Align promoted frontend values with hardened Hub chart

Remove the invalid Docker Hub prefix on GHCR images, use frontend port 8080 and named NodePort routing, and add a pre-infrastructure runtime preflight for chart 0.170.0+.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/kind.yaml

@@ -27,6 +27,10 @@ jobs:
           kubectl get sc
       - name: Checkout repository
         uses: actions/checkout@v2
+      - name: Check promoted Hub runtime
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
       - name: Install OpenEBS
         run: |
           kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml

README.md

@@ -17,6 +17,21 @@ The Kerberos.io stack offers flexible installation options, supporting deploymen
 
 This repository continuously tests the Kerberos.io deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider.
 
+### Hardened Hub frontend
+
+The promoted frontend image requires Hub chart **0.170.0 or newer**, which
+provides port `8080`, non-root/read-only runtime settings and a writable `/tmp`
+mount. Both primary and demo frontends use these settings; Admin remains on its
+legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied
+fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend
+NodePort remains `32080`, targeting the container port named `http`.
+
+Run `bash scripts/check-hub-runtime.sh` to check the published chart with these
+values before installation, or pass a local chart path as the first argument.
+When adding custom branding mounts, preserve the chart's `frontend-tmp` volume
+and `/tmp` mount. Existing deployments may require the explicit
+[HTTP port migration](https://github.com/kerberos-io/helm-charts/blob/main/charts/hub/README.md#recovering-a-duplicate-http-port-during-upgrades).
+
 ## Architecture
 
 As previously indicated, several integral components, including Object Storage, Database, and Message Brokers, are deployed and configured to ensure the proper functionality of Kerberos.io. The architecture diagrams below aims to provide a visual representation of these components and their interactions with one another depending the deployment; self-hosted or managed cloud deployment.

base/hub/kerberos-hub-nodeports.yaml

@@ -9,7 +9,7 @@ spec:
   type: NodePort
   ports:
     - port: 80
-      targetPort: 80
+      targetPort: http
       nodePort: 32080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
       name: frontend
       protocol: TCP

base/hub/kerberos-hub-values.yaml

@@ -19,7 +19,7 @@ licenseServer:
 
 # When using a private registry, you can specify the registry here.
 global:
-  imageRegistry: "docker.io/"
+  imageRegistry: ""
 # Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'.
 # Set to 'true' if this is a private deployment.
 environment: "production"
@@ -157,7 +157,7 @@ kerberoshub:
   api:
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
-    tag: "v1.9.48"
+    tag: "v1.11.31"
     replicas: 1
     jwtSecret: "I1JcwzW3A0t_THIS-IS_NOT_A_SECRET_WJK9jnPkipbnVTpf0efMy" # change to a random value, this is for generating JWT tokens.
     schema: "http"
@@ -240,7 +240,9 @@ kerberoshub:
   frontend:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
-    tag: "v1.13.0"
+    tag: "v1.19.28"
+    # Requires Hub chart 0.170.0+ for the matching hardened runtime defaults.
+    containerPort: 8080
     replicas: 1
     schema: "http"
     url: "yourdomain.com"
@@ -355,7 +357,7 @@ kerberoshub:
   cleanup:
     repository: ghcr.io/uug-ai/hub-cleanup
     pullPolicy: IfNotPresent
-    tag: "v1.4.16"
+    tag: "v1.4.26"
     resources:
       requests:
         memory: 50Mi
@@ -363,7 +365,7 @@ kerberoshub:
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent
-    tag: "v1.4.1"
+    tag: "v1.4.10"
     resources:
       requests:
         memory: 50Mi
@@ -415,7 +417,7 @@ kerberospipeline:
   event:
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
-    tag: "v1.3.1"
+    tag: "v1.3.9"
     replicas: 1
     resources:
       requests:
@@ -427,7 +429,7 @@ kerberospipeline:
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
     pullPolicy: IfNotPresent
-    tag: "v1.3.11"
+    tag: "v1.3.29"
     replicas: 1
     resources:
       requests:
@@ -439,7 +441,7 @@ kerberospipeline:
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
     pullPolicy: IfNotPresent
-    tag: "v1.6.23"
+    tag: "v1.7.14"
     replicas: 1
     resources:
       requests:
@@ -449,9 +451,9 @@ kerberospipeline:
         memory: 50Mi
         cpu: 50m
   throttler:
-    repository: uugai/hub-pipeline-throttler
+    repository: ghcr.io/uug-ai/hub-pipeline-throttler
     pullPolicy: IfNotPresent
-    tag: "v1.2.0"
+    tag: "v1.2.10"
     replicas: 1
     resources:
       requests:
@@ -463,7 +465,7 @@ kerberospipeline:
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
     pullPolicy: IfNotPresent
-    tag: "v1.3.17"
+    tag: "v1.3.46"
     replicas: 1
     resources:
       requests:
@@ -481,9 +483,9 @@ kerberospipeline:
         #    persistentVolumeClaim:
         #      claimName: custom-layout-claim
   notifyTest:
-    repository: uugai/hub-pipeline-notification-test
+    repository: ghcr.io/uug-ai/hub-pipeline-notification-test
     pullPolicy: IfNotPresent
-    tag: "v1.2.1"
+    tag: "v1.2.6"
     replicas: 1
     resources:
       requests:
@@ -503,7 +505,7 @@ kerberospipeline:
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
     pullPolicy: IfNotPresent
-    tag: "v1.8.4"
+    tag: "v1.8.29"
     replicas: 1
     resources:
       requests:
@@ -515,7 +517,7 @@ kerberospipeline:
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
     pullPolicy: IfNotPresent
-    tag: "v2.0.3"
+    tag: "v2.0.9"
     replicas: 1
     resources:
       requests:
@@ -527,7 +529,7 @@ kerberospipeline:
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
     pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.22"
     replicas: 1
     quality: "1" # 1 (best) - 31 (worst)
     width: "600"
@@ -542,9 +544,9 @@ kerberospipeline:
         memory: 50Mi
         cpu: 50m
   counting:
-    repository: uugai/hub-pipeline-counting
+    repository: ghcr.io/uug-ai/hub-pipeline-counting
     pullPolicy: IfNotPresent
-    tag: "v1.6.3"
+    tag: "v2.0.6"
     replicas: 1
     resources:
       requests:
@@ -554,7 +556,7 @@ kerberospipeline:
     enabled: true # Enable or disable the sprite generation 'true' or 'false
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
-    tag: "v1.1.16"
+    tag: "v1.1.27"
     replicas: 1
     interval: "1" # Number of secondes between each thumbnail in the sprite
     width: "240" # Should not be changed for the moment (hard coded in UI)
@@ -569,7 +571,7 @@ kerberospipeline:
   export:
     repository: ghcr.io/uug-ai/hub-pipeline-export
     pullPolicy: IfNotPresent
-    tag: "v1.2.9"
+    tag: "v1.2.20"
     replicas: 1
     resources:
       requests:

base/vault/kerberos-vault-deployment.yaml

@@ -24,7 +24,7 @@ spec:
           command: ["sh", "-c", "until nc -z mongodb.mongodb 27017 > /dev/null; do echo Waiting for master.; sleep 2; done;"]
       containers:
         - name: vault
-          image: ghcr.io/uug-ai/vault:v1.4.9
+          image: ghcr.io/uug-ai/vault:v1.7.19
           resources:
             requests:
               memory: 128Mi
@@ -43,4 +43,4 @@ spec:
                 optional: true
           env:
             - name: GIN_MODE
-              value: release
+              value: release

scripts/check-hub-runtime.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHART="${1:-kerberos/hub}"
+
+assert_contains() {
+  if ! grep -Eq -- "$2" <<< "$1"; then
+    printf 'Missing expected deployment runtime setting: %s\n' "$2" >&2
+    exit 1
+  fi
+}
+
+nodeport="$(awk '
+  /^---/ { selected=0 }
+  /name: hub-frontend-nodeport$/ { selected=1 }
+  selected { print }
+' "$ROOT/base/hub/kerberos-hub-nodeports.yaml")"
+assert_contains "$nodeport" 'targetPort: http$'
+assert_contains "$nodeport" 'nodePort: 32080'
+
+rendered="$(helm template hub "$CHART" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
+  --set mode=ui --set kerberoshub.frontend.demoEnabled=true)"
+if grep -q 'image: "docker.io/ghcr.io/' <<< "$rendered"; then
+  echo "Fully qualified GHCR image was prefixed with docker.io" >&2
+  exit 1
+fi
+for name in hub-frontend hub-frontend-demo; do
+  deployment="$(awk -v name="$name" '
+    function emit() { if (deployment && matched) printf "%s", block }
+    /^---$/ { emit(); block=""; deployment=0; matched=0 }
+    { block=block $0 "\n" }
+    /^kind: Deployment$/ { deployment=1 }
+    $0 == "  name: " name { matched=1 }
+    END { emit() }
+  ' <<< "$rendered")"
+  for setting in 'containerPort: 8080' 'runAsNonRoot: true' 'runAsUser: 65532' \
+    'readOnlyRootFilesystem: true' 'mountPath: /tmp' 'name: frontend-tmp'; do
+    assert_contains "$deployment" "^[[:space:]]*(- )?$setting$"
+  done
+  assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
+  echo "OK: $name uses the promoted image and matching hardened runtime"
+done
+echo "Deployment Hub runtime preflight passed."