mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-09-10 20:26:58 +00:00
Compare commits
14 Commits
docs/refre
...
feat/audit
| Author | SHA1 | Date | |
|---|---|---|---|
|
3d5c0ecd3e | ||
|
|
6454e8fa33 | ||
|
|
fbffe917bb | ||
|
|
5c1d233c45 | ||
|
|
f9de70fce4 | ||
|
|
6c50f1d359 | ||
|
|
9badb35126 | ||
|
|
fb26c6b755 | ||
|
|
3719ec0bbe | ||
|
|
c262433aa1 | ||
|
|
f70aedc5d5 | ||
|
|
2d75d84509 | ||
|
|
c5231ca3cf | ||
|
|
776599cd30 |
@@ -16,7 +16,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.134.0
|
||||
version: 0.137.0
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
@@ -207,6 +207,7 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
|
||||
| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
|
||||
| `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
|
||||
| `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
|
||||
| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
|
||||
| `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
|
||||
| `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
|
||||
@@ -248,8 +249,9 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled` | Limit marker, category, event, and tag filter options to the selected recordings day. | `"false"` |
|
||||
| `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
|
||||
| `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
|
||||
| `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
|
||||
@@ -298,8 +300,23 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
|
||||
| `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
|
||||
| `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
|
||||
| `kerberoshub.cleanup.auditEventRetentionDays` | Deployment-wide audit-event retention in days, independent of recording plans, inactive-account cleanup, and the optional global pass. Set to `"0"` or a negative value to keep audit events indefinitely. | `"400"` |
|
||||
| `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
|
||||
| `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
|
||||
| `kerberoshub.audit.enabled` | Deploy the Hub audit service. Its first responsibility is forwarding canonical MongoDB `audit_events` to configured destinations. | `false` |
|
||||
| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
|
||||
| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.audit.tag` | Hub audit service image tag. | `"v0.1.0"` |
|
||||
| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
|
||||
| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
|
||||
| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
|
||||
| `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
|
||||
| `kerberoshub.audit.destinations` | Webhook destinations. Each entry supports `id`, `enabled`, `url`, delivery limits, filters, public `headers`, `bearerTokenSecret`, and arbitrary `secretHeaders`. Destination IDs retain independent checkpoints. | `[]` |
|
||||
| `kerberoshub.audit.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for audit service metrics. | `true` |
|
||||
| `kerberoshub.audit.serviceMonitor.interval` | Audit service metrics scrape interval. | `"15s"` |
|
||||
| `kerberoshub.audit.volumes` | Additional pod volumes, for example a private webhook CA bundle. | `[]` |
|
||||
| `kerberoshub.audit.volumeMounts` | Additional audit service container volume mounts. | `[]` |
|
||||
| `kerberoshub.audit.extraEnv` | Additional audit service environment variables. | `[]` |
|
||||
| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
|
||||
| `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
|
||||
| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
|
||||
@@ -315,10 +332,11 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
|
||||
| `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
|
||||
| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
|
||||
| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
|
||||
| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
|
||||
| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
|
||||
| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
|
||||
| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
|
||||
| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
|
||||
| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
|
||||
| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
|
||||
| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
|
||||
@@ -354,6 +372,7 @@ Below all configuration options and parameters are listed.
|
||||
| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
|
||||
| `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
|
||||
| `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
|
||||
| `kerberospipeline.notify.notificationExpiryMinutes` | Maximum recording age in minutes before notification delivery. Set to `"0"` to disable the freshness cutoff. | `"15"` |
|
||||
| `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
|
||||
| `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
|
||||
| `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
|
||||
@@ -486,6 +505,20 @@ As mentioned during the Post installation step, you'll import some `.nosql` file
|
||||
|
||||
Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.
|
||||
|
||||
New deployments should define the shared classification list through
|
||||
`classificationCatalog`. Each entry contains the stable classifier output
|
||||
`key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
|
||||
to alerts and filters. When the mounted catalog is unavailable, compatible Hub
|
||||
API versions fall back to the legacy `settings` document and then the built-in
|
||||
classification list.
|
||||
|
||||
```yaml
|
||||
classificationCatalog:
|
||||
- key: forklift
|
||||
label: Forklift
|
||||
icon: vehicle
|
||||
```
|
||||
|
||||
### Indexing
|
||||
|
||||
Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.
|
||||
|
||||
@@ -0,0 +1,8 @@
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: classification-catalog
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
classifications.json: |-
|
||||
{{- toPrettyJson .Values.classificationCatalog | nindent 4 }}
|
||||
51
charts/hub/templates/configmap-hub-audit.yaml
Normal file
51
charts/hub/templates/configmap-hub-audit.yaml
Normal file
@@ -0,0 +1,51 @@
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.audit.enabled -}}
|
||||
{{- $destinations := list -}}
|
||||
{{- $destinationIDs := dict -}}
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
|
||||
{{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
|
||||
{{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $destinationIDs $id -}}
|
||||
{{- fail (printf "duplicate audit destination id %q" $id) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $destinationIDs $id true -}}
|
||||
{{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
|
||||
{{- $entry := dict
|
||||
"id" $id
|
||||
"type" (default "webhook" $destination.type)
|
||||
"enabled" $destination.enabled
|
||||
"url" $url
|
||||
"timeoutSeconds" (default 10 $destination.timeoutSeconds)
|
||||
"batchSize" (default 100 $destination.batchSize)
|
||||
"maxAttempts" (default 10 $destination.maxAttempts)
|
||||
"startAt" (default "latest" $destination.startAt)
|
||||
"headers" (default dict $destination.headers)
|
||||
"filters" (default dict $destination.filters) -}}
|
||||
{{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret -}}
|
||||
{{- if gt (len $bearer) 0 -}}
|
||||
{{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
|
||||
{{- $secretKey := default "token" $bearer.key -}}
|
||||
{{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- $headerFiles := dict -}}
|
||||
{{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
|
||||
{{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
|
||||
{{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
|
||||
{{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $headerFiles) 0 -}}
|
||||
{{- $_ := set $entry "headerFiles" $headerFiles -}}
|
||||
{{- end -}}
|
||||
{{- $destinations = append $destinations $entry -}}
|
||||
{{- end -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
destinations.json: |
|
||||
{{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -120,6 +120,7 @@ spec:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/classification-catalog: {{ include (print $.Template.BasePath "/configmap-classification-catalog.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-api
|
||||
spec:
|
||||
@@ -132,8 +133,10 @@ spec:
|
||||
{{- end }}
|
||||
{{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
- name: classification-catalog
|
||||
configMap:
|
||||
name: classification-catalog
|
||||
{{- with .Values.kerberoshub.api.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -145,7 +148,6 @@ spec:
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -161,8 +163,10 @@ spec:
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
{{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
- name: classification-catalog
|
||||
mountPath: /etc/kerberos/classifications
|
||||
readOnly: true
|
||||
{{- with .Values.kerberoshub.api.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -174,12 +178,13 @@ spec:
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Mongodb - loaded from ConfigMap
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
- name: CLASSIFICATION_CATALOG_FILE
|
||||
value: /etc/kerberos/classifications/classifications.json
|
||||
- name: ENVIRONMENT
|
||||
value: "{{ .Values.environment }}"
|
||||
- name: READ_ONLY
|
||||
|
||||
@@ -0,0 +1,18 @@
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: hub-audit-servicemonitor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
service: hub-audit
|
||||
release: prometheus
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
service: hub-audit
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
|
||||
path: /metrics
|
||||
{{- end }}
|
||||
145
charts/hub/templates/kerberos-hub/hub-audit.yaml
Normal file
145
charts/hub/templates/kerberos-hub/hub-audit.yaml
Normal file
@@ -0,0 +1,145 @@
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.audit.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberoshub.audit.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: hub-audit
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
spec:
|
||||
terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.kerberoshub.serviceAccount.create }}
|
||||
serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
volumes:
|
||||
- name: destinations
|
||||
configMap:
|
||||
name: hub-audit
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
projected:
|
||||
sources:
|
||||
{{- if gt (len $bearer) 0 }}
|
||||
- secret:
|
||||
name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
|
||||
items:
|
||||
- key: {{ default "token" $bearer.key | quote }}
|
||||
path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- range $headerName, $secret := $secretHeaders }}
|
||||
- secret:
|
||||
name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
|
||||
items:
|
||||
- key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
|
||||
path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: hub-audit
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
|
||||
{{- with .Values.kerberoshub.audit.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
volumeMounts:
|
||||
- name: destinations
|
||||
mountPath: /etc/hub-audit
|
||||
readOnly: true
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
- name: DISPATCH_INTERVAL
|
||||
value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
|
||||
- name: LEASE_DURATION
|
||||
value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
{{- with .Values.kerberoshub.audit.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
service: hub-audit
|
||||
spec:
|
||||
ports:
|
||||
- name: metrics
|
||||
port: 2112
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: hub-audit
|
||||
{{- end }}
|
||||
@@ -108,6 +108,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
|
||||
- name: DEFAULT_TASK_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
|
||||
- name: AUDIT_EVENT_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
|
||||
{{- if .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -229,6 +229,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
@@ -363,6 +365,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
|
||||
|
||||
@@ -312,6 +312,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
@@ -457,6 +459,8 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
|
||||
@@ -66,6 +66,8 @@ spec:
|
||||
env:
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.notify.logLevel }}"
|
||||
- name: NOTIFICATION_EXPIRY_MINUTES
|
||||
value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
|
||||
# Queue
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if eq .Values.mode "all" -}}
|
||||
{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
|
||||
@@ -69,6 +69,37 @@ mongodb:
|
||||
caFileName: ""
|
||||
mountPath: "/etc/mongodb/tls"
|
||||
insecureSkipVerify: false
|
||||
|
||||
# Classifications supported by Hub filters, alerts, markers, and other
|
||||
# downstream processing. Classifier output keys must match these values.
|
||||
classificationCatalog:
|
||||
- key: animal
|
||||
label: Animal
|
||||
icon: animal
|
||||
- key: pedestrian
|
||||
label: Pedestrian
|
||||
icon: pedestrian
|
||||
- key: cyclist
|
||||
label: Cyclist
|
||||
icon: cyclist
|
||||
- key: motorbike
|
||||
label: Motorbike
|
||||
icon: motorbike
|
||||
- key: lorry
|
||||
label: Lorry
|
||||
icon: lorry
|
||||
- key: car
|
||||
label: Car
|
||||
icon: car
|
||||
- key: handbag
|
||||
label: Handbag
|
||||
icon: handbag
|
||||
- key: suitcase
|
||||
label: Suitcase
|
||||
icon: suitcase
|
||||
- key: cell phone
|
||||
label: Cell phone
|
||||
icon: cell phone
|
||||
###################################################
|
||||
# MQTT configuration (bi-directional communication)
|
||||
###################################################
|
||||
@@ -477,6 +508,9 @@ kerberoshub:
|
||||
# Workflows allow you to define automated processes and actions in the front-end.
|
||||
workflows:
|
||||
enabled: "false" # Enable or disable workflows feature 'true' or 'false'
|
||||
# Audit events are visible to owner/admin users when enabled.
|
||||
audit:
|
||||
enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
|
||||
# Organisation controls remain visible as a read-only current organisation when switching is disabled.
|
||||
organisations:
|
||||
enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
|
||||
@@ -537,6 +571,8 @@ kerberoshub:
|
||||
enabled: "true" # Enable or disable category filter in media 'true' or 'false'
|
||||
markers:
|
||||
enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
|
||||
markerOptionsByDate:
|
||||
enabled: "false" # Limit marker-related filter options to the selected recording day
|
||||
events:
|
||||
enabled: "true" # Enable or disable events filter in media 'true' or 'false'
|
||||
tags:
|
||||
@@ -643,10 +679,60 @@ kerberoshub:
|
||||
# Tasks with `legal_hold=true` are never deleted. Must match the value
|
||||
# used by `kerberoshub.api.defaultTaskRetentionDays`.
|
||||
defaultTaskRetentionDays: "0"
|
||||
# Deployment-wide retention for audit events. This is independent from
|
||||
# recording plans, inactive-account cleanup, and the optional global pass.
|
||||
# Set to "0" or a negative value to retain audit events indefinitely.
|
||||
auditEventRetentionDays: "400"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# Dispatches canonical audit_events to one or more external webhook sinks.
|
||||
# Credentials are always read from existing Secrets and never stored here.
|
||||
audit:
|
||||
enabled: false
|
||||
repository: ghcr.io/uug-ai/hub-audit
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v0.1.0"
|
||||
replicas: 1
|
||||
dispatchInterval: "5s"
|
||||
leaseDuration: "2m"
|
||||
terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
|
||||
topologySpreadConstraints: []
|
||||
volumes: []
|
||||
volumeMounts: []
|
||||
extraEnv: []
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 15s
|
||||
destinations: []
|
||||
# - id: primary-siem
|
||||
# type: webhook
|
||||
# enabled: true
|
||||
# url: https://siem.example.com/api/audit
|
||||
# timeoutSeconds: 10
|
||||
# batchSize: 100
|
||||
# maxAttempts: 10
|
||||
# startAt: latest # latest | beginning, applied only on first creation
|
||||
# headers:
|
||||
# X-Source: kerberos-hub
|
||||
# bearerTokenSecret:
|
||||
# name: audit-primary-siem
|
||||
# key: token
|
||||
# secretHeaders:
|
||||
# X-Api-Key:
|
||||
# secretName: audit-primary-siem
|
||||
# secretKey: api-key
|
||||
# filters:
|
||||
# organisationIds: []
|
||||
# projectIds: []
|
||||
# actions: []
|
||||
# categories: []
|
||||
# outcomes: [] # success | failure
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 32Mi
|
||||
# cpu: 10m
|
||||
# hub-workflows is the standalone, queue-driven workflow engine. It consumes
|
||||
# pipeline events and dispatches the stages declared in its workflow
|
||||
# definitions, tracking each run in its own `workflow_runs` collection. It shares events
|
||||
@@ -857,10 +943,11 @@ kerberoshub:
|
||||
# cpu: 10m
|
||||
# This proxy is legacy for the old agent, will be migrated in the new Hub API.
|
||||
proxy:
|
||||
enabled: false
|
||||
repository: uugai/hub-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 0 # Number of pods for the service. Set to 0 to disable.
|
||||
replicas: 0 # Number of pods for the service when enabled.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -957,6 +1044,7 @@ kerberospipeline:
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
|
||||
Reference in New Issue
Block a user