Align promoted frontend values with hardened Hub chart

Remove the invalid Docker Hub prefix on GHCR images, use frontend port 8080 and named NodePort routing, and add a pre-infrastructure runtime preflight for chart 0.170.0+.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/kind.yaml

@@ -27,6 +27,10 @@ jobs:
           kubectl get sc
       - name: Checkout repository
         uses: actions/checkout@v2
+      - name: Check promoted Hub runtime
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          bash scripts/check-hub-runtime.sh
       - name: Install OpenEBS
         run: |
           kubectl apply -f https://openebs.github.io/charts/openebs-operator.yaml

README.md

@@ -17,6 +17,21 @@ The Kerberos.io stack offers flexible installation options, supporting deploymen
 
 This repository continuously tests the Kerberos.io deployment using GitHub Actions across various platforms. Refer to the badges for an overview of the operating systems and Kubernetes distributions we are deploying to. We welcome suggestions for additional automations to consider.
 
+### Hardened Hub frontend
+
+The promoted frontend image requires Hub chart **0.170.0 or newer**, which
+provides port `8080`, non-root/read-only runtime settings and a writable `/tmp`
+mount. Both primary and demo frontends use these settings; Admin remains on its
+legacy image and port `80`. Keep `global.imageRegistry` empty for the supplied
+fully qualified `ghcr.io` image names. Service ports remain `80` and the frontend
+NodePort remains `32080`, targeting the container port named `http`.
+
+Run `bash scripts/check-hub-runtime.sh` to check the published chart with these
+values before installation, or pass a local chart path as the first argument.
+When adding custom branding mounts, preserve the chart's `frontend-tmp` volume
+and `/tmp` mount. Existing deployments may require the explicit
+[HTTP port migration](https://github.com/kerberos-io/helm-charts/blob/main/charts/hub/README.md#recovering-a-duplicate-http-port-during-upgrades).
+
 ## Architecture
 
 As previously indicated, several integral components, including Object Storage, Database, and Message Brokers, are deployed and configured to ensure the proper functionality of Kerberos.io. The architecture diagrams below aims to provide a visual representation of these components and their interactions with one another depending the deployment; self-hosted or managed cloud deployment.

base/hub/kerberos-hub-nodeports.yaml

@@ -9,7 +9,7 @@ spec:
   type: NodePort
   ports:
     - port: 80
-      targetPort: 80
+      targetPort: http
       nodePort: 32080 # You can specify a port in the range 30000-32767 or let Kubernetes assign one automatically
       name: frontend
       protocol: TCP

base/hub/kerberos-hub-values.yaml

@@ -19,7 +19,7 @@ licenseServer:
 
 # When using a private registry, you can specify the registry here.
 global:
-  imageRegistry: "docker.io/"
+  imageRegistry: ""
 # Environment: set to 'production', 'develop', 'demo', 'staging' or 'acceptance'.
 # Set to 'true' if this is a private deployment.
 environment: "production"
@@ -241,6 +241,8 @@ kerberoshub:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
     tag: "v1.19.28"
+    # Requires Hub chart 0.170.0+ for the matching hardened runtime defaults.
+    containerPort: 8080
     replicas: 1
     schema: "http"
     url: "yourdomain.com"

scripts/check-hub-runtime.sh

@@ -0,0 +1,44 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ROOT="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
+CHART="${1:-kerberos/hub}"
+
+assert_contains() {
+  if ! grep -Eq -- "$2" <<< "$1"; then
+    printf 'Missing expected deployment runtime setting: %s\n' "$2" >&2
+    exit 1
+  fi
+}
+
+nodeport="$(awk '
+  /^---/ { selected=0 }
+  /name: hub-frontend-nodeport$/ { selected=1 }
+  selected { print }
+' "$ROOT/base/hub/kerberos-hub-nodeports.yaml")"
+assert_contains "$nodeport" 'targetPort: http$'
+assert_contains "$nodeport" 'nodePort: 32080'
+
+rendered="$(helm template hub "$CHART" --values "$ROOT/base/hub/kerberos-hub-values.yaml" \
+  --set mode=ui --set kerberoshub.frontend.demoEnabled=true)"
+if grep -q 'image: "docker.io/ghcr.io/' <<< "$rendered"; then
+  echo "Fully qualified GHCR image was prefixed with docker.io" >&2
+  exit 1
+fi
+for name in hub-frontend hub-frontend-demo; do
+  deployment="$(awk -v name="$name" '
+    function emit() { if (deployment && matched) printf "%s", block }
+    /^---$/ { emit(); block=""; deployment=0; matched=0 }
+    { block=block $0 "\n" }
+    /^kind: Deployment$/ { deployment=1 }
+    $0 == "  name: " name { matched=1 }
+    END { emit() }
+  ' <<< "$rendered")"
+  for setting in 'containerPort: 8080' 'runAsNonRoot: true' 'runAsUser: 65532' \
+    'readOnlyRootFilesystem: true' 'mountPath: /tmp' 'name: frontend-tmp'; do
+    assert_contains "$deployment" "^[[:space:]]*(- )?$setting$"
+  done
+  assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
+  echo "OK: $name uses the promoted image and matching hardened runtime"
+done
+echo "Deployment Hub runtime preflight passed."