Merge pull request #177 from kerberos-io/feature/hub-vlm-worker

feature/hub-vlm-worker

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.134.0
+version: 0.147.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -31,10 +31,90 @@ Uninstall the Kerberos Hub chart
 
     helm uninstall hub -n kerberos-hub
 
+### Sprite Resolution
+
+`kerberospipeline.sprite.width` and `height` set the pixel dimensions of each
+sprite tile, not the complete sheet. Preserve a **16:9 aspect ratio**: for
+example, `240x135` (default), `480x270`, or `640x360`.
+
+Deploy the dimension-aware Hub frontend, Hub API, analysis worker, sprite worker,
+notification worker, and export worker before increasing resolution. Release the updated shared Go
+models and update the Hub API/export worker dependency pins before building those
+services. Newly generated sprites carry their own tile dimensions; existing
+sprites without dimensions retain the `240x135` fallback and need no migration.
+Do not change a global fallback to match the new size. Increasing both dimensions
+by two produces four times as many pixels, increasing decoded memory and usually
+storage and bandwidth. Hover previews retain their display size; fullscreen
+scrubbing uses the higher-resolution tiles.
+
+```yaml
+kerberospipeline:
+    sprite:
+        width: "480"
+        height: "270"
+```
+
+### Optional Argo CD pipeline ordering
+
+Each listed pipeline service accepts `deploymentAnnotations` in its existing
+values section. The default is `{}`, so installing or upgrading the chart alone
+does not enable ordering. Commented examples appear beside the service settings
+in `values.yaml`; replace the empty map rather than adding duplicate YAML keys.
+Annotations render on Deployment `metadata`, not on pod templates or Services.
+
+The inline examples use the following order, leaving gaps of ten:
+
+| Wave | `kerberospipeline` keys |
+| --- | --- |
+| 10 | `event` |
+| 20 | `notify` |
+| 30 | `throttler` |
+| 40 | `analysis` |
+| 50 | `thumbnail`, `sprite`, `dominantColor`, `counting` |
+| 60 | `sequence` |
+| 70 | `monitor` |
+
+Enable the annotation in each service's existing environment values section.
+No separate example values file is required. These annotations do not change
+image tags or enable disabled services such as sprite.
+Deploy the compatible analysis bridge before replying workers, and select the
+fixed counting release; waves do not enforce minimum compatible image versions.
+The chart's default image tags are not a compatibility-tested rollout bundle.
+
+Argo CD applies lower waves first and waits for sync/health before proceeding
+within the same Application. Unannotated resources remain at wave zero. A
+single-service image update does not restart earlier services, but an unhealthy
+earlier wave can block it. Separate Applications and external classifier/workflow
+workers require their own coordination. Helm itself does not enforce these waves.
+
+Waves are not a substitute for message compatibility, readiness checks, or
+stopping old RabbitMQ consumers. This example does not add health probes or
+change the Deployment rolling-update strategy.
+
 ### Parameters
 
 Below all configuration options and parameters are listed.
 
+When upgrading to `0.144.0`, move `kerberoshub.audit.enabled` and
+`kerberoshub.audit.intake` to `audit.enabled` and `audit.intake`. Consumer
+workload settings remain under `kerberoshub.audit`.
+
+Auditing is globally disabled by default. Setting `audit.enabled: true` deploys
+the audit consumer and enables every supported producer by default. A producer
+is enabled only when both the global switch and its service switch are true; set
+the service's `audit.enabled` value to `false` only when that service must opt
+out.
+
+```yaml
+audit:
+    enabled: true
+
+kerberospipeline:
+    notify:
+        audit:
+            enabled: false # Optional per-service opt-out.
+```
+
 | Name                                        | Description                                                                                                                | Value |
 | ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----- |
 | `license` | The license key you received from support@kerberos.io. If not available request one. | `"L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"` |
@@ -71,6 +151,12 @@ Below all configuration options and parameters are listed.
 | `rabbitmq.username` | RabbitMQ username, by default `'yourusername'` | `"yourusername"` |
 | `rabbitmq.password` | RabbitMQ password, by default `'yourpassword'` | `"yourpassword"` |
 | `rabbitmq.exchange` | RabbitMQ exchange, by default `''` | `""` |
+| `audit.enabled` | Deploy the Hub audit consumer and act as the master switch for all audit producers. | `false` |
+| `audit.intake.queue` | Shared durable RabbitMQ queue used by audit producers and the audit consumer. | `"hub-audit-events"` |
+| `audit.intake.deadletterQueue` | Shared RabbitMQ queue used for invalid audit events and exhausted persistence retries. | `"hub-audit-dead-letter"` |
+| `audit.intake.maxRetries` | Maximum MongoDB persistence retries before an intake event is dead-lettered. | `10` |
+| `audit.intake.prefetchCount` | Maximum unacknowledged intake events per audit replica. | `20` |
+| `audit.intake.persistTimeout` | Timeout for one MongoDB persistence attempt. | `"10s"` |
 | `kafka.broker` | Kafka brokers, by default `'kafka1.yourdomain.com:9094,kafka2.yourdomain.com:9094'` | `"kafka1.yourdomain.com:9094"` |
 | `kafka.username` | Kafka username, by default `'yourusername'` | `"yourusername"` |
 | `kafka.password` | Kafka password, by default `'yourpassword'` | `"yourpassword"` |
@@ -121,6 +207,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
+| `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
@@ -205,8 +292,9 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
-| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (`en`, `nl`, `pl`, `pt`, `it`, `tr`, `fr`, `sv`, `de`). | `"en"` |
+| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.audit.enabled` | Enable or disable the owner/admin Audit events page and navigation link. | `"true"` |
 | `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
@@ -228,16 +316,21 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
 | `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
-| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control and recording-state overlay in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.deviceStatusEnabled` | Show connectivity and recent-motion status in live view tile headers. | `"true"` |
 | `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
 | `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
 | `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
 | `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
 | `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
+| `kerberoshub.frontend.features.chart.colors` | Ordered colors shared by chart series and marker detection overlays. | `["#84569f", "#3ba7ff", "#ff5c8a", "#4ad991", "#ffb84d", "#ff7043"]` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionFill` | Fill color for chart selection regions. | `"rgba(132, 86, 159, 0.07)"` |
 | `kerberoshub.frontend.features.chart.colorChartSelectionStroke` | Stroke color for chart selection regions. | `"rgba(132, 86, 159, 0.4)"` |
 | `kerberoshub.frontend.features.chart.colorChartGridStroke` | Stroke color for chart grid lines. | `"rgba(0, 106, 255, 0.18)"` |
 | `kerberoshub.frontend.features.devices.hideAgent` | Hide agent controls in the devices section of the frontend. | `"false"` |
+| `kerberoshub.frontend.features.devices.analyticsEnabled` | Enable or disable the Analytics tab on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.devices.developerToolsEnabled` | Enable or disable owner-only live Agent logs and terminal access on device detail pages. | `"true"` |
+| `kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled` | Enable or disable the fullscreen Sites map on the Dashboard. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.date.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.date`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.sites.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sites`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.groups.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.groups`. | `"true"` |
@@ -248,8 +341,11 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled` | Limit marker, category, event, and tag filter options to the selected recordings day. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled` | Order marker filter options from configured categories before other markers. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories` | Ordered exact, case-sensitive marker category names to prioritize. | `[]` |
 | `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
-| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.tags.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.tags`. | `"true"` |
 | `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
 | `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
 | `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
@@ -298,8 +394,22 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
 | `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
 | `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
+| `kerberoshub.cleanup.auditEventRetentionDays` | Deployment-wide audit-event retention in days, independent of recording plans, inactive-account cleanup, and the optional global pass. Set to `"0"` or a negative value to keep audit events indefinitely. | `"400"` |
 | `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
+| `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
+| `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. | `"v1.0.1"` |
+| `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
+| `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
+| `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
+| `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
+| `kerberoshub.audit.destinations` | Webhook destinations. Each entry supports `id`, `enabled`, `url`, delivery limits, filters, public `headers`, `bearerTokenSecret`, and arbitrary `secretHeaders`. Destination IDs retain independent checkpoints. | `[]` |
+| `kerberoshub.audit.serviceMonitor.enabled` | Create a Prometheus `ServiceMonitor` for audit service metrics. | `true` |
+| `kerberoshub.audit.serviceMonitor.interval` | Audit service metrics scrape interval. | `"15s"` |
+| `kerberoshub.audit.volumes` | Additional pod volumes, for example a private webhook CA bundle. | `[]` |
+| `kerberoshub.audit.volumeMounts` | Additional audit service container volume mounts. | `[]` |
+| `kerberoshub.audit.extraEnv` | Additional audit service environment variables. | `[]` |
 | `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
 | `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
@@ -315,10 +425,11 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
 | `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
+| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -353,7 +464,9 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
 | `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
+| `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
+| `kerberospipeline.notify.notificationExpiryMinutes` | Maximum recording age in minutes before notification delivery. Set to `"0"` to disable the freshness cutoff. | `"15"` |
 | `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
@@ -405,8 +518,8 @@ Below all configuration options and parameters are listed.
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
-| `kerberospipeline.sprite.width` | Configuration value for `kerberospipeline.sprite.width`. | `"240"` |
-| `kerberospipeline.sprite.height` | Configuration value for `kerberospipeline.sprite.height`. | `"135"` |
+| `kerberospipeline.sprite.width` | Tile width in pixels; preserve width:height = 16:9. | `"240"` |
+| `kerberospipeline.sprite.height` | Tile height in pixels; preserve width:height = 16:9. | `"135"` |
 | `kerberospipeline.sprite.resources.requests.memory` | Memory request for `kerberospipeline.sprite`. | `"512Mi"` |
 | `kerberospipeline.sprite.resources.requests.cpu` | CPU request for `kerberospipeline.sprite`. | `"500m"` |
 | `kerberospipeline.sprite.resources.limits.memory` | Memory limit for `kerberospipeline.sprite`. | `"2Gi"` |
@@ -486,6 +599,22 @@ As mentioned during the Post installation step, you'll import some `.nosql` file
 
 Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.
 
+New deployments should define the shared classification list through
+`classificationCatalog`. Each entry contains the stable classifier output
+`key`, the user-facing `label`, and an `icon` key. Hub API exposes this catalog
+to alerts and filters. When the mounted catalog is unavailable, compatible Hub
+API versions fall back to the legacy `settings` document and then the built-in
+classification list. Set `classificationCatalogEnabled: false` to omit the
+ConfigMap and make Hub API use that fallback directly.
+
+```yaml
+classificationCatalogEnabled: true
+classificationCatalog:
+  - key: forklift
+    label: Forklift
+    icon: vehicle
+```
+
 ### Indexing
 
 Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.

charts/hub/custom-layout/i18n-custom/en.json

@@ -1,15 +1,7 @@
 {
   "nav": {
     "cases": "Investigations",
-    "dashboard": "Home",
-    "context": {
-      "label": "Tenant",
-      "title": "Switch tenant",
-      "open": "Choose tenant and project"
-    }
-  },
-  "projects": {
-    "current": "Active project"
+    "dashboard": "Home"
   },
   "login": {
     "signInTo": "Sign in to {{domain}} \u2014 Acme Security"

charts/hub/templates/configmap-classification-catalog.yaml

@@ -0,0 +1,10 @@
+{{- if .Values.classificationCatalogEnabled }}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: classification-catalog
+  namespace: {{ .Release.Namespace }}
+data:
+  classifications.json: |-
+    {{- toPrettyJson .Values.classificationCatalog | nindent 4 }}
+{{- end }}

charts/hub/templates/configmap-hub-audit.yaml

@@ -0,0 +1,51 @@
+{{- if .Values.audit.enabled -}}
+{{- $destinations := list -}}
+{{- $destinationIDs := dict -}}
+{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
+  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
+    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
+  {{- end -}}
+  {{- if hasKey $destinationIDs $id -}}
+    {{- fail (printf "duplicate audit destination id %q" $id) -}}
+  {{- end -}}
+  {{- $_ := set $destinationIDs $id true -}}
+  {{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
+  {{- $entry := dict
+      "id" $id
+      "type" (default "webhook" $destination.type)
+      "enabled" $destination.enabled
+      "url" $url
+      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
+      "batchSize" (default 100 $destination.batchSize)
+      "maxAttempts" (default 10 $destination.maxAttempts)
+      "startAt" (default "latest" $destination.startAt)
+      "headers" (default dict $destination.headers)
+      "filters" (default dict $destination.filters) -}}
+  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
+  {{- $bearer := default dict $destination.bearerTokenSecret -}}
+  {{- if gt (len $bearer) 0 -}}
+    {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
+    {{- $secretKey := default "token" $bearer.key -}}
+    {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- $headerFiles := dict -}}
+  {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
+    {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
+    {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
+    {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
+  {{- end -}}
+  {{- if gt (len $headerFiles) 0 -}}
+    {{- $_ := set $entry "headerFiles" $headerFiles -}}
+  {{- end -}}
+  {{- $destinations = append $destinations $entry -}}
+{{- end -}}
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+data:
+  destinations.json: |
+    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -120,6 +120,9 @@ spec:
     metadata:
       annotations:
         checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+        {{- if .Values.classificationCatalogEnabled }}
+        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configmap-classification-catalog.yaml") . | sha256sum }}
+        {{- end }}
       labels:
         app: hub-api
     spec:
@@ -132,8 +135,14 @@ spec:
       {{- end }}
       {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
       {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
+      {{- if or $classificationCatalogEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- if $classificationCatalogEnabled }}
+        - name: classification-catalog
+          configMap:
+            name: classification-catalog
+      {{- end }}
       {{- with .Values.kerberoshub.api.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
@@ -161,8 +170,13 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          {{- if or $classificationCatalogEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- if $classificationCatalogEnabled }}
+            - name: classification-catalog
+              mountPath: /etc/kerberos/classifications
+              readOnly: true
+          {{- end }}
           {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
@@ -180,6 +194,10 @@ spec:
             - configMapRef:
                 name: mongodb-config
           env:
+            {{- if $classificationCatalogEnabled }}
+            - name: CLASSIFICATION_CATALOG_FILE
+              value: /etc/kerberos/classifications/classifications.json
+            {{- end }}
             - name: ENVIRONMENT
               value: "{{ .Values.environment }}"
             - name: READ_ONLY
@@ -356,6 +374,14 @@ spec:
               value: "{{ .Values.rabbitmq.username }}"
             - name: RABBITMQ_PASSWORD
               value: "{{ .Values.rabbitmq.password }}"
+            - name: AUDIT_ENABLED
+              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
+            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            {{- end }}
 
             # Slack notifications (this will send events/logs to a specific channel).
             - name: SLACK_ENABLED
@@ -444,11 +470,11 @@ spec:
             - name: VAULT_SPRITE_SECRET_KEY
               value: "{{ .Values.kerberosvault.sprite.secretKey }}"
             - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberosvault.sprite.interval }}"
+              value: "{{ .Values.kerberospipeline.sprite.interval }}"
             - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberosvault.sprite.width }}"
+              value: "{{ .Values.kerberospipeline.sprite.width }}"
             - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberosvault.sprite.height }}"
+              value: "{{ .Values.kerberospipeline.sprite.height }}"
             {{- if .Values.kerberoshub.extraEnv }}
             {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
             {{- end }}

charts/hub/templates/kerberos-hub/hub-audit-servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-audit-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-audit
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-audit
+  endpoints:
+    - port: metrics
+      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-hub/hub-audit.yaml

@@ -0,0 +1,166 @@
+{{- if .Values.audit.enabled -}}
+{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
+{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
+{{- end -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.audit.replicas }}
+  selector:
+    matchLabels:
+      app: hub-audit
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-audit
+    spec:
+      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      volumes:
+        - name: destinations
+          configMap:
+            name: hub-audit
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+      {{- $bearer := default dict $destination.bearerTokenSecret }}
+      {{- $secretHeaders := default dict $destination.secretHeaders }}
+      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+          projected:
+            sources:
+            {{- if gt (len $bearer) 0 }}
+              - secret:
+                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
+                  items:
+                    - key: {{ default "token" $bearer.key | quote }}
+                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
+            {{- end }}
+            {{- range $headerName, $secret := $secretHeaders }}
+              - secret:
+                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
+                  items:
+                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
+                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
+            {{- end }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: hub-audit
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
+          {{- with .Values.kerberoshub.audit.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: metrics
+              containerPort: 2112
+              protocol: TCP
+          readinessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          livenessProbe:
+            httpGet:
+              path: /healthz
+              port: metrics
+          volumeMounts:
+            - name: destinations
+              mountPath: /etc/hub-audit
+              readOnly: true
+          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- $bearer := default dict $destination.bearerTokenSecret }}
+          {{- $secretHeaders := default dict $destination.secretHeaders }}
+          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
+            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
+              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
+              readOnly: true
+          {{- end }}
+          {{- end }}
+          {{- with .Values.kerberoshub.audit.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          env:
+            - name: RABBITMQ_HOST
+              value: {{ .Values.rabbitmq.host | quote }}
+            - name: RABBITMQ_EXCHANGE
+              value: {{ .Values.rabbitmq.exchange | quote }}
+            - name: RABBITMQ_USERNAME
+              value: {{ .Values.rabbitmq.username | quote }}
+            - name: RABBITMQ_PASSWORD
+              value: {{ .Values.rabbitmq.password | quote }}
+            - name: AUDIT_QUEUE
+              value: {{ .Values.audit.intake.queue | quote }}
+            - name: AUDIT_DEADLETTER_QUEUE
+              value: {{ .Values.audit.intake.deadletterQueue | quote }}
+            - name: AUDIT_MAX_RETRIES
+              value: {{ .Values.audit.intake.maxRetries | quote }}
+            - name: AUDIT_PREFETCH_COUNT
+              value: {{ .Values.audit.intake.prefetchCount | quote }}
+            - name: AUDIT_PERSIST_TIMEOUT
+              value: {{ .Values.audit.intake.persistTimeout | quote }}
+            - name: DISPATCH_INTERVAL
+              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
+            - name: LEASE_DURATION
+              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
+            - name: POD_NAME
+              valueFrom:
+                fieldRef:
+                  fieldPath: metadata.name
+          {{- with .Values.kerberoshub.audit.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.kerberoshub.extraEnv }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-audit
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-audit
+    service: hub-audit
+spec:
+  ports:
+    - name: metrics
+      port: 2112
+      targetPort: metrics
+      protocol: TCP
+  selector:
+    app: hub-audit
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -108,6 +108,8 @@ spec:
               value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
             - name: DEFAULT_TASK_RETENTION_DAYS
               value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
+            - name: AUDIT_EVENT_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
           {{- if .Values.kerberoshub.extraEnv }}
           {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
           {{- end }}

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -193,6 +193,10 @@ spec:
         - name: GOOGLEMAPS_KEY
           value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
 
+        # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
+
         # Zendesk for support
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
@@ -229,6 +233,14 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
         - name: FEATURE_ORGANISATIONS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
         - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
@@ -267,6 +279,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
         - name: FEATURE_REMOTE_RECORDING_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
         - name: MOQ_RELAY_URL
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
         - name: MOQ_BROADCAST_PREFIX
@@ -363,6 +377,12 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
         - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
         - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
         - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -312,6 +312,14 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_AUDIT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
+        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
+        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
+        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
         - name: FEATURE_ORGANISATIONS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
         - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
@@ -352,6 +360,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
         - name: FEATURE_REMOTE_RECORDING_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
         - name: MOQ_RELAY_URL
           value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
         - name: MOQ_BROADCAST_PREFIX
@@ -419,6 +429,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
 
         # features > chart
+        - name: CHART_COLORS
+          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
         - name: COLOR_CHART_SELECTION_FILL
           value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
         - name: COLOR_CHART_SELECTION_STROKE
@@ -457,6 +469,12 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
         - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
+          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
         - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
           value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
         - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -18,6 +18,9 @@
   redaction) declares its destination provider with the named field
   services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
   read-only stage omits it and gets no provider env.
+
+  Worker-specific settings go in services.<name>.env (plain values) and
+  services.<name>.secretEnv (references to keys in an existing Secret).
 */ -}}
 {{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
 {{- $root := . -}}
@@ -122,6 +125,19 @@ spec:
         {{- range $key, $value := $svc.env }}
         - name: {{ $key }}
           value: {{ $value | quote }}
+        {{- end }}        {{- with $svc.secretEnv }}
+
+        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
+        # container env var to a key in an existing Kubernetes Secret
+        # ({name, key}), so credentials such as a model API key stay out of
+        # values. The Secret must exist in the release namespace.
+        {{- range $key, $ref := . }}
+        - name: {{ $key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
+              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
+        {{- end }}
         {{- end }}
 ---
 apiVersion: v1

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-analysis
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.analysis.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-counting
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.counting.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-dominantcolor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-event
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.event.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-monitor
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.monitor.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-notify
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.notify.replicas }}
   selector:
@@ -66,6 +70,8 @@ spec:
         env:
         - name: LOG_LEVEL
           value: "{{ .Values.kerberospipeline.notify.logLevel }}"
+        - name: NOTIFICATION_EXPIRY_MINUTES
+          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
         # Queue
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -91,6 +97,14 @@ spec:
           value: "{{ .Values.rabbitmq.username }}"
         - name: RABBITMQ_PASSWORD
           value: "{{ .Values.rabbitmq.password }}"
+        - name: AUDIT_ENABLED
+          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
+        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
+        - name: AUDIT_QUEUE
+          value: {{ .Values.audit.intake.queue | quote }}
+        - name: AUDIT_DEADLETTER_QUEUE
+          value: {{ .Values.audit.intake.deadletterQueue | quote }}
+        {{- end }}
 
         # Kerberos Vault
         - name: STORAGE_URI

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sequence
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sequence.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-sprite
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.sprite.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-throttler
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.throttler.replicas }}
   selector:

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -4,6 +4,10 @@ kind: Deployment
 metadata:
   name: pipe-thumbnail
   namespace: {{ .Release.Namespace }}
+  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
+  annotations:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
 spec:
   replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
   selector:

charts/hub/templates/kerberos-vault/vault-proxy.yaml

@@ -1,4 +1,4 @@
-{{- if eq .Values.mode "all" -}}
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:

charts/hub/values.yaml

@@ -69,6 +69,39 @@ mongodb:
     caFileName: ""
     mountPath: "/etc/mongodb/tls"
     insecureSkipVerify: false
+
+# Classifications supported by Hub filters, alerts, markers, and other
+# downstream processing. Classifier output keys must match these values.
+# Disable this to use the legacy classification catalog stored in MongoDB.
+classificationCatalogEnabled: true
+classificationCatalog:
+  - key: animal
+    label: Animal
+    icon: animal
+  - key: pedestrian
+    label: Pedestrian
+    icon: pedestrian
+  - key: cyclist
+    label: Cyclist
+    icon: cyclist
+  - key: motorbike
+    label: Motorbike
+    icon: motorbike
+  - key: lorry
+    label: Lorry
+    icon: lorry
+  - key: car
+    label: Car
+    icon: car
+  - key: handbag
+    label: Handbag
+    icon: handbag
+  - key: suitcase
+    label: Suitcase
+    icon: suitcase
+  - key: cell phone
+    label: Cell phone
+    icon: cell phone
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
@@ -102,6 +135,16 @@ rabbitmq:
   username: "yourusername"
   password: "yourpassword"
   exchange: ""
+# Shared audit transport. The master switch controls the consumer and all
+# producers; individual services may opt out through their own audit setting.
+audit:
+  enabled: false
+  intake:
+    queue: "hub-audit-events"
+    deadletterQueue: "hub-audit-dead-letter"
+    maxRetries: 10
+    prefetchCount: 20
+    persistTimeout: "10s"
 # If you already have a Kafka cluster you might use this instead of RabbitMQ.
 kafka:
   broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
@@ -242,6 +285,8 @@ kerberoshub:
     pullPolicy: IfNotPresent
     tag: "v1.9.51"
     replicas: 2
+    audit:
+      enabled: true
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-api Service (e.g. when an
     # external/shared Service is managed elsewhere).
@@ -470,13 +515,16 @@ kerberoshub:
       # hidden and `defaultLanguage` is always forced; users cannot change it.
       i18n:
         enabled: "true" # Enable or disable the language switcher 'true' or 'false'
-        defaultLanguage: "en" # Default language code: en, nl, pl, pt, it, tr, fr, sv, de
+        defaultLanguage: "en" # Default language code: en, nl, pl, tr, fr, sv, de
       # Case management is a feature that allows you to create cases, and link recordings, devices, sites, groups, markers and events to those cases. 
       case:
         enabled: "true" # Enable or disable case management feature 'true' or 'false'
       # Workflows allow you to define automated processes and actions in the front-end.
       workflows:
         enabled: "false" # Enable or disable workflows feature 'true' or 'false'
+      # Audit events are visible to owner/admin users when enabled.
+      audit:
+        enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
       # Organisation controls remain visible as a read-only current organisation when switching is disabled.
       organisations:
         enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
@@ -505,7 +553,8 @@ kerberoshub:
         liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
         hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
         moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
-        remoteRecordingEnabled: "true" # Show the manual REC control in live views
+        remoteRecordingEnabled: "true" # Show the manual REC control and recording-state overlay in live views
+        deviceStatusEnabled: "true" # Show connectivity and recent-motion status in live view tile headers
         moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
         moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
         paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
@@ -514,6 +563,11 @@ kerberoshub:
       # Device page
       devices:
         hideAgent: "false" # Hide the 'add agent' button in the front-end
+        analyticsEnabled: "true" # Enable or disable the Analytics tab on device detail pages 'true' or 'false'
+        developerToolsEnabled: "true" # Enable or disable device logs and terminal access 'true' or 'false'
+      # Dashboard page
+      dashboard:
+        sitesFullscreenEnabled: "true" # Enable or disable the fullscreen Sites map 'true' or 'false'
       # Media page
       media:
         filter:
@@ -537,6 +591,11 @@ kerberoshub:
             enabled: "true" # Enable or disable category filter in media 'true' or 'false'
           markers:
             enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
+          markerOptionsByDate:
+            enabled: "false" # Limit marker-related filter options to the selected recording day
+          markerCategoryPriority:
+            enabled: "false" # Order marker options from configured categories before other markers
+            categories: [] # Ordered marker category names, for example ["security", "traffic"]
           events:
             enabled: "true" # Enable or disable events filter in media 'true' or 'false'
           tags:
@@ -544,6 +603,13 @@ kerberoshub:
           defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
       # Chart feature
       chart:
+        colors:
+          - "#84569f"
+          - "#3ba7ff"
+          - "#ff5c8a"
+          - "#4ad991"
+          - "#ffb84d"
+          - "#ff7043"
         colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
         colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
         colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
@@ -643,10 +709,59 @@ kerberoshub:
     # Tasks with `legal_hold=true` are never deleted. Must match the value
     # used by `kerberoshub.api.defaultTaskRetentionDays`.
     defaultTaskRetentionDays: "0"
+    # Deployment-wide retention for audit events. This is independent from
+    # recording plans, inactive-account cleanup, and the optional global pass.
+    # Set to "0" or a negative value to retain audit events indefinitely.
+    auditEventRetentionDays: "400"
     resources:
       requests:
         memory: 10Mi
         cpu: 10m
+  # Dispatches canonical audit_events to one or more external webhook sinks.
+  # Credentials are always read from existing Secrets and never stored here.
+  audit:
+    repository: ghcr.io/uug-ai/hub-audit
+    pullPolicy: IfNotPresent
+    tag: "v1.0.1"
+    replicas: 1
+    dispatchInterval: "5s"
+    leaseDuration: "2m"
+    terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
+    topologySpreadConstraints: []
+    volumes: []
+    volumeMounts: []
+    extraEnv: []
+    serviceMonitor:
+      enabled: true
+      interval: 15s
+    destinations: []
+    # - id: primary-siem
+    #   type: webhook
+    #   enabled: true
+    #   url: https://siem.example.com/api/audit
+    #   timeoutSeconds: 10
+    #   batchSize: 100
+    #   maxAttempts: 10
+    #   startAt: latest # latest | beginning, applied only on first creation
+    #   headers:
+    #     X-Source: kerberos-hub
+    #   bearerTokenSecret:
+    #     name: audit-primary-siem
+    #     key: token
+    #   secretHeaders:
+    #     X-Api-Key:
+    #       secretName: audit-primary-siem
+    #       secretKey: api-key
+    #   filters:
+    #     organisationIds: []
+    #     projectIds: []
+    #     actions: []
+    #     categories: []
+    #     outcomes: [] # success | failure
+    # resources:
+    #   requests:
+    #     memory: 32Mi
+    #     cpu: 10m
   # hub-workflows is the standalone, queue-driven workflow engine. It consumes
   # pipeline events and dispatches the stages declared in its workflow
   # definitions, tracking each run in its own `workflow_runs` collection. It shares events
@@ -713,6 +828,14 @@ kerberoshub:
     #      # (no condition ⇒ gate on the upstream's presence, not a value).
     #      needs:
     #        - operation: objecttracking
+    #vlm-workflow:
+    #  # Describe every recording with the hub-vlm worker (services.vlm below).
+    #  enabled: true
+    #  triggers:
+    #    - type: automatic
+    #  stages:
+    #    - operation: vlm
+    #      dispatch: always
   # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
   # replicas/resources/queue lives here in a single, uniform shape:
   #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -723,6 +846,8 @@ kerberoshub:
   #     Deploying a worker (services.<name>.enabled) is independent from routing
   #     to it (a workflows.definitions stage of the same operation) — it runs only
   #     when its own `enabled` is true AND the workflows engine is enabled.
+  #     Worker-specific settings go in `env` (plain key/values) and `secretEnv`
+  #     (ENV_NAME: {name, key} of an existing Secret, for credentials).
   services:
     # hub-workflows — the workflows engine (orchestrator). Consumes the engine
     # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
@@ -801,6 +926,43 @@ kerberoshub:
           #    requests:
           #      memory: 10Mi
           #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) — hub-vlm (operation "vlm").
+          #
+          # Samples frames from the recording, describes them with an Azure OpenAI
+          # vision model and emits timeline markers plus a recording description.
+          # Route to it with a workflows.definitions stage `- operation: vlm`.
+          # See https://github.com/uug-ai/hub-vlm for every VLM_* / AZURE_OPENAI_*
+          # setting. Create the API key Secret first, e.g.
+          #   kubectl create secret generic hub-vlm-azure-openai \
+          #     --from-literal=apiKey=<azure-openai-api-key>
+          #vlm:
+          #  # Deploy the hub-vlm worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-vlm
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (VLM_QUEUE).
+          #  queue: "hub-vlm-queue"
+          #  env:
+          #    AZURE_OPENAI_ENDPOINT: "https://<resource>.openai.azure.com"
+          #    AZURE_OPENAI_DEPLOYMENT: "gpt-5.4-mini" # Name of the model deployment.
+          #    AZURE_OPENAI_REASONING_EFFORT: "low" # none | minimal | low | medium | high
+          #    VLM_MAX_FRAMES: "8" # Frames sampled per recording (max 32).
+          #    VLM_FRAME_WIDTH: "1024" # Maximum frame width in pixels.
+          #    VLM_SET_DESCRIPTION: "true" # Write the summary to the recording description.
+          #  # The API key is read from an existing Secret, never from values.
+          #  secretEnv:
+          #    AZURE_OPENAI_API_KEY:
+          #      name: hub-vlm-azure-openai
+          #      key: apiKey
+          #  resources:
+          #    requests:
+          #      memory: 128Mi
+          #      cpu: 100m
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent
@@ -857,10 +1019,11 @@ kerberoshub:
     #    cpu: 10m
   # This proxy is legacy for the old agent, will be migrated in the new Hub API.
   proxy:
+    enabled: false
     repository: uugai/hub-proxy
     pullPolicy: IfNotPresent
     tag: "v1.0.0"
-    replicas: 0 # Number of pods for the service. Set to 0 to disable.
+    replicas: 0 # Number of pods for the service when enabled.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -880,6 +1043,10 @@ kerberoshub:
 # The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
 kerberospipeline:
   event:
+    deploymentAnnotations: {}
+    # Example (opt-in Argo CD ordering):
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "10"
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
     tag: "v1.3.1"
@@ -899,6 +1066,9 @@ kerberospipeline:
         cpu: 10m
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "70"
     pullPolicy: IfNotPresent
     tag: "v1.3.13"
     replicas: 1 # Number of pods for the service.
@@ -917,6 +1087,9 @@ kerberospipeline:
         cpu: 10m
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "60"
     pullPolicy: IfNotPresent
     tag: "v1.6.26"
     replicas: 1 # Number of pods for the service.
@@ -934,6 +1107,9 @@ kerberospipeline:
         cpu: 10m
   throttler:
     repository: uugai/hub-pipeline-throttler
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "30"
     pullPolicy: IfNotPresent
     tag: "v1.2.1"
     replicas: 1 # Number of pods for the service.
@@ -952,11 +1128,17 @@ kerberospipeline:
         cpu: 10m
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "20"
     pullPolicy: IfNotPresent
     tag: "v1.3.18"
     replicas: 1 # Number of pods for the service.
+    audit:
+      enabled: true
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
+    notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
     resources:
       requests:
         memory: 10Mi
@@ -989,6 +1171,9 @@ kerberospipeline:
         #      claimName: custom-layout-claim
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "40"
     pullPolicy: IfNotPresent
     tag: "v1.8.5"
     replicas: 1 # Number of pods for the service.
@@ -1007,6 +1192,9 @@ kerberospipeline:
         cpu: 10m
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v2.0.3"
     replicas: 3 # Number of pods for the service.
@@ -1028,6 +1216,9 @@ kerberospipeline:
         cpu: 1000m
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v1.3.10"
     replicas: 2 # Number of pods for the service.
@@ -1054,6 +1245,9 @@ kerberospipeline:
         cpu: 1000m
   counting:
     repository: uugai/hub-pipeline-counting
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     pullPolicy: IfNotPresent
     tag: "v2.0.0"
     replicas: 1 # Number of pods for the service.
@@ -1072,6 +1266,9 @@ kerberospipeline:
         cpu: 10m
   sprite:
     enabled: false # Enable or disable the sprite generation 'true' or 'false
+    deploymentAnnotations: {}
+    # deploymentAnnotations:
+    #   argocd.argoproj.io/sync-wave: "50"
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
     tag: "v1.1.16"
@@ -1086,8 +1283,10 @@ kerberospipeline:
     #    mountPath: /data
     logLevel: "info" # possible values: trace, debug, info, warn,
     interval: "1" # Number of secondes between each thumbnail in the sprite
-    width: "240" # Should not be changed for the moment (hard coded in UI)
-    height: "135" # Should not be changed for the moment (hard coded in UI)
+    # Tile size in pixels. Preserve width:height = 16:9 (e.g. 240x135, 480x270, 640x360).
+    # Deploy dimension-aware sprite/analysis workers, Hub API and frontend before increasing.
+    width: "240"
+    height: "135"
     resources:
       requests:
         memory: 512Mi

scripts/check-pipeline-deployment-annotations.sh

@@ -0,0 +1,81 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+
+# Supply per-service test overrides without requiring a separate values file.
+WAVE_FLAGS=()
+for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
+  service="${setting%%:*}"
+  wave="${setting#*:}"
+  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
+done
+
+# Only read Deployment metadata, never pod-template or Service annotations.
+extract_waves() {
+  awk '
+    /^---/ { deployment=0; metadata=0; name="" }
+    /^kind: Deployment$/ { deployment=1 }
+    /^metadata:$/ { metadata=1; next }
+    /^[^ #]/ { metadata=0 }
+    deployment && metadata && /^  name:/ { name=$2 }
+    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
+      value=$2
+      gsub(/"/, "", value)
+      print name, value
+    }
+  ' | sort
+}
+
+assert_waves() {
+  local rendered="$1"
+  local expected="$2"
+  local actual
+  actual="$(printf '%s\n' "$rendered" | extract_waves)"
+  if [[ "$actual" != "$expected" ]]; then
+    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
+    return 1
+  fi
+  local all_count expected_count
+  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
+  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
+  if [[ "$all_count" != "$expected_count" ]]; then
+    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
+    return 1
+  fi
+}
+
+expected="$(printf '%s\n' \
+  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
+  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
+  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
+
+for mode in all pipeline; do
+  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$default_render" ""
+  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
+    echo "Empty annotations must be omitted" >&2
+    exit 1
+  fi
+  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true)"
+  assert_waves "$configured_render" "$expected"
+  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
+done
+
+disabled_sprite="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
+assert_waves "$disabled_sprite" "$(printf '%s\n' "$expected" | grep -v '^pipe-sprite ')"
+
+ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true)"
+assert_waves "$ui_render" ""
+
+# Exercise zero/negative strings and an unrelated annotation on the same map.
+for wave in 0 -10; do
+  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
+    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
+    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
+  assert_waves "$override" "pipe-event $wave"
+  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
+  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
+done
+
+echo "All pipeline Deployment annotation checks passed."