Update the hub API Helm template to set `REFRESH_COOKIE_SECURE` automatically when the API schema is HTTPS, and generate `CORS_ALLOWED_ORIGINS` from configured frontend URLs (legacy URL, domain list, tenant wildcard domain, and demo URL). This keeps cookie behavior and CORS config aligned with deployment settings.
Default replicas for the hub proxy and reactivation subscriptions services are now set to 0, allowing them to be disabled unless explicitly enabled. This updates the chart metadata and docs to reflect the new default behavior.
hub-pipeline-redaction is a private, client-specific worker. Remove its Deployment/Service template and the kerberospipeline.redaction values block (plus the generated README rows) from the public chart. Deployment is now documented in the private hub-pipeline-redaction repo.
Adds the en.json translations for the case Run-workflow dialog
(title/subtitle/labels/empty/submit and the runWorkflow menu item)
and the Redact faces attachment action (k14).
hub-api reads WORKFLOW_DEFINITIONS (the same enabled definition set the
workflows engine consumes, assembled via kerberoshub.workflows.workflowDefinitions)
read-only to surface config workflows alongside DB/user workflows. Previously
only the engine received this env, so hub-api returned an empty config-workflow
list and manual/on-demand config workflows never appeared in GET /workflows.
The generic stage-worker loop in templates/kerberos-pipeline/hub-stage.yaml
closed each iteration with `{{- end }}`, whose left-trim stripped the newline
after the Service's final line (`app: hub-<name>`). With a single enabled stage
worker this was latent, but with two or more the next worker's `---` separator
was glued onto the previous Service's last line (e.g. `app: hub-loitering---`),
merging two resources into one malformed document.
In production this surfaced as ArgoCD "one or more synchronization tasks are not
valid" once objecttracking was enabled alongside anpr and loitering (3 stage
workers -> 2 glued boundaries: anpr->loitering and loitering->objecttracking).
Fix: emit a trailing newline before the next document separator by using
`{{ end -}}` for the per-service if-close. Rendering the hub chart with the
production values now yields 58 valid documents (previously 56, of which 2 were
Service+Deployment glued together) and 0 malformed separators. Bump chart to
0.121.1 so the fix can be published to charts.kerberos.io.
Replace the flat PIPELINE_STAGE_REGISTRY with per-workflow
WORKFLOW_DEFINITIONS, matching hub-workflows' definitions engine:
- _workflows-helpers.tpl: stageRegistry -> workflowDefinitions. Emits a
JSON array of named workflow objects (name, enabled, source=config,
triggers defaulting to a bare automatic trigger, and the executable
stages), one per enabled kerberoshub.workflows.definitions entry. Each
stage's queue is still taken from the matching services.<operation> so
dispatch and consume cannot drift.
- hub-workflows.yaml: set WORKFLOW_DEFINITIONS instead of
PIPELINE_STAGE_REGISTRY.
- hub-stage.yaml: render a worker for every enabled services.<name> other
than the engine itself (decoupled from routing), and pass through any
services.<name>.env as container env for per-worker tuning.
- values.yaml: workflows.stages -> workflows.definitions (map keyed by
workflow name) with an object-tracking + loitering worked example and
updated docs.
Chart 0.120.0 -> 0.121.0. helm lint + template validated.
- Add kerberoshub.frontend.features.liveview.hlsEnabled (default true) and
wire it as FEATURE_HLS_ENABLED on hub-frontend and hub-frontend-demo. When
'false' the front-end removes the HLS live-transport option.
- Replace the bundled anpr example stage/worker with a commented-out
hub-loitering example; the chart now ships no enabled custom stage by
default (stages are values-only, opt-in).
- Update the generic hub-stage comment to the loitering example.
- Make the queue-consistency check self-contained: it synthesises a neutral
throwaway stage ('queuecheck') via --set instead of relying on a bundled
example worker.
NOTE: Chart.yaml version intentionally not bumped — repo version/tag state is
already inconsistent (Chart.yaml 0.117.0 vs tags up to hub-0.119.0); pick the
next version at release time.
