Bump chart version to 0.126.2

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.134.0
+version: 0.126.2
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -53,11 +53,6 @@ Below all configuration options and parameters are listed.
 | `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
 | `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
 | `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
-| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
-| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
-| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
-| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
-| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
 | `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
 | `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
 | `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
@@ -205,30 +200,17 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
-| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (`en`, `nl`, `pl`, `pt`, `it`, `tr`, `fr`, `sv`, `de`). | `"en"` |
+| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
-| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
-| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
-| `kerberoshub.frontend.features.projects.enabled` | Fallback project group switch used when the organisations umbrella is unset. | `""` |
-| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
-| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
-| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
 | `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
-| `kerberoshub.frontend.features.map.overlayTileUrl` | Optional XYZ overlay URL supporting `{z}`, `{x}`, `{y}`, and `{apiKey}`. Empty disables the overlay. | `""` |
-| `kerberoshub.frontend.features.map.overlayApiKey` | Optional browser-visible API key substituted for `{apiKey}` in the overlay URL. | `""` |
-| `kerberoshub.frontend.features.map.overlayAttribution` | Attribution text displayed when the overlay is enabled. | `""` |
-| `kerberoshub.frontend.features.map.overlayMinZoom` | Minimum zoom level for overlay tiles. | `"0"` |
-| `kerberoshub.frontend.features.map.overlayMaxZoom` | Maximum zoom level for overlay tiles. | `"19"` |
-| `kerberoshub.frontend.features.map.overlayOpacity` | Overlay opacity from `0` to `1`. | `"1"` |
 | `kerberoshub.frontend.features.liveview.defaultStreamMode` | Liveview behavior setting: `defaultStreamMode`. | `"SD"` |
 | `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
 | `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
-| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control in live views. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
 | `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
 | `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
@@ -266,7 +248,6 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
 | `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
-| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
 | `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
 | `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
 | `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
@@ -310,7 +291,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
 | `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
-| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
+| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. | `1` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
@@ -318,7 +299,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. | `1` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -333,7 +314,6 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
 | `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
-| `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
 | `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
 | `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
 | `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
@@ -506,7 +486,6 @@ Following indexes should be executed on the MongoDB database (Kerberos) to impro
 #### Analysis collection
 
     db.getCollection("analysis").createIndex({start:1})
-    db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
     db.getCollection("analysis").createIndex({userid:1, key:1})
     db.getCollection("analysis").createIndex({userid:1, start:1})
 

charts/hub/custom-layout/i18n-custom/en.json

@@ -1,15 +1,7 @@
 {
   "nav": {
     "cases": "Investigations",
-    "dashboard": "Home",
-    "context": {
-      "label": "Tenant",
-      "title": "Switch tenant",
-      "open": "Choose tenant and project"
-    }
-  },
-  "projects": {
-    "current": "Active project"
+    "dashboard": "Home"
   },
   "login": {
     "signInTo": "Sign in to {{domain}} \u2014 Acme Security"

charts/hub/custom-layout/i18n/en.json

@@ -1702,9 +1702,7 @@
                   "k14": "fps",
                   "k15": "Detection run",
                   "k16": "Select a detection run",
-                  "k17": "No detections",
-                  "k18": "Automatic tracks unavailable",
-                  "k19": "Automatic face tracks are disabled. You can still draw redaction boxes manually on the player and submit."
+                  "k17": "No detections"
                 }
               },
               "motionmap": {

charts/hub/templates/_helpers.tpl

@@ -1,48 +0,0 @@
-{{/* Build the path to the configured MongoDB CA bundle. */}}
-{{- define "hub.mongodb.tlsCAFile" -}}
-{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
-{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
-{{- end -}}
-{{- end -}}
-
-{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
-{{- define "hub.mongodb.uri" -}}
-{{- $uri := .Values.mongodb.uri | default "" -}}
-{{- if and .Values.mongodb.tls.enabled $uri -}}
-  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
-    {{- $separator := "?" -}}
-    {{- if contains "?" $uri -}}
-      {{- $separator = "&" -}}
-    {{- end -}}
-    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stls=true" $uri $separator -}}
-  {{- end -}}
-  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
-  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
-    {{- $separator := "&" -}}
-    {{- if not (contains "?" $uri) -}}
-      {{- $separator = "?" -}}
-    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
-  {{- end -}}
-{{- end -}}
-{{- $uri -}}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA Secret volume. */}}
-{{- define "hub.mongodb.tlsVolume" -}}
-- name: mongodb-tls
-  secret:
-    secretName: {{ .Values.mongodb.tls.existingSecret }}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA volume mount. */}}
-{{- define "hub.mongodb.tlsVolumeMount" -}}
-- name: mongodb-tls
-  mountPath: {{ .Values.mongodb.tls.mountPath }}
-  readOnly: true
-{{- end -}}

charts/hub/templates/configmap-mongodb.yaml

@@ -4,7 +4,7 @@ metadata:
   name: mongodb-config
   namespace: {{ .Release.Namespace }}
 data:
-  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
+  MONGODB_URI: "{{ .Values.mongodb.uri }}"
   MONGODB_HOST: "{{ .Values.mongodb.host }}"
   MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
   MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
@@ -12,7 +12,4 @@ data:
   MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
   MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
   MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
-  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
-  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
-  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
   MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -131,8 +131,7 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
       volumes:
       {{- with .Values.kerberoshub.api.volumes }}
         {{- toYaml . | nindent 8 }}
@@ -142,9 +141,6 @@ spec:
           secret:
             secretName: {{ $serverTLS.secretName }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
       {{- end }}
       {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
       topologySpreadConstraints:
@@ -161,7 +157,7 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
           volumeMounts:
           {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
@@ -171,9 +167,6 @@ spec:
               mountPath: {{ $serverTLS.mountPath }}
               readOnly: true
           {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
           {{- end }}
           # Mongodb - loaded from ConfigMap
           envFrom:
@@ -194,23 +187,6 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
-            - name: REFRESH_COOKIE_SECURE
-              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
-            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
-            {{- with .Values.kerberoshub.frontend.legacyUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- range .Values.kerberoshub.frontend.domains }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
-            {{- end }}
-            - name: CORS_ALLOWED_ORIGINS
-              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberoshub.cleanup.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
           {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -229,22 +229,6 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
-        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
-        - name: FEATURE_ORGANISATION_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
         - name: FEATURE_DARK_MODE
           value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
         - name: FEATURE_SPLASH_SCREEN_ENABLED
@@ -265,8 +249,6 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
         - name: FEATURE_MOQ_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
         - name: MOQ_RELAY_URL
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
         - name: MOQ_BROADCAST_PREFIX
@@ -285,26 +267,6 @@ spec:
         # features > floorplan
         - name: FEATURE_FLOORPLAN_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
-        # features > map
-        - name: MAP_TILE_URL_LIGHT
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
-        - name: MAP_TILE_URL_DARK
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
-        - name: MAP_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
-
         - name: COLOR_TRACK_BOX
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
         - name: COLOR_TRACK_BOX_HOVER
@@ -338,9 +300,7 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -312,22 +312,10 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
         - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
         - name: FEATURE_ORGANISATION_CREATION_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
         - name: FEATURE_DARK_MODE
           value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
         - name: FEATURE_SPLASH_SCREEN_ENABLED
@@ -350,8 +338,6 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
         - name: FEATURE_MOQ_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
         - name: MOQ_RELAY_URL
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
         - name: MOQ_BROADCAST_PREFIX
@@ -378,18 +364,6 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
         - name: MAP_ATTRIBUTION
           value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
 
         - name: COLOR_TRACK_BOX
           value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
@@ -432,9 +406,7 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberoshub.monitordevice.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
           {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -26,16 +26,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberoshub.reactivate.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -44,15 +38,10 @@ spec:
         - name: hub-reactivate-subscription
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
           {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -1,17 +1,15 @@
 {{/*
 Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
 JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
-This is the engine's boot-loaded configuration source and deployment stage
-catalog: several distinct config workflows can run over one recording — each
-opens its own run and dispatches only its own stages. Organisation-scoped
-database workflows are discovered separately at runtime.
+This is the engine's single routing source: several distinct workflows can run
+over one recording — each opens its own run and dispatches only its own stages.
 
 Each enabled definition contributes one workflow object:
   name      the map key (the workflow's human-readable name; also its identity —
             the engine derives a stable id from it when the definition carries
             no explicit id).
   enabled   always true here (a disabled definition is skipped entirely).
-  source    "config" — provenance marking a Helm-defined, deployment-global,
+  source    "config" — provenance marking a Helm-seeded, deployment-global,
             ops-managed workflow (read-only in the API, no owning organisation).
   triggers  how a run OPENS. Defaults to a single bare automatic trigger
             (opens for every recording); narrow with device/schedule triggers.

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberoshub.services.workflows.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
@@ -73,10 +62,8 @@ spec:
         # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
         # trigger and executable stages, assembled from the enabled definitions
         # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
-        # Definitions are the engine's boot-loaded config source and deployment
-        # stage catalog. Organisation-scoped database workflows are read per
-        # recording; an in-cluster engine still requires at least one config
-        # definition so an empty catalog cannot silently drop traffic.
+        # Definitions are the engine's single routing source; empty means no
+        # workflows run.
         - name: WORKFLOWS_QUEUE
           value: "{{ .Values.kerberoshub.services.workflows.queue }}"
         - name: WORKFLOW_DEFINITIONS

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.analysis.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.event.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.event.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         ports:
           - containerPort: 8080
         envFrom:

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.export.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.export.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.monitor.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,23 +45,14 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
         env:
-        # Application
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
-
         # Queue      
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.notify.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.sequence.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -29,16 +29,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.throttler.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -51,15 +45,10 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
         {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -27,16 +27,10 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberoshub.forwarder.volumes }}
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
       {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -49,15 +43,10 @@ spec:
             requests:
               memory: 10Mi
               cpu: 10m
-          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
           {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
           envFrom:
           - configMapRef:
               name: mongodb-config

charts/hub/values.yaml

@@ -60,15 +60,6 @@ mongodb:
   # and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
   # should also set retryWrites: "false".
   flavor: "mongodb"
-  # TLS for MongoDB-compatible backends. When uri is set, missing TLS query
-  # parameters are appended automatically. AWS DocumentDB requires TLS and a
-  # trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
-  tls:
-    enabled: false
-    existingSecret: ""
-    caFileName: ""
-    mountPath: "/etc/mongodb/tls"
-    insecureSkipVerify: false
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
@@ -240,7 +231,7 @@ kerberoshub:
   api:
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
-    tag: "v1.9.51"
+    tag: "v1.9.29"
     replicas: 2
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-api Service (e.g. when an
@@ -353,7 +344,7 @@ kerberoshub:
   frontend:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
-    tag: "v1.13.9"
+    tag: "v1.9.32"
     replicas: 2
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-frontend Service (e.g. when an
@@ -470,7 +461,7 @@ kerberoshub:
       # hidden and `defaultLanguage` is always forced; users cannot change it.
       i18n:
         enabled: "true" # Enable or disable the language switcher 'true' or 'false'
-        defaultLanguage: "en" # Default language code: en, nl, pl, pt, it, tr, fr, sv, de
+        defaultLanguage: "en" # Default language code: en, nl, pl, tr, fr, sv, de
       # Case management is a feature that allows you to create cases, and link recordings, devices, sites, groups, markers and events to those cases. 
       case:
         enabled: "true" # Enable or disable case management feature 'true' or 'false'
@@ -479,33 +470,19 @@ kerberoshub:
         enabled: "false" # Enable or disable workflows feature 'true' or 'false'
       # Organisation controls remain visible as a read-only current organisation when switching is disabled.
       organisations:
-        enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
         switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
         creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
-        settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
-      projects:
-        enabled: "" # Fallback project group switch used only when organisations.enabled is empty
-        switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
-        creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
-        settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
       # Map tile configuration  
       map:
         tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
         tileUrlDark: "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png" # Map tile URL for dark mode
         attribution: "&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>" # Map attribution
-        overlayTileUrl: "" # Optional XYZ overlay URL; supports {z}, {x}, {y}, and {apiKey}
-        overlayApiKey: "" # Optional browser-visible API key substituted into overlayTileUrl
-        overlayAttribution: "" # Attribution displayed when the overlay is enabled
-        overlayMinZoom: "0" # Minimum overlay zoom level
-        overlayMaxZoom: "19" # Maximum overlay zoom level
-        overlayOpacity: "1" # Overlay opacity from 0 to 1
       # Live view page
       liveview:
         defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
         liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
         hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
         moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
-        remoteRecordingEnabled: "true" # Show the manual REC control in live views
         moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
         moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
         paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
@@ -571,7 +548,6 @@ kerberoshub:
       # Face redaction feature
       faceRedaction:
         enabled: "false" # Enable or disable face redaction 'true' or 'false'
-        classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
     # Optional integrations
     mixpanel: # We can keep track logging in Mixpanel as well
       apikey: "xxx"
@@ -607,7 +583,7 @@ kerberoshub:
   cleanup:
     repository: ghcr.io/uug-ai/hub-cleanup
     pullPolicy: IfNotPresent
-    tag: "v1.4.19"
+    tag: "v1.4.16"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -666,18 +642,16 @@ kerberoshub:
     # -----------------------------------------------------------------------
     # Global workflow definitions — the named workflows the engine runs.
     #
-    # `definitions` is the engine's deployment-global configuration source and
-    # stage catalog: several distinct workflows can run over one recording, each
-    # opening its own run and dispatching only its own stages. Database-backed
-    # organisation workflows, when present, are read separately per recording.
-    # This is a MAP keyed by workflow name (names are unique and merge cleanly
-    # across -f / --set overrides). Ships empty; the commented block is a worked
-    # example of an object-tracking + loitering pipeline. Add more keys to run
-    # more config workflows.
+    # `definitions` is the engine's single routing source: several distinct
+    # workflows can run over one recording, each opening its own run and
+    # dispatching only its own stages. It is a MAP keyed by workflow name (names
+    # are unique and merge cleanly across -f / --set overrides). Ships empty; the
+    # commented block is a worked example of an object-tracking + loitering
+    # pipeline. Add more keys to run more workflows.
     #
     # Each definition:
     #   enabled   include this workflow (soft-delete toggle).
-    #   source    always rendered as "config" (a Helm-defined, ops-managed,
+    #   source    always rendered as "config" (a Helm-seeded, ops-managed,
     #             deployment-global workflow — read-only in the API).
     #   triggers  how a run OPENS. Omit for a single bare automatic trigger
     #             (opens for every recording); the per-stage `needs` then decide
@@ -689,9 +663,9 @@ kerberoshub:
     #             {operation?, condition?} — operation is the readiness GATE (the
     #             upstream op whose data must be present before the condition is
     #             read; omit for a check on the run root itself), condition is
-    #             {path, op, value} where path is ABSOLUTE from the run root;
-    #             a `*` segment fans out across array elements. needsMode combines
-    #             multiple needs: "any" (default;
+    #             {path, op, value} where path is ABSOLUTE from the run root and
+    #             resolves through string-keyed maps only (it cannot index into
+    #             arrays). needsMode combines multiple needs: "any" (default;
     #             fire on the first match) or "all" (a join; fire once every need
     #             has resolved and matched). The queue is taken from the matching
     #             services.<operation> entry, so dispatch and consume cannot drift.
@@ -700,19 +674,19 @@ kerberoshub:
     # kerberoshub.services.<operation> (deploy the objecttracking / loitering
     # workers below).
     definitions: {}
-    #tracking-workflow:
-    #  enabled: true
-    #  triggers:
-    #    - type: automatic
-    #  stages:
-    #    - operation: objecttracking
-    #      dispatch: always
-    #    - operation: loitering
-    #      dispatch: conditional
-    #      # Fire loitering once objecttracking has resolved — a readiness join
-    #      # (no condition ⇒ gate on the upstream's presence, not a value).
-    #      needs:
-    #        - operation: objecttracking
+      #tracking-workflow:
+      #  enabled: true
+      #  triggers:
+      #    - type: automatic
+      #  stages:
+      #    - operation: objecttracking
+      #      dispatch: always
+      #    - operation: loitering
+      #      dispatch: conditional
+      #      # Fire loitering once objecttracking has resolved — a readiness join
+      #      # (no condition ⇒ gate on the upstream's presence, not a value).
+      #      needs:
+      #        - operation: objecttracking
   # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
   # replicas/resources/queue lives here in a single, uniform shape:
   #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -725,10 +699,9 @@ kerberoshub:
   #     when its own `enabled` is true AND the workflows engine is enabled.
   services:
     # hub-workflows — the workflows engine (orchestrator). Consumes the engine
-    # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
-    # plus organisation-scoped database workflows, and dispatches to the stage
-    # workers below. Deployed when workflows.enabled is true; it has no separate
-    # `enabled` here.
+    # queue, evaluates the workflow definitions (WORKFLOW_DEFINITIONS) and
+    # dispatches to the stage workers below. Deployed when workflows.enabled is
+    # true; it has no separate `enabled` here.
     workflows:
       repository: ghcr.io/uug-ai/hub-workflows
       pullPolicy: IfNotPresent
@@ -750,61 +723,61 @@ kerberoshub:
         requests:
           memory: 10Mi
           cpu: 10m
-          # ---------------------------------------------------------------------
-          # EXAMPLE custom stage worker (commented out) — hub-loitering.
-          #
-          # Companion deployment for the workflows.definitions example above (the
-          # loitering stage of tracking-workflow). Uncomment to deploy the demo
-          # worker. It ships as its own repository/module.
-          # See https://github.com/uug-ai/hub-loitering.
-          #loitering:
-          #  # Deploy the hub-loitering worker.
-          #  enabled: true
-          #  repository: ghcr.io/uug-ai/hub-loitering
-          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.0"
-          #  replicas: 1 # Number of pods for the worker.
-          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-          #  #volumes:
-          #  #  - name: extra
-          #  #    emptyDir: {}
-          #  #volumeMounts:
-          #  #  - name: extra
-          #  #    mountPath: /data
-          #  logLevel: "info" # possible values: trace, debug, info, warn, error
-          #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
-          #  # same value is taken into the matching workflows.definitions stage, so the
-          #  # engine dispatches and the worker consumes the same queue with no drift.
-          #  # Convention: "kcloud-<operation>-queue.fifo".
-          #  queue: "kcloud-loitering-queue.fifo"
-          #  resources:
-          #    requests:
-          #      memory: 10Mi
-          #      cpu: 10m
-          # ---------------------------------------------------------------------
-          # EXAMPLE stage worker (commented out) for the workflows.definitions example
-          # above — hub-objecttracking. Uncomment the worker whose operation a
-          # definition references, so the engine dispatches and the worker consumes the
-          # same queue with no drift.
-          #objecttracking:
-          #  # Deploy the object-tracking worker (operation "objecttracking").
-          #  enabled: true
-          #  repository: ghcr.io/uug-ai/hub-objecttracking
-          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.0"
-          #  replicas: 1 # Number of pods for the worker.
-          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-          #  logLevel: "info" # possible values: trace, debug, info, warn, error
-          #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
-          #  queue: "kcloud-objecttracking-queue.fifo"
-          #  resources:
-          #    requests:
-          #      memory: 10Mi
-          #      cpu: 10m
+    # ---------------------------------------------------------------------
+    # EXAMPLE custom stage worker (commented out) — hub-loitering.
+    #
+    # Companion deployment for the workflows.definitions example above (the
+    # loitering stage of tracking-workflow). Uncomment to deploy the demo
+    # worker. It ships as its own repository/module.
+    # See https://github.com/uug-ai/hub-loitering.
+    #loitering:
+    #  # Deploy the hub-loitering worker.
+    #  enabled: true
+    #  repository: ghcr.io/uug-ai/hub-loitering
+    #  pullPolicy: IfNotPresent
+    #  tag: "v1.0.0"
+    #  replicas: 1 # Number of pods for the worker.
+    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+    #  #volumes:
+    #  #  - name: extra
+    #  #    emptyDir: {}
+    #  #volumeMounts:
+    #  #  - name: extra
+    #  #    mountPath: /data
+    #  logLevel: "info" # possible values: trace, debug, info, warn, error
+    #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
+    #  # same value is taken into the matching workflows.definitions stage, so the
+    #  # engine dispatches and the worker consumes the same queue with no drift.
+    #  # Convention: "kcloud-<operation>-queue.fifo".
+    #  queue: "kcloud-loitering-queue.fifo"
+    #  resources:
+    #    requests:
+    #      memory: 10Mi
+    #      cpu: 10m
+    # ---------------------------------------------------------------------
+    # EXAMPLE stage worker (commented out) for the workflows.definitions example
+    # above — hub-objecttracking. Uncomment the worker whose operation a
+    # definition references, so the engine dispatches and the worker consumes the
+    # same queue with no drift.
+    #objecttracking:
+    #  # Deploy the object-tracking worker (operation "objecttracking").
+    #  enabled: true
+    #  repository: ghcr.io/uug-ai/hub-objecttracking
+    #  pullPolicy: IfNotPresent
+    #  tag: "v1.0.0"
+    #  replicas: 1 # Number of pods for the worker.
+    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+    #  logLevel: "info" # possible values: trace, debug, info, warn, error
+    #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
+    #  queue: "kcloud-objecttracking-queue.fifo"
+    #  resources:
+    #    requests:
+    #      memory: 10Mi
+    #      cpu: 10m
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent
-    tag: "v1.4.2"
+    tag: "v1.4.0"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -824,7 +797,7 @@ kerberoshub:
     repository: uugai/hub-reactivatesubscriptions
     pullPolicy: IfNotPresent
     tag: "v1.0.2"
-    replicas: 0 # Number of pods for the service. Set to 0 to disable.
+    replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -860,7 +833,7 @@ kerberoshub:
     repository: uugai/hub-proxy
     pullPolicy: IfNotPresent
     tag: "v1.0.0"
-    replicas: 0 # Number of pods for the service. Set to 0 to disable.
+    replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -882,7 +855,7 @@ kerberospipeline:
   event:
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
-    tag: "v1.3.1"
+    tag: "v1.3.0"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -900,7 +873,7 @@ kerberospipeline:
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
     pullPolicy: IfNotPresent
-    tag: "v1.3.13"
+    tag: "v1.3.10"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -910,7 +883,6 @@ kerberospipeline:
     #volumeMounts:
     #  - name: extra
     #    mountPath: /data
-    logLevel: "info" # possible values: debug, info, warn, error
     resources:
       requests:
         memory: 10Mi
@@ -918,7 +890,7 @@ kerberospipeline:
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
     pullPolicy: IfNotPresent
-    tag: "v1.6.26"
+    tag: "v1.6.18"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -935,7 +907,7 @@ kerberospipeline:
   throttler:
     repository: uugai/hub-pipeline-throttler
     pullPolicy: IfNotPresent
-    tag: "v1.2.1"
+    tag: "v1.2.0"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -953,7 +925,7 @@ kerberospipeline:
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
     pullPolicy: IfNotPresent
-    tag: "v1.3.18"
+    tag: "v1.3.9"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -972,7 +944,7 @@ kerberospipeline:
   notifyTest:
     repository: uugai/hub-pipeline-notification-test
     pullPolicy: IfNotPresent
-    tag: "v1.2.2"
+    tag: "v1.2.1"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     resources:
@@ -990,7 +962,7 @@ kerberospipeline:
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
     pullPolicy: IfNotPresent
-    tag: "v1.8.5"
+    tag: "v1.7.17"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1008,7 +980,7 @@ kerberospipeline:
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
     pullPolicy: IfNotPresent
-    tag: "v2.0.3"
+    tag: "v2.0.2"
     replicas: 3 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1029,7 +1001,7 @@ kerberospipeline:
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
     pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.6"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1055,7 +1027,7 @@ kerberospipeline:
   counting:
     repository: uugai/hub-pipeline-counting
     pullPolicy: IfNotPresent
-    tag: "v2.0.0"
+    tag: "v1.6.3"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1074,7 +1046,7 @@ kerberospipeline:
     enabled: false # Enable or disable the sprite generation 'true' or 'false
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
-    tag: "v1.1.16"
+    tag: "v1.1.14"
     replicas: 5 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1098,7 +1070,7 @@ kerberospipeline:
   export:
     repository: ghcr.io/uug-ai/hub-pipeline-export
     pullPolicy: IfNotPresent
-    tag: "v1.2.10"
+    tag: "v1.2.8"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error