Update the hub API Helm template to set `REFRESH_COOKIE_SECURE` automatically when the API schema is HTTPS, and generate `CORS_ALLOWED_ORIGINS` from configured frontend URLs (legacy URL, domain list, tenant wildcard domain, and demo URL). This keeps cookie behavior and CORS config aligned with deployment settings.
Default replicas for the hub proxy and reactivation subscriptions services are now set to 0, allowing them to be disabled unless explicitly enabled. This updates the chart metadata and docs to reflect the new default behavior.
hub-pipeline-redaction is a private, client-specific worker. Remove its Deployment/Service template and the kerberospipeline.redaction values block (plus the generated README rows) from the public chart. Deployment is now documented in the private hub-pipeline-redaction repo.
Adds the en.json translations for the case Run-workflow dialog
(title/subtitle/labels/empty/submit and the runWorkflow menu item)
and the Redact faces attachment action (k14).
hub-api reads WORKFLOW_DEFINITIONS (the same enabled definition set the
workflows engine consumes, assembled via kerberoshub.workflows.workflowDefinitions)
read-only to surface config workflows alongside DB/user workflows. Previously
only the engine received this env, so hub-api returned an empty config-workflow
list and manual/on-demand config workflows never appeared in GET /workflows.
The generic stage-worker loop in templates/kerberos-pipeline/hub-stage.yaml
closed each iteration with `{{- end }}`, whose left-trim stripped the newline
after the Service's final line (`app: hub-<name>`). With a single enabled stage
worker this was latent, but with two or more the next worker's `---` separator
was glued onto the previous Service's last line (e.g. `app: hub-loitering---`),
merging two resources into one malformed document.
In production this surfaced as ArgoCD "one or more synchronization tasks are not
valid" once objecttracking was enabled alongside anpr and loitering (3 stage
workers -> 2 glued boundaries: anpr->loitering and loitering->objecttracking).
Fix: emit a trailing newline before the next document separator by using
`{{ end -}}` for the per-service if-close. Rendering the hub chart with the
production values now yields 58 valid documents (previously 56, of which 2 were
Service+Deployment glued together) and 0 malformed separators. Bump chart to
0.121.1 so the fix can be published to charts.kerberos.io.
