Merge pull request #46 from uug-ai/docs/learn-product-links

Link all products to Learn documentation

.github/workflows/k3d.yaml

@@ -99,8 +99,9 @@ jobs:
         id: install-hub
         run: |
           helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

.github/workflows/kind.yaml

@@ -102,7 +102,7 @@ jobs:
         run: |
           helm repo add kerberos https://charts.kerberos.io
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

.github/workflows/microk8s.yaml

@@ -90,8 +90,9 @@ jobs:
         id: install-hub
         run: |
           helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

README.md

@@ -10,14 +10,20 @@ The ecosystem offers flexible installation options, supporting deployment in hyb
 
 - [Agent](https://learn.uug.ai/docs/agent/)
 - [Factory](https://learn.uug.ai/docs/factory/)
-- [Vault](https://github.com/kerberos-io/vault)
-- [Hub](https://github.com/kerberos-io/hub)
+- [Vault](https://learn.uug.ai/docs/vault/)
+- [Hub](https://learn.uug.ai/docs/hub/)
 
 ## Continuous deployment
 
-[<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Microk8s/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/microk8s.yaml) [<img src="https://github.com/kerberos-io/deployment/workflows/Deploy%20on%20Kubernetes/badge.svg"/>](https://github.com/kerberos-io/deployment/actions/workflows/kind.yaml)
+[![Deploy on kind](https://github.com/uug-ai/deployment/actions/workflows/kind.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/kind.yaml)
+[![Deploy on k3d](https://github.com/uug-ai/deployment/actions/workflows/k3d.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/k3d.yaml)
+[![Deploy on MicroK8s](https://github.com/uug-ai/deployment/actions/workflows/microk8s.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/microk8s.yaml)
+[![Validate Kustomize, Garage and Factory on kind](https://github.com/uug-ai/deployment/actions/workflows/kustomize.yaml/badge.svg?branch=main)](https://github.com/uug-ai/deployment/actions/workflows/kustomize.yaml)
 
-This repository continuously tests the ecosystem deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider.
+These badges show the latest status of each GitHub Actions workflow on `main`.
+Select a badge to view its runs and platform-specific results. The deployment
+workflows continuously test the ecosystem across kind, k3d, and MicroK8s; the
+Kustomize workflow validates the Kustomize, Garage, and Factory setup.
 
 Kubernetes examples and CI now use **Garage S3** for local object storage.
 See the [Garage setup guide](./base/garage/README.md) for generated credentials,
@@ -32,20 +38,10 @@ example on fork PRs), CI emits a warning and skips delivery without masking
 deployment failures. Configured webhook delivery errors still fail the step.
 Failed deployment jobs collect pod events and bounded logs for diagnosis.
 
-### Hardened Hub frontend
+### Security
 
-The promoted frontend image requires Hub chart **0.170.0 or newer**, which
-provides port `8080`, non-root/read-only runtime settings and a writable `/tmp`
-mount. Both primary and demo frontends use these settings; Admin remains on its
-legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied
-fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend
-NodePort remains `32080`, targeting the container port named `http`.
-
-Run `bash scripts/check-hub-runtime.sh` to check the published chart with these
-values before installation, or pass a local chart path as the first argument.
-When adding custom branding mounts, preserve the chart's `frontend-tmp` volume
-and `/tmp` mount. Existing deployments may require the explicit
-[HTTP port migration](https://github.com/kerberos-io/helm-charts/blob/main/charts/hub/README.md#recovering-a-duplicate-http-port-during-upgrades).
+We harden our container images and check our solutions for known CVEs. See the
+[Secure repository](https://github.com/uug-ai/secure) for our security work.
 
 ## Architecture
 

base/hub/kerberos-hub-values.yaml

@@ -155,6 +155,8 @@ kerberoshub:
         memory: 100Mi
         cpu: 100m
   api:
+    # Chart 0.170.1 supplies non-root security contexts and writable /tmp.
+    # Retain hub-api-tmp when overriding the chart's volume/mount lists.
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
     tag: "v1.11.31"

overlays/documentdb/kustomization.yaml

@@ -36,7 +36,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.84.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         license: "L/+FAwEBB2xpY2Vuc2UB/4YAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMw/4YB/gEl/8wQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZf+BAwEBB0xpY2Vuc2UB/4IAAQwBAklkAf+EAAEDS2V5AQwAAQdDb21wYW55AQwAAQdFeHBUaW1lAQQAAQREYXlzAQQAAQdDYW1lcmFzAQQAAQVTaXRlcwEEAAEGVmF1bHRzAQQAAQpNZWRpYUxpbWl0AQQAAQlQZXJwZXR1YWwBAgABBkFjdGl2ZQECAAEJSXBBZGRyZXNzAQwAAAAY/4MBAQEIT2JqZWN0SUQB/4QAAQYBGAAAPf+COgEMAAAAAAAAAAAAAAAAAg9nZW5lcmljLWxpY2Vuc2UB+AJl6LAHsRMYAfoB0alKIAABEAEUARQDAQAB/gIAFlQqo9yJj1a3OH1+5iGjCPcz9VtrRuGfz/iuQEFohbCfSiZGAdHh16gEc59Z2kPaey+eJcwY0BQsBoipW7SwFRmcHkrWLuxt+Yzi2kvwmL4TN0quWqM4xxBzH1sejS6kZpPm7bw11JBsBuaNOYMbl5lgpPCFajWUH6GzfmuQlptNQKosocacI/9PaaqEUUM0ALjDZNSqqFwZPPsFh9WTeaHGbRbmwQRMPFDgaPCxiHnCCUagbvuVZeOQbKaR5gPTUfPQY/L4mrN9QnMxdzwUJgqm7FbTH4UhoZn6EEzNGTN6DbHhpx8lezzCRW8dzMNuK8R1igiORV5gdWOPzBMZlTgodIZRD07e8iAo2XqT/BWcqaJXutdqXltaiJKshh2QzStdv2WZUynVTguYIQJyBNhrXEkewKZA0UftcSemDPkCmp6VovMMveV4X3Cpzkm7ZHtE7j39At/kpuqY/icTEzRWYuQqEDtqXMVar84VOpgVhxeNrrqZniLq8o3ezRdwy0BJG5xT9cuMxq13ZB3Am9iqTSjx2mh5VZZeB33GjLVAtLscj8NoKWy7BThchXB9xwoiy2RLO8nE+EI8wPbg+ajb2Ta7AFyxHgJJU6cea+zEpiBMARwjPKqk2nn02xdfdqMzQ+E9e115sIqhotBM5RI7uBIf8DDwT93HLsJZRBAA"

overlays/microk8s/kustomization.yaml

@@ -26,7 +26,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.170.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         mqtt:

overlays/standalone/kustomization.yaml

@@ -8,7 +8,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.170.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         kerberoshub:

scripts/check-hub-runtime.sh

@@ -3,6 +3,8 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 CHART="${1:-kerberos/hub}"
+version=()
+if [[ "$CHART" == kerberos/hub ]]; then version=(--version 0.170.1); fi
 
 assert_contains() {
   if ! grep -Eq -- "$2" <<< "$1"; then
@@ -19,7 +21,7 @@ nodeport="$(awk '
 assert_contains "$nodeport" 'targetPort: http$'
 assert_contains "$nodeport" 'nodePort: 32080'
 
-rendered="$(helm template hub "$CHART" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
+rendered="$(helm template hub "$CHART" "${version[@]}" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
   --set mode=ui --set kerberoshub.frontend.demoEnabled=true)"
 if grep -q 'image: "docker.io/ghcr.io/' <<< "$rendered"; then
   echo "Fully qualified GHCR image was prefixed with docker.io" >&2
@@ -41,4 +43,20 @@ for name in hub-frontend hub-frontend-demo; do
   assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
   echo "OK: $name uses the promoted image and matching hardened runtime"
 done
+api="$(awk '
+  function emit() { if (deployment && matched) printf "%s", block }
+  /^---$/ { emit(); block=""; deployment=0; matched=0 }
+  { block=block $0 "\n" }
+  /^kind: Deployment$/ { deployment=1 }
+  /^  name: hub-api$/ { matched=1 }
+  END { emit() }
+' <<< "$rendered")"
+for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
+  'fsGroup: 65532' 'readOnlyRootFilesystem: true' 'allowPrivilegeEscalation: false' \
+  'type: RuntimeDefault' 'drop:' '- ALL' 'name: hub-api-tmp' \
+  'emptyDir: \{\}' 'mountPath: /tmp'; do
+  assert_contains "$api" "^[[:space:]]*(- )?$setting$"
+done
+assert_contains "$api" 'image: "ghcr.io/uug-ai/hub-api:v1.11.31"$'
+echo "OK: hub-api uses the promoted image, hardened security and writable scratch"
 echo "Deployment Hub runtime preflight passed."