feat(hub): make sprite and thumbnail prefetch count configurable (#191)

Add kerberospipeline.{sprite,thumbnail}.prefetchCount, rendered as
RABBITMQ_PREFETCH_COUNT only when greater than 0, and bump the images to
the releases that read it (sprite v1.1.21, thumbnail v1.3.15).

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

.devcontainer/Dockerfile

@@ -0,0 +1,28 @@
+FROM mcr.microsoft.com/devcontainers/go:1.25-bookworm
+
+# Remove expired Yarn GPG key from base image
+RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
+
+# Remove expired Yarn repository key (inherited from base image)
+RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
+
+# Install AZURE CLI
+RUN curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+
+# Install helm and kubectl
+RUN curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+    && chmod +x ./kubectl \
+    && sudo mv ./kubectl /usr/local/bin/kubectl
+
+# Install Argocd CLI
+RUN VERSION=$(curl -L -s https://raw.githubusercontent.com/argoproj/argo-cd/stable/VERSION)
+RUN curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/v$VERSION/argocd-linux-amd64
+RUN sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
+RUN rm argocd-linux-amd64
+
+# Install google-cloud-sdk
+RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
+RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+RUN sudo apt-get update && sudo apt-get install -y google-cloud-cli
+RUN sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin

.devcontainer/devcontainer.json

@@ -0,0 +1,23 @@
+{
+	"name": "go:1.25-bookworm",
+	"dockerFile": "Dockerfile",
+	"runArgs": [
+		"--name=helm-charts",
+		"--network=host",
+		 "--privileged"
+	],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-kubernetes-tools.vscode-kubernetes-tools",
+				"redhat.vscode-yaml",
+				"Tim-Koehler.helm-intellisense",
+				"ms-vscode.azurecli",
+				"ms-vscode-remote.remote-containers",
+				"GitHub.copilot",
+				"ms-kubernetes-tools.vscode-aks-tools",
+				"fabiospampinato.vscode-diff"
+			]
+		}
+	}
+}

.github/workflows/k3d.yaml

@@ -0,0 +1,56 @@
+name: Deploy on k3d
+on:
+  workflow_dispatch:
+  pull_request:
+jobs:
+  deploy:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+        k3d: [v5.7.5]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: "Create single cluster"
+        uses: AbsaOSS/k3d-action@v2
+        with:
+          k3d-version: ${{ matrix.k3d }}  
+          cluster-name: "k3d-cluster"
+      - name: Print Kubernetes Version
+        run: |
+          kubectl version
+      - name: Test k3d
+        run: |
+          echo "Sleeping for 120 seconds, give time for the cluster to be ready" && sleep 120
+          kubectl get no
+          kubectl get pods -A -o wide
+          kubectl get sc
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Prometheus operator
+        id: install-prometheus-operator
+        run: |
+          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
+          kubectl get crd
+          kubectl get po -A -o wide
+      - name: Install Hub Helm chart
+        id: install-hub
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          kubectl create namespace kerberos-hub
+          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
+          kubectl get pods -A -o wide
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ K3d deployment successful on ${{ matrix.os }} (${{ matrix.k3d }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ K3d deployment failed on ${{ matrix.os }} (${{ matrix.k3d }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/kind-cloud.yaml

@@ -1,42 +0,0 @@
-name: Deploy on Kind
-
-on:
-  pull_request:
-    types: [opened, synchronize, reopened]
-
-jobs:
-  deploy:
-    runs-on: ubuntu-latest
-    strategy:
-      matrix:
-        kind: [v0.21.0, v0.22.0, v0.23.0, v0.24.0]
-    steps:
-      - name: Create k8s Kind Cluster
-        uses: helm/kind-action@v1
-        with:
-          version: ${{ matrix.kind }}
-      - name: Print Kubernetes Version
-        run: |
-          kubectl version
-      - name: Test Kubernetes Cluster
-        run: |
-          kubectl get no
-          kubectl get pods -A -o wide
-          kubectl get sc
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          echo "Sleeping for 30 seconds, give time for the operator to create the CRDs" && sleep 30
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Kerberos Hub helm chart
-        id: install-kerberos-hub
-        run: |
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          echo "Sleeping for 300 seconds, give time for the helm chart to create the pods" && sleep 300
-          kubectl get pods -A -o wide
-          kubectl get pods -A -o wide | grep hub-frontend | awk '{print $3}' | grep -q '1/1' && echo "hub-frontend pod is running with status 1/1" || (echo "kerberos-hub pod is not running with status 1/1" && exit 1)

.github/workflows/kind.yaml

@@ -0,0 +1,52 @@
+name: Deploy on kind
+on:
+  workflow_dispatch:
+  pull_request:
+jobs:
+  deploy:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+        kind: [v0.25.0]
+    steps:
+      - name: Create kind
+        uses: helm/kind-action@v1
+        with:
+          version: ${{ matrix.kind }}
+      - name: Print Kubernetes Version
+        run: |
+          kubectl version
+      - name: Test kind
+        run: |
+          kubectl get no
+          kubectl get pods -A -o wide
+          kubectl get sc
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Prometheus operator
+        id: install-prometheus-operator
+        run: |
+          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
+          kubectl get crd
+          kubectl get po -A -o wide
+      - name: Install Hub Helm chart
+        id: install-hub
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          kubectl create namespace kerberos-hub
+          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
+          kubectl get pods -A -o wide
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ Kind deployment successful on ${{ matrix.os }} (${{ matrix.kind }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ Kind deployment failed on ${{ matrix.os }} (${{ matrix.kind }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/microk8s.yaml

@@ -1,25 +1,23 @@
-name: Deploy on Microk8s
-
+name: Deploy on microk8s
 on:
+  workflow_dispatch:
   pull_request:
-    types: [opened, synchronize, reopened]
-
 jobs:
   deploy:
     runs-on: ${{ matrix.os }}
     strategy:
       matrix:
-        os: [ubuntu-20.04, ubuntu-22.04, ubuntu-24.04]
-    name: MicroK8s
+        os: [ubuntu-22.04, ubuntu-24.04]
+        microk8s: [1.32/stable]
     steps:
       - uses: balchua/microk8s-actions@v0.4.3
         with:
-          channel: "1.30/stable"
+          channel: ${{ matrix.microk8s }}
           addons: '["dns", "dashboard", "hostpath-storage", "nvidia"]'
       - name: Set permissions
         run: |
           sudo chown -f -R $USER $HOME/.kube $HOME/.config
-      - name: Test MicroK8s
+      - name: Test microk8s
         id: list-pods
         run: |
           kubectl get no
@@ -30,14 +28,26 @@ jobs:
         id: install-prometheus-operator
         run: |
           kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          echo "Sleeping for 30 seconds, give time for the operator to create the CRDs" && sleep 30
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
           kubectl get crd
           kubectl get po -A -o wide
-      - name: Install Kerberos Hub helm chart
-        id: install-kerberos-hub
+      - name: Install Hub Helm chart
+        id: install-hub
         run: |
+          helm repo add kerberos https://charts.kerberos.io
           kubectl create namespace kerberos-hub
           helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          echo "Sleeping for 300 seconds, give time for the helm chart to create the pods" && sleep 300
           kubectl get pods -A -o wide
-          kubectl get pods -A -o wide | grep hub-frontend | awk '{print $3}' | grep -q '1/1' && echo "hub-frontend pod is running with status 1/1" || (echo "kerberos-hub pod is not running with status 1/1" && exit 1)
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ MicroK8s deployment successful on ${{ matrix.os }} (${{ matrix.microk8s }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ MicroK8s deployment failed on ${{ matrix.os }} (${{ matrix.microk8s }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
+          

.github/workflows/pr-description.yml

@@ -1,19 +0,0 @@
-name: Autofill PR description
-
-on: pull_request
-
-jobs:
-  openai-pr-description:
-    runs-on: ubuntu-22.04
-
-    steps:
-      - uses: actions/checkout@v4
-      - name: Autofill PR description if empty using OpenAI
-        uses: cedricve/azureopenai-pr-description@master
-        with:
-          github_token: ${{ secrets.TOKEN }}
-          openai_api_key: ${{ secrets.OPENAI_API_KEY }}
-          azure_openai_api_key: ${{ secrets.AZURE_OPENAI_API_KEY }}
-          azure_openai_endpoint: ${{ secrets.AZURE_OPENAI_ENDPOINT }}
-          azure_openai_version: ${{ secrets.AZURE_OPENAI_VERSION }}
-          overwrite_description: true

.github/workflows/release-create.yaml

@@ -1,9 +1,11 @@
-name: Release Charts
+name: Create a new release
 
 on:
   push:
     branches:
       - main
+    paths:
+      - 'charts/**/Chart.yaml'
 
 jobs:
   release:

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.88.0
+version: 0.157.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/custom-layout/i18n-custom/custom-i18n-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: custom-i18n-claim
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: azurefile-premium
+  resources:
+    requests:
+      storage: 25Mi

charts/hub/custom-layout/i18n-custom/en.json

@@ -0,0 +1,9 @@
+{
+  "nav": {
+    "cases": "Investigations",
+    "dashboard": "Home"
+  },
+  "login": {
+    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
+  }
+}

charts/hub/custom-layout/icons.js

@@ -99,6 +99,34 @@
     <path fill-rule="evenodd" clip-rule="evenodd" d="M9 6C9.55228 6 10 5.55228 10 5C10 4.44772 9.55228 4 9 4C8.44772 4 8 4.44772 8 5C8 5.55228 8.44772 6 9 6ZM9 7C10.1046 7 11 6.10457 11 5C11 3.89543 10.1046 3 9 3C7.89543 3 7 3.89543 7 5C7 6.10457 7.89543 7 9 7Z" fill="currentColor"/>
   </svg>`
 
+  /* Device group */
+  window["env"]["svg"]["deviceGroup"] = `<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <g clip-path="url(#clip0_1_20)">
+    <g clip-path="url(#clip1_1_20)">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M12.4802 6H15V5.11364C15 4.64235 14.9043 4.1751 14.7178 3.73836C14.5312 3.30157 14.257 2.90316 13.9099 2.56651C13.5626 2.2298 13.1492 1.96154 12.6925 1.77812C12.2359 1.59469 11.7456 1.5 11.25 1.5C10.7544 1.5 10.2642 1.59469 9.80746 1.77812C9.52217 1.89271 9.25373 2.04042 9.00778 2.21724L7.32179 1.72093C7.39394 1.64168 7.46868 1.56454 7.5459 1.48966C8.03441 1.01595 8.61311 0.64137 9.24838 0.386204C9.88362 0.131052 10.5637 5.99978e-08 11.25 0C11.9363 -5.99977e-08 12.6163 0.131052 13.2516 0.386204C13.8869 0.64137 14.4655 1.01595 14.9541 1.48966C15.4426 1.9634 15.8314 2.52708 16.0972 3.14913C16.3629 3.77123 16.5 4.43885 16.5 5.11364V6.75C16.5 6.94892 16.4209 7.13968 16.2803 7.28033C16.1397 7.42098 15.9489 7.5 15.75 7.5H13.6903L12.4802 6Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M13.5686 7.5H15V8.25H13.9865L14.179 9.75H15.75C16.1642 9.75 16.5 9.41423 16.5 9V6.75C16.5 6.33579 16.1642 6 15.75 6H12.5131L13.5686 7.5Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M16.5 12H13.0178V13.5H17.25C17.6642 13.5 18 13.1642 18 12.75V9.75C18 8.92155 17.3285 8.25 16.5 8.25H14.0031L14.2502 9.75H16.5V12Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M11.6761 5.18862C12.297 5.00501 12.75 4.43041 12.75 3.75C12.75 2.92157 12.0785 2.25 11.25 2.25C10.8002 2.25 10.3966 2.44801 10.1217 2.76162L10.6799 3.26263C10.8175 3.10188 11.0218 3 11.25 3C11.6642 3 12 3.33579 12 3.75C12 4.09028 11.7734 4.37763 11.4628 4.46937L11.6761 5.18862Z" fill="currentColor"/>
+    </g>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M11.8206 5.27212C11.7697 5.10777 11.6651 4.80819 11.5972 4.64915C11.3314 4.0271 10.9426 3.46342 10.4541 2.98967C9.96555 2.51597 9.38692 2.14138 8.7516 1.88622C8.11635 1.63107 7.43629 1.50002 6.75 1.50002C6.0637 1.50002 5.38363 1.63107 4.74838 1.88622C4.11311 2.14139 3.53441 2.51597 3.04591 2.98967C2.55736 3.46342 2.16854 4.0271 1.90283 4.64915C1.63709 5.27125 1.5 5.93886 1.5 6.61366V8.25002C1.5 8.66423 1.83579 9.00002 2.25 9.00002H4.99591L5.55615 7.50002H3V6.61366C3 6.14237 3.0957 5.67512 3.28225 5.23838C3.46883 4.80158 3.74296 4.40318 4.09013 4.06652C4.43735 3.72982 4.85081 3.46156 5.30746 3.27814C5.76415 3.0947 6.25439 3.00002 6.75 3.00002C7.24561 3.00002 7.73587 3.0947 8.19255 3.27814C8.64922 3.46156 9.06262 3.72982 9.40987 4.06652C9.65998 4.30905 9.87217 4.58362 10.041 4.8815L11.8206 5.27212Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M4.99564 9H3V9.75H4.89629L4.87556 11.25H2.25C1.83579 11.25 1.5 10.9142 1.5 10.5V8.25C1.5 7.83579 1.83579 7.5 2.25 7.5H5.55093L4.99564 9Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M5.0625 11.25H1.5V13.5H3.90234L3.375 15H0.75C0.335786 15 0 14.6642 0 14.25V11.25C0 10.4215 0.671573 9.75 1.5 9.75H5.0625V11.25Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M7.38875 4.85676C7.25667 4.64269 7.02 4.50002 6.75 4.50002C6.33579 4.50002 6 4.83581 6 5.25002C6 5.34965 6.01943 5.44474 6.0547 5.53172L5.44733 5.99421C5.32177 5.7749 5.25 5.52084 5.25 5.25002C5.25 4.42159 5.92157 3.75002 6.75 3.75002C7.37642 3.75002 7.91313 4.13398 8.13765 4.67938L7.38875 4.85676Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M14.1044 11.7803C13.9638 11.921 13.773 12 13.5741 12H4.57407C4.15986 12 3.82407 11.6642 3.82407 11.25V9.61364C3.82407 8.93885 3.96116 8.27123 4.2269 7.64913C4.49261 7.02709 4.88142 6.4634 5.36997 5.98966C5.85848 5.51595 6.43718 5.14137 7.07245 4.8862C7.70769 4.63105 8.38777 4.5 9.07407 4.5C9.76035 4.5 10.4404 4.63105 11.0757 4.8862C11.711 5.14137 12.2896 5.51595 12.7782 5.98966C13.2667 6.4634 13.6555 7.02708 13.9212 7.64913C14.187 8.27123 14.3241 8.93885 14.3241 9.61364V11.25C14.3241 11.4489 14.245 11.6397 14.1044 11.7803ZM12.8241 10.5V9.61364C12.8241 9.14235 12.7284 8.6751 12.5418 8.23836C12.3552 7.80157 12.0811 7.40316 11.7339 7.06651C11.3867 6.7298 10.9733 6.46154 10.5166 6.27812C10.0599 6.09469 9.56967 6 9.07407 6C8.57846 6 8.08822 6.09469 7.63153 6.27812C7.17488 6.46154 6.76142 6.7298 6.4142 7.06651C6.06702 7.40316 5.7929 7.80157 5.60632 8.23836C5.41977 8.6751 5.32407 9.14235 5.32407 9.61364V10.5H12.8241Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M3.82407 11.25C3.82407 10.8358 4.15986 10.5 4.57407 10.5H13.5741C13.9883 10.5 14.3241 10.8358 14.3241 11.25V13.5C14.3241 13.9142 13.9883 14.25 13.5741 14.25H4.57407C4.15986 14.25 3.82407 13.9142 3.82407 13.5V11.25ZM5.32407 12V12.75H12.8241V12H5.32407Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M2.32407 14.25C2.32407 13.4215 2.99564 12.75 3.82407 12.75H14.3241C15.1525 12.75 15.8241 13.4215 15.8241 14.25V17.25C15.8241 17.6642 15.4883 18 15.0741 18H3.07407C2.65985 18 2.32407 17.6642 2.32407 17.25V14.25ZM14.3241 14.25H3.82407V16.5H14.3241V14.25Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M9.07406 9C9.48827 9 9.82406 8.66421 9.82406 8.25C9.82406 7.83579 9.48827 7.5 9.07406 7.5C8.65985 7.5 8.32406 7.83579 8.32406 8.25C8.32406 8.66421 8.65985 9 9.07406 9ZM9.07406 9.75C9.90251 9.75 10.5741 9.07843 10.5741 8.25C10.5741 7.42157 9.90251 6.75 9.07406 6.75C8.24563 6.75 7.57406 7.42157 7.57406 8.25C7.57406 9.07843 8.24563 9.75 9.07406 9.75Z" fill="currentColor"/>
+    </g>
+    <defs>
+    <clipPath id="clip0_1_20">
+    <rect width="18" height="18" fill="white"/>
+    </clipPath>
+    <clipPath id="clip1_1_20">
+    <rect width="13.5" height="13.5" fill="white" transform="translate(4.5)"/>
+    </clipPath>
+    </defs>
+  </svg>`
+
     /* Active devices */
   window["env"]["svg"]["deviceActive"] = `<svg class="icon icon-camera" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M15.7071 9.70711C15.5196 9.89464 15.2652 10 15 10L3 10C2.44772 10 2 9.55228 2 9L2 6.81819C2 5.91846 2.18279 5.02831 2.53711 4.19884C2.89139 3.36945 3.40981 2.61787 4.06121 1.98621C4.71255 1.3546 5.48415 0.85516 6.33118 0.514938C7.17817 0.174736 8.08494 -2.61718e-07 9 -3.41715e-07C9.91505 -4.21712e-07 10.8218 0.174736 11.6688 0.514938C12.5159 0.855159 13.2874 1.3546 13.9388 1.98621C14.5902 2.61787 15.1086 3.36944 15.4629 4.19884C15.8172 5.02831 16 5.91846 16 6.81819L16 9C16 9.26522 15.8946 9.51957 15.7071 9.70711ZM14 8L14 6.81819C14 6.1898 13.8724 5.5668 13.6237 4.98448C13.3749 4.40209 13.0094 3.87088 12.5465 3.42201C12.0835 2.97307 11.5323 2.61539 10.9234 2.37083C10.3145 2.12625 9.66081 2 9 2C8.33919 2 7.68554 2.12625 7.07662 2.37083C6.46775 2.61539 5.91647 2.97307 5.45351 3.42201C4.99061 3.87088 4.62511 4.40209 4.37634 4.98448C4.1276 5.5668 4 6.1898 4 6.81819L4 8L14 8Z" fill="#5E8F6E"/>
@@ -685,6 +713,12 @@
     <path fill-rule="evenodd" clip-rule="evenodd" d="M11.6464 2.64645C11.8417 2.45118 12.1583 2.45118 12.3536 2.64645L15.3536 5.64645C15.5488 5.84171 15.5488 6.15829 15.3536 6.35355C15.1583 6.54882 14.8417 6.54882 14.6464 6.35355L11.6464 3.35355C11.4512 3.15829 11.4512 2.84171 11.6464 2.64645Z" fill="currentColor"/>
   </svg>`
 
+  /* Plus */
+  window["env"]["svg"]["plus"] = `<svg class="icon icon-plus" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M9 13C9.55228 13 10 12.5523 10 12V6C10 5.44772 9.55228 5 9 5C8.44772 5 8 5.44772 8 6V12C8 12.5523 8.44772 13 9 13Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M13 9C13 8.44772 12.5523 8 12 8L6 8C5.44772 8 5 8.44772 5 9C5 9.55229 5.44772 10 6 10L12 10C12.5523 10 13 9.55228 13 9Z" fill="currentColor"/>
+  </svg>`
+  
   /* Plus circle ("add" button) */
   window["env"]["svg"]["plus-circle"] = `<svg class="icon icon-plus-circle" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M9 16C5.13401 16 2 12.866 2 9C2 5.13401 5.13401 2 9 2C12.866 2 16 5.13401 16 9C16 12.866 12.866 16 9 16ZM0 9C0 13.9706 4.02944 18 9 18C13.9706 18 18 13.9706 18 9C18 4.02944 13.9706 0 9 0C4.02944 0 0 4.02944 0 9Z" fill="currentColor"/>
@@ -693,11 +727,23 @@
   </svg>`
 
 
+
   /* Plus circle ("add" button) */
   window["env"]["svg"]["play-circle"] = `<svg class="icon icon-play-circle" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M18 9C18 13.9706 13.9706 18 9 18C4.02944 18 0 13.9706 0 9C0 4.02944 4.02944 0 9 0C13.9706 0 18 4.02944 18 9ZM7.27038 13.0048C6.93762 13.2187 6.5 12.9798 6.5 12.5842V5.41586C6.5 5.02027 6.93762 4.78135 7.27038 4.99527L12.8457 8.57943C13.1519 8.77625 13.1519 9.22379 12.8457 9.42061L7.27038 13.0048Z" fill="currentColor"/>
   </svg>`
 
+  /* Play */
+  window["env"]["svg"]["play"] = `<svg class="icon icon-play" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M6 4L14 9L6 14V4Z" fill="currentColor"/>
+  </svg>`
+
+  /* Pause */
+  window["env"]["svg"]["pause"] = `<svg class="icon icon-pause" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <rect x="5" y="4" width="3" height="10" rx="0.5" fill="currentColor"/>
+    <rect x="10" y="4" width="3" height="10" rx="0.5" fill="currentColor"/>
+  </svg>`
+
   /* Preferences */
   window["env"]["svg"]["preferences"] = `<svg class="icon icon-preferences" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M6 3C6 2.44771 6.44772 2 7 2L17 2.00002C17.5523 2.00002 18 2.44773 18 3.00002C18 3.5523 17.5523 4.00002 17 4.00002L7 4C6.44771 4 6 3.55228 6 3Z" fill="currentColor"/>
@@ -727,12 +773,32 @@
     <path fill-rule="evenodd" clip-rule="evenodd" d="M3.29289 11.7071C2.90237 11.3166 2.90237 10.6834 3.29289 10.2929L8.29289 5.29289C8.68342 4.90237 9.31658 4.90237 9.70711 5.29289L14.7071 10.2929C15.0976 10.6834 15.0976 11.3166 14.7071 11.7071C14.3166 12.0976 13.6834 12.0976 13.2929 11.7071L9 7.41421L4.70711 11.7071C4.31658 12.0976 3.68342 12.0976 3.29289 11.7071Z" fill="white"/>
   </svg>`
   /* PTZ Center */
-  window["env"]["svg"]["ptz-center"] = `<svg class="icon icon-ptz-center" svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+  window["env"]["svg"]["ptz-center"] = `<svg class="icon icon-ptz-center" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
   <path d="M7 1H2C1.44772 1 1 1.44772 1 2V7" stroke="currentColor" stroke-width="2"/>
   <path d="M11 1H16C16.5523 1 17 1.44772 17 2V7" stroke="currentColor" stroke-width="2"/>
   <path d="M11 17H16C16.5523 17 17 16.5523 17 16V11" stroke="currentColor" stroke-width="2"/>
   <path d="M7 17H2C1.44772 17 1 16.5523 1 16V11" stroke="currentColor" stroke-width="2"/>
-  <path fill-rule="evenodd" clip-rule="evenodd" d="M9.2 12.0667C7.39587 12.0667 5.93333 10.6041 5.93333 8.8C5.93333 6.99587 7.39587 5.53333 9.2 5.53333C11.0041 5.53333 12.4667 6.99587 12.4667 8.8C12.4667 10.6041 11.0041 12.0667 9.2 12.0667ZM5 8.8C5 11.1196 6.8804 13 9.2 13C11.5196 13 13.4 11.1196 13.4 8.8C13.4 6.4804 11.5196 4.6 9.2 4.6C6.8804 4.6 5 6.4804 5 8.8Z" fill="white" stroke="currentColor"/>
+  <circle cx="9" cy="9" r="3" stroke="currentColor" stroke-width="2"/>
+  </svg>`
+
+  /* PTZ Zoom In */
+  window["env"]["svg"]["ptz-zoom-in"] = `<svg class="icon icon-ptz-zoom-in" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M9 3C9.55228 3 10 3.44772 10 4V8H14C14.5523 8 15 8.44772 15 9C15 9.55228 14.5523 10 14 10H10V14C10 14.5523 9.55228 15 9 15C8.44772 15 8 14.5523 8 14V10H4C3.44772 10 3 9.55228 3 9C3 8.44772 3.44772 8 4 8H8V4C8 3.44772 8.44772 3 9 3Z" fill="white"/>
+  </svg>`
+
+  /* PTZ Zoom Out */
+  window["env"]["svg"]["ptz-zoom-out"] = `<svg class="icon icon-ptz-zoom-out" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M3 9C3 8.44772 3.44772 8 4 8H14C14.5523 8 15 8.44772 15 9C15 9.55228 14.5523 10 14 10H4C3.44772 10 3 9.55228 3 9Z" fill="white"/>
+  </svg>`
+
+  /* Drag handle */
+  window["env"]["svg"]["drag"] = `<svg class="icon icon-drag" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <circle cx="6" cy="4" r="1.5" fill="currentColor"/>
+    <circle cx="12" cy="4" r="1.5" fill="currentColor"/>
+    <circle cx="6" cy="9" r="1.5" fill="currentColor"/>
+    <circle cx="12" cy="9" r="1.5" fill="currentColor"/>
+    <circle cx="6" cy="14" r="1.5" fill="currentColor"/>
+    <circle cx="12" cy="14" r="1.5" fill="currentColor"/>
   </svg>`
 
   /* Queue */
@@ -793,6 +859,14 @@
   <path fill-rule="evenodd" clip-rule="evenodd" d="M8.98547 7.85756L3.98547 4.85756L5.01447 3.14258L10.0145 6.14258L8.98547 7.85756Z" fill="currentColor"/>
   </svg>`
 
+  /* Link / Hyperlink */
+  window["env"]["svg"]["link"] = `<svg class="icon icon-link" width="18" height="18" viewBox="12 12 16 16" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M16.5 27.5C15.4 27.5 14.4 27.1 13.6 26.3C12.8 25.5 12.4 24.5 12.4 23.4C12.4 22.3 12.8 21.3 13.6 20.5L15.5 18.6C15.7 18.4 16 18.4 16.2 18.6C16.4 18.8 16.4 19.1 16.2 19.3L14.3 21.2C13.7 21.8 13.4 22.5 13.4 23.4C13.4 24.3 13.7 25 14.3 25.6C15.5 26.8 17.5 26.8 18.6 25.6L20.5 23.7C20.7 23.5 21 23.5 21.2 23.7C21.4 23.9 21.4 24.2 21.2 24.4L19.3 26.3C18.6 27.1 17.6 27.5 16.5 27.5Z" fill="currentColor" stroke="currentColor" stroke-width="1" stroke-linejoin="round"/>
+    <path d="M24.1 21.4C24 21.4 23.8 21.4 23.7 21.3C23.5 21.1 23.5 20.8 23.7 20.6L25.6 18.7C26.8 17.5 26.8 15.6 25.6 14.4C24.4 13.2 22.5 13.2 21.3 14.4L19.4 16.3C19.2 16.5 18.9 16.5 18.7 16.3C18.5 16.1 18.5 15.8 18.7 15.6L20.6 13.7C22.2 12.1 24.7 12.1 26.3 13.7C27.9 15.3 27.9 17.8 26.3 19.4L24.4 21.3C24.4 21.4 24.2 21.4 24.1 21.4Z" fill="currentColor" stroke="currentColor" stroke-width="1" stroke-linejoin="round"/>
+    <path d="M16.5 24C16.4 24 16.2 24 16.1 23.9C15.9 23.7 15.9 23.4 16.1 23.2L23 16.3C23.2 16.1 23.5 16.1 23.7 16.3C23.9 16.5 23.9 16.8 23.7 17L16.8 23.9C16.8 23.9 16.6 24 16.5 24Z" fill="currentColor" stroke="currentColor" stroke-width="1" stroke-linejoin="round"/>
+  </svg>`
+  window["env"]["svg"]["hyperlink"] = window["env"]["svg"]["link"]
+
   /* Shield check ("verify") */
   window["env"]["svg"]["shield-check"] = `<svg class="icon icon-shield-check" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M6.04289 7.79289C6.43342 7.40237 7.06658 7.40237 7.45711 7.79289L8.25 8.58579L10.5429 6.29289C10.9334 5.90237 11.5666 5.90237 11.9571 6.29289C12.3476 6.68342 12.3476 7.31658 11.9571 7.70711L8.95711 10.7071C8.56658 11.0976 7.93342 11.0976 7.54289 10.7071L6.04289 9.20711C5.65237 8.81658 5.65237 8.18342 6.04289 7.79289Z" fill="currentColor"/>
@@ -852,6 +926,13 @@
     <path fill-rule="evenodd" clip-rule="evenodd" d="M9 4C9.55228 4 10 4.44772 10 5V13C10 13.5523 9.55228 14 9 14C8.44772 14 8 13.5523 8 13V5C8 4.44772 8.44772 4 9 4Z" fill="currentColor"/>
   </svg>`
 
+  /* Invoice */
+  window["env"]["svg"]["invoice"] = `<svg class="icon icon-invoice" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M5.9453 5.54295C6.58555 5.11611 7.47538 5 8.5 5H11C11.5523 5 12 5.44772 12 6C12 6.55228 11.5523 7 11 7H8.5C7.52462 7 7.16445 7.13389 7.0547 7.20705C7.03426 7.22067 7.03361 7.22365 7.03297 7.22658C7.03285 7.22715 7.03272 7.22772 7.03245 7.22837C7.02311 7.2508 7 7.32539 7 7.5C7 7.65149 7.01759 7.7156 7.02407 7.734C7.02962 7.73847 7.04039 7.74633 7.05864 7.75676C7.24508 7.8633 7.75279 8 9 8C10.2528 8 11.2451 8.1133 11.9336 8.50676C12.3184 8.72663 12.6117 9.03408 12.7919 9.4271C12.9615 9.79718 13 10.1769 13 10.5C13 10.8231 12.9615 11.2028 12.7919 11.5729C12.6117 11.9659 12.3184 12.2734 11.9336 12.4932C11.2451 12.8867 10.2528 13 9 13H7C6.44772 13 6 12.5523 6 12C6 11.4477 6.44772 11 7 11H9C10.2472 11 10.7549 10.8633 10.9414 10.7568C10.9596 10.7463 10.9704 10.7385 10.9759 10.734C10.9824 10.7156 11 10.6515 11 10.5C11 10.3485 10.9824 10.2844 10.9759 10.266C10.9704 10.2615 10.9596 10.2537 10.9414 10.2432C10.7549 10.1367 10.2472 10 9 10C7.74721 10 6.75492 9.8867 6.06636 9.49324C5.68159 9.27337 5.38825 8.96592 5.20812 8.5729C5.0385 8.20282 5 7.82305 5 7.5C5 6.82469 5.18169 6.05202 5.9453 5.54295Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M9 4C9.55228 4 10 4.44772 10 5V13C10 13.5523 9.55228 14 9 14C8.44772 14 8 13.5523 8 13V5C8 4.44772 8.44772 4 9 4Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M1 2C1 0.89543 1.89543 0 3 0H15C16.1046 0 17 0.89543 17 2V17C17 17.3214 16.8455 17.6233 16.5847 17.8112C16.3239 17.9992 15.9887 18.0503 15.6838 17.9487L13.0767 17.0797L11.4472 17.8944C11.1657 18.0352 10.8343 18.0352 10.5528 17.8944L9 17.118L7.44721 17.8944C7.16569 18.0352 6.83431 18.0352 6.55279 17.8944L4.92327 17.0797L2.31623 17.9487C2.01128 18.0503 1.67606 17.9992 1.41529 17.8112C1.15452 17.6233 1 17.3214 1 17V2ZM15 2H3V15.6126L4.68377 15.0513C4.93538 14.9674 5.21 14.987 5.44721 15.1056L7 15.882L8.55279 15.1056C8.83431 14.9648 9.16569 14.9648 9.44721 15.1056L11 15.882L12.5528 15.1056C12.79 14.987 13.0646 14.9674 13.3162 15.0513L15 15.6126V2Z" fill="currentColor"/>
+  </svg>`
+
   /* Suitcase (detection classification)  */
   window["env"]["svg"]["suitcase"] = `<svg class="icon icon-suitcase" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
     <path fill-rule="evenodd" clip-rule="evenodd" d="M1 4C1 3.44772 1.44772 3 2 3H16C16.5523 3 17 3.44772 17 4V17C17 17.5523 16.5523 18 16 18H2C1.44772 18 1 17.5523 1 17V4ZM3 5V16H15V5H3Z" fill="currentColor"/>
@@ -1038,6 +1119,19 @@
     <path d="M7 9H16M16 9L13.375 11.625M16 9L13.375 6.375" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
   </svg>`;
 
+    /* Counting Region */
+  window["env"]["svg"]["countingRegion"] = `<svg class="icon icon-group" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M0 1C0 0.447715 0.447715 0 1 0H5C5.55228 0 6 0.447715 6 1V5C6 5.55228 5.55228 6 5 6H1C0.447715 6 0 5.55228 0 5V1ZM2 2V4H4V2H2Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M0 13C0 12.4477 0.447715 12 1 12H5C5.55228 12 6 12.4477 6 13V17C6 17.5523 5.55228 18 5 18H1C0.447715 18 0 17.5523 0 17V13ZM2 14V16H4V14H2Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M12 1C12 0.447715 12.4477 0 13 0H17C17.5523 0 18 0.447715 18 1V5C18 5.55228 17.5523 6 17 6H13C12.4477 6 12 5.55228 12 5V1ZM14 2V4H16V2H14Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M12 13C12 12.4477 12.4477 12 13 12H17C17.5523 12 18 12.4477 18 13V17C18 17.5523 17.5523 18 17 18H13C12.4477 18 12 17.5523 12 17V13ZM14 14V16H16V14H14Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M2 13V5H4V13H2Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M13 16L5 16L5 14L13 14L13 16Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M14 13V5H16V13H14Z" fill="currentColor"/>
+    <path fill-rule="evenodd" clip-rule="evenodd" d="M13 4L5 4L5 2L13 2L13 4Z" fill="currentColor"/>
+  </svg>`
+
+
    /* Load more */
    window["env"]["svg"]["loadMore"] = `  <svg width="12" height="18" viewBox="0 0 12 18" fill="none" xmlns="http://www.w3.org/2000/svg">
   <g opacity="0.5">
@@ -1089,4 +1183,67 @@
     <path fill="currentColor" d="M3.75 2h16.5c.966 0 1.75.784 1.75 1.75v16.5A1.75 1.75 0 0 1 20.25 22H3.75A1.75 1.75 0 0 1 2 20.25V3.75C2 2.784 2.784 2 3.75 2M3.5 3.75v16.5c0 .138.112.25.25.25H15v-17H3.75a.25.25 0 0 0-.25.25m13 16.75h3.75a.25.25 0 0 0 .25-.25V3.75a.25.25 0 0 0-.25-.25H16.5Z" />
   </svg>`;
 
+  /* Back single */
+  window["env"]["svg"]["backSingle"] = `<svg class="icon icon-chevron-left" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M11.5 4.5L6.5 9L11.5 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+  
+  /* Back double */
+  window["env"]["svg"]["backDouble"] = `<svg class="icon icon-double-chevron-left-spaced" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M13.5 4.5L8.5 9L13.5 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M8 4.5L3 9L8 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+
+  /* Forward single */
+  window["env"]["svg"]["forwardSingle"] = `<svg class="icon icon-chevron-right" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M6.5 4.5L11.5 9L6.5 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+
+  /* Forward double */
+  window["env"]["svg"]["forwardDouble"] = `<svg class="icon icon-double-chevron-right-spaced" width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M4.5 4.5L9.5 9L4.5 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M10 4.5L15 9L10 13.5" stroke="currentColor" stroke-width="2" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+
+  /* Marker */
+  window["env"]["svg"]["marker"] = `<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <g clip-path="url(#clip0_6_89)">
+    <path d="M16.6918 4.01166L14.074 1.31671C13.6638 0.894431 12.9964 0.894431 12.5862 1.31671L8.05873 5.97762L3.53129 10.6385L3.93802 11.0573L3.20337 11.8136L3.24617 11.9644C3.34893 12.3266 3.35504 12.7124 3.2638 13.08C3.17241 13.4465 2.98659 13.7818 2.72646 14.0496L2.10155 14.6929L2.27067 14.867L1 16.1751L2.71678 17L3.52971 16.1631L3.69883 16.3372L4.32369 15.6939C4.85375 15.1483 5.62995 14.9433 6.3494 15.1589L6.49581 15.2028L7.23039 14.4466L7.63697 14.8652L16.6918 5.54333C16.8905 5.33881 17 5.0668 17 4.77752C17 4.48823 16.8905 4.21622 16.6918 4.01166ZM2.60765 16.3622L1.88456 16.0148L2.63507 15.2421L2.90025 15.515L3.16542 15.788L2.60765 16.3622ZM6.3433 14.6096C5.48675 14.4095 4.58567 14.6741 3.95933 15.3188L3.69883 15.587L3.26457 15.14L2.83032 14.6929L3.09089 14.4247C3.41624 14.0898 3.64863 13.6704 3.76305 13.2116C3.86426 12.8037 3.86964 12.3778 3.7798 11.9704L4.30246 11.4324L6.86606 14.0715L6.3433 14.6096ZM16.3274 5.16823L7.63689 14.115L4.25998 10.6385L12.9505 1.69177C13.1598 1.4763 13.5003 1.4763 13.7097 1.69177L16.3274 4.38673C16.4288 4.49111 16.4847 4.62986 16.4847 4.77748C16.4847 4.92509 16.4288 5.06385 16.3274 5.16823Z" fill="currentColor" stroke="currentColor"/>
+    </g>
+    <defs>
+    <clipPath id="clip0_6_89">
+    <rect width="18" height="18" fill="white"/>
+    </clipPath>
+    </defs>
+  </svg>`;
+
+  /* Event */
+  window["env"]["svg"]["event"] = `<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M6 15.75V12M6 12V2.68281C6 2.33024 6.38707 2.11461 6.68686 2.30019L13.2796 6.3814C13.5581 6.55386 13.565 6.9567 13.2923 7.13844L6 12Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+
+  /* Category */
+  window["env"]["svg"]["category"] = `<svg width="18" height="18" viewBox="0 0 18 18" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <g clip-path="url(#clip0_7_135)">
+    <path d="M5.25 4.5H12.75" stroke="" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M5.25 6.75H12.75" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M6.75 12.75H11.25" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M2.25 9H1.95C1.70147 9 1.5 9.20145 1.5 9.45V16.05C1.5 16.2986 1.70147 16.5 1.95 16.5H16.05C16.2986 16.5 16.5 16.2986 16.5 16.05V9.45C16.5 9.20145 16.2986 9 16.05 9H15.75M2.25 9V1.95C2.25 1.70147 2.45147 1.5 2.7 1.5H15.3C15.5486 1.5 15.75 1.70147 15.75 1.95V9M2.25 9H15.75" stroke="currentColor" stroke-width="1.5"/>
+    </g>
+  </svg>`;
+
+  /* Pin */
+  window["env"]["svg"]["pin"] = `<svg class="icon icon-pin" width="18" height="18" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M9.5 14.5L3 21" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M5.00007 9.48528L14.1925 18.6777L15.8895 16.9806L15.4974 13.1944L21.0065 8.5211L15.1568 2.67141L10.4834 8.18034L6.69713 7.78823L5.00007 9.48528Z" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+
+  /* Unpin */
+  window["env"]["svg"]["unpin"] = `<svg class="icon icon-unpin" width="18" height="18" viewBox="0 0 24 24" fill="none" xmlns="http://www.w3.org/2000/svg">
+    <path d="M9.5 14.5L3 21" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M7.67602 7.8896L6.69713 7.78823L5.00007 9.48528L14.1925 18.6777L15.8895 16.9806L15.7879 16M11.4847 7L15.1568 2.67141L21.0065 8.5211L16.6991 12.175" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+    <path d="M3 3L21 21" stroke="currentColor" stroke-width="1.5" stroke-linecap="round" stroke-linejoin="round"/>
+  </svg>`;
+  
 })(this);
+  

charts/hub/custom-layout/templates/share_case.html

@@ -0,0 +1,418 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">A case has been shared with you</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">{{user}} shared a case with you</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Open the shared case</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
+
+
+						<a style="text-decoration: none;color: none;" href="{{url}}">
+                            <p style="font-family: Inter;
+                                                font-size: 14px;
+                                                font-style: normal;
+                                                line-height: 24px;
+                                                mso-line-height-rule:exactly;
+                                                letter-spacing: 0em;
+                                                text-align: left;
+                                                color:#FFFFFF;
+                                                background-color: #84559F;
+                                                padding-top: 6px;
+                                                padding-bottom: 6px;
+                                                padding-right: 16px;
+                                                padding-left: 16px;
+                                                width: 130px;
+                                                border-radius: 4px;
+												text-align: center;
+                                                cursor: pointer;">Open case -></p>
+                        </a>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+A case has been shared with you
+{{user}} shared a case with you
+
+Open the shared case
+{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
+{{url}}
+
+This link will expire in {{expiry}}.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/share_case_otp.html

@@ -0,0 +1,425 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">Verify your access</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">Use the code below to open the shared case</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Your verification code</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">Enter the code below on the share page to access the case.</p>
+
+                        <p style="font-family: 'Courier New', Courier, monospace;
+                                        font-size: 32px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 40px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 8px;
+                                        text-align: center;
+                                        color:#262424;
+                                        background-color: #F2F0F4;
+                                        padding-top: 16px;
+                                        padding-bottom: 16px;
+                                        padding-right: 16px;
+                                        padding-left: 16px;
+                                        margin-top: 16px;
+                                        margin-bottom: 16px;
+                                        border-radius: 4px;">{{code}}</p>
+
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case_otp.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+Verify your access
+Use the code below to open the shared case
+
+Your verification code
+{{code}}
+
+Enter this code on the share page to access the case. This code expires in {{expiry}}.
+If you didn't request this, you can safely ignore this email.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/examples/catalogs/pose-keypoints.json

@@ -0,0 +1,5 @@
+[
+  {"key": "nose", "label": "Nose"},
+  {"key": "left_shoulder", "label": "Left shoulder"},
+  {"key": "right_shoulder", "label": "Right shoulder"}
+]

charts/hub/examples/hub-api-server-tls-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hub-api-server-tls
+  namespace: kerberos-hub
+type: kubernetes.io/tls
+stringData:
+  # Paste your PEM certificate chain here (e.g., fullchain.pem)
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_YOUR_CERTIFICATE
+    -----END CERTIFICATE-----
+  # Paste your PEM private key here (e.g., privkey.pem)
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_YOUR_PRIVATE_KEY
+    -----END PRIVATE KEY-----

charts/hub/examples/workflow-configuration-overrides-values.yaml

@@ -0,0 +1,25 @@
+# Create these ConfigMaps in the release namespace before deploying the chart.
+# Keys contain complete contracts/catalogs; they are not merged with chart data.
+# Remove the retired classificationCatalog key from every values overlay.
+# Do not also set classificationCatalogExistingConfigMap.
+classificationCatalogEnabled: true
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: deployment-workflow-overrides
+      items:
+        - key: start.yaml
+          path: workflow-contracts/start.yaml
+          replace: true
+        - key: deployment-classifications.json
+          path: catalogs/classifications.json
+          replace: true
+    - name: custom-workflow-contracts
+      items:
+        - key: pose.yaml
+          path: workflow-contracts/pose.yaml
+    - name: shared-pose-catalog
+      items:
+        - key: pose-keypoints.json
+          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-configuration-values.yaml

@@ -0,0 +1,13 @@
+# Packaging only; does not activate contract loading or deploy a pose worker.
+workflowConfiguration:
+  enabled: true
+  includeDefaults: true
+  configMaps:
+    - name: custom-workflow-contracts
+      items:
+        - key: pose.yaml
+          path: workflow-contracts/pose.yaml
+    - name: shared-pose-catalog
+      items:
+        - key: pose-keypoints.json
+          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-contracts/pose.yaml

@@ -0,0 +1,53 @@
+# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
+# Hypothetical custom worker output; not an installed stage or universal pose schema.
+schemaVersion: 1
+stage: pose
+contractVersion: 1
+presentation:
+  name: Detect poses
+  description: Estimate body keypoints and posture for people in the recording.
+  icon: person
+  color: teal
+# Settings authors enter per node; the worker receives them as node data.
+params:
+  - name: minConfidence
+    label: Minimum keypoint confidence
+    type: number
+    default: 0.5
+  - name: model
+    label: Model
+    type: select
+    options: [fast, accurate]
+    optionLabels: {fast: Fast, accurate: Accurate}
+    default: fast
+fields:
+  - id: keypoint
+    label: Keypoint
+    path: people.*.keypoints.*.name
+    type: string
+    operators: [in]
+    choices:
+      file: ../catalogs/pose-keypoints.json
+  - id: posture
+    label: Posture
+    path: people.*.posture
+    type: string
+    operators: [in]
+    choices:
+      values: [standing, sitting, lying]
+  - id: confidence
+    label: Keypoint confidence
+    path: people.*.keypoints.*.confidence
+    type: number
+    operators: [gt, gte, lt, lte]
+    minimum: 0
+    maximum: 1
+# Connections leaving this stage: one section with fixed inputs, then the
+# Extra conditions catch-all (appended collapsed when not placed explicitly).
+panel:
+  sections:
+    - id: posture
+      label: Posture
+      fields:
+        - {field: posture, widget: multiselect}
+        - {field: confidence, widget: number, operator: gte, label: Minimum confidence}

charts/hub/schemas/catalog.schema.json

@@ -0,0 +1,17 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub shared choice catalog v1",
+  "description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
+  "type": "array",
+  "minItems": 1,
+  "items": {
+    "type": "object",
+    "additionalProperties": false,
+    "required": ["key", "label"],
+    "properties": {
+      "key": {"type": "string", "minLength": 1},
+      "label": {"type": "string", "minLength": 1},
+      "icon": {"type": "string", "minLength": 1}
+    }
+  }
+}

charts/hub/schemas/workflow-contract.schema.json

@@ -0,0 +1,321 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "title": "Hub workflow editor contract v1",
+  "type": "object",
+  "additionalProperties": false,
+  "required": ["schemaVersion", "stage", "contractVersion", "fields"],
+  "properties": {
+    "schemaVersion": {"const": 1},
+    "stage": {
+      "type": "string",
+      "pattern": "^[a-z][a-z0-9-]*$",
+      "description": "Stage type, not a node instance. start describes initial context."
+    },
+    "contractVersion": {"const": 1},
+    "presentation": {
+      "type": "object",
+      "additionalProperties": false,
+      "description": "How the editor shows this node. Icons and colours come from approved sets.",
+      "properties": {
+        "name": {"type": "string", "minLength": 1, "maxLength": 80},
+        "description": {"type": "string", "minLength": 1, "maxLength": 500},
+        "icon": {"enum": ["play", "camera", "person", "eye-crossed", "car", "clock", "mlModel", "share"]},
+        "color": {
+          "enum": ["blue", "teal", "rose", "amber", "indigo", "violet", "green", "grey"],
+          "description": "Theme colour token."
+        }
+      }
+    },
+    "params": {
+      "type": "array",
+      "maxItems": 64,
+      "description": "Worker-stage settings authors enter, stored per node. An explicit list (even empty) replaces kerberoshub.workflows.editorStages params. Not supported on start.",
+      "items": {"$ref": "#/definitions/param"}
+    },
+    "fields": {
+      "type": "array",
+      "description": "Typed values conditions may test. Start: the selectors device, sites, groups and classifications plus condition-only fields whose path exists in the condition root schema (models.WorkflowConditionRootSchema), e.g. device.deviceName or inputs.classify.details.*.isStatic; other inputs.<operation> paths are worker-defined. Stage: outputs relative to results.<stage>. New conditions may only use declared fields. An empty array is valid.",
+      "items": {"$ref": "#/definitions/field"},
+      "maxItems": 128
+    },
+    "controls": {
+      "type": "array",
+      "items": {
+        "type": "object",
+        "additionalProperties": false,
+        "required": ["id", "label"],
+        "properties": {
+          "id": {"enum": ["weeklySchedule", "conditions"]},
+          "label": {"type": "string", "minLength": 1}
+        }
+      },
+      "description": "Start only. Controls offered for new authoring; omitted offers none. conditions applies to edges leaving Start.",
+      "maxItems": 16
+    },
+    "triggerModes": {
+      "type": "array",
+      "minItems": 1,
+      "uniqueItems": true,
+      "items": {"enum": ["automatic", "manual"]},
+      "description": "Start only. Trigger modes offered for new authoring; omitted offers both."
+    },
+    "panel": {"$ref": "#/definitions/panel"}
+  },
+  "definitions": {
+    "choices": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "source": {
+          "type": "string",
+          "description": "Built-in authorized project-resource resolver; not a database path.",
+          "oneOf": [
+            {
+              "const": "project.devices",
+              "description": "Device keys as values, device names as labels."
+            },
+            {"const": "project.sites", "description": "Site IDs as values, site names as labels."},
+            {
+              "const": "project.groups",
+              "description": "Group IDs as values, group names as labels."
+            }
+          ]
+        },
+        "file": {
+          "type": "string",
+          "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
+          "description": "Direct shared catalog file relative to the contract; no URLs or nested references."
+        },
+        "values": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"type": ["string", "number", "boolean"]}
+        }
+      },
+      "oneOf": [{"required": ["source"]}, {"required": ["file"]}, {"required": ["values"]}]
+    },
+    "field": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "label", "path", "type", "operators"],
+      "properties": {
+        "id": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
+          "description": "Stable identifier, unique within this contract."
+        },
+        "label": {"type": "string", "minLength": 1},
+        "path": {
+          "type": "string",
+          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
+          "description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
+        },
+        "type": {"enum": ["string", "integer", "number", "boolean"]},
+        "operators": {
+          "type": "array",
+          "minItems": 1,
+          "uniqueItems": true,
+          "items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
+        },
+        "optional": {
+          "type": "boolean",
+          "default": false,
+          "description": "Field may be absent even when the node completes; branch availability is determined separately."
+        },
+        "minimum": {"type": "number"},
+        "maximum": {"type": "number"},
+        "choices": {"$ref": "#/definitions/choices"}
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"const": "string"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
+              "choices": {"properties": {"values": {"items": {"type": "string"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "boolean"}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
+              "choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
+            },
+            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number"]}}},
+          "then": {
+            "properties": {
+              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
+              "choices": {"properties": {"values": {"items": {"type": "number"}}}}
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "integer"}}},
+          "then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
+          "then": {
+            "properties": {"choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}}
+          }
+        }
+      ]
+    },
+    "param": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "type"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
+          "maxLength": 64,
+          "description": "Key in node data; unique within the contract."
+        },
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "description": {"type": "string", "minLength": 1, "maxLength": 500},
+        "group": {
+          "type": "string",
+          "minLength": 1,
+          "maxLength": 80,
+          "description": "Editor section; params sharing a group appear together."
+        },
+        "placeholder": {"type": "string", "minLength": 1, "maxLength": 160},
+        "type": {"enum": ["string", "number", "boolean", "select", "multiselect", "secret"]},
+        "required": {"type": "boolean"},
+        "default": {
+          "description": "Value the editor pre-fills and the API stores when a node leaves the setting unset; never for secrets. Typically the worker's own default."
+        },
+        "options": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 256,
+          "uniqueItems": true,
+          "items": {"type": "string", "minLength": 1, "maxLength": 160}
+        },
+        "optionLabels": {
+          "type": "object",
+          "additionalProperties": {"type": "string", "minLength": 1, "maxLength": 160}
+        },
+        "minimum": {"type": "number", "description": "Inclusive lower bound for a number setting."},
+        "maximum": {"type": "number", "description": "Inclusive upper bound for a number setting."},
+        "choices": {
+          "type": "object",
+          "additionalProperties": false,
+          "required": ["file"],
+          "properties": {
+            "file": {"type": "string", "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$"}
+          },
+          "description": "Options for a select or multiselect setting from a shared catalog file (keys become options, labels become optionLabels). Use instead of options."
+        }
+      },
+      "allOf": [
+        {
+          "if": {"properties": {"type": {"enum": ["select", "multiselect"]}}},
+          "then": {"oneOf": [{"required": ["options"]}, {"required": ["choices"]}]},
+          "else": {
+            "not": {
+              "anyOf": [{"required": ["options"]}, {"required": ["optionLabels"]}, {"required": ["choices"]}]
+            }
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "secret"}}},
+          "then": {"not": {"required": ["default"]}}
+        },
+        {
+          "if": {"properties": {"type": {"enum": ["string", "select"]}}},
+          "then": {"properties": {"default": {"type": "string"}}}
+        },
+        {
+          "if": {"properties": {"type": {"const": "multiselect"}}},
+          "then": {
+            "properties": {"default": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}}
+          }
+        },
+        {
+          "if": {"properties": {"type": {"const": "number"}}},
+          "then": {"properties": {"default": {"type": "number"}}},
+          "else": {"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}}
+        },
+        {
+          "if": {"properties": {"type": {"const": "boolean"}}},
+          "then": {"properties": {"default": {"type": "boolean"}}}
+        }
+      ]
+    },
+    "panel": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["sections"],
+      "description": "Layout of connections leaving this node. Without it, a default panel is used. A section with picker: true positions the Extra conditions catch-all; without one it is appended collapsed. On start, a panel replaces the top-level controls list.",
+      "properties": {
+        "sections": {
+          "type": "array",
+          "minItems": 1,
+          "maxItems": 16,
+          "items": {"$ref": "#/definitions/panelSection"}
+        }
+      }
+    },
+    "panelSection": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["id", "label"],
+      "properties": {
+        "id": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*$", "maxLength": 80},
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "collapsed": {"type": "boolean"},
+        "picker": {
+          "type": "boolean",
+          "description": "This section is the Extra conditions catch-all over every declared field of Start and upstream stages; it holds no fields or controls."
+        },
+        "controls": {
+          "type": "array",
+          "items": {"const": "weeklySchedule"},
+          "maxItems": 1,
+          "description": "Start only."
+        },
+        "fields": {"type": "array", "maxItems": 32, "items": {"$ref": "#/definitions/panelField"}}
+      },
+      "if": {"properties": {"picker": {"const": true}}, "required": ["picker"]},
+      "then": {"not": {"anyOf": [{"required": ["fields"]}, {"required": ["controls"]}]}}
+    },
+    "panelField": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["field", "widget"],
+      "properties": {
+        "field": {
+          "type": "string",
+          "description": "ID of a field declared in this contract; each field is placed at most once."
+        },
+        "label": {"type": "string", "minLength": 1, "maxLength": 160},
+        "widget": {
+          "enum": ["multiselect", "select", "text", "number", "toggle"],
+          "description": "multiselect: string with choices (in); select: choices (eq, ne); text: string (eq, contains, matches, ne, in); number: integer or number (gte, gt, lte, lt, eq, ne); toggle: boolean (eq, ne)."
+        },
+        "operator": {
+          "enum": ["eq", "ne", "in", "contains", "matches", "gt", "gte", "lt", "lte"],
+          "description": "Fixed operator; must be declared by the field and supported by the widget. Defaults to the first widget operator the field declares."
+        }
+      }
+    }
+  },
+  "allOf": [
+    {
+      "if": {"properties": {"stage": {"const": "start"}}, "required": ["stage"]},
+      "then": {"not": {"required": ["params"]}},
+      "else": {"not": {"anyOf": [{"required": ["controls"]}, {"required": ["triggerModes"]}]}}
+    },
+    {"if": {"required": ["panel"]}, "then": {"not": {"required": ["controls"]}}}
+  ]
+}

charts/hub/templates/_configuration.tpl

@@ -0,0 +1,120 @@
+{{- define "hub.workflowConfiguration.bundledPaths" -}}
+{{- list "workflow-contracts/start.yaml" "workflow-contracts/anpr.yaml" "workflow-contracts/forwarder.yaml" "catalogs/classifications.json" | toYaml -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.anpr.configMapName" -}}
+{{- printf "%s-workflow-contract-anpr" (.Release.Name | trunc 40 | trimSuffix "-") -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.forwarder.configMapName" -}}
+{{- printf "%s-workflow-contract-forwarder" (.Release.Name | trunc 40 | trimSuffix "-") -}}
+{{- end -}}
+
+{{- define "hub.classificationCatalog.configMapName" -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- $replacement := index $config.replacements "catalogs/classifications.json" | default dict -}}
+{{- if $replacement -}}
+{{- $replacement.name -}}
+{{- else -}}
+{{- default "classification-catalog" .Values.classificationCatalogExistingConfigMap -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Normalize both interfaces without changing the caller's values. */}}
+{{- define "hub.workflowConfiguration.settings" -}}
+{{- if hasKey .Values "classificationCatalog" -}}
+{{- fail "classificationCatalog is no longer supported; remove the values key and place the complete catalog in a ConfigMap, then use workflowConfiguration.configMaps with path: catalogs/classifications.json and replace: true" -}}
+{{- end -}}
+{{- $config := .Values.workflowConfiguration | default dict -}}
+{{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
+{{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
+{{- if and $unified $legacy -}}
+{{- fail "workflowConfiguration cannot mix includeDefaults/configMaps with existingConfigMap/items/extraConfigMaps" -}}
+{{- end -}}
+{{- $includeDefaults := true -}}
+{{- $sources := $config.extraConfigMaps | default list -}}
+{{- if $unified -}}
+{{- $sources = $config.configMaps | default list -}}
+{{- if hasKey $config "includeDefaults" -}}
+{{- $includeDefaults = $config.includeDefaults -}}
+{{- end -}}
+{{- else -}}
+{{- if $config.existingConfigMap -}}
+{{- if and $config.enabled (not $config.items) -}}
+{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
+{{- end -}}
+{{- $includeDefaults = false -}}
+{{- $sources = prepend $sources (dict "name" $config.existingConfigMap "items" ($config.items | default list)) -}}
+{{- else if and $config.enabled $config.items -}}
+{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
+{{- end -}}
+{{- end -}}
+{{- $enabled := $config.enabled | default false -}}
+{{- $replacements := dict -}}
+{{- $normalizedSources := list -}}
+{{- $bundledPaths := include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray -}}
+{{- range $sources -}}
+{{- $name := .name -}}
+{{- $items := list -}}
+{{- range .items -}}
+{{- if and $enabled .replace -}}
+{{- if or (not $unified) (not $includeDefaults) -}}
+{{- fail "workflowConfiguration item replace: true requires configMaps with includeDefaults: true" -}}
+{{- end -}}
+{{- if not (has .path $bundledPaths) -}}
+{{- fail (printf "workflowConfiguration item replace: true targets unknown bundled path %q" .path) -}}
+{{- end -}}
+{{- if hasKey $replacements .path -}}
+{{- fail (printf "duplicate workflowConfiguration replacement path %q" .path) -}}
+{{- end -}}
+{{- $_ := set $replacements .path (dict "name" $name "key" .key) -}}
+{{- end -}}
+{{- $items = append $items (omit . "replace") -}}
+{{- end -}}
+{{- $normalizedSources = append $normalizedSources (dict "name" $name "items" $items) -}}
+{{- end -}}
+{{- if hasKey $replacements "catalogs/classifications.json" -}}
+{{- if .Values.classificationCatalogExistingConfigMap -}}
+{{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
+{{- end -}}
+{{- end -}}
+{{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
+{{- end -}}
+
+{{- define "hub.workflowConfiguration.validate" -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if $config.enabled -}}
+{{- $paths := dict -}}
+{{- if $config.includeDefaults -}}
+{{- if not .Values.classificationCatalogEnabled -}}
+{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; disable includeDefaults and supply configMaps for a custom bundle" -}}
+{{- end -}}
+{{- range $path := (include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray) -}}
+{{- if not (hasKey $config.replacements $path) -}}
+{{- $_ := set $paths $path true -}}
+{{- end -}}
+{{- end -}}
+{{- else -}}
+{{- if not $config.configMaps -}}
+{{- fail "workflowConfiguration.configMaps must be nonempty when enabled without defaults" -}}
+{{- end -}}
+{{- end -}}
+{{- range $config.configMaps -}}
+{{- if not .items -}}
+{{- fail (printf "workflowConfiguration ConfigMap %q requires nonempty items" .name) -}}
+{{- end -}}
+{{- range .items -}}
+{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
+{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
+{{- end -}}
+{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$" .path)) (ne (clean .path) .path) -}}
+{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
+{{- end -}}
+{{- if hasKey $paths .path -}}
+{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
+{{- end -}}
+{{- $_ := set $paths .path true -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}

charts/hub/templates/_helpers.tpl

@@ -0,0 +1,100 @@
+{{/* Build the path to the configured MongoDB CA bundle. */}}
+{{- define "hub.mongodb.tlsCAFile" -}}
+{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
+{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
+{{- define "hub.mongodb.uri" -}}
+{{- $uri := .Values.mongodb.uri | default "" -}}
+{{- if and .Values.mongodb.tls.enabled $uri -}}
+  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
+    {{- $separator := "?" -}}
+    {{- if contains "?" $uri -}}
+      {{- $separator = "&" -}}
+    {{- end -}}
+    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stls=true" $uri $separator -}}
+  {{- end -}}
+  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
+  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
+  {{- end -}}
+{{- end -}}
+{{- $uri -}}
+{{- end -}}
+
+{{/*
+MongoDB URI with appName set to one workload, so the Atlas query profiler and
+currentOp attribute each operation to the service that issued it. Renders
+nothing when no URI is configured or mongodb.appNamePerService is false.
+Usage: include "hub.mongodb.appUri" (dict "root" $ "app" "hub-api")
+*/}}
+{{- define "hub.mongodb.appUri" -}}
+{{- $uri := include "hub.mongodb.uri" .root -}}
+{{- if and $uri .root.Values.mongodb.appNamePerService -}}
+  {{- if regexMatch "(?i)[?&]appName=" $uri -}}
+    {{- $uri = regexReplaceAll "(?i)([?&])appName=[^&]*" $uri (printf "${1}appName=%s" .app) -}}
+  {{- else -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%sappName=%s" $uri $separator .app -}}
+  {{- end -}}
+  {{- $uri -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Container env entry that overrides MONGODB_URI from mongodb-config with the
+workload's own appName. An explicit env entry takes precedence over envFrom.
+Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
+*/}}
+{{- define "hub.mongodb.appUriEnv" -}}
+{{- with include "hub.mongodb.appUri" . -}}
+- name: MONGODB_URI
+  value: {{ . | quote }}
+{{- end -}}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA Secret volume. */}}
+{{- define "hub.mongodb.tlsVolume" -}}
+- name: mongodb-tls
+  secret:
+    secretName: {{ .Values.mongodb.tls.existingSecret }}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA volume mount. */}}
+{{- define "hub.mongodb.tlsVolumeMount" -}}
+- name: mongodb-tls
+  mountPath: {{ .Values.mongodb.tls.mountPath }}
+  readOnly: true
+{{- end -}}
+
+{{/*
+OpenTelemetry sampler env entries, rendered only when configured. The OTel SDKs
+read these natively; unset keeps the SDK default (parentbased_always_on).
+Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+*/}}
+{{- define "hub.opentelemetry.samplerEnv" -}}
+{{- with .Values.opentelemetry.sampler.type }}
+- name: OTEL_TRACES_SAMPLER
+  value: {{ . | quote }}
+{{- end }}
+{{- with .Values.opentelemetry.sampler.arg }}
+- name: OTEL_TRACES_SAMPLER_ARG
+  value: {{ . | quote }}
+{{- end }}
+{{- end -}}

charts/hub/templates/admin/deployment.yaml

@@ -1,3 +1,4 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -13,6 +14,14 @@ spec:
       labels:
         app: admin
     spec:
+      {{- with .Values.admin.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.admin.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: admin
           image: "{{ .Values.global.imageRegistry }}{{ .Values.admin.repository }}:{{ .Values.admin.tag }}"
@@ -21,11 +30,17 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- with .Values.admin.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - name: http
               containerPort: 80
               protocol: TCP
           env:
+            - name: LOG_LEVEL
+              value: "{{ .Values.admin.logLevel }}"
             - name: API_URL
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: TITLE
@@ -38,4 +53,5 @@ spec:
             - name: PRODUCTION
               value: "true"
             - name: DEMO
-              value: "false"
+              value: "false"
+{{- end }}

charts/hub/templates/admin/ingress.yaml

@@ -1,4 +1,5 @@
 
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 {{ if ne .Values.ingress "" }}
 {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
 apiVersion: networking.k8s.io/v1
@@ -47,4 +48,5 @@ spec:
               serviceName: admin-svc
               servicePort: 80
   {{- end }}
+{{- end }}
 {{- end }}

charts/hub/templates/admin/oauth2-proxy.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.admin.oauth2Proxy.enabled true  }}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) (eq .Values.admin.oauth2Proxy.enabled true) }}
 apiVersion: networking.k8s.io/v1
 kind: Ingress
 metadata:
@@ -46,6 +46,14 @@ spec:
       labels:
         k8s-app: oauth2-proxy-admin
     spec:
+      {{- with .Values.admin.oauth2Proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.admin.oauth2Proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - args:
             - --provider=github
@@ -53,6 +61,10 @@ spec:
             - --upstream=file:///dev/null
             - --http-address=0.0.0.0:4180
             - --skip-auth-preflight=true
+          {{- with .Values.admin.oauth2Proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: OAUTH2_PROXY_CLIENT_ID
               value: "{{ .Values.admin.oauth2Proxy.github.clientId }}"

charts/hub/templates/admin/service.yaml

@@ -1,3 +1,4 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -13,3 +14,4 @@ spec:
       name: http
   selector:
     app: admin
+{{- end }}

charts/hub/templates/configMaps/catalogs/classifications.yaml

@@ -0,0 +1,24 @@
+{{- define "hub.classificationCatalog.defaults" -}}
+[
+  {"key": "animal", "label": "Animal", "icon": "animal"},
+  {"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
+  {"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
+  {"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
+  {"key": "lorry", "label": "Lorry", "icon": "lorry"},
+  {"key": "car", "label": "Car", "icon": "car"},
+  {"key": "handbag", "label": "Handbag", "icon": "handbag"},
+  {"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
+  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
+]
+{{- end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: classification-catalog
+  namespace: {{ .Release.Namespace }}
+data:
+  classifications.json: |-
+    {{- include "hub.classificationCatalog.defaults" . | mustFromJson | toPrettyJson | nindent 4 }}
+{{- end -}}

charts/hub/templates/configMaps/configmap-hub-audit.yaml

@@ -0,0 +1,51 @@
+{{- if .Values.audit.enabled -}}
+{{- $destinations := list -}}
+{{- $destinationIDs := dict -}}
+{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
+  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
+    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
+  {{- end -}}
+  {{- if hasKey $destinationIDs $id -}}
+    {{- fail (printf "duplicate audit destination id %q" $id) -}}
+  {{- end -}}
+  {{- $_ := set $destinationIDs $id true -}}
+  {{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
+  {{- $entry := dict
+      "id" $id
+      "type" (default "webhook" $destination.type)
+      "enabled" $destination.enabled
+      "url" $url
+      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
+      "batchSize" (default 100 $destination.batchSize)
+      "maxAttempts" (default 10 $destination.maxAttempts)
+      "startAt" (default "latest" $destination.startAt)
+      "headers" (default dict $destination.headers)
+      "filters" (default dict $destination.filters) -}}
+  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
+  {{- $bearer := default dict $destination.bearerTokenSecret -}}
+  {{- if gt (len $bearer) 0 -}}
+    {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
+    {{- $secretKey := default "token" $bearer.key -}}
+    {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- $headerFiles := dict -}}
+  {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
+    {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
+    {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
+    {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- if gt (len $headerFiles) 0 -}}
+    {{- $_ := set $entry "headerFiles" $headerFiles -}}
+  {{- end -}}
+  {{- $destinations = append $destinations $entry -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+data:
+  destinations.json: |
+    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/configmap-mongodb.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mongodb-config
+  namespace: {{ .Release.Namespace }}
+data:
+  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
+  MONGODB_HOST: "{{ .Values.mongodb.host }}"
+  MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
+  MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
+  MONGODB_USERNAME: "{{ .Values.mongodb.username }}"
+  MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
+  MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
+  MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
+  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
+  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
+  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
+  MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/configMaps/workflow-contracts/anpr.yaml

@@ -0,0 +1,135 @@
+{{/* Validate the rendered anpr.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.anpr" -}}
+schemaVersion: 1
+stage: anpr
+contractVersion: 1
+presentation:
+  name: Number plate recognition
+  description: Read the number plates of vehicles in the recording.
+  icon: car
+  color: amber
+
+# Node settings hub-anpr reads per run (see its README, "Node settings"). Each
+# overrides the matching ANPR_* environment variable; the defaults below equal
+# the worker's built-in defaults. A deployment that changes those variables
+# should change these defaults too, because new nodes store them on save.
+params:
+  - name: plateClasses
+    label: Read plates for
+    description: Vehicle classes whose plates are read (ANPR_PLATE_CLASSES).
+    type: multiselect
+    choices: {file: ../catalogs/classifications.json}
+    default: [car]
+    group: Which vehicles
+  - name: minMovement
+    label: Minimum movement
+    description: Skip vehicles that barely moved; 0 reads every vehicle (ANPR_READ_MOVEMENT_MIN).
+    type: number
+    minimum: 0
+    default: 0
+    group: Which vehicles
+  - name: maxJump
+    label: Maximum jump between frames
+    description: Drop unstable tracks; 0 disables the check (ANPR_READ_MAX_JUMP).
+    type: number
+    minimum: 0
+    default: 0
+    group: Which vehicles
+  - name: readFrames
+    label: Frames to read per vehicle
+    description: Frames OCR'd per vehicle; 0 disables OCR (ANPR_READ_FRAMES).
+    type: number
+    minimum: 0
+    maximum: 10
+    default: 1
+    group: Recognition
+  - name: readQuorum
+    label: Agreeing reads required
+    description: Reads that must agree before a plate is accepted; 0 accepts any read (ANPR_READ_QUORUM).
+    type: number
+    minimum: 0
+    maximum: 10
+    default: 0
+    group: Recognition
+  - name: minConfidence
+    label: Minimum OCR confidence
+    description: Ignore reads below this confidence (ANPR_READ_CONF_MIN).
+    type: number
+    minimum: 0
+    maximum: 1
+    default: 0
+    group: Recognition
+
+# Paths are relative to results.anpr (models.WorkflowAnprResult): one track and
+# one marker per vehicle. Plate, unread and class can be tied to the same
+# vehicle with "Must match the same item"; OCR confidence and engine live on
+# the markers and cannot be tied to a plate.
+fields:
+  - id: plate
+    label: Number plate
+    path: detections.*.tracks.*.meta.plate
+    type: string
+    operators: [eq, in, contains, matches]   # stored uppercase, letters and digits only, e.g. AB123CD
+    optional: true
+  - id: unread
+    label: Plate could not be read
+    path: detections.*.tracks.*.meta.unread
+    type: boolean
+    operators: [eq]
+    optional: true
+  - id: vehicleClass
+    label: Vehicle class (from classification)
+    path: detections.*.tracks.*.meta.classifiedAs
+    type: string
+    operators: [eq, in]
+    optional: true
+    choices: {file: ../catalogs/classifications.json}
+  - id: ocrConfidence
+    label: OCR confidence
+    path: markers.*.metadata.confidence
+    type: number
+    operators: [gte, gt, lte, lt]   # read plates only; about 0-1 for fast, 0.5 for tesseract
+    minimum: 0
+    optional: true
+  - id: ocrEngine
+    label: OCR engine
+    path: markers.*.metadata.engine
+    type: string
+    operators: [eq, in]   # read plates only
+    optional: true
+    choices: {values: [fast, tesseract, tesseract+opencv, http]}
+  - id: secondsVisible
+    label: Seconds visible
+    path: markers.*.duration
+    type: integer
+    operators: [gte, lte]
+    minimum: 0
+    optional: true
+
+# Connections leaving this stage; Extra conditions are appended collapsed.
+panel:
+  sections:
+    - id: plate
+      label: Plate
+      fields:
+        - {field: plate, widget: text, operator: contains, label: Plate contains (e.g. AB123)}
+        - {field: unread, widget: toggle, label: Plate could not be read}
+    - id: recognition
+      label: Recognition
+      collapsed: true
+      fields:
+        - {field: ocrConfidence, widget: number, operator: gte, label: Minimum OCR confidence}
+        - {field: vehicleClass, widget: multiselect}
+        - {field: secondsVisible, widget: number, operator: gte, label: Visible for at least (seconds)}
+{{ end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/anpr.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  anpr.yaml: |-
+    {{- include "hub.workflowConfiguration.anpr" . | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/workflow-contracts/forwarder.yaml

@@ -0,0 +1,95 @@
+{{/* Validate the rendered forwarder.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.forwarder" -}}
+schemaVersion: 1
+stage: forwarder
+contractVersion: 1
+presentation:
+  name: Forward to my system
+  description: Send the run's data to your own RabbitMQ destination.
+  icon: share
+  color: green
+
+# Custom workflows supply their own connection; deployment credentials are never
+# inherited. These non-secret defaults are stored on save, not read from the worker.
+params:
+  - name: broker
+    label: Provider
+    description: Custom workflows use their own RabbitMQ destination. Shared deployment integrations are reserved for global workflows.
+    type: select
+    required: true
+    options: [rabbitmq]
+    optionLabels: {rabbitmq: RabbitMQ}
+    default: rabbitmq
+    group: Delivery
+  - name: mode
+    label: Completion mode
+    description: Complete after delivery, or wait for the external result. Callback requires a deployment-configured Hub callback URL.
+    type: select
+    required: true
+    options: [delivered, callback]
+    optionLabels: {delivered: Complete after delivery, callback: Wait for result}
+    default: delivered
+    group: Delivery
+  - name: host
+    label: Host
+    description: Your RabbitMQ destination host. Required before enabling the workflow.
+    type: string
+    required: true
+    placeholder: rabbitmq.example.com
+    group: RabbitMQ destination
+  - name: port
+    label: Port
+    description: Your RabbitMQ destination port, a whole number (usually 5671 with TLS or 5672 without TLS).
+    type: number
+    required: true
+    minimum: 1
+    maximum: 65535
+    group: RabbitMQ destination
+  - name: queue
+    label: Queue
+    description: Your destination queue. Its dead-letter queue is this name followed by .forwarder-dead-letter.
+    type: string
+    required: true
+    group: RabbitMQ destination
+  - name: vhost
+    label: Virtual host
+    description: Your RabbitMQ virtual host. Use / for the broker's default virtual host.
+    type: string
+    required: true
+    placeholder: /
+    group: RabbitMQ destination
+  - name: tls
+    label: Use TLS
+    description: Encrypt the connection and verify the broker certificate using system trust roots. Deployment TLS overrides are never inherited.
+    type: boolean
+    required: true
+    default: true
+    group: RabbitMQ destination
+  - name: username
+    label: Username
+    description: Your RabbitMQ destination username. Deployment credentials are never used.
+    type: string
+    required: true
+    group: RabbitMQ credentials
+  - name: password
+    label: Password
+    description: Your RabbitMQ destination password. Required before enabling the workflow; masked after saving.
+    type: secret
+    required: true
+    group: RabbitMQ credentials
+
+# It contributes no output fields: connections after it can still use Start and
+# earlier stages in Extra conditions.
+fields: []
+{{ end -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/forwarder.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
+  namespace: {{ .Release.Namespace }}
+data:
+  forwarder.yaml: |-
+    {{- include "hub.workflowConfiguration.forwarder" . | nindent 4 }}
+{{- end }}

charts/hub/templates/configMaps/workflow-contracts/start.yaml

@@ -0,0 +1,75 @@
+{{/* Validate the rendered start.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
+{{- define "hub.workflowConfiguration.start" -}}
+schemaVersion: 1
+stage: start
+contractVersion: 1
+
+# Paths refer to the safe initial context, not the full event or credentials.
+fields:
+  - id: device
+    label: Device
+    path: device.deviceKey
+    type: string
+    operators: [eq, in]
+    choices:
+      source: project.devices
+  - id: sites
+    label: Sites
+    path: device.siteIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.sites
+  - id: groups
+    label: Groups
+    path: device.groupIds.*
+    type: string
+    operators: [in]
+    choices:
+      source: project.groups
+  - id: classifications
+    label: Initial classifications
+    path: inputs.classify.details.*.classified
+    type: string
+    operators: [in]
+    optional: true
+    choices:
+      file: ../catalogs/classifications.json
+  # Condition-only context fields (not selectors): advanced conditions on
+  # Start connections may test only declared fields, under device. or inputs.
+  - id: deviceName
+    label: Camera name
+    path: device.deviceName
+    type: string
+    operators: [eq, in, contains, matches]
+  - id: objectClass
+    label: Detected object
+    path: inputs.classify.details.*.classified
+    type: string
+    operators: [eq, ne, in, exists]
+    optional: true
+    choices:
+      file: ../catalogs/classifications.json
+
+# Controls offered for new authoring; an omitted control is not offered.
+controls:
+  - id: weeklySchedule
+    label: Weekly schedule
+  - id: conditions
+    label: Advanced conditions
+
+# Trigger modes offered for new authoring; omitted offers both.
+triggerModes: [automatic, manual]
+{{ end -}}
+{{- include "hub.workflowConfiguration.validate" . -}}
+{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/start.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+  namespace: {{ .Release.Namespace }}
+data:
+  start.yaml: |-
+    {{- include "hub.workflowConfiguration.start" . | nindent 4 }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -1,3 +1,7 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- $workflowConfiguration := include "hub.workflowConfiguration.settings" . | fromYaml -}}
+{{- $catalogReplacement := index $workflowConfiguration.replacements "catalogs/classifications.json" | default dict -}}
+{{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -17,6 +21,7 @@ spec:
       protocol: TCP
   selector:
     app: hub-api
+{{- end }}
 {{ if ne .Values.ingress "" }}
 ---
 {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
@@ -115,15 +120,100 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+        {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
+        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
+        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml")) }}
+        checksum/workflow-contract-anpr: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/anpr.yaml") . | sha256sum }}
+        {{- end }}
+        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml")) }}
+        checksum/workflow-contract-forwarder: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/forwarder.yaml") . | sha256sum }}
+        {{- end }}
       labels:
         app: hub-api
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.api.volumes }}
+      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
+      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- if $workflowConfiguration.enabled }}
+        - name: workflow-configuration
+          projected:
+            sources:
+              {{- if $workflowConfiguration.includeDefaults }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml") }}
+              - configMap:
+                  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
+                  items:
+                    - key: start.yaml
+                      path: workflow-contracts/start.yaml
+              {{- end }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml") }}
+              - configMap:
+                  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
+                  items:
+                    - key: anpr.yaml
+                      path: workflow-contracts/anpr.yaml
+              {{- end }}
+              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml") }}
+              - configMap:
+                  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
+                  items:
+                    - key: forwarder.yaml
+                      path: workflow-contracts/forwarder.yaml
+              {{- end }}
+              {{- if not $catalogReplacement }}
+              - configMap:
+                  name: {{ include "hub.classificationCatalog.configMapName" . }}
+                  items:
+                    - key: classifications.json
+                      path: catalogs/classifications.json
+              {{- end }}
+              {{- end }}
+              {{- range $workflowConfiguration.configMaps }}
+              - configMap:
+                  name: {{ .name | quote }}
+                  items:
+                    {{- toYaml .items | nindent 20 }}
+              {{- end }}
+      {{- end }}
+      {{- if $classificationCatalogEnabled }}
+        - name: classification-catalog
+          configMap:
+            name: {{ include "hub.classificationCatalog.configMapName" . }}
+            {{- if or .Values.classificationCatalogExistingConfigMap $catalogReplacement }}
+            items:
+              - key: {{ default "classifications.json" $catalogReplacement.key | quote }}
+                path: classifications.json
+            {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.api.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $serverTLS.enabled $serverTLS.secretName }}
+        - name: hub-api-server-tls
+          secret:
+            secretName: {{ $serverTLS.secretName }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
@@ -137,15 +227,46 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- with .Values.kerberoshub.api.volumeMounts}}
+          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- if $workflowConfiguration.enabled }}
+            - name: workflow-configuration
+              mountPath: /etc/kerberos/configuration
+              readOnly: true
+          {{- end }}
+          {{- if $classificationCatalogEnabled }}
+            - name: classification-catalog
+              mountPath: /etc/kerberos/classifications
+              readOnly: true
+          {{- end }}
+          {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $serverTLS.enabled $serverTLS.secretName }}
+            - name: hub-api-server-tls
+              mountPath: {{ $serverTLS.mountPath }}
+              readOnly: true
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          # Mongodb - loaded from ConfigMap
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
+            {{- if $classificationCatalogEnabled }}
+            - name: CLASSIFICATION_CATALOG_FILE
+              value: /etc/kerberos/classifications/classifications.json
+            {{- end }}
             - name: ENVIRONMENT
               value: "{{ .Values.environment }}"
             - name: READ_ONLY
               value: "{{ .Values.readOnly }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.api.logLevel }}"
             - name: SUPPORT_ENABLED
               value: "{{ .Values.kerberoshub.support.enabled }}"
             - name: CLOUD_API_URL
@@ -154,6 +275,26 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.api.corsAllowedOrigins }}
+            {{- $corsOrigins = append $corsOrigins . }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"
@@ -168,6 +309,26 @@ spec:
             - name: API_KEY
               value: "{{ .Values.kerberoshub.api.apiKey }}"
 
+            # MQTT credentials (served via /runtime/config to authenticated
+            # frontend clients; no longer exposed in the public env.js).
+            - name: MQTT_USERNAME
+              value: "{{ .Values.mqtt.username }}"
+            - name: MQTT_PASSWORD
+              value: "{{ .Values.mqtt.password }}"
+
+            # TURN credentials (served via /runtime/config to authenticated
+            # frontend clients; no longer exposed in the public env.js).
+            - name: TURN_USERNAME
+              value: "{{ .Values.turn.username }}"
+            - name: TURN_PASSWORD
+              value: "{{ .Values.turn.password }}"
+            {{- if .Values.kerberoshub.api.serverTLS.enabled }}
+            - name: TLS_CERT_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"
+            - name: TLS_KEY_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.keyFile }}"
+            {{- end }}
+
             # Kerberos Hub
             - name: LICENSE_KEY
               value: "{{ .Values.license }}"
@@ -180,6 +341,27 @@ spec:
             - name: KERBEROS_JWT_SECRET
               value: "{{ .Values.kerberoshub.api.jwtSecret }}"
 
+            # Temporarily stop serving the polled GET /devices list (204, no DB reads).
+            - name: DISABLE_AGENT_HEARTBEAT
+              value: {{ .Values.kerberoshub.api.disableAgentHeartbeat | default false | quote }}
+
+            # Media proxy: hide Vault/storage endpoints behind hub-api URLs.
+            {{- $mediaProxy := .Values.kerberoshub.api.mediaProxy | default dict }}
+            - name: MEDIA_PROXY_ENABLED
+              value: {{ $mediaProxy.enabled | default false | quote }}
+            {{- if $mediaProxy.publicUrl }}
+            - name: MEDIA_PROXY_PUBLIC_URL
+              value: {{ $mediaProxy.publicUrl | quote }}
+            {{- end }}
+            {{- if $mediaProxy.key }}
+            - name: MEDIA_PROXY_KEY
+              value: {{ $mediaProxy.key | quote }}
+            {{- end }}
+            {{- if $mediaProxy.ttl }}
+            - name: MEDIA_PROXY_TTL
+              value: {{ $mediaProxy.ttl | quote }}
+            {{- end }}
+
             # SSO (OIDC) setup
             - name: SSO_DOMAINS
               value:  "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
@@ -206,6 +388,22 @@ spec:
             - name: QUEUE_NAME
               value: "{{ .Values.queueName }}"
 
+            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
+            # SAME set the workflows engine consumes, assembled from the enabled
+            # definitions under kerberoshub.workflows.definitions (see
+            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
+            # read-only to surface config workflows alongside the user workflows
+            # it stores in the database; the config workflows are never persisted.
+            - name: WORKFLOW_DEFINITIONS
+              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+            # Deployment service routing catalog used by API-owned embedded
+            # workflows (for example the one-stage case redaction modal flow).
+            - name: WORKFLOW_STAGE_QUEUES
+              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+            # Stages tenants may place in the workflow editor (see workflows.editorStages).
+            - name: WORKFLOW_EDITOR_STAGES
+              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
+
             # Stripe for billing
             - name: STRIPE_KEY
               value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
@@ -266,22 +464,14 @@ spec:
               value: "{{ .Values.rabbitmq.username }}"
             - name: RABBITMQ_PASSWORD
               value: "{{ .Values.rabbitmq.password }}"
-
-            # Mongodb
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_URI
-              value: "{{ .Values.mongodb.uri }}"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_AUTHENTICATION_MECHANISM
-              value: "{{ .Values.mongodb.authenticationMechanism }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
+            - name: AUDIT_ENABLED
+              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
+            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            {{- end }}
 
             # Slack notifications (this will send events/logs to a specific channel).
             - name: SLACK_ENABLED
@@ -291,22 +481,6 @@ spec:
             - name: SLACK_USERNAME
               value: "{{ .Values.kerberoshub.api.slack.username }}"
 
-            # Elastic search - Kibana
-            - name: LOGGING_ELASTICSEARCH
-              value: "{{ .Values.kerberoshub.api.elasticsearch.enabled }}"
-            - name: LOGGING_ELASTICSEARCH_PROTOCOL
-              value: "{{ .Values.kerberoshub.api.elasticsearch.protocol }}"
-            - name: LOGGING_ELASTICSEARCH_HOST
-              value: "{{ .Values.kerberoshub.api.elasticsearch.host }}"
-            - name: LOGGING_ELASTICSEARCH_PORT
-              value: "{{ .Values.kerberoshub.api.elasticsearch.port }}"
-            - name: LOGGING_ELASTICSEARCH_INDEX
-              value: "{{ .Values.kerberoshub.api.elasticsearch.index }}"
-            - name: LOGGING_ELASTICSEARCH_USERNAME
-              value: "{{ .Values.kerberoshub.api.elasticsearch.username }}"
-            - name: LOGGING_ELASTICSEARCH_PASSWORD
-              value: "{{ .Values.kerberoshub.api.elasticsearch.password }}"
-
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -332,10 +506,22 @@ spec:
               value: "{{ .Values.email.templates.share }}"
             - name: SHARE_TITLE
               value: "{{ .Values.email.templates.shareTitle }}"
+            - name: CASE_SHARE_TEMPLATE
+              value: "{{ .Values.email.templates.caseShare }}"
+            - name: CASE_SHARE_TITLE
+              value: "{{ .Values.email.templates.caseShareTitle }}"
+            - name: CASE_SHARE_OTP_TEMPLATE
+              value: "{{ .Values.email.templates.caseShareOtp }}"
+            - name: CASE_SHARE_OTP_TITLE
+              value: "{{ .Values.email.templates.caseShareOtpTitle }}"
             - name: ASSIGN_TASK_TEMPLATE
               value: "{{ .Values.email.templates.assignTask }}"
             - name: ASSIGN_TASK_TITLE
               value: "{{ .Values.email.templates.assignTaskTitle }}"
+            - name: DEFAULT_TASK_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.api.defaultTaskRetentionDays }}"
+            - name: CASES_MAX_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.api.casesMaxRetentionDays }}"
 
             # SMTP
             - name: SMTP_SERVER
@@ -374,19 +560,23 @@ spec:
             - name: VAULT_SPRITE_SECRET_KEY
               value: "{{ .Values.kerberosvault.sprite.secretKey }}"
             - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberosvault.sprite.interval }}"
+              value: "{{ .Values.kerberospipeline.sprite.interval }}"
             - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberosvault.sprite.width }}"
+              value: "{{ .Values.kerberospipeline.sprite.width }}"
             - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberosvault.sprite.height }}"
+              value: "{{ .Values.kerberospipeline.sprite.height }}"
             {{- if .Values.kerberoshub.extraEnv }}
             {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
             {{- end }}
 
+            {{- if .Values.opentelemetry.enabled }}
             # Open Telemetry tracing
             - name: OTEL_EXPORTED_OTLP_ENABLED
-              value: "{{ .Values.kerberoshub.api.otlp.enabled }}"
+              value: "{{ .Values.opentelemetry.enabled }}"
             - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-              value: "{{ .Values.kerberoshub.api.otlp.routingEnabled }}"
+              value: "{{ .Values.opentelemetry.routingEnabled }}"
             - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "{{ .Values.kerberoshub.api.otlp.endpoint }}"
+              value: "{{ .Values.opentelemetry.collector.endpoint }}"
+            {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 12 }}
+            {{- end }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-audit-servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-audit-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-audit
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-audit
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-hub/hub-audit.yaml

@@ -0,0 +1,167 @@
+{{- if .Values.audit.enabled -}}
+{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
+{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.audit.replicas }}
+  selector:
+    matchLabels:
+      app: hub-audit
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-audit
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      volumes:
+        - name: destinations
+          configMap:
+            name: hub-audit
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+      {{- $bearer := default dict $destination.bearerTokenSecret }}
+      {{- $secretHeaders := default dict $destination.secretHeaders }}
+      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+          projected:
+            sources:
+            {{- if gt (len $bearer) 0 }}
+              - secret:
+                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
+                  items:
+                    - key: {{ default "token" $bearer.key | quote }}
+                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
+            {{- end }}
+            {{- range $headerName, $secret := $secretHeaders }}
+              - secret:
+                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
+                  items:
+                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
+                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
+            {{- end }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: hub-audit
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
+          {{- with .Values.kerberoshub.audit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: metrics
+              containerPort: 2112
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          volumeMounts:
+            - name: destinations
+              mountPath: /etc/hub-audit
+              readOnly: true
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- $bearer := default dict $destination.bearerTokenSecret }}
+          {{- $secretHeaders := default dict $destination.secretHeaders }}
+          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
+              readOnly: true
+          {{- end }}
+          {{- end }}
+          {{- with .Values.kerberoshub.audit.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-audit") | nindent 12 }}
+            - name: RABBITMQ_HOST
+              value: {{ .Values.rabbitmq.host | quote }}
+            - name: RABBITMQ_EXCHANGE
+              value: {{ .Values.rabbitmq.exchange | quote }}
+            - name: RABBITMQ_USERNAME
+              value: {{ .Values.rabbitmq.username | quote }}
+            - name: RABBITMQ_PASSWORD
+              value: {{ .Values.rabbitmq.password | quote }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            - name: AUDIT_MAX_RETRIES
+              value: {{ .Values.audit.intake.maxRetries | quote }}
+            - name: AUDIT_PREFETCH_COUNT
+              value: {{ .Values.audit.intake.prefetchCount | quote }}
+            - name: AUDIT_PERSIST_TIMEOUT
+              value: {{ .Values.audit.intake.persistTimeout | quote }}
+            - name: DISPATCH_INTERVAL
+              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
+            - name: LEASE_DURATION
+              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          {{- with .Values.kerberoshub.audit.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.kerberoshub.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-audit
+    service: hub-audit
+spec:
+  ports:
+    - name: metrics
+      port: 2112
+      targetPort: metrics
+      protocol: TCP
+  selector:
+    app: hub-audit
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup-servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-cleanup-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-cleanup
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-cleanup
+  endpoints:
+    - port: hub-metrics
+      interval: 15s
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -1,10 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-cleanup
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.cleanup.replicas }}
   selector:
     matchLabels:
       app: hub-cleanup
@@ -16,13 +17,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-cleanup
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.cleanup.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: hub-cleanup
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
@@ -31,25 +51,86 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          ports:
+            - containerPort: 8080
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-cleanup") | nindent 12 }}
+            - name: MODE
+              value: "{{ .Values.kerberoshub.cleanup.mode }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.cleanup.logLevel }}"
+            - name: RUN_INTERVAL_MINUTES
+              value: "{{ .Values.kerberoshub.cleanup.runIntervalMinutes }}"
+            - name: CLEANUP_USERNAMES
+              value: "{{ .Values.kerberoshub.cleanup.cleanupUsernames }}"
             - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+              value: "{{ .Values.readOnly }}"
             - name: MAX_DAYS
               value: "{{ .Values.kerberoshub.cleanup.maxDays }}"
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_URI
-              value: "{{ .Values.mongodb.uri }}"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_AUTHENTICATION_MECHANISM
-              value: "{{ .Values.mongodb.authenticationMechanism }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
+            - name: BATCH_SIZE
+              value: "{{ .Values.kerberoshub.cleanup.batchSize }}"
+            - name: USER_BATCH_SIZE
+              value: "{{ .Values.kerberoshub.cleanup.userBatchSize }}"
+            - name: MAX_USERS_PER_RUN
+              value: "{{ .Values.kerberoshub.cleanup.maxUsersPerRun }}"
+            - name: PROGRESS_EVERY
+              value: "{{ .Values.kerberoshub.cleanup.progressEvery }}"
+            - name: ACTIVE_USER_RESCAN_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.activeUserRescanHours }}"
+            - name: INACTIVE_USER_RESCAN_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.inactiveUserRescanHours }}"
+            - name: READ_TIMEOUT_SECONDS
+              value: "{{ .Values.kerberoshub.cleanup.readTimeoutSeconds }}"
+            - name: DELETE_TIMEOUT_SECONDS
+              value: "{{ .Values.kerberoshub.cleanup.deleteTimeoutSeconds }}"
+            - name: REPORT_INCLUDE_STATS
+              value: "{{ .Values.kerberoshub.cleanup.reportIncludeStats }}"
+            - name: DRY_RUN
+              value: "{{ .Values.kerberoshub.cleanup.dryRun }}"
+            - name: DEBUG
+              value: "{{ .Values.kerberoshub.cleanup.debug }}"
+            - name: GLOBAL_PASS_ENABLED
+              value: "{{ .Values.kerberoshub.cleanup.globalPassEnabled }}"
+            - name: GLOBAL_PASS_INTERVAL_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.globalPassIntervalHours }}"
+            - name: GLOBAL_PASS_DELETE_BUDGET
+              value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
+            - name: DEFAULT_TASK_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
+            - name: AUDIT_EVENT_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
+            - name: WORKFLOW_RUN_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.workflowRunRetentionDays | default "0" }}"
           {{- if .Values.kerberoshub.extraEnv }}
           {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
           {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-cleanup
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-cleanup
+    service: hub-cleanup
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-cleanup
+{{- end }}

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -1,3 +1,4 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.frontend.demoEnabled -}}
 apiVersion: v1
 kind: Service
 metadata:
@@ -81,6 +82,9 @@ spec:
       labels:
         app: hub-frontend-demo
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -89,6 +93,10 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: hub-frontend-demo
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
@@ -105,8 +113,12 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        - name: SSO_DOMAIN
-          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
+        - name: SSO_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
+        - name: SSO_FORCE_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
         - name: TITLE
           value: "{{ .Values.kerberoshub.frontend.title }}"
         - name: LOGO_NAME
@@ -128,6 +140,10 @@ spec:
           value: "true"
         - name: DEMO
           value: "true"
+        - name: MULTI_TENANT
+          value: "{{ .Values.kerberoshub.frontend.multiTenant }}"
+        - name: TENANT_BASE_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.tenantBaseDomain }}"
 
         # Mqtt (VERNEMQ)
         - name: MQTT_PROTOCOL
@@ -136,18 +152,24 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        - name: MQTT_USERNAME
-          value: "{{ .Values.mqtt.username }}"
-        - name: MQTT_PASSWORD
-          value: "{{ .Values.mqtt.password }}"
+        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
+        - name: MQTT_LEGACY_SERVER
+          value: "{{ .Values.mqtt.legacy.host }}"
+        - name: MQTT_LEGACY_PORT
+          value: "{{ .Values.mqtt.legacy.port }}"
+
+        # OpenAI
+        - name: OPENAI_ENABLED
+          value: "{{ .Values.openai.enabled }}"
 
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        - name: TURN_USERNAME
-          value: "{{ .Values.turn.username }}"
-        - name: TURN_PASSWORD
-          value: "{{ .Values.turn.password }}"
+        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -171,39 +193,14 @@ spec:
         - name: GOOGLEMAPS_KEY
           value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
 
+        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
+
         # Zendesk for support
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        # Titles and descriptions on pages
-        - name: LOGIN_DESCRIPTION
-          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
-        - name: LOGIN_COPYRIGHT
-          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
-        - name: PAGE_DASHBOARD_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
-        - name: PAGE_DASHBOARD_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
-        - name: PAGE_LATESTEVENTS_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
-        - name: PAGE_LATESTEVENTS_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
-        - name: PAGE_LIVESTREAM_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
-        - name: PAGE_LIVESTREAM_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
-        - name: PAGE_MEDIA_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
-        - name: PAGE_MEDIA_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
-        - name: PAGE_DASHBOARD_CPU_USAGE
-          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
-        - name: PAGE_DASHBOARD_FPS
-          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
-        - name: PAGE_DASHBOARD_MLA
-          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
-        - name: PAGE_DASHBOARD_OBJECTS
-          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
         - name: HIDE_ADD_AGENT
           value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
 
@@ -228,10 +225,108 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
         - name: NAVIGATION_LINK_URL_5
           value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
-
         - name: CASE_FILTER_ASSIGNEES_DEFAULT
           value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
-        # Custom colors for floor-plans
+
+        # features > general
+        - name: FEATURE_CASE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
+        - name: FEATURE_WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
+        - name: FEATURE_DARK_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: FEATURE_LANDING_PAGE
+          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
+
+        # features > internationalization (i18n)
+        - name: FEATURE_I18N_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
+        - name: DEFAULT_LANGUAGE
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
+
+        # features > liveview
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
+        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
+        - name: FEATURE_LIVEVIEW_PAGE_SIZE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
+        - name: FEATURE_LIVEVIEW_MAX_STREAMS
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
+
+        # features > devices
+        - name: FEATURE_DEVICES_HIDE_AGENT
+          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
+
+        # features > floorplan
+        - name: FEATURE_FLOORPLAN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
+        # features > map
+        - name: MAP_TILE_URL_LIGHT
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
+        - name: MAP_TILE_URL_DARK
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
+        - name: MAP_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
+
+        - name: COLOR_TRACK_BOX
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
+        - name: COLOR_TRACK_BOX_HOVER
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
+        - name: COLOR_TRACK_BOX_DRAWING
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
+        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
         - name: COLOR_DEVICE_ACTIVE
           value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
         - name: COLOR_DEVICE_INACTIVE
@@ -240,13 +335,62 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
         - name: COLOR_DEVICE_MOTION
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
-        - name: COLOR_FLOORPLAN_LABEL_TEXT
+        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
+        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
           value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
-        - name: COLOR_FLOORPLAN_LABEL_BACKGROUND
+        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
           value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
         - name: COLOR_DEVICE_MARKER_BORDER
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
+
+        # features > video edits
+        - name: FEATURE_VIDEO_EDITS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
+
+        # features > face redaction 
+        - name: FEATURE_FACE_REDACTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+        
+        # features > media
+        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
+        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
         
         {{- if .Values.kerberoshub.extraEnv }}
         {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
         {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -1,3 +1,5 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- if .Values.kerberoshub.frontend.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
@@ -13,6 +15,7 @@ spec:
     name: http
   selector:
     app: hub-frontend
+{{- end }}
 {{ if ne .Values.ingress "" }}
 ---
 {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
@@ -160,6 +163,9 @@ spec:
       labels:
         app: hub-frontend
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -168,6 +174,10 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: hub-frontend
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
@@ -184,6 +194,8 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberoshub.frontend.logLevel }}"
         - name: SSO_DOMAINS
           # get the domain attribute from the list of sso domains
           value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
@@ -223,10 +235,9 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        - name: MQTT_USERNAME
-          value: "{{ .Values.mqtt.username }}"
-        - name: MQTT_PASSWORD
-          value: "{{ .Values.mqtt.password }}"
+        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
         - name: MQTT_LEGACY_SERVER
           value: "{{ .Values.mqtt.legacy.host }}"
         - name: MQTT_LEGACY_PORT
@@ -239,10 +250,9 @@ spec:
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        - name: TURN_USERNAME
-          value: "{{ .Values.turn.username }}"
-        - name: TURN_PASSWORD
-          value: "{{ .Values.turn.password }}"
+        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -270,39 +280,6 @@ spec:
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        # Titles and descriptions on pages
-        - name: LOGIN_DESCRIPTION
-          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
-        - name: LOGIN_COPYRIGHT
-          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
-        - name: PAGE_DASHBOARD_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
-        - name: PAGE_DASHBOARD_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
-        - name: PAGE_LATESTEVENTS_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
-        - name: PAGE_LATESTEVENTS_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
-        - name: PAGE_LIVESTREAM_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
-        - name: PAGE_LIVESTREAM_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
-        - name: PAGE_MEDIA_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
-        - name: PAGE_MEDIA_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
-        - name: PAGE_DAY_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dayTitle }}"
-        - name: PAGE_DAY_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.daySubTitle }}"
-        - name: PAGE_DASHBOARD_CPU_USAGE
-          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
-        - name: PAGE_DASHBOARD_FPS
-          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
-        - name: PAGE_DASHBOARD_MLA
-          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
-        - name: PAGE_DASHBOARD_OBJECTS
-          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
         - name: HIDE_ADD_AGENT
           value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
 
@@ -329,6 +306,109 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
         - name: CASE_FILTER_ASSIGNEES_DEFAULT
           value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
+
+        # features > general
+        - name: FEATURE_CASE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
+        - name: FEATURE_WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
+        - name: FEATURE_DARK_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: FEATURE_LANDING_PAGE
+          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
+
+        # features > internationalization (i18n)
+        - name: FEATURE_I18N_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
+        - name: DEFAULT_LANGUAGE
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
+
+        # features > liveview
+        - name: FEATURE_DEFAULT_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
+        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
+        - name: FEATURE_LIVEVIEW_PAGE_SIZE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
+        - name: FEATURE_LIVEVIEW_MAX_STREAMS
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
+
+        # features > devices
+        - name: FEATURE_DEVICES_HIDE_AGENT
+          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
+
+        # features > floorplan
+        - name: FEATURE_FLOORPLAN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
+
+        # features > map
+        - name: MAP_TILE_URL_LIGHT
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
+        - name: MAP_TILE_URL_DARK
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
+        - name: MAP_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
+
+        - name: COLOR_TRACK_BOX
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
+        - name: COLOR_TRACK_BOX_HOVER
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
+        - name: COLOR_TRACK_BOX_DRAWING
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
+        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
         - name: COLOR_DEVICE_ACTIVE
           value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
         - name: COLOR_DEVICE_INACTIVE
@@ -337,23 +417,75 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
         - name: COLOR_DEVICE_MOTION
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
         - name: COLOR_FLOOR_PLAN_LABEL_TEXT
           value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
         - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
           value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
         - name: COLOR_DEVICE_MARKER_BORDER
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
-        - name: FLOOR_PLAN_NAME
-          value: "{{ .Values.kerberoshub.frontend.floorPlanName }}"
-        - name: SITES_NAME
-          value: "{{ .Values.kerberoshub.frontend.sitesName }}"
-        - name: GROUPS_NAME
-          value: "{{ .Values.kerberoshub.frontend.groupsName }}"
-        - name: SITE_GROUP_NAME
-          value: "{{ .Values.kerberoshub.frontend.siteGroupName }}"
-        - name: DEVICE_GROUP_NAME
-          value: "{{ .Values.kerberoshub.frontend.deviceGroupName }}"
-          
+
+        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
+        - name: COLOR_CHART_SELECTION_FILL
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
+        - name: COLOR_CHART_SELECTION_STROKE
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionStroke }}"
+        - name: COLOR_CHART_GRID_STROKE
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartGridStroke }}"
+
+        # features > video edits
+        - name: FEATURE_VIDEO_EDITS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
+
+        # features > face redaction 
+        - name: FEATURE_FACE_REDACTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+        
+        # features > media
+        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
+        - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
+        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
+        
+
         {{- if .Values.kerberoshub.extraEnv }}
         {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
         {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -1,10 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-monitor-device
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.monitordevice.replicas }}
   selector:
     matchLabels:
       app: hub-monitor-device
@@ -16,15 +17,30 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-monitor-device
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.monitordevice.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
@@ -35,29 +51,24 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
             - name: READ_ONLY
               value: "{{ .Values.readonly }}"
-            # Mongodb
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_URI
-              value: "{{ .Values.mongodb.uri }}"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_AUTHENTICATION_MECHANISM
-              value: "{{ .Values.mongodb.authenticationMechanism }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
-
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -90,3 +101,4 @@ spec:
         {{- if .Values.kerberoshub.extraEnv }}
         {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
         {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-oauth2-proxy.yaml

@@ -1,4 +1,4 @@
-{{- if .Values.kerberoshub.oauth2Proxy.enabled -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.oauth2Proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,6 +16,14 @@ spec:
       labels:
         k8s-app: oauth2-proxy
     spec:
+      {{- with .Values.kerberoshub.oauth2Proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.oauth2Proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - args:
             - --provider=github
@@ -23,6 +31,10 @@ spec:
             - --upstream=file:///dev/null
             - --http-address=0.0.0.0:4180
             - --skip-auth-preflight=true
+          {{- with .Values.kerberoshub.oauth2Proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           env:
             - name: OAUTH2_PROXY_CLIENT_ID
               value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientId }}"

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -1,10 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-reactivate-subscription
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.reactivate.replicas }}
   selector:
     matchLabels:
       app: hub-reactivate-subscription
@@ -16,6 +17,8 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-reactivate-subscription
     spec:
@@ -23,25 +26,42 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.reactivate.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: hub-reactivate-subscription
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
+          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
+            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-reactivatesubscriptions") | nindent 12 }}
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
             - name: READ_ONLY
               value: "{{ .Values.readonly }}"
-            - name: MONGODB_URI
-              value: "{{ .Values.mongodb.uri }}"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_AUTHENTICATION_MECHANISM
-              value: "{{ .Values.mongodb.authenticationMechanism }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
             - name: AWS_ACCESS_KEY_ID
               value: "{{ .Values.kerberoshub.api.aws.accessKey }}"
             - name: AWS_SECRET_ACCESS_KEY
@@ -49,3 +69,4 @@ spec:
             {{- if .Values.kerberoshub.extraEnv }}
             {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
             {{- end }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui") (eq .Values.mode "pipeline")) .Values.kerberoshub.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.kerberoshub.serviceAccount.annotations | nindent 4 }}
+  {{- with .Values.kerberoshub.serviceAccount.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -0,0 +1,96 @@
+{{/*
+Reserve every effective identity, including disabled definitions, so enabling a
+workflow later cannot silently alias another workflow's runs or references.
+*/}}
+{{- define "kerberoshub.workflows.validateDefinitions" -}}
+{{- $identities := dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- $id := sha256sum $name | trunc 24 -}}
+{{- if hasKey $wf "id" -}}
+{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
+{{- if not (kindIs "string" $wf.id) -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
+{{- fail $invalid -}}
+{{- end -}}
+{{- $id = lower $wf.id -}}
+{{- end -}}
+{{- if hasKey $identities $id -}}
+{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
+{{- end -}}
+{{- $_ := set $identities $id $name -}}
+{{- end -}}
+{{- end -}}
+
+{{/*
+Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
+JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
+This is the engine's boot-loaded configuration source and deployment stage
+catalog: several distinct config workflows can run over one recording — each
+opens its own run and dispatches only its own stages. Organisation-scoped
+database workflows are discovered separately at runtime.
+
+Each enabled definition contributes one workflow object:
+  id        optional explicit stable identity, normalized to lowercase. Omitted
+            for legacy definitions; their effective id is SHA256(name)[:24].
+  name      the map key (mutable display name when an explicit id is supplied).
+  enabled   always true here (a disabled definition is skipped entirely).
+  source    "config" — provenance marking a Helm-defined, deployment-global,
+            ops-managed workflow (read-only in the API, no owning organisation).
+  triggers  how a run OPENS. Defaults to a single bare automatic trigger
+            (opens for every recording); narrow with device/schedule triggers.
+            Per-stage `needs` (below) decide which stages then FIRE.
+  stages    the executable stage set, each contributing the same routing
+            descriptor the stageRegistry emits:
+              operation  the stage's operation (unique within the workflow).
+              dispatch   "always" (default) | "conditional".
+              queue      from the matching services.<operation>.queue
+                         (authoritative; omitted when unset so the engine
+                         derives "kcloud-<operation>-queue.fifo").
+              needs      conditional stages only: upstream dependencies, each
+                         {operation?, condition?}, carried through verbatim.
+              needsMode  conditional stages: "any" (default) | "all".
+*/}}
+{{- define "kerberoshub.workflows.workflowDefinitions" -}}
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
+{{- $defs := list -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- if $wf.enabled -}}
+{{- $stages := list -}}
+{{- range $stage := $wf.stages -}}
+{{- $op := $stage.operation -}}
+{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
+{{- $service := index $services $op -}}
+{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
+{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
+{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
+{{- $stages = append $stages $entry -}}
+{{- end -}}
+{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
+{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
+{{- $defs = append $defs $def -}}
+{{- end -}}
+{{- end -}}
+{{- $defs | toJson -}}
+{{- end -}}
+
+{{/*
+Expose the deployment's operation→queue catalog to API producers that seed
+embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
+are enabled for internal flows but are absent from user-visible workflow
+definitions. The workflows engine remains authoritative for dispatch; producers
+use this only to embed the same queue on a synthetic stage.
+*/}}
+{{- define "kerberoshub.workflows.stageQueues" -}}
+{{- $queues := dict -}}
+{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- if ne $operation "workflows" -}}
+{{- with $service.queue -}}
+{{- $_ := set $queues $operation . -}}
+{{- end -}}
+{{- end -}}
+{{- end -}}
+{{- $queues | toJson -}}
+{{- end -}}

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -0,0 +1,161 @@
+{{- /*
+  Generic workflow-stage worker.
+
+  Renders a Deployment + Service for every enabled worker under
+  kerberoshub.services.<name> other than the `workflows` engine itself. A custom
+  stage joins the pipeline by values alone — declare its worker here and route to
+  it from a kerberoshub.workflows.definitions stage of the same operation; no
+  per-stage template is needed.
+
+  Every stage worker receives the same connection contract; the only value that
+  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
+  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
+  a worker outside the chart instead, leave services.<name>.enabled unset (or
+  false) and point its workflow stage at the queue you publish.
+
+  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
+  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
+  redaction) declares its destination provider with the named field
+  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
+  read-only stage omits it and gets no provider env.
+
+  Worker-specific settings go in services.<name>.env (plain values) and
+  services.<name>.secretEnv (references to keys in an existing Secret).
+*/ -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+{{- $root := . -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $svc := $services -}}
+{{- if and (ne $name "workflows") $svc $svc.enabled -}}
+{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+spec:
+  replicas: {{ $svc.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app: hub-{{ $name }}
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: hub-{{ $name }}
+    spec:
+      {{- if $root.Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-{{ $name }}
+        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
+        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
+        {{- with $svc.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with $svc.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        env:
+        - name: LOG_LEVEL
+          value: "{{ $svc.logLevel | default "info" }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ $root.Values.queueProvider }}"
+
+        # The queue this stage worker consumes dispatched "{{ $name }}" stages
+        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
+        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
+        # any stage that needs "{{ $name }}" can fire).
+        - name: {{ $queueEnv }}
+          value: "{{ $svc.queue }}"
+        - name: WORKFLOWS_QUEUE
+          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ $root.Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ $root.Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ $root.Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ $root.Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials this stage uses to fetch
+        # the media it operates on.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ $root.Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ $root.Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ $root.Values.kerberosvault.secretkey }}"
+        {{- with $svc.storageProvider }}
+        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
+        # that write an artefact back (e.g. redaction) set services.<name>.
+        # storageProvider; read-only stages omit it and get no provider env.
+        - name: KERBEROS_STORAGE_PROVIDER
+          value: {{ . | quote }}
+        {{- end }}
+
+        # Per-stage tuning knobs. Any key/value under services.<name>.env is
+        # rendered verbatim as container env, so a worker can be tuned from
+        # values without a per-stage template. These override the image's own
+        # ENV defaults; the fixed contract env above is not overridable here.
+        {{- range $key, $value := $svc.env }}
+        - name: {{ $key }}
+          value: {{ $value | quote }}
+        {{- end }}        {{- with $svc.secretEnv }}
+
+        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
+        # container env var to a key in an existing Kubernetes Secret
+        # ({name, key}), so credentials such as a model API key stay out of
+        # values. The Secret must exist in the release namespace.
+        {{- range $key, $ref := . }}
+        - name: {{ $key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
+              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
+        {{- end }}
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    app: hub-{{ $name }}
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-{{ $name }}
+{{ end -}}
+{{- end }}
+{{- end }}

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -0,0 +1,137 @@
+{{- include "kerberoshub.workflows.validateDefinitions" . -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
+  selector:
+    matchLabels:
+      app: hub-workflows
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-workflows
+    spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.services.workflows.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-workflows
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
+        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
+        {{- with .Values.kerberoshub.services.workflows.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
+        env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-workflows") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ .Values.queueProvider }}"
+
+        # Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
+        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
+        # trigger and executable stages, assembled from the enabled definitions
+        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
+        # Definitions are the engine's boot-loaded config source and deployment
+        # stage catalog. Organisation-scoped database workflows are read per
+        # recording; an in-cluster engine refuses to start only when both the
+        # config definitions and the stage-queue catalog below are empty.
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
+        - name: WORKFLOW_DEFINITIONS
+          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+        # Operation→queue catalog so DB workflows reach workers no config workflow references.
+        - name: WORKFLOW_STAGE_QUEUES
+          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials a dispatched stage worker
+        # uses to fetch the media. Per-recording vault overrides (site/account)
+        # are resolved at dispatch time from the database.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ .Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ .Values.kerberosvault.secretkey }}"
+
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-workflows
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-workflows
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-analysis
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.analysis.replicas }}
   selector:
@@ -16,13 +21,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-analysis
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.analysis.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-analysis
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
@@ -31,26 +55,27 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-analysis") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -72,6 +97,18 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+
+        # When true, analysis tees the classify result to the hub-workflows
+        # service in parallel with the throttler/notification tail (which still
+        # runs unchanged). Kept in sync with whether the workflows service runs.
+        - name: WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.workflows.enabled }}"
+
+        # Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
+        # taken from the workflows service's queue so analysis and the engine
+        # always agree on the queue name (no drift).
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
           
         # Kerberos Vault
         - name: KERBEROS_STORAGE_URI
@@ -84,6 +121,23 @@ spec:
         # Sprites
         - name: SPRITE_ENABLED
           value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+
+        # In-memory cache for hot-path MongoDB lookups
+        - name: DB_CACHE_ENABLED
+          value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
+        - name: DB_CACHE_TTL
+          value: {{ .Values.kerberospipeline.analysis.dbCache.ttl | default "5m" | quote }}
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -100,4 +154,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-analysis
+    app: pipe-analysis
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-counting
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.counting.replicas }}
   selector:
@@ -19,10 +24,21 @@ spec:
       labels:
         app: pipe-counting
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.counting.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.counting.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-counting
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
@@ -31,7 +47,13 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- with .Values.kerberospipeline.counting.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.counting.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -58,6 +80,17 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -74,4 +107,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-counting
+    app: pipe-counting
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-dominantcolor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
   selector:
@@ -19,10 +24,21 @@ spec:
       labels:
         app: pipe-dominantcolor
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.dominantColor.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.dominantColor.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-dominantcolor
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
@@ -31,7 +47,13 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- with .Values.kerberospipeline.dominantColor.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.dominantColor.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -58,6 +80,17 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -74,4 +107,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-dominantcolor
+    app: pipe-dominantcolor
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-event
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.event.replicas }}
   selector:
@@ -16,13 +21,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-event
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.event.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-event
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
@@ -31,9 +55,24 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.event.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         ports:
           - containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-event") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.event.logLevel }}"
         - name: READ_ONLY
           value: "{{ .Values.readonly }}"
         - name: CLOUD_PROVIDER
@@ -41,20 +80,6 @@ spec:
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -76,6 +101,17 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -93,3 +129,4 @@ spec:
       protocol: TCP
   selector:
     app: pipe-event
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -1,3 +1,4 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,13 +17,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-export
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.export.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-export
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.export.repository }}:{{ .Values.kerberospipeline.export.tag }}"
@@ -31,28 +51,31 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.export.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-export") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.export.logLevel }}"
+        {{- if .Values.kerberospipeline.export.playerAssetsPath }}
+        - name: PLAYER_ASSETS_PATH
+          value: "{{ .Values.kerberospipeline.export.playerAssetsPath }}"
+        {{- end }}
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_DATABASE_CLOUD
-          value: "Kerberos"
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -110,6 +133,17 @@ spec:
           value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
         - name: VAULT_THUMBNAIL_SECRET_KEY
           value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -126,4 +160,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-export
+    app: pipe-export
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-monitor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.monitor.replicas }}
   selector:
@@ -16,13 +21,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-monitor
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.monitor.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-monitor
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
@@ -31,21 +55,24 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-  
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-monitor") | nindent 8 }}
+        # Application
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
+
         # Queue      
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -95,6 +122,17 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -111,4 +149,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-monitor
+    app: pipe-monitor
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -1,3 +1,4 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -16,15 +17,30 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify-test
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
@@ -35,28 +51,23 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification-test") | nindent 8 }}
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kerberos Vault
         - name: STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
@@ -94,6 +105,8 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
+        - name: PUBLIC_URL
+          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates
         - name: DETECT_TEMPLATE
@@ -108,6 +121,17 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -124,4 +148,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-notify-test
+    app: pipe-notify-test
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-notify
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.notify.replicas }}
   selector:
@@ -16,15 +21,30 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notify.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notify.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
@@ -35,25 +55,24 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notify.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.notify.logLevel }}"
+        - name: NOTIFICATION_EXPIRY_MINUTES
+          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
         # Queue
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -79,6 +98,14 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        - name: AUDIT_ENABLED
+          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
+        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
+        - name: AUDIT_QUEUE
+          value: {{ .Values.audit.intake.queue | quote }}
+        - name: AUDIT_DEADLETTER_QUEUE
+          value: {{ .Values.audit.intake.deadletterQueue | quote }}
+        {{- end }}
 
         # Kerberos Vault
         - name: STORAGE_URI
@@ -95,6 +122,8 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
+        - name: PUBLIC_URL
+          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates 
         - name: DETECT_TEMPLATE
@@ -138,6 +167,17 @@ spec:
           value: "{{ .Values.kerberosvault.sprite.accessKey }}"
         - name: VAULT_SPRITE_SECRET_KEY
           value: "{{ .Values.kerberosvault.sprite.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -154,4 +194,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-notify
+    app: pipe-notify
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-sequence
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sequence.replicas }}
   selector:
@@ -16,13 +21,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-sequence
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.sequence.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-sequence
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
@@ -31,26 +55,25 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -72,6 +95,17 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -88,4 +122,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-sequence
+    app: pipe-sequence
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -1,9 +1,13 @@
-{{ if eq .Values.kerberospipeline.sprite.enabled true }}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.sprite.enabled true) }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-sprite
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sprite.replicas }}
   selector:
@@ -20,10 +24,21 @@ spec:
       labels:
         app: pipe-sprite
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.sprite.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.sprite.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-sprite
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sprite.repository }}:{{ .Values.kerberospipeline.sprite.tag }}"
@@ -32,7 +47,13 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- with .Values.kerberospipeline.sprite.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.sprite.logLevel }}"
         {{ if .Values.isPrivate }}
         - name: KERBEROS_PRIVATE_CLOUD
           value: "true"
@@ -66,6 +87,10 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        {{- with .Values.kerberospipeline.sprite.prefetchCount }}
+        - name: RABBITMQ_PREFETCH_COUNT
+          value: {{ . | quote }}
+        {{- end }}
 
         # There is an option to store the sprites in a storage provider in Kerberos Vault.
         - name: VAULT_SPRITE_ENABLED
@@ -82,6 +107,17 @@ spec:
           value: "{{ .Values.kerberospipeline.sprite.width }}"
         - name: VAULT_SPRITE_HEIGHT
           value: "{{ .Values.kerberospipeline.sprite.height }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-throttler
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.throttler.replicas }}
   selector:
@@ -16,13 +21,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-throttler
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.throttler.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-throttler
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
@@ -31,26 +55,27 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-throttler") | nindent 8 }}
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_URI
-          value: "{{ .Values.mongodb.uri }}"
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_AUTHENTICATION_MECHANISM
-          value: "{{ .Values.mongodb.authenticationMechanism }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -72,6 +97,17 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
 ---
 apiVersion: v1
 kind: Service
@@ -88,4 +124,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-throttler
+    app: pipe-throttler
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -1,8 +1,13 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-thumbnail
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
   selector:
@@ -19,10 +24,21 @@ spec:
       labels:
         app: pipe-thumbnail
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.thumbnail.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.thumbnail.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-thumbnail
         image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
@@ -31,7 +47,13 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- with .Values.kerberospipeline.thumbnail.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.thumbnail.logLevel }}"
         {{ if .Values.isPrivate }}
         - name: KERBEROS_PRIVATE_CLOUD
           value: "true"
@@ -65,6 +87,10 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        {{- with .Values.kerberospipeline.thumbnail.prefetchCount }}
+        - name: RABBITMQ_PREFETCH_COUNT
+          value: {{ . | quote }}
+        {{- end }}
 
         # Thumbnail generation
         - name: THUMBNAIL_QUALITY
@@ -84,6 +110,18 @@ spec:
           value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
         - name: VAULT_THUMBNAIL_SECRET_KEY
           value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
+        {{- end }}
+
 ---
 apiVersion: v1
 kind: Service
@@ -100,4 +138,5 @@ spec:
       targetPort: 8080
       protocol: TCP
   selector:
-    app: pipe-thumbnail
+    app: pipe-thumbnail
+{{- end }}

charts/hub/templates/kerberos-pipeline/servicemonitor.yaml

@@ -1,3 +1,4 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: monitoring.coreos.com/v1
 kind: ServiceMonitor
 metadata:
@@ -14,3 +15,4 @@ spec:
     - port: hub-metrics
       interval: 15s
       path: /metrics
+{{- end }}

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -1,5 +1,5 @@
 # If .Values.kerberoshub.forwarder.enabled is set to true 
-{{- if .Values.kerberoshub.forwarder.enabled }}
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
@@ -18,6 +18,8 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: vault-forwarder
     spec:
@@ -25,6 +27,20 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.forwarder.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: vault-forwarder
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
@@ -33,32 +49,28 @@ spec:
             requests:
               memory: 10Mi
               cpu: 10m
+          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+          - configMapRef:
+              name: mongodb-config
           env:
-            - name: ITERATION_SPEED
-              value: "5"
-            - name: BUFFER_TIME
-              value: "3"
-            # Mongodb
-            - name: MONGODB_URI
-              value: "{{ .Values.mongodb.uri }}"
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_AUTHENTICATION_MECHANISM
-              value: "{{ .Values.mongodb.authenticationMechanism }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
-
-            # Mqtt (VERNEMQ)
-            - name: MQTT_URI
-              value: "{{ .Values.mqtt.host }}"
-            - name: MQTT_USERNAME
-              value: "{{ .Values.mqtt.username }}"
-            - name: MQTT_PASSWORD
-              value: "{{ .Values.mqtt.password }}"
+          {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
+          - name: ITERATION_SPEED
+            value: "5"
+          - name: BUFFER_TIME
+            value: "3"
+          - name: MQTT_URI
+            value: "{{ .Values.mqtt.host }}"
+          - name: MQTT_USERNAME
+            value: "{{ .Values.mqtt.username }}"
+          - name: MQTT_PASSWORD
+            value: "{{ .Values.mqtt.password }}"
 {{- end }}

charts/hub/templates/kerberos-vault/vault-proxy.yaml

@@ -1,10 +1,11 @@
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: vault-proxy
   namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 3
+  replicas: {{ .Values.kerberoshub.proxy.replicas }}
   selector:
     matchLabels:
       app: vault-proxy
@@ -23,14 +24,28 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberoshub.proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: vault-proxy
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
+          {{- with .Values.kerberoshub.proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - containerPort: 8080
               name: http
           env:
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.proxy.logLevel }}"
             # Kerberos Hub API
             - name: KERBEROS_API_CHECK_SUBSCRIPTION
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
@@ -60,3 +75,4 @@ spec:
       name: http
   selector:
     app: vault-proxy
+{{- end }}

charts/hub/values.schema.json

@@ -0,0 +1,101 @@
+{
+  "$schema": "http://json-schema.org/draft-07/schema#",
+  "type": "object",
+  "properties": {
+    "classificationCatalogExistingConfigMap": {
+      "type": "string",
+      "maxLength": 253,
+      "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+    },
+    "classificationCatalog": {
+      "not": {},
+      "description": "Removed in 0.155.0. Store the complete catalog in a ConfigMap and use workflowConfiguration.configMaps with replace: true at catalogs/classifications.json."
+    },
+    "kerberoshub": {
+      "type": "object",
+      "properties": {
+        "api": {
+          "type": "object",
+          "properties": {
+            "corsAllowedOrigins": {
+              "type": "array",
+              "items": {
+                "type": "string",
+                "pattern": "^https?://[^/?#]+$"
+              }
+            }
+          }
+        }
+      }
+    },
+    "workflowConfiguration": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["enabled"],
+      "not": {
+        "allOf": [
+          {"anyOf": [{"required": ["includeDefaults"]}, {"required": ["configMaps"]}]},
+          {"anyOf": [{"required": ["existingConfigMap"]}, {"required": ["items"]}, {"required": ["extraConfigMaps"]}]}
+        ]
+      },
+      "properties": {
+        "enabled": {"type": "boolean"},
+        "includeDefaults": {
+          "type": "boolean",
+          "description": "Include bundled files not explicitly replaced by configMaps items; true when omitted."
+        },
+        "configMaps": {
+          "type": "array",
+          "items": {"$ref": "#/definitions/configMapSource"},
+          "description": "Add files or explicitly replace a bundled file using replace: true on an item."
+        },
+        "extraConfigMaps": {
+          "type": "array",
+          "description": "Legacy additive sources; use configMaps for new deployments.",
+          "items": {"$ref": "#/definitions/configMapSource"}
+        },
+        "existingConfigMap": {
+          "type": "string",
+          "maxLength": 253,
+          "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+        },
+        "items": {
+          "type": "array",
+          "items": {"$ref": "#/definitions/configMapItem"}
+        }
+      }
+    }
+  },
+  "definitions": {
+    "configMapSource": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["name", "items"],
+      "properties": {
+        "name": {
+          "type": "string",
+          "maxLength": 253,
+          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
+        },
+        "items": {
+          "type": "array",
+          "minItems": 1,
+          "items": {"$ref": "#/definitions/configMapItem"}
+        }
+      }
+    },
+    "configMapItem": {
+      "type": "object",
+      "additionalProperties": false,
+      "required": ["key", "path"],
+      "properties": {
+        "key": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
+        "path": {"type": "string", "pattern": "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$"},
+        "replace": {
+          "type": "boolean",
+          "description": "Replace this whole bundled file, not individual fields/entries. Requires configMaps and includeDefaults: true; the path must identify a bundled file."
+        }
+      }
+    }
+  }
+}

scripts/check-pipeline-deployment-annotations.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Supply per-service test overrides without requiring a separate values file.
+WAVE_FLAGS=()
+for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
+  service="${setting%%:*}"
+  wave="${setting#*:}"
+  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
+done
+
+# Only read Deployment metadata, never pod-template or Service annotations.
+extract_waves() {
+  awk '
+    /^---/ { deployment=0; metadata=0; name="" }
+    /^kind: Deployment$/ { deployment=1 }
+    /^metadata:$/ { metadata=1; next }
+    /^[^ #]/ { metadata=0 }
+    deployment && metadata && /^  name:/ { name=$2 }
+    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
+      value=$2
+      gsub(/"/, "", value)
+      print name, value
+    }
+  ' | sort
+}
+
+assert_waves() {
+  local rendered="$1"
+  local expected="$2"
+  local actual
+  actual="$(printf '%s\n' "$rendered" | extract_waves)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  local all_count expected_count
+  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$all_count" != "$expected_count" ]]; then
+    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
+    return 1
+  fi
+}
+
+expected="$(printf '%s\n' \
+  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
+  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
+  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
+
+for mode in all pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$default_render" ""
+  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
+    echo "Empty annotations must be omitted" >&2
+    exit 1
+  fi
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$configured_render" "$expected"
+  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
+done
+
+disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+assert_waves "$ui_render" ""
+
+# Exercise zero/negative strings and an unrelated annotation on the same map.
+for wave in 0 -10; do
+  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
+    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
+    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
+  assert_waves "$override" "pipe-event $wave"
+  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
+  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
+done
+
+echo "All pipeline Deployment annotation checks passed."