Pin Hub chart 0.170.1 and verify hardened API runtime

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/k3d.yaml

@@ -100,8 +100,9 @@ jobs:
         id: install-hub
         run: |
           helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

.github/workflows/kind.yaml

@@ -103,7 +103,7 @@ jobs:
         run: |
           helm repo add kerberos https://charts.kerberos.io
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

.github/workflows/microk8s.yaml

@@ -91,8 +91,9 @@ jobs:
         id: install-hub
         run: |
           helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
           kubectl create namespace kerberos-hub
-          helm install hub kerberos/hub --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
+          helm install hub kerberos/hub --version 0.170.1 --values ./base/hub/kerberos-hub-values.yaml -n kerberos-hub --create-namespace
           sleep 10
           kubectl wait --for=condition=available deployment --all -n kerberos-hub --timeout=300s
           kubectl get pods -A -o wide

README.md

@@ -30,7 +30,16 @@ example on fork PRs), CI emits a warning and skips delivery without masking
 deployment failures. Configured webhook delivery errors still fail the step.
 Failed deployment jobs collect pod events and bounded logs for diagnosis.
 
-### Hardened Hub frontend
+### Hardened Hub API and frontend
+
+The Kubernetes overlays and full deployment workflows pin Hub chart **0.170.1**.
+It supplies Hub API container/pod security contexts for the promoted
+`ghcr.io/uug-ai/hub-api:v1.11.31`: UID/GID `65532`, read-only root filesystem,
+no privilege escalation, dropped capabilities and RuntimeDefault seccomp.
+A disk-backed `hub-api-tmp` emptyDir at `/tmp` provides writable upload scratch
+space with pod `fsGroup: 65532`; it is not persistent storage.
+Retain this volume and mount when adding custom API mounts, because Helm
+replaces lists rather than appending to them.
 
 The promoted frontend image requires Hub chart **0.170.0 or newer**, which
 provides port `8080`, non-root/read-only runtime settings and a writable `/tmp`
@@ -39,7 +48,7 @@ legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied
 fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend
 NodePort remains `32080`, targeting the container port named `http`.
 
-Run `bash scripts/check-hub-runtime.sh` to check the published chart with these
+Run `bash scripts/check-hub-runtime.sh` to check published chart `0.170.1` with these
 values before installation, or pass a local chart path as the first argument.
 When adding custom branding mounts, preserve the chart's `frontend-tmp` volume
 and `/tmp` mount. Existing deployments may require the explicit

base/hub/kerberos-hub-values.yaml

@@ -155,6 +155,8 @@ kerberoshub:
         memory: 100Mi
         cpu: 100m
   api:
+    # Chart 0.170.1 supplies non-root security contexts and writable /tmp.
+    # Retain hub-api-tmp when overriding the chart's volume/mount lists.
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
     tag: "v1.11.31"

overlays/documentdb/kustomization.yaml

@@ -36,7 +36,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.84.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         license: "L/+FAwEBB2xpY2Vuc2UB/4YAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMw/4YB/gEl/8wQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZf+BAwEBB0xpY2Vuc2UB/4IAAQwBAklkAf+EAAEDS2V5AQwAAQdDb21wYW55AQwAAQdFeHBUaW1lAQQAAQREYXlzAQQAAQdDYW1lcmFzAQQAAQVTaXRlcwEEAAEGVmF1bHRzAQQAAQpNZWRpYUxpbWl0AQQAAQlQZXJwZXR1YWwBAgABBkFjdGl2ZQECAAEJSXBBZGRyZXNzAQwAAAAY/4MBAQEIT2JqZWN0SUQB/4QAAQYBGAAAPf+COgEMAAAAAAAAAAAAAAAAAg9nZW5lcmljLWxpY2Vuc2UB+AJl6LAHsRMYAfoB0alKIAABEAEUARQDAQAB/gIAFlQqo9yJj1a3OH1+5iGjCPcz9VtrRuGfz/iuQEFohbCfSiZGAdHh16gEc59Z2kPaey+eJcwY0BQsBoipW7SwFRmcHkrWLuxt+Yzi2kvwmL4TN0quWqM4xxBzH1sejS6kZpPm7bw11JBsBuaNOYMbl5lgpPCFajWUH6GzfmuQlptNQKosocacI/9PaaqEUUM0ALjDZNSqqFwZPPsFh9WTeaHGbRbmwQRMPFDgaPCxiHnCCUagbvuVZeOQbKaR5gPTUfPQY/L4mrN9QnMxdzwUJgqm7FbTH4UhoZn6EEzNGTN6DbHhpx8lezzCRW8dzMNuK8R1igiORV5gdWOPzBMZlTgodIZRD07e8iAo2XqT/BWcqaJXutdqXltaiJKshh2QzStdv2WZUynVTguYIQJyBNhrXEkewKZA0UftcSemDPkCmp6VovMMveV4X3Cpzkm7ZHtE7j39At/kpuqY/icTEzRWYuQqEDtqXMVar84VOpgVhxeNrrqZniLq8o3ezRdwy0BJG5xT9cuMxq13ZB3Am9iqTSjx2mh5VZZeB33GjLVAtLscj8NoKWy7BThchXB9xwoiy2RLO8nE+EI8wPbg+ajb2Ta7AFyxHgJJU6cea+zEpiBMARwjPKqk2nn02xdfdqMzQ+E9e115sIqhotBM5RI7uBIf8DDwT93HLsJZRBAA"

overlays/microk8s/kustomization.yaml

@@ -26,7 +26,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.170.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         mqtt:

overlays/standalone/kustomization.yaml

@@ -8,7 +8,7 @@ helmCharts:
     releaseName: hub
     namespace: kerberos-hub
     repo: https://charts.kerberos.io
-    version: 0.170.0
+    version: 0.170.1
     valuesFile: ../../base/hub/kerberos-hub-values.yaml
     valuesInline:
         kerberoshub:

scripts/check-hub-runtime.sh

@@ -3,6 +3,8 @@ set -euo pipefail
 
 ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 CHART="${1:-kerberos/hub}"
+version=()
+if [[ "$CHART" == kerberos/hub ]]; then version=(--version 0.170.1); fi
 
 assert_contains() {
   if ! grep -Eq -- "$2" <<< "$1"; then
@@ -19,7 +21,7 @@ nodeport="$(awk '
 assert_contains "$nodeport" 'targetPort: http$'
 assert_contains "$nodeport" 'nodePort: 32080'
 
-rendered="$(helm template hub "$CHART" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
+rendered="$(helm template hub "$CHART" "${version[@]}" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
   --set mode=ui --set kerberoshub.frontend.demoEnabled=true)"
 if grep -q 'image: "docker.io/ghcr.io/' <<< "$rendered"; then
   echo "Fully qualified GHCR image was prefixed with docker.io" >&2
@@ -41,4 +43,20 @@ for name in hub-frontend hub-frontend-demo; do
   assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
   echo "OK: $name uses the promoted image and matching hardened runtime"
 done
+api="$(awk '
+  function emit() { if (deployment && matched) printf "%s", block }
+  /^---$/ { emit(); block=""; deployment=0; matched=0 }
+  { block=block $0 "\n" }
+  /^kind: Deployment$/ { deployment=1 }
+  /^  name: hub-api$/ { matched=1 }
+  END { emit() }
+' <<< "$rendered")"
+for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
+  'fsGroup: 65532' 'readOnlyRootFilesystem: true' 'allowPrivilegeEscalation: false' \
+  'type: RuntimeDefault' 'drop:' '- ALL' 'name: hub-api-tmp' \
+  'emptyDir: \{\}' 'mountPath: /tmp'; do
+  assert_contains "$api" "^[[:space:]]*(- )?$setting$"
+done
+assert_contains "$api" 'image: "ghcr.io/uug-ai/hub-api:v1.11.31"$'
+echo "OK: hub-api uses the promoted image, hardened security and writable scratch"
 echo "Deployment Hub runtime preflight passed."