mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-09-20 12:46:59 +00:00
Compare commits
124 Commits
KilianBout
...
feature/dy
| Author | SHA1 | Date | |
|---|---|---|---|
|
ad5d3305f2 | ||
|
|
1538b8cf12 | ||
|
|
30378b94bf | ||
|
|
f6ac0b771c | ||
|
|
065335c0f8 | ||
|
|
456aba7ee5 | ||
|
|
a364873372 | ||
|
|
3e78109e52 | ||
|
|
4a6ea2dc59 | ||
|
|
518ea5732a | ||
|
|
a2b10cde36 | ||
|
|
4ed325fdab | ||
|
|
01f5a7beb3 | ||
|
|
52165fa668 | ||
|
|
93ba2c6045 | ||
|
|
cb7e51e2e3 | ||
|
|
293ae4699c | ||
|
|
142e7d5c54 | ||
|
|
07fd4c345d | ||
|
|
0ed38b82f7 | ||
|
|
2c17f5a579 | ||
|
|
ae3d1d26fb | ||
|
|
dae3d663b4 | ||
|
|
3d5c0ecd3e | ||
|
|
6454e8fa33 | ||
|
|
fbffe917bb | ||
|
|
5c1d233c45 | ||
|
|
f9de70fce4 | ||
|
|
6c50f1d359 | ||
|
|
9badb35126 | ||
|
|
fb26c6b755 | ||
|
|
3719ec0bbe | ||
|
|
c262433aa1 | ||
|
|
f70aedc5d5 | ||
|
|
2d75d84509 | ||
|
|
c5231ca3cf | ||
|
|
776599cd30 | ||
|
|
8629c701a1 | ||
|
|
e3a38a007d | ||
|
|
f097916ceb | ||
|
|
678d4d84ea | ||
|
|
0deaf41420 | ||
|
|
813b008955 | ||
|
|
32b71a82ca | ||
|
|
7bbf4ae78c | ||
|
|
6f34bd4735 | ||
|
|
24918922fd | ||
|
|
0fadcb74d0 | ||
|
|
f834d9b8f5 | ||
|
|
eefe96c679 | ||
|
|
93888e2855 | ||
|
|
759ac8dbf8 | ||
|
|
4aaa70f121 | ||
|
|
ad7ef4ac12 | ||
|
|
5ad56f9730 | ||
|
|
91eb64a2f3 | ||
|
|
55ae6cdd3e | ||
|
|
f492c14336 | ||
|
|
d4a13a4cff | ||
|
|
98cc8d4f2d | ||
|
|
a5125eee69 | ||
|
|
b2ff3e2e20 | ||
|
|
277ddde3b4 | ||
|
|
7878be79d6 | ||
|
|
123bde292e | ||
|
|
e76311872e | ||
|
|
0f2176822a | ||
|
|
8ca4c402f8 | ||
|
|
8d9b943100 | ||
|
|
3e10489251 | ||
|
|
a7fd8d394f | ||
|
|
c29647ec62 | ||
|
|
685b92e9cc | ||
|
|
01d1e6866a | ||
|
|
8cf73bcf1d | ||
|
|
57f6ab6f3b | ||
|
|
2ed7829391 | ||
|
|
0c9726f21b | ||
|
|
9ae2e1fc86 | ||
|
|
f3a9886053 | ||
|
|
933fedc080 | ||
|
|
2c7f6a89a3 | ||
|
|
5af0ffab6c | ||
|
|
0a3cf69c80 | ||
|
|
b8499c97e2 | ||
|
|
641dc7510c | ||
|
|
20f4fa24ba | ||
|
|
b793014f89 | ||
|
|
348bab8f2b | ||
|
|
8a71bd2a05 | ||
|
|
611ddec1f1 | ||
|
|
34a285666e | ||
|
|
59cf74ba66 | ||
|
|
020f2d969d | ||
|
|
eeb29e8cac | ||
|
|
1ec2be4cc7 | ||
|
|
b9166ea1ed | ||
|
|
be2290075c | ||
|
|
cb47ad3f12 | ||
|
|
42bd87d16d | ||
|
|
0ed38add2e | ||
|
|
c8c070d51e | ||
|
|
0e21755bb8 | ||
|
|
8781ede494 | ||
|
|
82e3da78dd | ||
|
|
30bbd97b6d | ||
|
|
b78a2246ee | ||
|
|
33b41cee0e | ||
|
|
3a464eeb8e | ||
|
|
d599befeaf | ||
|
|
9ea9016bfa | ||
|
|
895c190e20 | ||
|
|
f4051f7e6a | ||
|
|
807369ef01 | ||
|
|
19cf677a56 | ||
|
|
7b39949e5b | ||
|
|
3752c0396e | ||
|
|
0d55fa5d2f | ||
|
|
2949db0a03 | ||
|
|
662a2c6a67 | ||
|
|
7cf273911e | ||
|
|
20f1de461d | ||
|
|
a237f7b4d6 | ||
|
|
fae8b028ad |
31
.github/workflows/workflows-queue-consistency.yaml
vendored
Normal file
31
.github/workflows/workflows-queue-consistency.yaml
vendored
Normal file
@@ -0,0 +1,31 @@
|
||||
name: Workflows queue consistency
|
||||
|
||||
# Fails the build if the analysis producer, the workflows engine and the stage
|
||||
# workers would render onto different WORKFLOWS_QUEUE names — the silent
|
||||
# producer/consumer queue-name drift that leaves runs piling up with no
|
||||
# consumer. Pure `helm template` render check, no cluster required.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
paths:
|
||||
- 'charts/hub/**'
|
||||
- 'scripts/check-workflows-queue-consistency.sh'
|
||||
- '.github/workflows/workflows-queue-consistency.yaml'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
check:
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
version: v3.16.2
|
||||
|
||||
- name: Check WORKFLOWS_QUEUE consistency
|
||||
run: ./scripts/check-workflows-queue-consistency.sh charts/hub
|
||||
@@ -16,7 +16,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.113.0
|
||||
version: 0.142.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
@@ -31,6 +31,29 @@ Uninstall the Kerberos Hub chart
|
||||
|
||||
helm uninstall hub -n kerberos-hub
|
||||
|
||||
### Sprite Resolution
|
||||
|
||||
`kerberospipeline.sprite.width` and `height` set the pixel dimensions of each
|
||||
sprite tile, not the complete sheet. Preserve a **16:9 aspect ratio**: for
|
||||
example, `240x135` (default), `480x270`, or `640x360`.
|
||||
|
||||
Deploy the dimension-aware Hub frontend, Hub API, analysis worker, sprite worker,
|
||||
notification worker, and export worker before increasing resolution. Release the updated shared Go
|
||||
models and update the Hub API/export worker dependency pins before building those
|
||||
services. Newly generated sprites carry their own tile dimensions; existing
|
||||
sprites without dimensions retain the `240x135` fallback and need no migration.
|
||||
Do not change a global fallback to match the new size. Increasing both dimensions
|
||||
by two produces four times as many pixels, increasing decoded memory and usually
|
||||
storage and bandwidth. Hover previews retain their display size; fullscreen
|
||||
scrubbing uses the higher-resolution tiles.
|
||||
|
||||
```yaml
|
||||
kerberospipeline:
|
||||
sprite:
|
||||
width: "480"
|
||||
height: "270"
|
||||
```
|
||||
|
||||
### Parameters
|
||||
|
||||
Below all configuration options and parameters are listed.
|
||||
@@ -53,6 +76,11 @@ Below all configuration options and parameters are listed.
|
||||
| `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
|
||||
| `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
|
||||
| `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
|
||||
| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
|
||||
| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
|
||||
| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
|
||||
| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
|
||||
| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
|
||||
| `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
|
||||
| `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
|
||||
| `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
|
||||
@@ -197,21 +225,48 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.frontend.caseFilterAssigneesDefault` | Default assignee filter behavior for cases in the frontend. | `"false"` |
|
||||
| `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
|
||||
| `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
|
||||
| `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
|
||||
| `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
|
||||
| `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
|
||||
| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
|
||||
| `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
|
||||
| `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
|
||||
| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
|
||||
| `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
|
||||
| `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
|
||||
| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
|
||||
| `kerberoshub.frontend.features.projects.enabled` | Fallback project group switch used when the organisations umbrella is unset. | `""` |
|
||||
| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
|
||||
| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
|
||||
| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
|
||||
| `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
|
||||
| `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
|
||||
| `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"© <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
|
||||
| `kerberoshub.frontend.features.map.overlayTileUrl` | Optional XYZ overlay URL supporting `{z}`, `{x}`, `{y}`, and `{apiKey}`. Empty disables the overlay. | `""` |
|
||||
| `kerberoshub.frontend.features.map.overlayApiKey` | Optional browser-visible API key substituted for `{apiKey}` in the overlay URL. | `""` |
|
||||
| `kerberoshub.frontend.features.map.overlayAttribution` | Attribution text displayed when the overlay is enabled. | `""` |
|
||||
| `kerberoshub.frontend.features.map.overlayMinZoom` | Minimum zoom level for overlay tiles. | `"0"` |
|
||||
| `kerberoshub.frontend.features.map.overlayMaxZoom` | Maximum zoom level for overlay tiles. | `"19"` |
|
||||
| `kerberoshub.frontend.features.map.overlayOpacity` | Overlay opacity from `0` to `1`. | `"1"` |
|
||||
| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Liveview behavior setting: `defaultStreamMode`. | `"SD"` |
|
||||
| `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
|
||||
| `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
|
||||
| `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
|
||||
| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control and recording-state overlay in live views. | `"true"` |
|
||||
| `kerberoshub.frontend.features.liveview.deviceStatusEnabled` | Show connectivity and recent-motion status in live view tile headers. | `"true"` |
|
||||
| `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
|
||||
| `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
|
||||
| `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
|
||||
| `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
|
||||
| `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
|
||||
| `kerberoshub.frontend.features.chart.colors` | Ordered colors shared by chart series and marker detection overlays. | `["#84569f", "#3ba7ff", "#ff5c8a", "#4ad991", "#ffb84d", "#ff7043"]` |
|
||||
| `kerberoshub.frontend.features.chart.colorChartSelectionFill` | Fill color for chart selection regions. | `"rgba(132, 86, 159, 0.07)"` |
|
||||
| `kerberoshub.frontend.features.chart.colorChartSelectionStroke` | Stroke color for chart selection regions. | `"rgba(132, 86, 159, 0.4)"` |
|
||||
| `kerberoshub.frontend.features.chart.colorChartGridStroke` | Stroke color for chart grid lines. | `"rgba(0, 106, 255, 0.18)"` |
|
||||
| `kerberoshub.frontend.features.devices.hideAgent` | Hide agent controls in the devices section of the frontend. | `"false"` |
|
||||
| `kerberoshub.frontend.features.devices.analyticsEnabled` | Enable or disable the Analytics tab on device detail pages. | `"true"` |
|
||||
| `kerberoshub.frontend.features.devices.developerToolsEnabled` | Enable or disable owner-only live Agent logs and terminal access on device detail pages. | `"true"` |
|
||||
| `kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled` | Enable or disable the fullscreen Sites map on the Dashboard. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.date.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.date`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.sites.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sites`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.groups.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.groups`. | `"true"` |
|
||||
@@ -222,8 +277,11 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled` | Limit marker, category, event, and tag filter options to the selected recordings day. | `"false"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled` | Order marker filter options from configured categories before other markers. | `"false"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories` | Ordered exact, case-sensitive marker category names to prioritize. | `[]` |
|
||||
| `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
|
||||
| `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
|
||||
@@ -240,6 +298,7 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
|
||||
| `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
|
||||
| `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
|
||||
| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
|
||||
| `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
|
||||
| `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
|
||||
| `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
|
||||
@@ -271,8 +330,28 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
|
||||
| `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
|
||||
| `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
|
||||
| `kerberoshub.cleanup.auditEventRetentionDays` | Deployment-wide audit-event retention in days, independent of recording plans, inactive-account cleanup, and the optional global pass. Set to `"0"` or a negative value to keep audit events indefinitely. | `"400"` |
|
||||
| `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
|
||||
| `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
|
||||
| `kerberoshub.audit.enabled` | Deploy the Hub audit service. Its first responsibility is forwarding canonical MongoDB `audit_events` to configured destinations. | `false` |
|
||||
| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
|
||||
| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.audit.tag` | Hub audit service image tag. | `"v1.0.1"` |
|
||||
| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
|
||||
| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
|
||||
| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
|
||||
| `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
|
||||
| `kerberoshub.audit.intake.queue` | Durable RabbitMQ queue used by Hub API producers and the audit consumer. | `"hub-audit-events"` |
|
||||
| `kerberoshub.audit.intake.deadletterQueue` | RabbitMQ queue used by Hub API and the audit consumer for invalid events and exhausted persistence retries. | `"hub-audit-dead-letter"` |
|
||||
| `kerberoshub.audit.intake.maxRetries` | Maximum MongoDB persistence retries before an intake event is dead-lettered. | `10` |
|
||||
| `kerberoshub.audit.intake.prefetchCount` | Maximum unacknowledged intake events per audit replica. | `20` |
|
||||
| `kerberoshub.audit.intake.persistTimeout` | Timeout for one MongoDB persistence attempt. | `"10s"` |
|
||||
| `kerberoshub.audit.destinations` | Webhook destinations. Each entry supports `id`, `enabled`, `url`, delivery limits, filters, public `headers`, `bearerTokenSecret`, and arbitrary `secretHeaders`. Destination IDs retain independent checkpoints. | `[]` |
|
||||
| `kerberoshub.audit.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for audit service metrics. | `true` |
|
||||
| `kerberoshub.audit.serviceMonitor.interval` | Audit service metrics scrape interval. | `"15s"` |
|
||||
| `kerberoshub.audit.volumes` | Additional pod volumes, for example a private webhook CA bundle. | `[]` |
|
||||
| `kerberoshub.audit.volumeMounts` | Additional audit service container volume mounts. | `[]` |
|
||||
| `kerberoshub.audit.extraEnv` | Additional audit service environment variables. | `[]` |
|
||||
| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
|
||||
| `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
|
||||
@@ -283,15 +362,16 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
|
||||
| `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
|
||||
| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
|
||||
| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. | `1` |
|
||||
| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
|
||||
| `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
|
||||
| `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
|
||||
| `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
|
||||
| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
|
||||
| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
|
||||
| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
|
||||
| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
|
||||
| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
|
||||
| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. | `1` |
|
||||
| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
|
||||
| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
|
||||
| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
|
||||
| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
|
||||
@@ -306,6 +386,7 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
|
||||
| `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
|
||||
| `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
|
||||
| `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
|
||||
| `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
|
||||
| `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
|
||||
@@ -326,6 +407,7 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
|
||||
| `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
|
||||
| `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
|
||||
| `kerberospipeline.notify.notificationExpiryMinutes` | Maximum recording age in minutes before notification delivery. Set to `"0"` to disable the freshness cutoff. | `"15"` |
|
||||
| `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
|
||||
| `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
|
||||
| `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
|
||||
@@ -377,8 +459,8 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
|
||||
| `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
|
||||
| `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
|
||||
| `kerberospipeline.sprite.width` | Configuration value for `kerberospipeline.sprite.width`. | `"240"` |
|
||||
| `kerberospipeline.sprite.height` | Configuration value for `kerberospipeline.sprite.height`. | `"135"` |
|
||||
| `kerberospipeline.sprite.width` | Tile width in pixels; preserve width:height = 16:9. | `"240"` |
|
||||
| `kerberospipeline.sprite.height` | Tile height in pixels; preserve width:height = 16:9. | `"135"` |
|
||||
| `kerberospipeline.sprite.resources.requests.memory` | Memory request for `kerberospipeline.sprite`. | `"512Mi"` |
|
||||
| `kerberospipeline.sprite.resources.requests.cpu` | CPU request for `kerberospipeline.sprite`. | `"500m"` |
|
||||
| `kerberospipeline.sprite.resources.limits.memory` | Memory limit for `kerberospipeline.sprite`. | `"2Gi"` |
|
||||
@@ -390,15 +472,6 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
|
||||
| `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
|
||||
| `kerberospipeline.export.resources.requests.cpu` | CPU request for `kerberospipeline.export`. | `"10m"` |
|
||||
| `kerberospipeline.redaction.repository` | Container image repository for `kerberospipeline.redaction`. | `"ghcr.io/uug-ai/hub-pipeline-redaction"` |
|
||||
| `kerberospipeline.redaction.pullPolicy` | Image pull policy for `kerberospipeline.redaction`. | `"IfNotPresent"` |
|
||||
| `kerberospipeline.redaction.tag` | Container image tag/version for `kerberospipeline.redaction`. | `"v1.0.0"` |
|
||||
| `kerberospipeline.redaction.replicas` | Number of replicas for `kerberospipeline.redaction`. | `2` |
|
||||
| `kerberospipeline.redaction.logLevel` | Log verbosity level for `kerberospipeline.redaction`. | `"info"` |
|
||||
| `kerberospipeline.redaction.resources.requests.memory` | Memory request for `kerberospipeline.redaction`. | `"512Mi"` |
|
||||
| `kerberospipeline.redaction.resources.requests.cpu` | CPU request for `kerberospipeline.redaction`. | `"500m"` |
|
||||
| `kerberospipeline.redaction.resources.limits.memory` | Memory limit for `kerberospipeline.redaction`. | `"2Gi"` |
|
||||
| `kerberospipeline.redaction.resources.limits.cpu` | CPU limit for `kerberospipeline.redaction`. | `"1000m"` |
|
||||
| `email.provider` | The email service provider for sending out messages over email , use `'mailgun'` or `'smtp'`. | `"mailgun"` |
|
||||
| `email.from` | The email address that is sending messages in name of, by default `'support@yourdomain.com'`. | `"support@yourdomain.com"` |
|
||||
| `email.displayName` | The display name that is sending messages in name of, by default `'yourdomain.com'` | `"yourdomain.com"` |
|
||||
@@ -467,6 +540,22 @@ As mentioned during the Post installation step, you'll import some `.nosql` file
|
||||
|
||||
Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.
|
||||
|
||||
New deployments should define the shared classification list through
|
||||
`classificationCatalog`. Each entry contains the stable classifier output
|
||||
`key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
|
||||
to alerts and filters. When the mounted catalog is unavailable, compatible Hub
|
||||
API versions fall back to the legacy `settings` document and then the built-in
|
||||
classification list. Set `classificationCatalogEnabled: false` to omit the
|
||||
ConfigMap and make Hub API use that fallback directly.
|
||||
|
||||
```yaml
|
||||
classificationCatalogEnabled: true
|
||||
classificationCatalog:
|
||||
- key: forklift
|
||||
label: Forklift
|
||||
icon: vehicle
|
||||
```
|
||||
|
||||
### Indexing
|
||||
|
||||
Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.
|
||||
@@ -487,6 +576,7 @@ Following indexes should be executed on the MongoDB database (Kerberos) to impro
|
||||
#### Analysis collection
|
||||
|
||||
db.getCollection("analysis").createIndex({start:1})
|
||||
db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
|
||||
db.getCollection("analysis").createIndex({userid:1, key:1})
|
||||
db.getCollection("analysis").createIndex({userid:1, start:1})
|
||||
|
||||
|
||||
2997
charts/hub/custom-layout/i18n/en.json
Normal file
2997
charts/hub/custom-layout/i18n/en.json
Normal file
File diff suppressed because it is too large
Load Diff
418
charts/hub/custom-layout/templates/share_case.html
Normal file
418
charts/hub/custom-layout/templates/share_case.html
Normal file
@@ -0,0 +1,418 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta
|
||||
name="viewport"
|
||||
content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
|
||||
/>
|
||||
<meta name="description" content="Kerberos.io Mailing">
|
||||
<style type="text/css">
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter var';
|
||||
font-weight: 100 900;
|
||||
font-display: swap;
|
||||
font-style: normal;
|
||||
font-named-instance: 'Regular';
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
|
||||
}
|
||||
|
||||
body{
|
||||
background: #E5E5E5;
|
||||
margin-top:0;
|
||||
margin-bottom: 0;
|
||||
margin-right: 0;
|
||||
margin-left: 0;
|
||||
padding-top: 0;
|
||||
padding-left: 0;
|
||||
padding-right: 0;
|
||||
padding-bottom: 0;
|
||||
font-family: 'Inter';
|
||||
}
|
||||
a, a:hover, a:active {
|
||||
color: #262424;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.corner-td{
|
||||
width: 60px;
|
||||
}
|
||||
|
||||
table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
|
||||
.ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
|
||||
.ExternalClass {width: 100%;}
|
||||
@media screen and (max-width:500px){
|
||||
.tab-td{
|
||||
padding-left: 10px!important;
|
||||
}
|
||||
.tab-td a h4{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.corner-td{
|
||||
width: 20px!important;
|
||||
}
|
||||
.company-name-td h3{
|
||||
font-size: 16px!important;
|
||||
}
|
||||
table.header-table{
|
||||
padding-top: 8px!important;
|
||||
padding-right: 0px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 0px!important;
|
||||
}
|
||||
.colored-card-td h4{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.colored-card-td h2{
|
||||
font-size: 20px!important;
|
||||
}
|
||||
.colored-card-td a p{
|
||||
font-size: 12px!important;
|
||||
width: 143px!important;
|
||||
}
|
||||
.colored-card-td{
|
||||
padding-top: 24px!important;
|
||||
padding-right: 24px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 24px!important;
|
||||
}
|
||||
.colorless-card-td{
|
||||
padding-top: 24px!important;
|
||||
padding-right: 24px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 24px!important;
|
||||
}
|
||||
.colorless-card-td h3{
|
||||
font-size: 18px!important;
|
||||
}
|
||||
.colorless-card-td p{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.colorless-card-table{
|
||||
margin-left: 0px!important;
|
||||
margin-right: 0px!important;
|
||||
margin-top: 24px!important;
|
||||
margin-bottom: 24px!important;
|
||||
}
|
||||
.footer-td{
|
||||
display: table-row!important;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width:600px) {
|
||||
.footer-td{
|
||||
display: table-row!important;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width:650px) {
|
||||
.footer-table{
|
||||
margin-left: 0px!important;
|
||||
margin-right: 0px!important;
|
||||
margin-top: 0px!important;
|
||||
margin-bottom: 36px!important;
|
||||
}
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body height="100%" width="100%">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36" src="https://kerberos.io/images/email/kerberos.png"/></td>
|
||||
<td height="36" align="left" class="company-name-td">
|
||||
<h3 width="36" height="36" style=" font-family: Inter;
|
||||
font-size: 20px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #262424;">Kerberos.io</h3>
|
||||
</td>
|
||||
<td height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
|
||||
<a style="text-decoration: none;color: none;" href={{tab1_href}}>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: right;
|
||||
color: #6D6666;">{{tab1_title}}</h4>
|
||||
</a>
|
||||
</td>
|
||||
<td height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right" >
|
||||
<a style="text-decoration: none;color: none;" href={{tab2_href}}>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: right;
|
||||
color: #6D6666;">{{tab2_title}}</h4>
|
||||
</a>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td class="colored-card-td" bgcolor="#57356B" style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
|
||||
<h2 style=" font-family: Inter;
|
||||
font-size: 24px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#FFFFFF;
|
||||
padding-top: 12px;
|
||||
margin-bottom: 0;
|
||||
padding-bottom: 0;
|
||||
padding-left: 0;
|
||||
padding-right: 0;">A case has been shared with you</h2>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#b09fb9;">{{user}} shared a case with you</h4>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
|
||||
<h3 style=" font-family: Inter;
|
||||
font-size: 20px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #262424;
|
||||
width: 280px">Open the shared case</h3>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #6D6666;
|
||||
margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
|
||||
|
||||
|
||||
<a style="text-decoration: none;color: none;" href="{{url}}">
|
||||
<p style="font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#FFFFFF;
|
||||
background-color: #84559F;
|
||||
padding-top: 6px;
|
||||
padding-bottom: 6px;
|
||||
padding-right: 16px;
|
||||
padding-left: 16px;
|
||||
width: 130px;
|
||||
border-radius: 4px;
|
||||
text-align: center;
|
||||
cursor: pointer;">Open case -></p>
|
||||
</a>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<!--[if mso | IE]>
|
||||
<table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
|
||||
<![endif]-->
|
||||
<td height="146" width="190" class="footer-td" style="margin-bottom: 12px;" valign="top" align="left">
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<h4 style=" font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#6D6666;">Get in touch</h4>
|
||||
<a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 16px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">support@kerberos.io</p>
|
||||
</a>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 16px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">9000 Ghent, BE</p>
|
||||
|
||||
<a style="text-decoration: none;color: none;" href="https://kerberos.io/">
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">https://kerberos.io</p>
|
||||
</a>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
<!--[if mso | IE]>
|
||||
<table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
|
||||
<![endif]-->
|
||||
<td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;" valign="top" align="left">
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<h4 style=" font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#6D6666;">About Kerberos</h4>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
|
||||
|
||||
|
||||
<p style="margin-top: 12px;">
|
||||
<a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
|
||||
<img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
|
||||
</a>
|
||||
<a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
|
||||
</a>
|
||||
<a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
|
||||
</a>
|
||||
<a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
|
||||
</a>
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr style="height: 50px">
|
||||
<td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
21
charts/hub/custom-layout/templates/share_case.txt
Normal file
21
charts/hub/custom-layout/templates/share_case.txt
Normal file
@@ -0,0 +1,21 @@
|
||||
Kerberos.io
|
||||
------------
|
||||
|
||||
A case has been shared with you
|
||||
{{user}} shared a case with you
|
||||
|
||||
Open the shared case
|
||||
{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
|
||||
{{url}}
|
||||
|
||||
This link will expire in {{expiry}}.
|
||||
|
||||
Get in touch
|
||||
------------
|
||||
support@kerberos.io
|
||||
9000 Ghent, BE
|
||||
https://kerberos.io
|
||||
|
||||
About Kerberos
|
||||
------------
|
||||
Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
|
||||
425
charts/hub/custom-layout/templates/share_case_otp.html
Normal file
425
charts/hub/custom-layout/templates/share_case_otp.html
Normal file
@@ -0,0 +1,425 @@
|
||||
<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
|
||||
<html xmlns="http://www.w3.org/1999/xhtml">
|
||||
<head>
|
||||
|
||||
<meta http-equiv="X-UA-Compatible" content="IE=edge" />
|
||||
<meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
|
||||
<meta
|
||||
name="viewport"
|
||||
content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
|
||||
/>
|
||||
<meta name="description" content="Kerberos.io Mailing">
|
||||
<style type="text/css">
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter';
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
font-display: swap;
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
|
||||
url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
|
||||
}
|
||||
|
||||
@font-face {
|
||||
font-family: 'Inter var';
|
||||
font-weight: 100 900;
|
||||
font-display: swap;
|
||||
font-style: normal;
|
||||
font-named-instance: 'Regular';
|
||||
src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
|
||||
}
|
||||
|
||||
body{
|
||||
background: #E5E5E5;
|
||||
margin-top:0;
|
||||
margin-bottom: 0;
|
||||
margin-right: 0;
|
||||
margin-left: 0;
|
||||
padding-top: 0;
|
||||
padding-left: 0;
|
||||
padding-right: 0;
|
||||
padding-bottom: 0;
|
||||
font-family: 'Inter';
|
||||
}
|
||||
a, a:hover, a:active {
|
||||
color: #262424;
|
||||
text-decoration: none;
|
||||
}
|
||||
|
||||
.corner-td{
|
||||
width: 60px;
|
||||
}
|
||||
|
||||
table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
|
||||
.ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
|
||||
.ExternalClass {width: 100%;}
|
||||
@media screen and (max-width:500px){
|
||||
.tab-td{
|
||||
padding-left: 10px!important;
|
||||
}
|
||||
.tab-td a h4{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.corner-td{
|
||||
width: 20px!important;
|
||||
}
|
||||
.company-name-td h3{
|
||||
font-size: 16px!important;
|
||||
}
|
||||
table.header-table{
|
||||
padding-top: 8px!important;
|
||||
padding-right: 0px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 0px!important;
|
||||
}
|
||||
.colored-card-td h4{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.colored-card-td h2{
|
||||
font-size: 20px!important;
|
||||
}
|
||||
.colored-card-td a p{
|
||||
font-size: 12px!important;
|
||||
width: 143px!important;
|
||||
}
|
||||
.colored-card-td{
|
||||
padding-top: 24px!important;
|
||||
padding-right: 24px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 24px!important;
|
||||
}
|
||||
.colorless-card-td{
|
||||
padding-top: 24px!important;
|
||||
padding-right: 24px!important;
|
||||
padding-bottom: 24px!important;
|
||||
padding-left: 24px!important;
|
||||
}
|
||||
.colorless-card-td h3{
|
||||
font-size: 18px!important;
|
||||
}
|
||||
.colorless-card-td p{
|
||||
font-size: 14px!important;
|
||||
}
|
||||
.colorless-card-table{
|
||||
margin-left: 0px!important;
|
||||
margin-right: 0px!important;
|
||||
margin-top: 24px!important;
|
||||
margin-bottom: 24px!important;
|
||||
}
|
||||
.footer-td{
|
||||
display: table-row!important;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width:600px) {
|
||||
.footer-td{
|
||||
display: table-row!important;
|
||||
}
|
||||
}
|
||||
@media screen and (max-width:650px) {
|
||||
.footer-table{
|
||||
margin-left: 0px!important;
|
||||
margin-right: 0px!important;
|
||||
margin-top: 0px!important;
|
||||
margin-bottom: 36px!important;
|
||||
}
|
||||
}
|
||||
</style>
|
||||
</head>
|
||||
<body height="100%" width="100%">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36" src="https://kerberos.io/images/email/kerberos.png"/></td>
|
||||
<td height="36" align="left" class="company-name-td">
|
||||
<h3 width="36" height="36" style=" font-family: Inter;
|
||||
font-size: 20px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #262424;">Kerberos.io</h3>
|
||||
</td>
|
||||
<td height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
|
||||
<a style="text-decoration: none;color: none;" href={{tab1_href}}>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: right;
|
||||
color: #6D6666;">{{tab1_title}}</h4>
|
||||
</a>
|
||||
</td>
|
||||
<td height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right" >
|
||||
<a style="text-decoration: none;color: none;" href={{tab2_href}}>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 500;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: right;
|
||||
color: #6D6666;">{{tab2_title}}</h4>
|
||||
</a>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td class="colored-card-td" bgcolor="#57356B" style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
|
||||
<h2 style=" font-family: Inter;
|
||||
font-size: 24px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#FFFFFF;
|
||||
padding-top: 12px;
|
||||
margin-bottom: 0;
|
||||
padding-bottom: 0;
|
||||
padding-left: 0;
|
||||
padding-right: 0;">Verify your access</h2>
|
||||
<h4 style="font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#b09fb9;">Use the code below to open the shared case</h4>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<td class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
|
||||
<h3 style=" font-family: Inter;
|
||||
font-size: 20px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #262424;
|
||||
width: 280px">Your verification code</h3>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #6D6666;
|
||||
margin-top: 12px;">Enter the code below on the share page to access the case.</p>
|
||||
|
||||
<p style="font-family: 'Courier New', Courier, monospace;
|
||||
font-size: 32px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 40px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 8px;
|
||||
text-align: center;
|
||||
color:#262424;
|
||||
background-color: #F2F0F4;
|
||||
padding-top: 16px;
|
||||
padding-bottom: 16px;
|
||||
padding-right: 16px;
|
||||
padding-left: 16px;
|
||||
margin-top: 16px;
|
||||
margin-bottom: 16px;
|
||||
border-radius: 4px;">{{code}}</p>
|
||||
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tr>
|
||||
<td bgcolor="E5E5E5">
|
||||
<table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
|
||||
<tbody>
|
||||
<tr>
|
||||
<td class="corner-td" align="left"></td>
|
||||
<!--[if mso | IE]>
|
||||
<table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
|
||||
<![endif]-->
|
||||
<td height="146" width="190" class="footer-td" style="margin-bottom: 12px;" valign="top" align="left">
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<h4 style=" font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#6D6666;">Get in touch</h4>
|
||||
<a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 16px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">support@kerberos.io</p>
|
||||
</a>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 16px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">9000 Ghent, BE</p>
|
||||
|
||||
<a style="text-decoration: none;color: none;" href="https://kerberos.io/">
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">https://kerberos.io</p>
|
||||
</a>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
<!--[if mso | IE]>
|
||||
<table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
|
||||
<![endif]-->
|
||||
<td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;" valign="top" align="left">
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr>
|
||||
<td>
|
||||
<h4 style=" font-family: Inter;
|
||||
font-size: 16px;
|
||||
font-style: normal;
|
||||
font-weight: 600;
|
||||
line-height: 36px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color:#6D6666;">About Kerberos</h4>
|
||||
<p style=" font-family: Inter;
|
||||
font-size: 14px;
|
||||
font-style: normal;
|
||||
font-weight: 400;
|
||||
line-height: 24px;
|
||||
mso-line-height-rule:exactly;
|
||||
letter-spacing: 0em;
|
||||
text-align: left;
|
||||
color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
|
||||
|
||||
|
||||
<p style="margin-top: 12px;">
|
||||
<a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
|
||||
<img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
|
||||
</a>
|
||||
<a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
|
||||
</a>
|
||||
<a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
|
||||
</a>
|
||||
<a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
|
||||
<img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
|
||||
</a>
|
||||
</p>
|
||||
</td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
<td class="corner-td" align="right"></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
<table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
|
||||
<tbody>
|
||||
<tr style="height: 50px">
|
||||
<td></td>
|
||||
</tr>
|
||||
</tbody>
|
||||
</table>
|
||||
</td>
|
||||
</tr>
|
||||
</table>
|
||||
</body>
|
||||
</html>
|
||||
21
charts/hub/custom-layout/templates/share_case_otp.txt
Normal file
21
charts/hub/custom-layout/templates/share_case_otp.txt
Normal file
@@ -0,0 +1,21 @@
|
||||
Kerberos.io
|
||||
------------
|
||||
|
||||
Verify your access
|
||||
Use the code below to open the shared case
|
||||
|
||||
Your verification code
|
||||
{{code}}
|
||||
|
||||
Enter this code on the share page to access the case. This code expires in {{expiry}}.
|
||||
If you didn't request this, you can safely ignore this email.
|
||||
|
||||
Get in touch
|
||||
------------
|
||||
support@kerberos.io
|
||||
9000 Ghent, BE
|
||||
https://kerberos.io
|
||||
|
||||
About Kerberos
|
||||
------------
|
||||
Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
|
||||
48
charts/hub/templates/_helpers.tpl
Normal file
48
charts/hub/templates/_helpers.tpl
Normal file
@@ -0,0 +1,48 @@
|
||||
{{/* Build the path to the configured MongoDB CA bundle. */}}
|
||||
{{- define "hub.mongodb.tlsCAFile" -}}
|
||||
{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
|
||||
{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
|
||||
{{- define "hub.mongodb.uri" -}}
|
||||
{{- $uri := .Values.mongodb.uri | default "" -}}
|
||||
{{- if and .Values.mongodb.tls.enabled $uri -}}
|
||||
{{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
|
||||
{{- $separator := "?" -}}
|
||||
{{- if contains "?" $uri -}}
|
||||
{{- $separator = "&" -}}
|
||||
{{- end -}}
|
||||
{{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
|
||||
{{- $separator = "" -}}
|
||||
{{- end -}}
|
||||
{{- $uri = printf "%s%stls=true" $uri $separator -}}
|
||||
{{- end -}}
|
||||
{{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
|
||||
{{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
|
||||
{{- $separator := "&" -}}
|
||||
{{- if not (contains "?" $uri) -}}
|
||||
{{- $separator = "?" -}}
|
||||
{{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
|
||||
{{- $separator = "" -}}
|
||||
{{- end -}}
|
||||
{{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $uri -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the shared MongoDB CA Secret volume. */}}
|
||||
{{- define "hub.mongodb.tlsVolume" -}}
|
||||
- name: mongodb-tls
|
||||
secret:
|
||||
secretName: {{ .Values.mongodb.tls.existingSecret }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the shared MongoDB CA volume mount. */}}
|
||||
{{- define "hub.mongodb.tlsVolumeMount" -}}
|
||||
- name: mongodb-tls
|
||||
mountPath: {{ .Values.mongodb.tls.mountPath }}
|
||||
readOnly: true
|
||||
{{- end -}}
|
||||
10
charts/hub/templates/configmap-classification-catalog.yaml
Normal file
10
charts/hub/templates/configmap-classification-catalog.yaml
Normal file
@@ -0,0 +1,10 @@
|
||||
{{- if .Values.classificationCatalogEnabled }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: classification-catalog
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
classifications.json: |-
|
||||
{{- toPrettyJson .Values.classificationCatalog | nindent 4 }}
|
||||
{{- end }}
|
||||
51
charts/hub/templates/configmap-hub-audit.yaml
Normal file
51
charts/hub/templates/configmap-hub-audit.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
{{- if .Values.kerberoshub.audit.enabled -}}
|
||||
{{- $destinations := list -}}
|
||||
{{- $destinationIDs := dict -}}
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
|
||||
{{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
|
||||
{{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $destinationIDs $id -}}
|
||||
{{- fail (printf "duplicate audit destination id %q" $id) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $destinationIDs $id true -}}
|
||||
{{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
|
||||
{{- $entry := dict
|
||||
"id" $id
|
||||
"type" (default "webhook" $destination.type)
|
||||
"enabled" $destination.enabled
|
||||
"url" $url
|
||||
"timeoutSeconds" (default 10 $destination.timeoutSeconds)
|
||||
"batchSize" (default 100 $destination.batchSize)
|
||||
"maxAttempts" (default 10 $destination.maxAttempts)
|
||||
"startAt" (default "latest" $destination.startAt)
|
||||
"headers" (default dict $destination.headers)
|
||||
"filters" (default dict $destination.filters) -}}
|
||||
{{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret -}}
|
||||
{{- if gt (len $bearer) 0 -}}
|
||||
{{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
|
||||
{{- $secretKey := default "token" $bearer.key -}}
|
||||
{{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- $headerFiles := dict -}}
|
||||
{{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
|
||||
{{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
|
||||
{{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
|
||||
{{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $headerFiles) 0 -}}
|
||||
{{- $_ := set $entry "headerFiles" $headerFiles -}}
|
||||
{{- end -}}
|
||||
{{- $destinations = append $destinations $entry -}}
|
||||
{{- end -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
destinations.json: |
|
||||
{{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -4,7 +4,7 @@ metadata:
|
||||
name: mongodb-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
MONGODB_URI: "{{ .Values.mongodb.uri }}"
|
||||
MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
|
||||
MONGODB_HOST: "{{ .Values.mongodb.host }}"
|
||||
MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
|
||||
MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
|
||||
@@ -12,4 +12,7 @@ data:
|
||||
MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
|
||||
MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
|
||||
MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
|
||||
MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
|
||||
MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
|
||||
MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
|
||||
MONGODB_DATABASE_CLOUD: "Kerberos"
|
||||
|
||||
@@ -120,6 +120,9 @@ spec:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
{{- if .Values.classificationCatalogEnabled }}
|
||||
checksum/classification-catalog: {{ include (print $.Template.BasePath "/configmap-classification-catalog.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
labels:
|
||||
app: hub-api
|
||||
spec:
|
||||
@@ -131,8 +134,15 @@ spec:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
|
||||
{{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
|
||||
{{- if or $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: classification-catalog
|
||||
configMap:
|
||||
name: classification-catalog
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -141,6 +151,9 @@ spec:
|
||||
secret:
|
||||
secretName: {{ $serverTLS.secretName }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
@@ -157,8 +170,13 @@ spec:
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
{{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
|
||||
{{- if or $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: classification-catalog
|
||||
mountPath: /etc/kerberos/classifications
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -167,12 +185,19 @@ spec:
|
||||
mountPath: {{ $serverTLS.mountPath }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Mongodb - loaded from ConfigMap
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: CLASSIFICATION_CATALOG_FILE
|
||||
value: /etc/kerberos/classifications/classifications.json
|
||||
{{- end }}
|
||||
- name: ENVIRONMENT
|
||||
value: "{{ .Values.environment }}"
|
||||
- name: READ_ONLY
|
||||
@@ -187,6 +212,23 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
|
||||
- name: PUBLIC_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
|
||||
- name: REFRESH_COOKIE_SECURE
|
||||
value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
|
||||
{{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
|
||||
{{- with .Values.kerberoshub.frontend.legacyUrl }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
|
||||
{{- end }}
|
||||
{{- range .Values.kerberoshub.frontend.domains }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
|
||||
{{- end }}
|
||||
- name: CORS_ALLOWED_ORIGINS
|
||||
value: {{ join "," $corsOrigins | quote }}
|
||||
{{ if .Values.isPrivate }}
|
||||
- name: KERBEROS_PRIVATE_CLOUD
|
||||
value: "true"
|
||||
@@ -259,6 +301,19 @@ spec:
|
||||
- name: QUEUE_NAME
|
||||
value: "{{ .Values.queueName }}"
|
||||
|
||||
# Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
|
||||
# SAME set the workflows engine consumes, assembled from the enabled
|
||||
# definitions under kerberoshub.workflows.definitions (see
|
||||
# kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
|
||||
# read-only to surface config workflows alongside the user workflows
|
||||
# it stores in the database; the config workflows are never persisted.
|
||||
- name: WORKFLOW_DEFINITIONS
|
||||
value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
|
||||
# Deployment service routing catalog used by API-owned embedded
|
||||
# workflows (for example the one-stage case redaction modal flow).
|
||||
- name: WORKFLOW_STAGE_QUEUES
|
||||
value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
|
||||
|
||||
# Stripe for billing
|
||||
- name: STRIPE_KEY
|
||||
value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
|
||||
@@ -319,6 +374,12 @@ spec:
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
{{- if .Values.kerberoshub.audit.enabled }}
|
||||
- name: AUDIT_QUEUE
|
||||
value: {{ .Values.kerberoshub.audit.intake.queue | quote }}
|
||||
- name: AUDIT_DEADLETTER_QUEUE
|
||||
value: {{ .Values.kerberoshub.audit.intake.deadletterQueue | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Slack notifications (this will send events/logs to a specific channel).
|
||||
- name: SLACK_ENABLED
|
||||
@@ -353,6 +414,14 @@ spec:
|
||||
value: "{{ .Values.email.templates.share }}"
|
||||
- name: SHARE_TITLE
|
||||
value: "{{ .Values.email.templates.shareTitle }}"
|
||||
- name: CASE_SHARE_TEMPLATE
|
||||
value: "{{ .Values.email.templates.caseShare }}"
|
||||
- name: CASE_SHARE_TITLE
|
||||
value: "{{ .Values.email.templates.caseShareTitle }}"
|
||||
- name: CASE_SHARE_OTP_TEMPLATE
|
||||
value: "{{ .Values.email.templates.caseShareOtp }}"
|
||||
- name: CASE_SHARE_OTP_TITLE
|
||||
value: "{{ .Values.email.templates.caseShareOtpTitle }}"
|
||||
- name: ASSIGN_TASK_TEMPLATE
|
||||
value: "{{ .Values.email.templates.assignTask }}"
|
||||
- name: ASSIGN_TASK_TITLE
|
||||
@@ -401,13 +470,14 @@ spec:
|
||||
- name: VAULT_SPRITE_INTERVAL
|
||||
value: "{{ .Values.kerberosvault.sprite.interval }}"
|
||||
- name: VAULT_SPRITE_WIDTH
|
||||
value: "{{ .Values.kerberosvault.sprite.width }}"
|
||||
value: "{{ .Values.kerberospipeline.sprite.width }}"
|
||||
- name: VAULT_SPRITE_HEIGHT
|
||||
value: "{{ .Values.kerberosvault.sprite.height }}"
|
||||
value: "{{ .Values.kerberospipeline.sprite.height }}"
|
||||
{{- if .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -415,4 +485,5 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if and .Values.kerberoshub.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: hub-audit-servicemonitor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
service: hub-audit
|
||||
release: prometheus
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
service: hub-audit
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
|
||||
path: /metrics
|
||||
{{- end }}
|
||||
166
charts/hub/templates/kerberos-hub/hub-audit.yaml
Normal file
166
charts/hub/templates/kerberos-hub/hub-audit.yaml
Normal file
@@ -0,0 +1,166 @@
|
||||
{{- if .Values.kerberoshub.audit.enabled -}}
|
||||
{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
|
||||
{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
|
||||
{{- end -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberoshub.audit.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: hub-audit
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
spec:
|
||||
terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.kerberoshub.serviceAccount.create }}
|
||||
serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
volumes:
|
||||
- name: destinations
|
||||
configMap:
|
||||
name: hub-audit
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
projected:
|
||||
sources:
|
||||
{{- if gt (len $bearer) 0 }}
|
||||
- secret:
|
||||
name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
|
||||
items:
|
||||
- key: {{ default "token" $bearer.key | quote }}
|
||||
path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- range $headerName, $secret := $secretHeaders }}
|
||||
- secret:
|
||||
name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
|
||||
items:
|
||||
- key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
|
||||
path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: hub-audit
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
|
||||
{{- with .Values.kerberoshub.audit.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
volumeMounts:
|
||||
- name: destinations
|
||||
mountPath: /etc/hub-audit
|
||||
readOnly: true
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
- name: RABBITMQ_HOST
|
||||
value: {{ .Values.rabbitmq.host | quote }}
|
||||
- name: RABBITMQ_EXCHANGE
|
||||
value: {{ .Values.rabbitmq.exchange | quote }}
|
||||
- name: RABBITMQ_USERNAME
|
||||
value: {{ .Values.rabbitmq.username | quote }}
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: {{ .Values.rabbitmq.password | quote }}
|
||||
- name: AUDIT_QUEUE
|
||||
value: {{ .Values.kerberoshub.audit.intake.queue | quote }}
|
||||
- name: AUDIT_DEADLETTER_QUEUE
|
||||
value: {{ .Values.kerberoshub.audit.intake.deadletterQueue | quote }}
|
||||
- name: AUDIT_MAX_RETRIES
|
||||
value: {{ .Values.kerberoshub.audit.intake.maxRetries | quote }}
|
||||
- name: AUDIT_PREFETCH_COUNT
|
||||
value: {{ .Values.kerberoshub.audit.intake.prefetchCount | quote }}
|
||||
- name: AUDIT_PERSIST_TIMEOUT
|
||||
value: {{ .Values.kerberoshub.audit.intake.persistTimeout | quote }}
|
||||
- name: DISPATCH_INTERVAL
|
||||
value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
|
||||
- name: LEASE_DURATION
|
||||
value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
{{- with .Values.kerberoshub.audit.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
service: hub-audit
|
||||
spec:
|
||||
ports:
|
||||
- name: metrics
|
||||
port: 2112
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: hub-audit
|
||||
{{- end }}
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.cleanup.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.cleanup.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.cleanup.volumeMounts }}
|
||||
{{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.cleanup.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -97,6 +108,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
|
||||
- name: DEFAULT_TASK_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
|
||||
- name: AUDIT_EVENT_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
|
||||
{{- if .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -193,6 +193,10 @@ spec:
|
||||
- name: GOOGLEMAPS_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
|
||||
|
||||
# features > chart
|
||||
- name: CHART_COLORS
|
||||
value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
|
||||
|
||||
# Zendesk for support
|
||||
- name: ZENDESK_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
|
||||
@@ -229,8 +233,34 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_DEVICE_ANALYTICS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
|
||||
- name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
|
||||
- name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
|
||||
- name: FEATURE_PROJECTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
|
||||
- name: FEATURE_PROJECT_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
|
||||
- name: FEATURE_PROJECT_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
|
||||
- name: FEATURE_PROJECT_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
|
||||
- name: FEATURE_DARK_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
|
||||
- name: FEATURE_SPLASH_SCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
|
||||
- name: FEATURE_LANDING_PAGE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
|
||||
|
||||
@@ -241,6 +271,20 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
|
||||
|
||||
# features > liveview
|
||||
- name: FEATURE_LIVE_STREAM_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
|
||||
- name: FEATURE_HLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
|
||||
- name: FEATURE_MOQ_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
|
||||
- name: FEATURE_REMOTE_RECORDING_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
|
||||
- name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
|
||||
- name: MOQ_RELAY_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
|
||||
- name: MOQ_BROADCAST_PREFIX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
|
||||
- name: FEATURE_LIVEVIEW_PAGINATION_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
|
||||
- name: FEATURE_LIVEVIEW_PAGE_SIZE
|
||||
@@ -255,6 +299,26 @@ spec:
|
||||
# features > floorplan
|
||||
- name: FEATURE_FLOORPLAN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
|
||||
# features > map
|
||||
- name: MAP_TILE_URL_LIGHT
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
|
||||
- name: MAP_TILE_URL_DARK
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
|
||||
- name: MAP_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
|
||||
- name: MAP_OVERLAY_TILE_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
|
||||
- name: MAP_OVERLAY_API_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
|
||||
- name: MAP_OVERLAY_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
|
||||
- name: MAP_OVERLAY_MIN_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
|
||||
- name: MAP_OVERLAY_MAX_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
|
||||
- name: MAP_OVERLAY_OPACITY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
|
||||
|
||||
- name: COLOR_TRACK_BOX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
|
||||
- name: COLOR_TRACK_BOX_HOVER
|
||||
@@ -288,7 +352,9 @@ spec:
|
||||
|
||||
# features > face redaction
|
||||
- name: FEATURE_FACE_REDACTION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
- name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
|
||||
|
||||
# features > media
|
||||
- name: FEATURE_MEDIA_FILTER_DATE_ENABLED
|
||||
@@ -307,10 +373,16 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_SORT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
|
||||
- name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
|
||||
value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
|
||||
|
||||
@@ -312,8 +312,34 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_DEVICE_ANALYTICS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
|
||||
- name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
|
||||
- name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
|
||||
- name: FEATURE_PROJECTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
|
||||
- name: FEATURE_PROJECT_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
|
||||
- name: FEATURE_PROJECT_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
|
||||
- name: FEATURE_PROJECT_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
|
||||
- name: FEATURE_DARK_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
|
||||
- name: FEATURE_SPLASH_SCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
|
||||
- name: FEATURE_LANDING_PAGE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
|
||||
|
||||
@@ -326,6 +352,20 @@ spec:
|
||||
# features > liveview
|
||||
- name: FEATURE_DEFAULT_STREAM_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
|
||||
- name: FEATURE_LIVE_STREAM_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
|
||||
- name: FEATURE_HLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
|
||||
- name: FEATURE_MOQ_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
|
||||
- name: FEATURE_REMOTE_RECORDING_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
|
||||
- name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
|
||||
- name: MOQ_RELAY_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
|
||||
- name: MOQ_BROADCAST_PREFIX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
|
||||
- name: FEATURE_LIVEVIEW_PAGINATION_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
|
||||
- name: FEATURE_LIVEVIEW_PAGE_SIZE
|
||||
@@ -348,6 +388,18 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
|
||||
- name: MAP_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
|
||||
- name: MAP_OVERLAY_TILE_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
|
||||
- name: MAP_OVERLAY_API_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
|
||||
- name: MAP_OVERLAY_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
|
||||
- name: MAP_OVERLAY_MIN_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
|
||||
- name: MAP_OVERLAY_MAX_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
|
||||
- name: MAP_OVERLAY_OPACITY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
|
||||
|
||||
- name: COLOR_TRACK_BOX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
|
||||
@@ -377,6 +429,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
|
||||
|
||||
# features > chart
|
||||
- name: CHART_COLORS
|
||||
value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
|
||||
- name: COLOR_CHART_SELECTION_FILL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
|
||||
- name: COLOR_CHART_SELECTION_STROKE
|
||||
@@ -390,7 +444,9 @@ spec:
|
||||
|
||||
# features > face redaction
|
||||
- name: FEATURE_FACE_REDACTION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
- name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
|
||||
|
||||
# features > media
|
||||
- name: FEATURE_MEDIA_FILTER_DATE_ENABLED
|
||||
@@ -409,10 +465,16 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_SORT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_CATEGORY_ENABLED
|
||||
- name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
|
||||
value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
|
||||
- name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.monitordevice.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.monitordevice.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.monitordevice.volumeMounts}}
|
||||
{{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.monitordevice.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
|
||||
@@ -26,10 +26,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.reactivate.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.reactivate.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -38,10 +44,15 @@ spec:
|
||||
- name: hub-reactivate-subscription
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
|
||||
{{- with .Values.kerberoshub.reactivate.volumeMounts }}
|
||||
{{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.reactivate.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
|
||||
@@ -1,42 +1,67 @@
|
||||
{{/*
|
||||
Assemble the workflows engine stage registry (PIPELINE_STAGE_REGISTRY) as a
|
||||
JSON array from every *enabled* stage under kerberoshub.workflows.stages, so the
|
||||
engine's routing stays in lockstep with the deployed stage workers and the
|
||||
per-stage queue cannot drift. The `stages:` block is the routing source of truth;
|
||||
each stage's deployment (and its queue) lives under the matching
|
||||
kerberoshub.services.<name> entry.
|
||||
Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
|
||||
JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
|
||||
This is the engine's boot-loaded configuration source and deployment stage
|
||||
catalog: several distinct config workflows can run over one recording — each
|
||||
opens its own run and dispatches only its own stages. Organisation-scoped
|
||||
database workflows are discovered separately at runtime.
|
||||
|
||||
Each enabled stage contributes one descriptor:
|
||||
operation defaults to the stage's map key.
|
||||
dispatch defaults to "always".
|
||||
queue taken from the matching services.<key>.queue (authoritative; the
|
||||
same value the worker consumes via <NAME>_QUEUE). Omitted when the
|
||||
service or its queue is unset, so the engine derives
|
||||
"kcloud-<operation>-queue.fifo".
|
||||
needs conditional stages only: the upstream dependencies (each
|
||||
{operation, condition?}) carried through verbatim.
|
||||
needsMode conditional stages with more than one need: how they combine —
|
||||
"any" (default; fire on the first matching upstream) or "all"
|
||||
(a join; fire only once every need has resolved and matched).
|
||||
Carried through verbatim; omitted when unset (engine defaults any).
|
||||
kind delegated-ingest stages only: the ingest handler the engine routes
|
||||
the stage's typed payload through (e.g. "detection"). Carried
|
||||
through verbatim; omitted when unset (engine treats the stage as
|
||||
self-persisting).
|
||||
Each enabled definition contributes one workflow object:
|
||||
name the map key (the workflow's human-readable name; also its identity —
|
||||
the engine derives a stable id from it when the definition carries
|
||||
no explicit id).
|
||||
enabled always true here (a disabled definition is skipped entirely).
|
||||
source "config" — provenance marking a Helm-defined, deployment-global,
|
||||
ops-managed workflow (read-only in the API, no owning organisation).
|
||||
triggers how a run OPENS. Defaults to a single bare automatic trigger
|
||||
(opens for every recording); narrow with device/schedule triggers.
|
||||
Per-stage `needs` (below) decide which stages then FIRE.
|
||||
stages the executable stage set, each contributing the same routing
|
||||
descriptor the stageRegistry emits:
|
||||
operation the stage's operation (unique within the workflow).
|
||||
dispatch "always" (default) | "conditional".
|
||||
queue from the matching services.<operation>.queue
|
||||
(authoritative; omitted when unset so the engine
|
||||
derives "kcloud-<operation>-queue.fifo").
|
||||
needs conditional stages only: upstream dependencies, each
|
||||
{operation?, condition?}, carried through verbatim.
|
||||
needsMode conditional stages: "any" (default) | "all".
|
||||
*/}}
|
||||
{{- define "kerberoshub.workflows.stageRegistry" -}}
|
||||
{{- $entries := list -}}
|
||||
{{- define "kerberoshub.workflows.workflowDefinitions" -}}
|
||||
{{- $defs := list -}}
|
||||
{{- $services := .Values.kerberoshub.services | default dict -}}
|
||||
{{- range $name, $stage := .Values.kerberoshub.workflows.stages -}}
|
||||
{{- if $stage.enabled -}}
|
||||
{{- $entry := dict "operation" (default $name $stage.operation) "dispatch" (default "always" $stage.dispatch) -}}
|
||||
{{- $service := index $services $name -}}
|
||||
{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
|
||||
{{- if $wf.enabled -}}
|
||||
{{- $stages := list -}}
|
||||
{{- range $stage := $wf.stages -}}
|
||||
{{- $op := $stage.operation -}}
|
||||
{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
|
||||
{{- $service := index $services $op -}}
|
||||
{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
|
||||
{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
|
||||
{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
|
||||
{{- with $stage.kind }}{{- $_ := set $entry "kind" . -}}{{- end }}
|
||||
{{- $entries = append $entries $entry -}}
|
||||
{{- $stages = append $stages $entry -}}
|
||||
{{- end -}}
|
||||
{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
|
||||
{{- $defs = append $defs $def -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $entries | toJson -}}
|
||||
{{- $defs | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Expose the deployment's operation→queue catalog to API producers that seed
|
||||
embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
|
||||
are enabled for internal flows but are absent from user-visible workflow
|
||||
definitions. The workflows engine remains authoritative for dispatch; producers
|
||||
use this only to embed the same queue on a synthetic stage.
|
||||
*/}}
|
||||
{{- define "kerberoshub.workflows.stageQueues" -}}
|
||||
{{- $queues := dict -}}
|
||||
{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
|
||||
{{- with $service.queue -}}
|
||||
{{- $_ := set $queues $operation . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $queues | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -1,24 +1,29 @@
|
||||
{{- /*
|
||||
Generic workflow-stage worker.
|
||||
|
||||
Renders a Deployment + Service for every stage under
|
||||
kerberoshub.workflows.stages that has a matching, enabled worker under
|
||||
kerberoshub.services.<name>. A custom stage joins the pipeline by values
|
||||
alone — no per-stage template needed.
|
||||
Renders a Deployment + Service for every enabled worker under
|
||||
kerberoshub.services.<name> other than the `workflows` engine itself. A custom
|
||||
stage joins the pipeline by values alone — declare its worker here and route to
|
||||
it from a kerberoshub.workflows.definitions stage of the same operation; no
|
||||
per-stage template is needed.
|
||||
|
||||
Every stage worker receives the same connection contract; the only value that
|
||||
varies by stage is the consume-queue variable name, <NAME>_QUEUE (a stage
|
||||
keyed "anpr" gets ANPR_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run a worker
|
||||
outside the chart instead, leave services.<name>.enabled unset (or false)
|
||||
while keeping the stage under workflows.stages so the engine still routes to
|
||||
the queue you publish.
|
||||
varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
|
||||
named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
|
||||
a worker outside the chart instead, leave services.<name>.enabled unset (or
|
||||
false) and point its workflow stage at the queue you publish.
|
||||
|
||||
All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
|
||||
ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
|
||||
redaction) declares its destination provider with the named field
|
||||
services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
|
||||
read-only stage omits it and gets no provider env.
|
||||
*/ -}}
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
|
||||
{{- $root := . -}}
|
||||
{{- $services := .Values.kerberoshub.services | default dict -}}
|
||||
{{- range $name, $stage := .Values.kerberoshub.workflows.stages -}}
|
||||
{{- $svc := index $services $name -}}
|
||||
{{- if and $svc $svc.enabled -}}
|
||||
{{- range $name, $svc := $services -}}
|
||||
{{- if and (ne $name "workflows") $svc $svc.enabled -}}
|
||||
{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
|
||||
---
|
||||
apiVersion: apps/v1
|
||||
@@ -102,6 +107,22 @@ spec:
|
||||
value: "{{ $root.Values.kerberosvault.accesskey }}"
|
||||
- name: KERBEROS_STORAGE_SECRET
|
||||
value: "{{ $root.Values.kerberosvault.secretkey }}"
|
||||
{{- with $svc.storageProvider }}
|
||||
# Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
|
||||
# that write an artefact back (e.g. redaction) set services.<name>.
|
||||
# storageProvider; read-only stages omit it and get no provider env.
|
||||
- name: KERBEROS_STORAGE_PROVIDER
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Per-stage tuning knobs. Any key/value under services.<name>.env is
|
||||
# rendered verbatim as container env, so a worker can be tuned from
|
||||
# values without a per-stage template. These override the image's own
|
||||
# ENV defaults; the fixed contract env above is not overridable here.
|
||||
{{- range $key, $value := $svc.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -119,6 +140,6 @@ spec:
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: hub-{{ $name }}
|
||||
{{- end }}
|
||||
{{ end -}}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.services.workflows.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.services.workflows.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.services.workflows.volumeMounts }}
|
||||
{{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.services.workflows.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -58,14 +69,18 @@ spec:
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
|
||||
# Queue this service consumes from (WORKFLOWS_QUEUE) and the custom
|
||||
# pipeline stage registry it may dispatch (PIPELINE_STAGE_REGISTRY).
|
||||
# The registry is assembled from the enabled stages under
|
||||
# kerberoshub.workflows.stages (see _workflows-helpers.tpl).
|
||||
# Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
|
||||
# named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
|
||||
# trigger and executable stages, assembled from the enabled definitions
|
||||
# under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
|
||||
# Definitions are the engine's boot-loaded config source and deployment
|
||||
# stage catalog. Organisation-scoped database workflows are read per
|
||||
# recording; an in-cluster engine still requires at least one config
|
||||
# definition so an empty catalog cannot silently drop traffic.
|
||||
- name: WORKFLOWS_QUEUE
|
||||
value: "{{ .Values.kerberoshub.services.workflows.queue }}"
|
||||
- name: PIPELINE_STAGE_REGISTRY
|
||||
value: {{ include "kerberoshub.workflows.stageRegistry" . | quote }}
|
||||
- name: WORKFLOW_DEFINITIONS
|
||||
value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
|
||||
|
||||
# RabbitMQ settings
|
||||
- name: RABBITMQ_HOST
|
||||
@@ -87,6 +102,7 @@ spec:
|
||||
- name: KERBEROS_STORAGE_SECRET
|
||||
value: "{{ .Values.kerberosvault.secretkey }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -94,6 +110,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.analysis.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.analysis.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.analysis.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.analysis.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -87,6 +98,12 @@ spec:
|
||||
# runs unchanged). Kept in sync with whether the workflows service runs.
|
||||
- name: WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.workflows.enabled }}"
|
||||
|
||||
# Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
|
||||
# taken from the workflows service's queue so analysis and the engine
|
||||
# always agree on the queue name (no drift).
|
||||
- name: WORKFLOWS_QUEUE
|
||||
value: "{{ .Values.kerberoshub.services.workflows.queue }}"
|
||||
|
||||
# Kerberos Vault
|
||||
- name: KERBEROS_STORAGE_URI
|
||||
@@ -100,6 +117,7 @@ spec:
|
||||
- name: SPRITE_ENABLED
|
||||
value: "{{ .Values.kerberospipeline.sprite.enabled }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -107,6 +125,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -77,6 +77,7 @@ spec:
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -84,6 +85,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -77,6 +77,7 @@ spec:
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -84,6 +85,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.event.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.event.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.event.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.event.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
envFrom:
|
||||
@@ -86,6 +97,7 @@ spec:
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -93,6 +105,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.export.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.export.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.export.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.export.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -122,6 +133,7 @@ spec:
|
||||
- name: VAULT_THUMBNAIL_SECRET_KEY
|
||||
value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -129,6 +141,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.monitor.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.monitor.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,14 +51,23 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.monitor.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.monitor.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
# Application
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
|
||||
|
||||
# Queue
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
@@ -103,6 +118,7 @@ spec:
|
||||
- name: SMTP_PASSWORD
|
||||
value: "{{ .Values.email.smtp.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -110,6 +126,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
|
||||
{{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -110,6 +121,7 @@ spec:
|
||||
- name: SMTP_PASSWORD
|
||||
value: "{{ .Values.email.smtp.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -117,6 +129,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notify.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.notify.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,16 +51,23 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notify.volumeMounts}}
|
||||
{{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.notify.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.notify.logLevel }}"
|
||||
- name: NOTIFICATION_EXPIRY_MINUTES
|
||||
value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
|
||||
# Queue
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
@@ -142,6 +155,7 @@ spec:
|
||||
- name: VAULT_SPRITE_SECRET_KEY
|
||||
value: "{{ .Values.kerberosvault.sprite.secretKey }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -149,6 +163,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -1,114 +0,0 @@
|
||||
{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: pipe-redaction
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.redaction.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: pipe-redaction
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
labels:
|
||||
app: pipe-redaction
|
||||
spec:
|
||||
{{- if .Values.kerberoshub.serviceAccount.create }}
|
||||
serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.redaction.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.redaction.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: pipe-redaction
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.redaction.repository }}:{{ .Values.kerberospipeline.redaction.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberospipeline.redaction.pullPolicy }}
|
||||
{{- with .Values.kerberospipeline.redaction.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.redaction.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.redaction.logLevel }}"
|
||||
- name: CLOUD_PROVIDER
|
||||
value: "{{ .Values.cloudProvider }}"
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
|
||||
# Kafka settings
|
||||
- name: KAFKA_BROKER
|
||||
value: "{{ .Values.kafka.broker }}"
|
||||
- name: KAFKA_USERNAME
|
||||
value: "{{ .Values.kafka.username }}"
|
||||
- name: KAFKA_PASSWORD
|
||||
value: "{{ .Values.kafka.password }}"
|
||||
- name: KAFKA_MECHANISM
|
||||
value: "{{ .Values.kafka.mechanism }}"
|
||||
- name: KAFKA_SECURITY
|
||||
value: "{{ .Values.kafka.security }}"
|
||||
|
||||
# RabbitMQ settings
|
||||
- name: RABBITMQ_HOST
|
||||
value: "{{ .Values.rabbitmq.host }}"
|
||||
- name: RABBITMQ_EXCHANGE
|
||||
value: "{{ .Values.rabbitmq.exchange }}"
|
||||
- name: RABBITMQ_USERNAME
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
# Kerberos Vault (used to download the source media and upload the redacted artifact).
|
||||
- name: KERBEROS_STORAGE_URI
|
||||
value: "{{ .Values.kerberosvault.uri }}"
|
||||
- name: KERBEROS_STORAGE_PROVIDER
|
||||
value: "{{ .Values.kerberosvault.provider }}"
|
||||
- name: KERBEROS_STORAGE_ACCESS_KEY
|
||||
value: "{{ .Values.kerberosvault.accesskey }}"
|
||||
- name: KERBEROS_STORAGE_SECRET
|
||||
value: "{{ .Values.kerberosvault.secretkey }}"
|
||||
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
- name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: pipe-redaction
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: pipe-redaction
|
||||
service: pipe
|
||||
spec:
|
||||
ports:
|
||||
- name: hub-metrics
|
||||
port: 8080
|
||||
targetPort: 8080
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: pipe-redaction
|
||||
{{- end }}
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.sequence.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.sequence.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.sequence.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.sequence.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -80,6 +91,7 @@ spec:
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -87,6 +99,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -100,6 +100,7 @@ spec:
|
||||
- name: VAULT_SPRITE_HEIGHT
|
||||
value: "{{ .Values.kerberospipeline.sprite.height }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -107,6 +108,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -29,10 +29,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.throttler.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.throttler.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -45,10 +51,15 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.throttler.volumeMounts }}
|
||||
{{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.throttler.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
@@ -82,6 +93,7 @@ spec:
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -89,6 +101,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
|
||||
@@ -103,6 +103,7 @@ spec:
|
||||
- name: VAULT_THUMBNAIL_SECRET_KEY
|
||||
value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
- name: OTEL_EXPORTED_OTLP_ENABLED
|
||||
value: "{{ .Values.opentelemetry.enabled }}"
|
||||
@@ -110,6 +111,7 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -27,10 +27,16 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.forwarder.volumes }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.forwarder.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -43,10 +49,15 @@ spec:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
{{- with .Values.kerberoshub.forwarder.volumeMounts }}
|
||||
{{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.forwarder.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq .Values.mode "all" -}}
|
||||
{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
|
||||
@@ -60,6 +60,48 @@ mongodb:
|
||||
# and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
|
||||
# should also set retryWrites: "false".
|
||||
flavor: "mongodb"
|
||||
# TLS for MongoDB-compatible backends. When uri is set, missing TLS query
|
||||
# parameters are appended automatically. AWS DocumentDB requires TLS and a
|
||||
# trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
|
||||
tls:
|
||||
enabled: false
|
||||
existingSecret: ""
|
||||
caFileName: ""
|
||||
mountPath: "/etc/mongodb/tls"
|
||||
insecureSkipVerify: false
|
||||
|
||||
# Classifications supported by Hub filters, alerts, markers, and other
|
||||
# downstream processing. Classifier output keys must match these values.
|
||||
# Disable this to use the legacy classification catalog stored in MongoDB.
|
||||
classificationCatalogEnabled: true
|
||||
classificationCatalog:
|
||||
- key: animal
|
||||
label: Animal
|
||||
icon: animal
|
||||
- key: pedestrian
|
||||
label: Pedestrian
|
||||
icon: pedestrian
|
||||
- key: cyclist
|
||||
label: Cyclist
|
||||
icon: cyclist
|
||||
- key: motorbike
|
||||
label: Motorbike
|
||||
icon: motorbike
|
||||
- key: lorry
|
||||
label: Lorry
|
||||
icon: lorry
|
||||
- key: car
|
||||
label: Car
|
||||
icon: car
|
||||
- key: handbag
|
||||
label: Handbag
|
||||
icon: handbag
|
||||
- key: suitcase
|
||||
label: Suitcase
|
||||
icon: suitcase
|
||||
- key: cell phone
|
||||
label: Cell phone
|
||||
icon: cell phone
|
||||
###################################################
|
||||
# MQTT configuration (bi-directional communication)
|
||||
###################################################
|
||||
@@ -121,7 +163,12 @@ opentelemetry:
|
||||
enabled: false
|
||||
routingEnabled: false
|
||||
collector:
|
||||
endpoint: "http://otel-collector:4317"
|
||||
# NOTE: the services use the OTLP *HTTP* exporter, so this must be the
|
||||
# collector's HTTP port (4318) and must include the scheme. Use http://
|
||||
# for a plaintext in-cluster collector (e.g. Jaeger) and https:// only if
|
||||
# the collector terminates TLS. A scheme-less value defaults to TLS and
|
||||
# fails against a plaintext collector ("server gave HTTP response to HTTPS client").
|
||||
endpoint: "http://otel-collector:4318"
|
||||
############################################
|
||||
# OpenAI configuration (semantic search)
|
||||
#
|
||||
@@ -226,7 +273,7 @@ kerberoshub:
|
||||
api:
|
||||
repository: ghcr.io/uug-ai/hub-api
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.9.8"
|
||||
tag: "v1.9.51"
|
||||
replicas: 2
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Set to false to skip rendering the hub-api Service (e.g. when an
|
||||
@@ -339,7 +386,7 @@ kerberoshub:
|
||||
frontend:
|
||||
repository: ghcr.io/uug-ai/hub-frontend
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.9.11"
|
||||
tag: "v1.13.9"
|
||||
replicas: 2
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Set to false to skip rendering the hub-frontend Service (e.g. when an
|
||||
@@ -448,6 +495,8 @@ kerberoshub:
|
||||
features:
|
||||
# General
|
||||
darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
|
||||
splashScreen:
|
||||
enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
|
||||
landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
|
||||
# Internationalization (i18n): controls the runtime language behaviour
|
||||
# of the front-end. When `enabled` is "false" the language switcher is
|
||||
@@ -461,20 +510,52 @@ kerberoshub:
|
||||
# Workflows allow you to define automated processes and actions in the front-end.
|
||||
workflows:
|
||||
enabled: "false" # Enable or disable workflows feature 'true' or 'false'
|
||||
# Audit events are visible to owner/admin users when enabled.
|
||||
audit:
|
||||
enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
|
||||
# Organisation controls remain visible as a read-only current organisation when switching is disabled.
|
||||
organisations:
|
||||
enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
|
||||
switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
|
||||
creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
|
||||
settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
|
||||
projects:
|
||||
enabled: "" # Fallback project group switch used only when organisations.enabled is empty
|
||||
switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
|
||||
creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
|
||||
settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
|
||||
# Map tile configuration
|
||||
map:
|
||||
tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
|
||||
tileUrlDark: "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png" # Map tile URL for dark mode
|
||||
attribution: "© <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>" # Map attribution
|
||||
overlayTileUrl: "" # Optional XYZ overlay URL; supports {z}, {x}, {y}, and {apiKey}
|
||||
overlayApiKey: "" # Optional browser-visible API key substituted into overlayTileUrl
|
||||
overlayAttribution: "" # Attribution displayed when the overlay is enabled
|
||||
overlayMinZoom: "0" # Minimum overlay zoom level
|
||||
overlayMaxZoom: "19" # Maximum overlay zoom level
|
||||
overlayOpacity: "1" # Overlay opacity from 0 to 1
|
||||
# Live view page
|
||||
liveview:
|
||||
defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
|
||||
liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
|
||||
hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
|
||||
moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
|
||||
remoteRecordingEnabled: "true" # Show the manual REC control and recording-state overlay in live views
|
||||
deviceStatusEnabled: "true" # Show connectivity and recent-motion status in live view tile headers
|
||||
moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
|
||||
moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
|
||||
paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
|
||||
pageSize: "6" # Max streams shown per page when paginationMode is 'numbered' (4, 8, 12, 16 or 25)
|
||||
maxStreams: "-1" # Maximum number of live streams to show in live view, -1 for unlimited
|
||||
# Device page
|
||||
devices:
|
||||
hideAgent: "false" # Hide the 'add agent' button in the front-end
|
||||
analyticsEnabled: "true" # Enable or disable the Analytics tab on device detail pages 'true' or 'false'
|
||||
developerToolsEnabled: "true" # Enable or disable device logs and terminal access 'true' or 'false'
|
||||
# Dashboard page
|
||||
dashboard:
|
||||
sitesFullscreenEnabled: "true" # Enable or disable the fullscreen Sites map 'true' or 'false'
|
||||
# Media page
|
||||
media:
|
||||
filter:
|
||||
@@ -498,6 +579,11 @@ kerberoshub:
|
||||
enabled: "true" # Enable or disable category filter in media 'true' or 'false'
|
||||
markers:
|
||||
enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
|
||||
markerOptionsByDate:
|
||||
enabled: "false" # Limit marker-related filter options to the selected recording day
|
||||
markerCategoryPriority:
|
||||
enabled: "false" # Order marker options from configured categories before other markers
|
||||
categories: [] # Ordered marker category names, for example ["security", "traffic"]
|
||||
events:
|
||||
enabled: "true" # Enable or disable events filter in media 'true' or 'false'
|
||||
tags:
|
||||
@@ -505,6 +591,13 @@ kerberoshub:
|
||||
defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
|
||||
# Chart feature
|
||||
chart:
|
||||
colors:
|
||||
- "#84569f"
|
||||
- "#3ba7ff"
|
||||
- "#ff5c8a"
|
||||
- "#4ad991"
|
||||
- "#ffb84d"
|
||||
- "#ff7043"
|
||||
colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
|
||||
colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
|
||||
colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
|
||||
@@ -532,6 +625,7 @@ kerberoshub:
|
||||
# Face redaction feature
|
||||
faceRedaction:
|
||||
enabled: "false" # Enable or disable face redaction 'true' or 'false'
|
||||
classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
|
||||
# Optional integrations
|
||||
mixpanel: # We can keep track logging in Mixpanel as well
|
||||
apikey: "xxx"
|
||||
@@ -567,7 +661,7 @@ kerberoshub:
|
||||
cleanup:
|
||||
repository: ghcr.io/uug-ai/hub-cleanup
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.13"
|
||||
tag: "v1.4.19"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -603,13 +697,69 @@ kerberoshub:
|
||||
# Tasks with `legal_hold=true` are never deleted. Must match the value
|
||||
# used by `kerberoshub.api.defaultTaskRetentionDays`.
|
||||
defaultTaskRetentionDays: "0"
|
||||
# Deployment-wide retention for audit events. This is independent from
|
||||
# recording plans, inactive-account cleanup, and the optional global pass.
|
||||
# Set to "0" or a negative value to retain audit events indefinitely.
|
||||
auditEventRetentionDays: "400"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# Dispatches canonical audit_events to one or more external webhook sinks.
|
||||
# Credentials are always read from existing Secrets and never stored here.
|
||||
audit:
|
||||
enabled: false
|
||||
repository: ghcr.io/uug-ai/hub-audit
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.1"
|
||||
replicas: 1
|
||||
dispatchInterval: "5s"
|
||||
leaseDuration: "2m"
|
||||
terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
|
||||
intake:
|
||||
queue: "hub-audit-events"
|
||||
deadletterQueue: "hub-audit-dead-letter"
|
||||
maxRetries: 10
|
||||
prefetchCount: 20
|
||||
persistTimeout: "10s"
|
||||
topologySpreadConstraints: []
|
||||
volumes: []
|
||||
volumeMounts: []
|
||||
extraEnv: []
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 15s
|
||||
destinations: []
|
||||
# - id: primary-siem
|
||||
# type: webhook
|
||||
# enabled: true
|
||||
# url: https://siem.example.com/api/audit
|
||||
# timeoutSeconds: 10
|
||||
# batchSize: 100
|
||||
# maxAttempts: 10
|
||||
# startAt: latest # latest | beginning, applied only on first creation
|
||||
# headers:
|
||||
# X-Source: kerberos-hub
|
||||
# bearerTokenSecret:
|
||||
# name: audit-primary-siem
|
||||
# key: token
|
||||
# secretHeaders:
|
||||
# X-Api-Key:
|
||||
# secretName: audit-primary-siem
|
||||
# secretKey: api-key
|
||||
# filters:
|
||||
# organisationIds: []
|
||||
# projectIds: []
|
||||
# actions: []
|
||||
# categories: []
|
||||
# outcomes: [] # success | failure
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 32Mi
|
||||
# cpu: 10m
|
||||
# hub-workflows is the standalone, queue-driven workflow engine. It consumes
|
||||
# pipeline events and dispatches custom stages declared in the stage registry,
|
||||
# tracking each run in its own `workflow_runs` collection. It shares events
|
||||
# pipeline events and dispatches the stages declared in its workflow
|
||||
# definitions, tracking each run in its own `workflow_runs` collection. It shares events
|
||||
# (not a document) with the analysis pipeline and is meant to grow into the
|
||||
# primary orchestrator. See https://github.com/uug-ai/hub-workflows.
|
||||
workflows:
|
||||
@@ -618,96 +768,77 @@ kerberoshub:
|
||||
# in parallel with the normal throttler/notification tail, which still runs
|
||||
# unchanged. Flip to true to run the workflows engine.
|
||||
enabled: false
|
||||
# This block is purely behaviour: the master switch above plus the stage
|
||||
# routing below. The engine's own deployment (image/tag/replicas/queue/
|
||||
# This block is purely behaviour: the master switch above plus the workflow
|
||||
# definitions below. The engine's own deployment (image/tag/replicas/queue/
|
||||
# resources) lives under kerberoshub.services.workflows, in the same uniform
|
||||
# shape as the stage workers it dispatches to.
|
||||
#
|
||||
# Stage routing — how each custom stage fits into the workflow. The engine's
|
||||
# PIPELINE_STAGE_REGISTRY is assembled automatically from the *enabled*
|
||||
# stages below: each contributes its operation and dispatch/needs routing,
|
||||
# plus the queue from its matching `services.<name>` entry — so the engine's
|
||||
# routing stays in lockstep with the deployed worker and the queue cannot
|
||||
# drift. There is nothing to set for the registry directly.
|
||||
# -----------------------------------------------------------------------
|
||||
# Global workflow definitions — the named workflows the engine runs.
|
||||
#
|
||||
# Each stage is keyed to a worker of the same name under kerberoshub.services.
|
||||
# Routing (here) and deployment (services) are toggled independently:
|
||||
# workflows.stages.<name>.enabled -> include the stage in the registry (route to it)
|
||||
# services.<name>.enabled -> deploy the worker (pipe-<name>.yaml)
|
||||
stages:
|
||||
# hub-anpr — automatic number-plate recognition stage. Routing only; its
|
||||
# worker deployment lives under kerberoshub.services.anpr.
|
||||
anpr:
|
||||
# Include this stage in the engine's registry (route to it).
|
||||
enabled: false
|
||||
# operation unique stage id (defaults to the key "anpr" if omitted);
|
||||
# binds the queue (taken from services.anpr.queue) and how
|
||||
# the result is recorded.
|
||||
# dispatch "always" (run on every workflow) | "conditional".
|
||||
# needs conditional stages only: upstream dependencies, each
|
||||
# {operation?, condition}. operation is the readiness GATE —
|
||||
# the upstream op whose data must be present before the
|
||||
# condition is read; leave it empty for a check on the run
|
||||
# root itself (device/user/identity), read as soon as the run
|
||||
# opens. condition shape:
|
||||
# {path: <abs-path>, op: eq|ne|contains|in|exists|gt|gte|lt|lte, value: <operand>}.
|
||||
# path is ABSOLUTE from the run root and resolves through
|
||||
# string-keyed maps only (it CANNOT index into arrays):
|
||||
# inputs.<op>.<field> (a trigger result, e.g. classify),
|
||||
# results.<op>.<field> (a finished stage), device.<field>,
|
||||
# user.<field>, or a top-level scalar (operation/runId/key).
|
||||
# classify is the only operation teed to workflows, so it is
|
||||
# the reliable upstream: match inputs.classify.properties (the
|
||||
# detected class strings) with `contains` — there is no
|
||||
# top-level `label`, and inputs.classify.details is an array a
|
||||
# path cannot index into — or gate on inputs.classify.objectCount
|
||||
# (top-level int) numerically. The engine rejects an unknown
|
||||
# path at boot.
|
||||
# needsMode conditional stages with more than one need: how they
|
||||
# combine. "any" (default) fires on the first matching
|
||||
# need; "all" is a join — the stage fires only once every
|
||||
# need has resolved and each condition matches, and only once.
|
||||
operation: anpr
|
||||
dispatch: conditional
|
||||
# kind routes this stage's typed result (the PostDetectionsRequest its
|
||||
# demo worker compiles from the classify car boxes and returns in the run
|
||||
# Payload) through the engine's shared ingest core, which persists it into
|
||||
# the detections collection so the recording's edit-media modal shows the
|
||||
# car boxes. Without it the result is only recorded for routing, not
|
||||
# persisted.
|
||||
kind: detection
|
||||
# Default routing — run anpr whenever classify reports a car (any camera).
|
||||
needsMode: any
|
||||
needs:
|
||||
- operation: classify
|
||||
condition: {path: "inputs.classify.properties", op: contains, value: car}
|
||||
# Restrict plate recognition to a SINGLE camera: add an ungated need on
|
||||
# the recording's device (empty operation = checked as soon as the run
|
||||
# opens) and switch needsMode to "all", so both must hold — "that camera
|
||||
# AND a car was detected". For several cameras use op: in with a list.
|
||||
#needsMode: all
|
||||
#needs:
|
||||
# - operation: classify
|
||||
# condition: {path: "inputs.classify.properties", op: contains, value: car}
|
||||
# - operation:
|
||||
# condition: {path: "device.deviceKey", op: eq, value: device02}
|
||||
|
||||
# `definitions` is the engine's deployment-global configuration source and
|
||||
# stage catalog: several distinct workflows can run over one recording, each
|
||||
# opening its own run and dispatching only its own stages. Database-backed
|
||||
# organisation workflows, when present, are read separately per recording.
|
||||
# This is a MAP keyed by workflow name (names are unique and merge cleanly
|
||||
# across -f / --set overrides). Ships empty; the commented block is a worked
|
||||
# example of an object-tracking + loitering pipeline. Add more keys to run
|
||||
# more config workflows.
|
||||
#
|
||||
# Each definition:
|
||||
# enabled include this workflow (soft-delete toggle).
|
||||
# source always rendered as "config" (a Helm-defined, ops-managed,
|
||||
# deployment-global workflow — read-only in the API).
|
||||
# triggers how a run OPENS. Omit for a single bare automatic trigger
|
||||
# (opens for every recording); the per-stage `needs` then decide
|
||||
# which stages FIRE. Narrow with device/schedule triggers, e.g.
|
||||
# `- {type: automatic, devices: [{key: <device-key>}]}`.
|
||||
# stages the executable stages, each {operation, dispatch?, needs?,
|
||||
# needsMode?}. dispatch is "always" (default) or "conditional";
|
||||
# a conditional stage's `needs` are upstream dependencies, each
|
||||
# {operation?, condition?} — operation is the readiness GATE (the
|
||||
# upstream op whose data must be present before the condition is
|
||||
# read; omit for a check on the run root itself), condition is
|
||||
# {path, op, value} where path is ABSOLUTE from the run root;
|
||||
# a `*` segment fans out across array elements. needsMode combines
|
||||
# multiple needs: "any" (default;
|
||||
# fire on the first match) or "all" (a join; fire once every need
|
||||
# has resolved and matched). The queue is taken from the matching
|
||||
# services.<operation> entry, so dispatch and consume cannot drift.
|
||||
#
|
||||
# Every stage `operation` must have a deployed worker under
|
||||
# kerberoshub.services.<operation> (deploy the objecttracking / loitering
|
||||
# workers below).
|
||||
definitions: {}
|
||||
#tracking-workflow:
|
||||
# enabled: true
|
||||
# triggers:
|
||||
# - type: automatic
|
||||
# stages:
|
||||
# - operation: objecttracking
|
||||
# dispatch: always
|
||||
# - operation: loitering
|
||||
# dispatch: conditional
|
||||
# # Fire loitering once objecttracking has resolved — a readiness join
|
||||
# # (no condition ⇒ gate on the upstream's presence, not a value).
|
||||
# needs:
|
||||
# - operation: objecttracking
|
||||
# Workflow deployments. Every workflows-subsystem Deployment's image/tag/
|
||||
# replicas/resources/queue lives here in a single, uniform shape:
|
||||
# - `workflows` is the engine itself (the orchestrator). It is deployed
|
||||
# whenever kerberoshub.workflows.enabled is true and has no `enabled` of
|
||||
# its own — the master switch already gates the whole subsystem.
|
||||
# - every other entry is a stage worker the engine dispatches to, keyed to
|
||||
# match a kerberoshub.workflows.stages entry of the same name. A worker
|
||||
# - every other entry is a stage worker the engine dispatches to. A worker
|
||||
# consumes its own queue and routes its result back to the engine queue.
|
||||
# Deploying a worker (services.<name>.enabled) is independent from routing
|
||||
# to it (workflows.stages.<name>.enabled) — it runs only when its own
|
||||
# `enabled` is true AND the workflows engine is enabled.
|
||||
# to it (a workflows.definitions stage of the same operation) — it runs only
|
||||
# when its own `enabled` is true AND the workflows engine is enabled.
|
||||
services:
|
||||
# hub-workflows — the workflows engine (orchestrator). Consumes the engine
|
||||
# queue, evaluates the stage registry (assembled from workflows.stages) and
|
||||
# dispatches to the stage workers below. Deployed when workflows.enabled is
|
||||
# true; it has no separate `enabled` here.
|
||||
# queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
|
||||
# plus organisation-scoped database workflows, and dispatches to the stage
|
||||
# workers below. Deployed when workflows.enabled is true; it has no separate
|
||||
# `enabled` here.
|
||||
workflows:
|
||||
repository: ghcr.io/uug-ai/hub-workflows
|
||||
pullPolicy: IfNotPresent
|
||||
@@ -724,42 +855,66 @@ kerberoshub:
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# Queue this service consumes ingest events and upstream results from
|
||||
# (WORKFLOWS_QUEUE). Must be fed the same messages the analysis service sees.
|
||||
queue: "kcloud-workflows-queue"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# hub-anpr — automatic number-plate recognition worker. Lives in the
|
||||
# hub-workflows repository as its own module. See
|
||||
# https://github.com/uug-ai/hub-workflows/tree/main/hub-anpr.
|
||||
anpr:
|
||||
# Deploy the hub-anpr worker.
|
||||
enabled: false
|
||||
repository: ghcr.io/uug-ai/hub-anpr
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 1 # Number of pods for the worker.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
#volumes:
|
||||
# - name: extra
|
||||
# emptyDir: {}
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# Queue this worker consumes dispatched messages from (ANPR_QUEUE). This
|
||||
# same value is read into the engine's generated registry entry for the
|
||||
# matching stage, so the engine dispatches and the worker consumes the same
|
||||
# queue with no drift. Convention: "kcloud-<operation>-queue.fifo".
|
||||
queue: "kcloud-anpr-queue.fifo"
|
||||
queue: "hub-workflows-queue"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE custom stage worker (commented out) — hub-loitering.
|
||||
#
|
||||
# Companion deployment for the workflows.definitions example above (the
|
||||
# loitering stage of tracking-workflow). Uncomment to deploy the demo
|
||||
# worker. It ships as its own repository/module.
|
||||
# See https://github.com/uug-ai/hub-loitering.
|
||||
#loitering:
|
||||
# # Deploy the hub-loitering worker.
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-loitering
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# #volumes:
|
||||
# # - name: extra
|
||||
# # emptyDir: {}
|
||||
# #volumeMounts:
|
||||
# # - name: extra
|
||||
# # mountPath: /data
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
|
||||
# # same value is taken into the matching workflows.definitions stage, so the
|
||||
# # engine dispatches and the worker consumes the same queue with no drift.
|
||||
# # Convention: "kcloud-<operation>-queue.fifo".
|
||||
# queue: "kcloud-loitering-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE stage worker (commented out) for the workflows.definitions example
|
||||
# above — hub-objecttracking. Uncomment the worker whose operation a
|
||||
# definition references, so the engine dispatches and the worker consumes the
|
||||
# same queue with no drift.
|
||||
#objecttracking:
|
||||
# # Deploy the object-tracking worker (operation "objecttracking").
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-objecttracking
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
|
||||
# queue: "kcloud-objecttracking-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
monitordevice:
|
||||
repository: ghcr.io/uug-ai/hub-monitor-device
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.0"
|
||||
tag: "v1.4.2"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -779,7 +934,7 @@ kerberoshub:
|
||||
repository: uugai/hub-reactivatesubscriptions
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.2"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
replicas: 0 # Number of pods for the service. Set to 0 to disable.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -812,10 +967,11 @@ kerberoshub:
|
||||
# cpu: 10m
|
||||
# This proxy is legacy for the old agent, will be migrated in the new Hub API.
|
||||
proxy:
|
||||
enabled: false
|
||||
repository: uugai/hub-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
replicas: 0 # Number of pods for the service when enabled.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -837,7 +993,7 @@ kerberospipeline:
|
||||
event:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-event
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.0"
|
||||
tag: "v1.3.1"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -855,7 +1011,7 @@ kerberospipeline:
|
||||
monitor:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-monitor
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.9"
|
||||
tag: "v1.3.13"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -865,6 +1021,7 @@ kerberospipeline:
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: debug, info, warn, error
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
@@ -872,7 +1029,7 @@ kerberospipeline:
|
||||
sequence:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-sequence
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.6.18"
|
||||
tag: "v1.6.26"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -889,7 +1046,7 @@ kerberospipeline:
|
||||
throttler:
|
||||
repository: uugai/hub-pipeline-throttler
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.0"
|
||||
tag: "v1.2.1"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -907,10 +1064,11 @@ kerberospipeline:
|
||||
notify:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-notification
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.9"
|
||||
tag: "v1.3.18"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
@@ -926,7 +1084,7 @@ kerberospipeline:
|
||||
notifyTest:
|
||||
repository: uugai/hub-pipeline-notification-test
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.1"
|
||||
tag: "v1.2.2"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
resources:
|
||||
@@ -944,7 +1102,7 @@ kerberospipeline:
|
||||
analysis:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-analysis
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.7.8"
|
||||
tag: "v1.8.5"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -962,7 +1120,7 @@ kerberospipeline:
|
||||
dominantColor:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v2.0.2"
|
||||
tag: "v2.0.3"
|
||||
replicas: 3 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -983,7 +1141,7 @@ kerberospipeline:
|
||||
thumbnail:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.4"
|
||||
tag: "v1.3.10"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1009,7 +1167,7 @@ kerberospipeline:
|
||||
counting:
|
||||
repository: uugai/hub-pipeline-counting
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.6.3"
|
||||
tag: "v2.0.0"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1028,7 +1186,7 @@ kerberospipeline:
|
||||
enabled: false # Enable or disable the sprite generation 'true' or 'false
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-sprite
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.1.12"
|
||||
tag: "v1.1.16"
|
||||
replicas: 5 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1040,8 +1198,10 @@ kerberospipeline:
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn,
|
||||
interval: "1" # Number of secondes between each thumbnail in the sprite
|
||||
width: "240" # Should not be changed for the moment (hard coded in UI)
|
||||
height: "135" # Should not be changed for the moment (hard coded in UI)
|
||||
# Tile size in pixels. Preserve width:height = 16:9 (e.g. 240x135, 480x270, 640x360).
|
||||
# Deploy dimension-aware sprite/analysis workers, Hub API and frontend before increasing.
|
||||
width: "240"
|
||||
height: "135"
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
@@ -1052,7 +1212,7 @@ kerberospipeline:
|
||||
export:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-export
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.4"
|
||||
tag: "v1.2.10"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -1068,27 +1228,6 @@ kerberospipeline:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
redaction:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-redaction
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
# - name: extra
|
||||
# emptyDir: {}
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
cpu: 500m
|
||||
limits:
|
||||
memory: 2Gi
|
||||
cpu: 1000m
|
||||
###########################################################################
|
||||
# Email configuration
|
||||
#
|
||||
@@ -1116,10 +1255,14 @@ email:
|
||||
forgotTitle: "Password reset Kerberos Hub. You forgot your password"
|
||||
share: "share"
|
||||
shareTitle: "[Action] You received a recording from Kerberos Hub"
|
||||
caseShare: "share_case"
|
||||
caseShareTitle: "[Action] A case has been shared with you on Kerberos Hub"
|
||||
caseShareOtp: "share_case_otp"
|
||||
caseShareOtpTitle: "Your Kerberos Hub verification code"
|
||||
assignTask: "assign_task"
|
||||
assignTaskTitle: "[Action] You've been assigned to a task"
|
||||
detection: "detection"
|
||||
disabled: "disabled"
|
||||
disabled: "disable"
|
||||
highupload: "highupload"
|
||||
device: "device"
|
||||
alertTitle: "[Alert] Kerberos Hub detected something an event"
|
||||
|
||||
97
scripts/check-workflows-queue-consistency.sh
Executable file
97
scripts/check-workflows-queue-consistency.sh
Executable file
@@ -0,0 +1,97 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Render the hub chart and assert that every deployment which carries the
|
||||
# workflows hand-off queue (the WORKFLOWS_QUEUE env var) resolves to the SAME,
|
||||
# non-empty value.
|
||||
#
|
||||
# Why: the analysis pipeline (pipe-analysis) publishes opened workflow runs to
|
||||
# WORKFLOWS_QUEUE, the workflows engine (hub-workflows) consumes it, and every
|
||||
# stage worker (hub-stage) routes its result back to it. All three templates
|
||||
# read the single key `kerberoshub.services.workflows.queue`. If a future edit
|
||||
# hardcodes a value, reads the wrong key, or drops the env on one of them, the
|
||||
# producer and consumer silently drift onto different queue names and messages
|
||||
# pile up with no consumer. This check fails the build before that can ship.
|
||||
#
|
||||
# Usage: scripts/check-workflows-queue-consistency.sh [chart-dir]
|
||||
# (chart-dir defaults to charts/hub, relative to the repo root)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
CHART_DIR="${1:-charts/hub}"
|
||||
PROBE="drift-probe-queue-name"
|
||||
|
||||
# Flags that force all three deployment kinds (analysis, engine and one stage
|
||||
# worker) to render, so the check actually has something to compare. The chart
|
||||
# ships NO enabled stage worker by default (custom stages are values-only and
|
||||
# opt-in), so we synthesise a throwaway stage purely to exercise the generic
|
||||
# hub-stage path. The name is a neutral fixture ("queuecheck") on purpose: any
|
||||
# arbitrary stage key must render the same way, so the check must not depend on
|
||||
# a specific bundled worker.
|
||||
STAGE="queuecheck"
|
||||
RENDER_FLAGS=(
|
||||
--set mode=all
|
||||
--set kerberoshub.workflows.enabled=true
|
||||
--set "kerberoshub.workflows.stages.${STAGE}.enabled=true"
|
||||
--set "kerberoshub.services.${STAGE}.enabled=true"
|
||||
--set "kerberoshub.services.${STAGE}.repository=example.invalid/queuecheck"
|
||||
--set "kerberoshub.services.${STAGE}.tag=test"
|
||||
--set "kerberoshub.services.${STAGE}.queue=queuecheck-fixture-queue"
|
||||
)
|
||||
|
||||
# Read `helm template` output on stdin and print one WORKFLOWS_QUEUE value per
|
||||
# line. Matches the `- name: WORKFLOWS_QUEUE` env entry and captures the value
|
||||
# from the following `value:` line, skipping blank/comment lines in between.
|
||||
extract_workflows_queue() {
|
||||
awk '
|
||||
/^[[:space:]]*-[[:space:]]*name:[[:space:]]*WORKFLOWS_QUEUE[[:space:]]*$/ { want=1; next }
|
||||
want==1 {
|
||||
if ($0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*$/) next
|
||||
v=$0
|
||||
sub(/^[[:space:]]*value:[[:space:]]*/, "", v)
|
||||
sub(/^"/, "", v); sub(/"[[:space:]]*$/, "", v)
|
||||
sub(/[[:space:]]+$/, "", v)
|
||||
print v
|
||||
want=0
|
||||
}
|
||||
'
|
||||
}
|
||||
|
||||
assert_all_equal() {
|
||||
local expected="$1"; shift
|
||||
local label="$1"; shift
|
||||
local -a vals=("$@")
|
||||
|
||||
if [ "${#vals[@]}" -lt 2 ]; then
|
||||
echo "FAIL (${label}): expected at least 2 WORKFLOWS_QUEUE values (analysis + engine), found ${#vals[@]}" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
local v
|
||||
for v in "${vals[@]}"; do
|
||||
if [ -z "${v}" ]; then
|
||||
echo "FAIL (${label}): a deployment rendered an empty WORKFLOWS_QUEUE value" >&2
|
||||
return 1
|
||||
fi
|
||||
if [ "${v}" != "${expected}" ]; then
|
||||
echo "FAIL (${label}): WORKFLOWS_QUEUE drift detected — expected '${expected}' but a deployment rendered '${v}'" >&2
|
||||
printf ' rendered values: %s\n' "${vals[*]}" >&2
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
|
||||
echo "OK (${label}): ${#vals[@]} deployments all use WORKFLOWS_QUEUE='${expected}'"
|
||||
}
|
||||
|
||||
echo "== Rendering ${CHART_DIR} with the chart's default workflows queue =="
|
||||
default_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}")"
|
||||
mapfile -t default_vals < <(printf '%s\n' "${default_out}" | extract_workflows_queue)
|
||||
default_queue="${default_vals[0]:-}"
|
||||
assert_all_equal "${default_queue}" "default values" "${default_vals[@]}" || exit 1
|
||||
|
||||
echo "== Rendering ${CHART_DIR} with an overridden workflows queue (-> ${PROBE}) =="
|
||||
probe_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
|
||||
--set kerberoshub.services.workflows.queue="${PROBE}")"
|
||||
mapfile -t probe_vals < <(printf '%s\n' "${probe_out}" | extract_workflows_queue)
|
||||
assert_all_equal "${PROBE}" "override probe" "${probe_vals[@]}" || exit 1
|
||||
|
||||
echo "All WORKFLOWS_QUEUE consistency checks passed."
|
||||
Reference in New Issue
Block a user