default the Hub allows multi-tenancy through the concept # of accounts and subaccounts. However through the concept of domains, you # take it a step further. Within a domain, user accounts are unique, and are prefixed by a (domain\). #multiTenant: true #tenantBaseDomain: "yourdomain.com" # this would resolve in following sub domain "https://domain.kerberos.io" # Page title (browser) - title: "Kerberos Hub - Video surveillance as it should be" - # You can style Kerberos hub as you wish. + title: "Hub - Video surveillance as it should be" + # You can style Hub as you wish. # 1. we do the styling on our side and bake it in the Docker image (change the logo attribute to your company name) # 2. you bring your own logo (set logo to 'custom'), and mount the css file and favicons. # we will need to include your logo in the Docker image, so please reach out to us. @@ -312,7 +312,7 @@ kerberoshub: # persistentVolumeClaim: # claimName: custom-layout-claim # By specifying the below environments variables, you can tweak the - # headings and paragraphs of Kerberos Hub front-end. + # headings and paragraphs of Hub front-end. # Login page loginDescription: "" loginCopyright: "" @@ -535,7 +535,7 @@ kerberospipeline: width: "600" height: "-1" kerberosvault: - enabled: true # If you want to use Kerberos Vault to store the thumbnails + enabled: true # If you want to use Vault to store the thumbnails resources: requests: memory: 50Mi diff --git a/base/vault/README.md b/base/vault/README.md index 3080241..21deae6 100644 --- a/base/vault/README.md +++ b/base/vault/README.md @@ -3,7 +3,7 @@ # Vault base manifests This directory holds the raw Kubernetes manifests for **Vault**. Vault receives -recordings from Kerberos Agents, stores recording metadata in MongoDB, and sends +recordings from Agents, stores recording metadata in MongoDB, and sends recording bytes to storage providers configured through the Vault UI. > **Scope of this README.** At the top level of this repository Vault is normally @@ -28,6 +28,85 @@ recording bytes to storage providers configured through the Vault UI. The matching `kerberos-vault` namespace is defined in [`../namespaces/kerberos-vault.yaml`](../namespaces/kerberos-vault.yaml). +## Hardened Vault image + +Both deployment variants use the hardened Vault image +`ghcr.io/uug-ai/vault:v1.7.19`. The Vault container runs as non-root UID/GID +`65532`, drops Linux capabilities, disables privilege escalation, uses the +`RuntimeDefault` seccomp profile, and has a read-only root filesystem. + +The image listens on container port `8080`. The Service keeps its existing +port `80` and NodePort `30080`, forwarding to the named `http` container port. +Startup, readiness, and liveness probes use `/api/health`. + +The image uses `/run/vault` for temporary upload/finalization files. Each +Deployment mounts a writable, disk-backed `emptyDir` there, limited to `1Gi`; +the pod `fsGroup` grants the non-root Vault process access. Size this scratch +limit for expected concurrent uploads and available node ephemeral storage. + +### Size the writable scratch volume + +There is no one-size-fits-all volume size: estimate how many full recordings +Vault may be writing to scratch at the same time, and the maximum size of each. + +- A regular HTTP upload is spooled to a temporary file. The default + `VAULT_MAX_PUBLISH_FILE_BYTES` limit is **1 GiB per upload**. If you change + this limit, use the new value in your sizing estimate. +- Resumable tus chunks are stored in the configured object-storage provider, + not in this volume. When an upload is finalized, Vault downloads the completed + recording to a temporary file, so count concurrent **tus finalizations** and + their maximum recording sizes. +- Set `TUS_MAX_SIZE_BYTES` to a positive byte limit to cap tus upload size. It is + unlimited when unset. For example, `1073741824` limits each tus upload to 1 + GiB. Keep this cap within the scratch capacity you have planned. + +Use this conservative estimate, then round up to a convenient GiB value: + +```text +scratch size >= 1.5 x ( + concurrent HTTP uploads x maximum HTTP upload size + + concurrent tus finalizations x maximum tus upload size +) +``` + +The `1.5` multiplier allows roughly 50% headroom. For example, allowing two +simultaneous 1 GiB HTTP uploads and two simultaneous 1 GiB tus finalizations +uses up to 4 GiB for those temporary files; choose a scratch limit of at least +**6 GiB**. If you only expect two full-file operations at once in total, a +**3 GiB** limit is a reasonable starting point. Increase it for larger files or +more concurrent operations. + +To apply the 6 GiB example, set the tus cap and scratch limit in the Vault +container and pod template of the Deployment you use. Make the same changes to +the Secret-backed Deployment if you use that variant: + +```yaml +spec: + template: + spec: + containers: + - name: vault + env: + - name: TUS_MAX_SIZE_BYTES + value: "1073741824" + volumeMounts: + - name: vault-tmp + mountPath: /run/vault + volumes: + - name: vault-tmp + emptyDir: + sizeLimit: 6Gi +``` + +Keep the existing `GIN_MODE` and other environment variables and the +`vault-tmp` mount; merge these entries rather than replacing them. The disk-backed +`emptyDir` is charged to node ephemeral storage: its `sizeLimit` is a ceiling, +not a reservation. Make sure the node and your pod's ephemeral-storage +requests/limits can accommodate scratch use as well as container logs and other +temporary files. If the limit is exhausted, uploads or finalizations can fail. +Apply the updated Deployment and check that the Vault pod becomes Ready before +relying on the new limits. + ## Prerequisites - A running Kubernetes cluster and `kubectl` configured to reach it. diff --git a/base/vault/kerberos-vault-deployment-with-secrets.yaml b/base/vault/kerberos-vault-deployment-with-secrets.yaml index 36d8e0d..b64d18d 100644 --- a/base/vault/kerberos-vault-deployment-with-secrets.yaml +++ b/base/vault/kerberos-vault-deployment-with-secrets.yaml @@ -18,13 +18,32 @@ spec: labels: app: vault spec: + securityContext: + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault initContainers: - name: wait-for-mongodb-before-starup image: busybox + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] command: ["sh", "-c", "until nc -z mongodb.mongodb 27017 > /dev/null; do echo Waiting for master.; sleep 2; done;"] containers: - name: vault - image: ghcr.io/uug-ai/vault:v1.4.9 + image: ghcr.io/uug-ai/vault:v1.7.19 + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] resources: requests: memory: 128Mi @@ -33,7 +52,33 @@ spec: memory: 128Mi cpu: 100m ports: - - containerPort: 80 + - name: http + containerPort: 8080 + protocol: TCP + startupProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + readinessProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + livenessProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 30 + timeoutSeconds: 3 + failureThreshold: 3 + volumeMounts: + - name: vault-tmp + mountPath: /run/vault envFrom: - configMapRef: name: mongodb @@ -45,3 +90,7 @@ spec: env: - name: GIN_MODE value: release + volumes: + - name: vault-tmp + emptyDir: + sizeLimit: 1Gi diff --git a/base/vault/kerberos-vault-deployment.yaml b/base/vault/kerberos-vault-deployment.yaml index deb8b7a..b6ca5e9 100644 --- a/base/vault/kerberos-vault-deployment.yaml +++ b/base/vault/kerberos-vault-deployment.yaml @@ -18,13 +18,32 @@ spec: labels: app: vault spec: + securityContext: + fsGroup: 65532 + seccompProfile: + type: RuntimeDefault initContainers: - name: wait-for-mongodb-before-starup image: busybox + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] command: ["sh", "-c", "until nc -z mongodb.mongodb 27017 > /dev/null; do echo Waiting for master.; sleep 2; done;"] containers: - name: vault image: ghcr.io/uug-ai/vault:v1.7.19 + securityContext: + runAsNonRoot: true + runAsUser: 65532 + runAsGroup: 65532 + readOnlyRootFilesystem: true + allowPrivilegeEscalation: false + capabilities: + drop: ["ALL"] resources: requests: memory: 128Mi @@ -33,7 +52,33 @@ spec: memory: 128Mi cpu: 100m ports: - - containerPort: 80 + - name: http + containerPort: 8080 + protocol: TCP + startupProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 30 + readinessProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 10 + timeoutSeconds: 3 + failureThreshold: 3 + livenessProbe: + httpGet: + path: /api/health + port: http + periodSeconds: 30 + timeoutSeconds: 3 + failureThreshold: 3 + volumeMounts: + - name: vault-tmp + mountPath: /run/vault envFrom: - configMapRef: name: mongodb @@ -44,3 +89,7 @@ spec: env: - name: GIN_MODE value: release + volumes: + - name: vault-tmp + emptyDir: + sizeLimit: 1Gi diff --git a/base/vault/kerberos-vault-service.yaml b/base/vault/kerberos-vault-service.yaml index bcf6fad..3ce5d45 100644 --- a/base/vault/kerberos-vault-service.yaml +++ b/base/vault/kerberos-vault-service.yaml @@ -10,7 +10,7 @@ spec: type: NodePort ports: - port: 80 - targetPort: 80 + targetPort: http nodePort: 30080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically name: frontend protocol: TCP @@ -27,7 +27,7 @@ spec: # type: LoadBalancer # ports: # - port: 80 -# targetPort: 80 +# targetPort: http # name: frontend # protocol: TCP # selector: diff --git a/base/volume/favicons/site.webmanifest b/base/volume/favicons/site.webmanifest index 2696d6f..9645138 100644 --- a/base/volume/favicons/site.webmanifest +++ b/base/volume/favicons/site.webmanifest @@ -1,6 +1,6 @@ { - "name": "Kerberos.io", - "short_name": "Kerberos.io", + "name": "Hub", + "short_name": "Hub", "icons": [ { "src": "/favicons/android-chrome-192x192.png?v=1", diff --git a/base/volume/templates/activate.html b/base/volume/templates/activate.html index f1daef5..e73e769 100644 --- a/base/volume/templates/activate.html +++ b/base/volume/templates/activate.html @@ -7,7 +7,7 @@ name="viewport" content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1" /> - +