kerberos-io/deployment
1
0
Fork 0
mirror of https://github.com/kerberos-io/deployment.git synced 2026-11-08 20:40:26 +00:00
Code Issues Packages Projects Releases Wiki Activity
422 Commits 17 Branches 7 Tags
711ace1f15caa2d9586ba6b542c9de1a862b23ff
Commit Graph
9 Commits
Author SHA1 Message Date
Cédric Verstraeten 4d5d7e3c18 Merge pull request #42 from uug-ai/chore/hub-chart-0.170.1 
Upgrade Hub chart to 0.170.1 with hardened API defaults
 2026-11-04 18:42:49 +01:00
Cédric VerstraetenandCopilot 913706fe3f Deploy verified hardened Factory v2.0.13 with coordinated runtime settings 
Pin the signed multiarchitecture digest, route unchanged external ports to HTTP 8080, enforce restricted security context and mount writable config/tmp volumes. Exercise a legacy upgrade and ConfigMap-backed settings after pod replacement on kind.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 17:16:29 +00:00
Cédric VerstraetenandCopilot 674875a754 docs: refresh deployment diagrams and harden Vault 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 15:44:28 +00:00
Cédric VerstraetenandCopilot 718fdbe302 Pin Hub chart 0.170.1 and verify hardened API runtime 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 14:53:34 +00:00
Cédric VerstraetenandCopilot a9a6ce33b5 Use AWS CLI for portable Garage S3 verification 
Avoid the broken SigV4 upload behavior of Ubuntu 22.04 curl. Use isolated path-style AWS CLI configuration and explicit checksum compatibility settings.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 10:55:54 +00:00
Cédric VerstraetenandCopilot 9f069cfdaa Sign Garage S3 payload hashes explicitly on older curl 
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 10:53:24 +00:00
Cédric VerstraetenandCopilot 8619bb1965 Use Garage environment secrets and document S3 setup 
Avoid Garage's root-owned secret-file permission incompatibility with non-root Kubernetes mounts. Validate generated secret formats and document fresh installation, Vault provider configuration and preservation of existing MinIO data.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 10:51:01 +00:00
Cédric VerstraetenandCopilot 7bccddb995 Use persistent Garage S3 in local deployments and CI 
Replace default MinIO operator installation with pinned non-root Garage, generated persistent credentials and authenticated S3 tests. Keep MinIO manifests intact for existing installations, add failure diagnostics and optional Slack handling, and align Kustomize chart pins.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 10:42:52 +00:00
Cédric VerstraetenandCopilot 9c3108b259 Align promoted frontend with hardened Hub chart 0.170.0 (#40) 
Use frontend port 8080 and named NodePort routing, remove the invalid registry prefix on GHCR images, and validate both frontends with the published chart before infrastructure installation. Runtime preflight passes; full-stack CI remains blocked at MinIO before Hub, with separate missing Slack webhook failures.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
 2026-11-04 11:30:18 +01:00