Default to the signed, hardened releases of admin, hub-audit and the
dominantcolors, event, export, notification, notification-test, sprite and
thumbnail pipelines; run hub-reactivatesubscriptions from
ghcr.io/uug-ai (v1.0.3). Their policies now follow the configured
validationFailureAction; only hub-objecttracking (unsigned -gpu image)
and trusted-registry stay in Audit.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Only ghcr.io/uug-ai images are trusted, so Admin now defaults to the
signed GHCR release with the hardened runtime production already uses
(8080, 65532 non-root, read-only root, memory /tmp, /healthz probes).
A legacy image can be restored with the documented opt-out values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
- admin and hub-reactivatesubscriptions signature/hardening policies
match ghcr.io/uug-ai only (Docker Hub references removed).
- Remove the oauth2-proxy (quay.io) signature policy.
- Add trusted-registry.yaml (category "Image registry", Audit): reports
every container, init and ephemeral container image that is not from
ghcr.io/uug-ai/. It flags the remaining non-GHCR images the chart can
deploy: uugai/admin and uugai/hub-reactivatesubscriptions (Docker Hub)
and quay.io/oauth2-proxy/oauth2-proxy.
- README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hub-reactivate-subscription is still needed: restore its template,
kerberoshub.reactivate values, README rows and its Kyverno signature and
hardening policies (Audit until the chart uses the signed
ghcr.io/uug-ai/hub-reactivatesubscriptions image). Only hub-proxy and
vault-forwarder are removed. The reactivate output is unchanged from main.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
These services are no longer used. Remove their templates
(kerberos-vault/vault-proxy.yaml, kerberos-vault/vault-forwarder.yaml,
kerberos-hub/hub-reactivate-subscription.yaml), their values
(kerberoshub.proxy, kerberoshub.forwarder, kerberoshub.reactivate), their
README sections, and the Kyverno policies added for them in this change.
Installs that still set these values keep rendering; the keys are ignored.
Upgrading removes the hub-reactivate-subscription Deployment (and the
vault-proxy / vault-forwarder ones where enabled).
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
A scan of every container and init container the chart can render (all
modes and optional components) found 26 images; 21 had a signature
policy and 11 a hardening policy. Add the missing ones so Policy
Reporter shows every gap instead of "no policy":
- Hardening policies for the 10 ghcr.io/uug-ai images without a hardened
release yet (audit, objecttracking, vlm, dominantcolors, event, export,
notification, notification-test, sprite, thumbnail).
- Signature and hardening policies for the Docker Hub images uugai/admin,
uugai/hub-proxy, uugai/hub-reactivatesubscriptions (also matching their
ghcr.io/uug-ai releases) and the legacy kerberos/vault-forwarder.
- A visibility-only signature policy for the third-party oauth2-proxy.
All new policies stay in Audit regardless of the configured mode, so
they report gaps without ever blocking. README tables updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hub-frontend v1.19.35 is a hardened release with the signed
image-hardening attestation (v1.19.34 was hardened before attestations
existed). With it, every chart default with a hardening policy is an
attested hardened release. Frontend runtime check and README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
check-frontend-runtime.sh asserted the old default hub-frontend tag
(v1.19.28); README parameter table defaults were stale.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Update every ghcr.io/uug-ai default image tag to the release running in
production: all signed by the UUG.AI release workflow for their own
repository, and hardened releases with the image-hardening attestation
for every image that has a hardening policy except hub-frontend. Older
defaults (e.g. hub-api v1.11.31, hub-workflows v1.0.0) were unsigned and
failed the chart's own Kyverno policies. Commented examples (loitering,
objecttracking, vlm) updated too.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
All 32 image policies used the category "Supply chain", so Policy
Reporter and its dashboards could not tell signing from hardening
results. Signature policies (*-signed-images) now use "Image signing"
and hardening policies (*-hardened-images) "Image hardening". No change
to what the policies check.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
hub-audit, hub-vlm and the dominantcolors, event, export, notification,
notification-test, sprite and thumbnail pipelines now sign every release
(signed from the releases noted in the README). Their signature
policies drop the forced Audit and follow
imageVerification.validationFailureAction like the others.
hub-objecttracking stays in Audit: its releases are signed from v1.0.10,
but its GPU image (<tag>-gpu) is not, and the policy matches every tag.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One namespaced Policy per image whose repository makes hardened
releases (11), requiring the signed image-hardening attestation
(https://github.com/uug-ai/workflows/attestations/image-hardening/v1)
from the UUG.AI release workflow for the image's own repository, with
predicate result "passed" and repository "uug-ai/<image>".
New opt-in imageHardening.enabled / validationFailureAction, separate
from imageVerification, since only recent hardened releases carry the
attestation. Schema and README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
One namespaced Policy per ghcr.io/uug-ai image the chart can deploy (21),
each requiring a keyless cosign signature from the UUG.AI release
workflow for the image's own uug-ai/<image> repository.
The 11 images whose releases are signed follow
imageVerification.validationFailureAction. The 10 whose releases are not
signed yet (their release workflows lack sign/id-token) always stay in
Audit, so Enforce never blocks them; each file says how to switch it.
Docker Hub images (uugai/*) and third-party oauth2-proxy are not covered.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
imageVerification.enabled now defaults to false: the Kyverno
image-verification policies are created only when enabled and Kyverno
is installed. README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
imageVerification.validationFailureAction (Audit by default, or Enforce)
sets the mode of the Kyverno image-verification policies. The schema
accepts only Audit or Enforce. README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Drop validationFailureAction (Audit), background and required, which
equal Kyverno's defaults. Keep only failurePolicy: Ignore,
webhookTimeoutSeconds: 30 and mutateDigest/verifyDigest: false, whose
defaults would change behaviour, each with a comment saying why.
Verified on bijlokehof that the effective policy is unchanged.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
The Kyverno policy files are static: Audit, failurePolicy Ignore and no
digest mutation are written in the template. Templating remains only for
the guard (imageVerification.enabled and Kyverno installed). Moving to
Enforce becomes a change in the policy files, shipped in a chart
release. Per-policy values, schema and README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Make templates/kyverno/hub-api-signed-images.yaml a plain namespaced
kyverno.io/v1 Policy: it applies only to the release namespace, so it
needs no per-release name or namespace match, and the image, signer,
repository and Rekor settings are written out in the file. Templating is
left only for the Kyverno/enabled guard and the per-policy
validationFailureAction, failurePolicy and mutateDigest. Remove
templates/kyverno/_helpers.tpl and the global signer values.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Move the image-verification policy to templates/kyverno/, one
ClusterPolicy per file (hub-api-signed-images.yaml), with the shared
parts (Kyverno check, names, labels, policy-wide settings and the UUG.AI
signer) in templates/kyverno/_helpers.tpl.
imageVerification.images becomes imageVerification.policies.<name>,
each with its own enabled switch and optional validationFailureAction,
failurePolicy and mutateDigest overrides. Schema and README updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
When Kyverno is installed (kyverno.io/v1 served), create a ClusterPolicy
per release, scoped to the release namespace, that verifies keyless
cosign signatures of UUG.AI images: issued by GitHub Actions, made by the
uug-ai/workflows release workflow, and for the image's own repository
(githubWorkflowRepository). Without Kyverno nothing is rendered.
Enabled by default in Audit mode with failurePolicy Ignore and no digest
mutation; Enforce, Fail and mutateDigest are opt-in. hub-api is the only
listed image until other releases are signed. Values schema and README
updated.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add kerberospipeline.analysis.thumbnailRegeneration.minSeconds (default
3), passed to pipe-analysis as THUMBNAIL_REGENERATION_MIN_SECONDS. Analysis
only regenerates a thumbnail when the classified object first appears at
least this many seconds into the recording; 0 regenerates for every
object. Requires an analysis image that reads the variable.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Expose MCP enabled/origin settings in Hub chart values and API deployment, with schema validation, documentation and rendering checks.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
hub-monitor-device's recording check (a continuously recording camera that
is online but uploads no recordings) sends the new recording email template.
email.templates.recording / recordingTitle set RECORDING_TEMPLATE and
RECORDING_TITLE on the monitor when given; empty keeps the monitor defaults,
so SendGrid and Mailgun keep their device template id. The README documents
the email and its placeholders, and custom-layout/templates gets
recording.html / recording.txt.
custom-layout/templates/device.txt was a copy of the welcome email; it now
describes the device change like device.html.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Destinations take credentials only as inline values: s3.accessKey /
s3.secretKey, bearerToken and secretHeaders.<name>.value. credentialsSecret,
bearerTokenSecret and secretHeaders secretName/secretKey are removed from the
values and README and fail the render with the inline field to use.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- README documents every destination field in its own row: required or
optional, default and limits. Adds kerberoshub.audit.resources and
topologySpreadConstraints.
- values.yaml examples mark each field required/optional with its default;
kerberoshub.audit.resources is a real key next to replicas.
- A destination without `enabled` is now enabled (it rendered null, which
hub-audit reads as false). `enabled: false` still pauses it.
- Empty or one-sided s3.accessKey/s3.secretKey fail the render instead of
falling back to the pod's AWS identity, like an empty bearerToken.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Adds kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled
(default "false"), setting FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED on the
frontend and the demo frontend.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Describe inline audit destination credentials on their own terms in the
values comments and the README.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Audit destinations now take credentials as plain values, like the other
Hub services: s3.accessKey / s3.secretKey on S3 destinations, bearerToken
and secretHeaders.<name>.value on webhooks. The chart stores them in a
Secret hub-audit-<id>-credentials and mounts it where hub-audit already
reads credential files, so no hub-audit change is needed and changed
values are picked up without a restart.
A shared hub.audit.destinations helper resolves inline values for the
ConfigMap, the Deployment volumes and the Secret template. Referencing an
existing Secret and credentialsSecret.create keep working and render
unchanged.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
credentialsSecret.create: true makes the chart render the Secret from
credentialsSecret.accessKeyId / secretAccessKey, so the audit S3 keys can
live in values like the chart's other credentials. The default stays
"bring your own Secret".
Inline keys without create: true now fail instead of being ignored, two
destinations creating the same Secret fail, and the docs spell out that
accessKeyIdKey / secretAccessKeyKey name keys inside the Secret.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
Coordinate frontend v1.19.28, port 8080, non-root/read-only security defaults and writable scratch for primary and demo. Preserve Service port 80, Admin legacy defaults, and explicit legacy rollback settings. Validate real image startup, health and generated configuration in Kind.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Add guarded, dry-run-first HTTP port migration and rollback recovery for Admin and both frontends. Preserve unrelated ports and containers; validate strategic-merge duplicates and repaired specifications against Kubernetes in CI.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* feat(hub): configure the audit export limit (0.169.0)
kerberoshub.api.auditExportMaxEvents sets AUDIT_EXPORT_MAX_EVENTS on the
Hub API only: the most audit events one export file holds. Empty keeps
the API default of 100000; the schema accepts 1 to 1000000.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
* feat(hub): name the audit export setting per file
kerberoshub.api.auditExportMaxEventsPerFile sets
AUDIT_EXPORT_MAX_EVENTS_PER_FILE: it sizes each export file and does not
refuse larger exports, which the Audit page splits into parts.
Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---------
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The default kerberoshub.audit.tag was v1.0.1, which predates S3
destinations, so following the chart docs without overriding the tag
gave a rejected config. Defaults to v1.0.10 (S3 + allowUnlockedBucket).
The values example drops PR references for versions, adds maxAttempts,
names Ceph RGW/MinIO/Garage for path-style, notes that pod identity is
AWS-only, and links the per-provider settings on learn.uug.ai.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
- custom-layout device_group.html: use the status-neutral sentence the
built-in template got in hub-pipeline-notification#150.
- values.yaml / README: the grouping hold is 20 s
(DEVICE_GROUPING_HOLD_SECONDS, monitor v1.4.10), no longer one scan.
- README: device {{text}} per change and the new grouped sections
(monitor v1.4.9).
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
The audit ConfigMap copies an allowlist of s3 fields, so the new
hub-audit allowUnlockedBucket option (uug-ai/hub-audit#16) was dropped.
Chart 0.168.2.
Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>
