Update index.yaml

Signed-off-by: cedricve <cedricve@users.noreply.github.com>

.devcontainer/Dockerfile

@@ -1,28 +0,0 @@
-FROM mcr.microsoft.com/devcontainers/go:1.25-bookworm
-
-# Remove expired Yarn GPG key from base image
-RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
-
-# Remove expired Yarn repository key (inherited from base image)
-RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
-
-# Install AZURE CLI
-RUN curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-
-# Install helm and kubectl
-RUN curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
-    && chmod +x ./kubectl \
-    && sudo mv ./kubectl /usr/local/bin/kubectl
-
-# Install Argocd CLI
-RUN VERSION=$(curl -L -s https://raw.githubusercontent.com/argoproj/argo-cd/stable/VERSION)
-RUN curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/v$VERSION/argocd-linux-amd64
-RUN sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
-RUN rm argocd-linux-amd64
-
-# Install google-cloud-sdk
-RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
-RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
-RUN sudo apt-get update && sudo apt-get install -y google-cloud-cli
-RUN sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin

.devcontainer/devcontainer.json

@@ -1,23 +0,0 @@
-{
-	"name": "go:1.25-bookworm",
-	"dockerFile": "Dockerfile",
-	"runArgs": [
-		"--name=helm-charts",
-		"--network=host",
-		 "--privileged"
-	],
-	"customizations": {
-		"vscode": {
-			"extensions": [
-				"ms-kubernetes-tools.vscode-kubernetes-tools",
-				"redhat.vscode-yaml",
-				"Tim-Koehler.helm-intellisense",
-				"ms-vscode.azurecli",
-				"ms-vscode-remote.remote-containers",
-				"GitHub.copilot",
-				"ms-kubernetes-tools.vscode-aks-tools",
-				"fabiospampinato.vscode-diff"
-			]
-		}
-	}
-}

.github/workflows/http-port-migration.yaml

@@ -1,28 +0,0 @@
-name: HTTP port migration
-
-on:
-  pull_request:
-  workflow_dispatch:
-
-jobs:
-  migration:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v4
-      - uses: azure/setup-helm@v4.3.1
-      - uses: helm/kind-action@v1
-      - name: Validate migration against Kubernetes
-        env:
-          SERVER_VALIDATION: "true"
-        run: bash scripts/check-http-port-migration.sh
-      - name: Validate chart runtime compatibility
-        run: |
-          helm lint charts/hub
-          bash scripts/check-admin-runtime.sh
-          bash scripts/check-hardened-workers.sh
-          bash scripts/check-frontend-runtime.sh
-          bash scripts/check-hub-api-runtime.sh
-      - name: Smoke test hardened frontend images and Service routing
-        env:
-          CLUSTER_SMOKE: "true"
-        run: bash scripts/check-frontend-runtime.sh

.github/workflows/k3d.yaml

@@ -1,56 +0,0 @@
-name: Deploy on k3d
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        k3d: [v5.7.5]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: "Create single cluster"
-        uses: AbsaOSS/k3d-action@v2
-        with:
-          k3d-version: ${{ matrix.k3d }}  
-          cluster-name: "k3d-cluster"
-      - name: Print Kubernetes Version
-        run: |
-          kubectl version
-      - name: Test k3d
-        run: |
-          echo "Sleeping for 120 seconds, give time for the cluster to be ready" && sleep 120
-          kubectl get no
-          kubectl get pods -A -o wide
-          kubectl get sc
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ K3d deployment successful on ${{ matrix.os }} (${{ matrix.k3d }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ K3d deployment failed on ${{ matrix.os }} (${{ matrix.k3d }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/kind.yaml

@@ -1,52 +0,0 @@
-name: Deploy on kind
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        kind: [v0.25.0]
-    steps:
-      - name: Create kind
-        uses: helm/kind-action@v1
-        with:
-          version: ${{ matrix.kind }}
-      - name: Print Kubernetes Version
-        run: |
-          kubectl version
-      - name: Test kind
-        run: |
-          kubectl get no
-          kubectl get pods -A -o wide
-          kubectl get sc
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ Kind deployment successful on ${{ matrix.os }} (${{ matrix.kind }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ Kind deployment failed on ${{ matrix.os }} (${{ matrix.kind }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/microk8s.yaml

@@ -1,53 +0,0 @@
-name: Deploy on microk8s
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        microk8s: [1.32/stable]
-    steps:
-      - uses: balchua/microk8s-actions@v0.4.3
-        with:
-          channel: ${{ matrix.microk8s }}
-          addons: '["dns", "dashboard", "hostpath-storage", "nvidia"]'
-      - name: Set permissions
-        run: |
-          sudo chown -f -R $USER $HOME/.kube $HOME/.config
-      - name: Test microk8s
-        id: list-pods
-        run: |
-          kubectl get no
-          kubectl get pods -A -o wide
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ MicroK8s deployment successful on ${{ matrix.os }} (${{ matrix.microk8s }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ MicroK8s deployment failed on ${{ matrix.os }} (${{ matrix.microk8s }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
-          

.github/workflows/release.yml

@@ -1,11 +1,9 @@
-name: Create a new release
+name: Release Charts
 
 on:
   push:
     branches:
       - main
-    paths:
-      - 'charts/**/Chart.yaml'
 
 jobs:
   release:

CNAME

@@ -0,0 +1 @@
+charts.kerberos.io

README.md

@@ -1,24 +1,19 @@
-## Helm charts
+## Usage
 
-Kerberos.io ecosystem can be deployed through Helm charts. Use one of the following charts to boost the installation:
-
-- [Hub](https://github.com/kerberos-io/helm-charts/tree/main/charts/hub)
-
-## Prerequisite
-
-[Helm](https://helm.sh) must be installed to use the charts. Please refer to Helm's [documentation](https://helm.sh/docs) to get started.
+[Helm](https://helm.sh) must be installed to use the charts. Please refer to
+Helm's [documentation](https://helm.sh/docs) to get started.
 
 Once Helm has been set up correctly, add the repo as follows:
 
-    helm repo add kerberos https://charts.kerberos.io
+helm repo add <alias> https://<orgname>.github.io/helm-charts
 
 If you had already added this repo earlier, run `helm repo update` to retrieve
-the latest versions of the packages. You can then run `helm search repo kerberos` to see the charts.
+the latest versions of the packages. You can then run `helm search repo <alias>` to see the charts.
 
-To install the `kerberos` chart:
+To install the <chart-name> chart:
 
-    helm install my-hub kerberos/hub
+    helm install my-<chart-name> <alias>/<chart-name>
 
 To uninstall the chart:
 
-    helm delete my-hub
+    helm delete my-<chart-name>

charts/hub/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: hub
-description: A Helm chart to install Kerberos Hub in Kubernetes
+description: A Helm chart for install Kerberos Hub in Kubernetes
 icon: https://doc.kerberos.io/images/kerberos-logo.svg
 
 # A chart can be either an 'application' or a 'library' chart.
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.186.0
+version: 0.29.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "3.3.0"
+appVersion: "3.0.0"

charts/hub/cert-manager/cluster-issuer.yaml

@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: cedric@verstraeten.io
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    # Enable the HTTP-01 challenge provider
+    solvers:
+      - http01:
+          ingress:
+            class: nginx

charts/hub/custom-layout/i18n-custom/custom-i18n-claim.yaml

@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: custom-i18n-claim
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: azurefile-premium
-  resources:
-    requests:
-      storage: 25Mi

charts/hub/custom-layout/i18n-custom/en.json

@@ -1,9 +0,0 @@
-{
-  "nav": {
-    "cases": "Investigations",
-    "dashboard": "Home"
-  },
-  "login": {
-    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
-  }
-}

charts/hub/custom-layout/templates/assign_task.html

@@ -1,409 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Hey, {{assignee}}</h4>
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        padding-bottom: 24px;
-                                        padding-left: 0;
-                                        padding-right: 0;">You have been assigned to a task</h2>
-						<p style="font-family: Inter;
-                                        font-size: 18px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;
-						">Task Details:</p>
-						<ul style="font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 12px;
-                                        padding-left: 0;
-                                        padding-right: 0;
-                                        margin-left: 12px">
-							<li>Task Name: {{task_name}}</li>
-							<li>Assigned By: {{user}}</li>
-						</ul>
- 						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 20px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 166px;
-                                                border-radius: 4px;
-                                                cursor: pointer;">View task on kerberos hub</p>
-                        </a>
-						
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>

charts/hub/custom-layout/templates/assign_task.txt

@@ -1,19 +0,0 @@
-Kerberos.io
-------------
-
-Hey, {{assignee}}
-You have been assigned to a new task on Kerberos Hub.
-Task Details:
-- Task Name: {{task_name}}
-- Assigned By: {{user}}
-- Link: {{link}}
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/detection.html

@@ -1,31 +1,3 @@
-package templates
-
-var TEMPLATE_DETECTION_TEXT = `
-Kerberos.io
-------------
-
-Hey, {{user}}
-Welcome to Kerberos Hub
-Activate your account ->
-{{link}}
-
-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
-
-However before you get started this amazing applications, please activate your account.
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
-`
-
-var TEMPLATE_DETECTION = `
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
@@ -303,25 +275,10 @@ var TEMPLATE_DETECTION = `
                                         letter-spacing: 0em;
                                         text-align: left;
                                         color: #6D6666;
-                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered for your device <b>{{devicename}}</b>. Please watch the recording, by clicking on below button. 
+                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered. Please watch the recording, by clicking on below button. 
 If you believe this event is a false positive, go to your Kerberos Hub account and change the alert settings accordingly.</p>
 
 
-                        <p style=" font-family: Inter;
-                        font-size: 14px;
-                        font-style: normal;
-                        font-weight: 400;
-                        line-height: 24px;
-                        mso-line-height-rule:exactly;
-                        letter-spacing: 0em;
-                        text-align: left;
-                        color: #6D6666;
-                        margin-top: 12px;">Following event was detected at {{datetime}}.</p>
-
-						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            {{thumbnail}}
-                        </a>
-
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                             <p style="font-family: Inter;
                                                 font-size: 14px;
@@ -472,4 +429,4 @@ If you believe this event is a false positive, go to your Kerberos Hub account a
     </tr>
 </table>
 </body>
-</html>`
+</html>

charts/hub/custom-layout/templates/device.txt

@@ -2,15 +2,15 @@ Kerberos.io
 ------------
 
 Hey, {{user}}
-
-One of your Kerberos Agents changed
-{{text}}
-
-Agents go offline due to a variety of reasons. The machine, node, micro controller on which your Agent runs, gets corrupted or disconnected from the internet. The camera itself is broken, damaged or in the worst case tampered. Have a look into your Kerberos Hub account for the latest recordings and/or verify the connection and status of your Kerberos Agent.
-
-Go to Kerberos Hub ->
+Welcome to Kerberos Hub
+Activate your account ->
 {{link}}
 
+Kerberos Hub in a nutshell
+With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+
+However before you get started this amazing applications, please activate your account.
+
 Get in touch
 ------------
 support@kerberos.io

charts/hub/custom-layout/templates/device_group.html

@@ -1,431 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Hey, {{user}}</h4>
-						<h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">Several of your cameras changed status</h2>
-                        <h2 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 24px;
-                                        padding-left: 0;
-                                        padding-right: 0;
-										color:#b09fb9;">{{text}}</h2>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 480px">What changed</h3>
-                        {{sections}}
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">Cameras that change status together usually share a cause, such as a site losing or regaining its internet connection or power. Have a look into your Kerberos Hub account for the latest recordings and the status of your cameras.</p>
-
-						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 24px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 160px;
-                                                border-radius: 4px;
-												text-align: center;
-                                                cursor: pointer;">Go to Kerberos Hub -></p>
-                        </a>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>

charts/hub/custom-layout/templates/device_group.txt

@@ -1,22 +0,0 @@
-Kerberos.io
-------------
-
-Hey, {{user}}
-
-Several of your cameras changed status
-{{text}}
-
-{{sectionsText}}
-
-Go to Kerberos Hub ->
-{{link}}
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/recording.html

@@ -1,431 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Hey, {{user}}</h4>
-						<h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">Camera recordings</h2>
-                        <h2 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 24px;
-                                        padding-left: 0;
-                                        padding-right: 0;
-										color:#b09fb9;">{{text}}</h2>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 480px">Cameras</h3>
-                        {{sections}}
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">These cameras record continuously, so a new recording normally arrives every few minutes. When a camera is online but its recordings stop arriving, check that the account has not reached its upload limit, that the storage the recordings are sent to is reachable and not full, and that the Agent's cloud settings and credentials are still valid. Cameras that are recording again need no action.</p>
-
-						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 24px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 160px;
-                                                border-radius: 4px;
-												text-align: center;
-                                                cursor: pointer;">Go to Kerberos Hub -></p>
-                        </a>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>

charts/hub/custom-layout/templates/recording.txt

@@ -1,24 +0,0 @@
-Kerberos.io
-------------
-
-Hey, {{user}}
-
-Camera recordings
-{{text}}
-
-{{sectionsText}}
-
-These cameras record continuously, so a new recording normally arrives every few minutes. When a camera is online but its recordings stop arriving, check that the account has not reached its upload limit, that the storage the recordings are sent to is reachable and not full, and that the Agent's cloud settings and credentials are still valid. Cameras that are recording again need no action.
-
-Go to Kerberos Hub ->
-{{link}}
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/share_case.html

@@ -1,418 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">A case has been shared with you</h2>
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">{{user}} shared a case with you</h4>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 280px">Open the shared case</h3>
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
-
-
-						<a style="text-decoration: none;color: none;" href="{{url}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 24px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 130px;
-                                                border-radius: 4px;
-												text-align: center;
-                                                cursor: pointer;">Open case -></p>
-                        </a>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>

charts/hub/custom-layout/templates/share_case.txt

@@ -1,21 +0,0 @@
-Kerberos.io
-------------
-
-A case has been shared with you
-{{user}} shared a case with you
-
-Open the shared case
-{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
-{{url}}
-
-This link will expire in {{expiry}}.
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/share_case_otp.html

@@ -1,425 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">Verify your access</h2>
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Use the code below to open the shared case</h4>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 280px">Your verification code</h3>
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">Enter the code below on the share page to access the case.</p>
-
-                        <p style="font-family: 'Courier New', Courier, monospace;
-                                        font-size: 32px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 40px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 8px;
-                                        text-align: center;
-                                        color:#262424;
-                                        background-color: #F2F0F4;
-                                        padding-top: 16px;
-                                        padding-bottom: 16px;
-                                        padding-right: 16px;
-                                        padding-left: 16px;
-                                        margin-top: 16px;
-                                        margin-bottom: 16px;
-                                        border-radius: 4px;">{{code}}</p>
-
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>

charts/hub/custom-layout/templates/share_case_otp.txt

@@ -1,21 +0,0 @@
-Kerberos.io
-------------
-
-Verify your access
-Use the code below to open the shared case
-
-Your verification code
-{{code}}
-
-Enter this code on the share page to access the case. This code expires in {{expiry}}.
-If you didn't request this, you can safely ignore this email.
-
-Get in touch
-------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
-------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/examples/catalogs/pose-keypoints.json

@@ -1,5 +0,0 @@
-[
-  {"key": "nose", "label": "Nose"},
-  {"key": "left_shoulder", "label": "Left shoulder"},
-  {"key": "right_shoulder", "label": "Right shoulder"}
-]

charts/hub/examples/hub-api-server-tls-secret.yaml

@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: hub-api-server-tls
-  namespace: kerberos-hub
-type: kubernetes.io/tls
-stringData:
-  # Paste your PEM certificate chain here (e.g., fullchain.pem)
-  tls.crt: |
-    -----BEGIN CERTIFICATE-----
-    REPLACE_WITH_YOUR_CERTIFICATE
-    -----END CERTIFICATE-----
-  # Paste your PEM private key here (e.g., privkey.pem)
-  tls.key: |
-    -----BEGIN PRIVATE KEY-----
-    REPLACE_WITH_YOUR_PRIVATE_KEY
-    -----END PRIVATE KEY-----

charts/hub/examples/workflow-configuration-overrides-values.yaml

@@ -1,24 +0,0 @@
-# Create these ConfigMaps in the release namespace before deploying the chart.
-# Keys contain complete contracts/catalogs; they are not merged with chart data.
-# Do not also set classificationCatalog or classificationCatalogExistingConfigMap.
-classificationCatalogEnabled: true
-workflowConfiguration:
-  enabled: true
-  includeDefaults: true
-  configMaps:
-    - name: deployment-workflow-overrides
-      items:
-        - key: start.yaml
-          path: workflow-contracts/start.yaml
-          replace: true
-        - key: deployment-classifications.json
-          path: catalogs/classifications.json
-          replace: true
-    - name: custom-workflow-contracts
-      items:
-        - key: pose.yaml
-          path: workflow-contracts/pose.yaml
-    - name: shared-pose-catalog
-      items:
-        - key: pose-keypoints.json
-          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-configuration-values.yaml

@@ -1,13 +0,0 @@
-# Packaging only; does not activate contract loading or deploy a pose worker.
-workflowConfiguration:
-  enabled: true
-  includeDefaults: true
-  configMaps:
-    - name: custom-workflow-contracts
-      items:
-        - key: pose.yaml
-          path: workflow-contracts/pose.yaml
-    - name: shared-pose-catalog
-      items:
-        - key: pose-keypoints.json
-          path: catalogs/pose-keypoints.json

charts/hub/examples/workflow-contracts/pose.yaml

@@ -1,53 +0,0 @@
-# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
-# Hypothetical custom worker output; not an installed stage or universal pose schema.
-schemaVersion: 1
-stage: pose
-contractVersion: 1
-presentation:
-  name: Detect poses
-  description: Estimate body keypoints and posture for people in the recording.
-  icon: person
-  color: teal
-# Settings authors enter per node; the worker receives them as node data.
-params:
-  - name: minConfidence
-    label: Minimum keypoint confidence
-    type: number
-    default: 0.5
-  - name: model
-    label: Model
-    type: select
-    options: [fast, accurate]
-    optionLabels: {fast: Fast, accurate: Accurate}
-    default: fast
-fields:
-  - id: keypoint
-    label: Keypoint
-    path: people.*.keypoints.*.name
-    type: string
-    operators: [in]
-    choices:
-      file: ../catalogs/pose-keypoints.json
-  - id: posture
-    label: Posture
-    path: people.*.posture
-    type: string
-    operators: [in]
-    choices:
-      values: [standing, sitting, lying]
-  - id: confidence
-    label: Keypoint confidence
-    path: people.*.keypoints.*.confidence
-    type: number
-    operators: [gt, gte, lt, lte]
-    minimum: 0
-    maximum: 1
-# Connections leaving this stage: one section with fixed inputs, then the
-# Extra conditions catch-all (appended collapsed when not placed explicitly).
-panel:
-  sections:
-    - id: posture
-      label: Posture
-      fields:
-        - {field: posture, widget: multiselect}
-        - {field: confidence, widget: number, operator: gte, label: Minimum confidence}

charts/hub/mongodb/fast.yaml

@@ -0,0 +1,7 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: fast
+provisioner: kubernetes.io/gce-pd
+parameters:
+  type: pd-ssd

charts/hub/mongodb/settings.nosql

@@ -65,22 +65,4 @@ db.settings.insertMany([
             "dayLimit" : NumberInt(30)
         }
     }
-},
-{ 
-    "_id" : ObjectId("63f346ec64011a574161cf99"), 
-    "key" : "classifications", 
-    "map" : {
-        "objects" : [
-            {
-                "text" : "Car", 
-                "value" : "car", 
-                "icon" : "car"
-            }, 
-            {
-                "text" : "Person", 
-                "value" : "pedestrian", 
-                "icon" : "pedestrian"
-            }
-        ]
-    }
 }])

charts/hub/mongodb/values.yaml

@@ -0,0 +1,932 @@
+## Global Docker image parameters
+## Please, note that this will override the image parameters, including dependencies, configured to use the global value
+## Current available global Docker image parameters: imageRegistry and imagePullSecrets
+##
+# global:
+#   imageRegistry: myRegistryName
+#   imagePullSecrets:
+#     - myRegistryKeySecretName
+#   storageClass: myStorageClass
+## Override the namespace for resource deployed by the chart, but can itself be overridden by the local namespaceOverride
+#   namespaceOverride: my-global-namespace
+
+image:
+  ## Bitnami MongoDB registry
+  ##
+  registry: docker.io
+  ## Bitnami MongoDB image name
+  ##
+  repository: bitnami/mongodb
+  ## Bitnami MongoDB image tag
+  ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/
+  ##
+  tag: 4.4.2-debian-10-r0
+  ## Specify a imagePullPolicy
+  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+  ##
+  pullPolicy: IfNotPresent
+  ## Optionally specify an array of imagePullSecrets.
+  ## Secrets must be manually created in the namespace.
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+  ##
+  # pullSecrets:
+  #   - myRegistryKeySecretName
+
+  ## Set to true if you would like to see extra information on logs
+  ## It turns on Bitnami debugging in minideb-extras-base
+  ## ref:  https://github.com/bitnami/minideb-extras-base
+  debug: false
+
+## String to partially override mongodb.fullname template (will maintain the release name)
+##
+# nameOverride:
+
+## String to fully override mongodb.fullname template
+##
+# fullnameOverride:
+
+## Kubernetes Cluster Domain
+##
+clusterDomain: cluster.local
+
+## Use an alternate scheduler, e.g. "stork".
+## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
+##
+# schedulerName:
+
+## MongoDB architecture. Allowed values: standalone or replicaset
+##
+architecture: standalone
+
+## Use StatefulSet instead of Deployment when deploying standalone
+##
+useStatefulSet: false
+
+## MongoDB Authentication parameters
+##
+auth:
+  ## Enable authentication
+  ## ref: https://docs.mongodb.com/manual/tutorial/enable-authentication/
+  ##
+  enabled: true
+  ## MongoDB root password
+  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#setting-the-root-password-on-first-run
+  ##
+  rootPassword: "yourmongodbpassword"
+  ## MongoDB custom user and database
+  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#creating-a-user-and-database-on-first-run
+  ##
+  # username: username
+  # password: password
+  # database: database
+  ## Key used for replica set authentication
+  ## Ignored when mongodb.architecture=standalone
+  ##
+  replicaSetKey: ""
+
+  ## Existing secret with MongoDB credentials
+  ## NOTE: When it's set the previous parameters are ignored.
+  ##
+  # existingSecret: name-of-existing-secret
+
+tls:
+  ## Enable or disable MongoDB TLS Support
+  enabled: false
+  ##
+  ## Bitnami Nginx image
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/cert-manager
+    tag: 1.19.4-debian-10-r19
+    pullPolicy: IfNotPresent
+
+## Name of the replica set
+## Ignored when mongodb.architecture=standalone
+##
+replicaSetName: rs0
+
+## Enable DNS hostnames in the replica set config
+## Ignored when mongodb.architecture=standalone
+## Ignored when externalAccess.enabled=true
+##
+replicaSetHostnames: true
+
+## Whether enable/disable IPv6 on MongoDB
+## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-ipv6
+##
+enableIPv6: false
+
+## Whether enable/disable DirectoryPerDB on MongoDB
+## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-directoryperdb
+##
+directoryPerDB: false
+
+## MongoDB System Log configuration
+## ref: https://github.com/bitnami/bitnami-docker-mongodb#configuring-system-log-verbosity-level
+##
+systemLogVerbosity: 0
+disableSystemLog: false
+
+## MongoDB configuration file for Primary and Secondary nodes. For documentation of all options, see:
+##   http://docs.mongodb.org/manual/reference/configuration-options/
+## Example:
+## configuration: |-
+##   # where and how to store data.
+##   storage:
+##     dbPath: /bitnami/mongodb/data/db
+##     journal:
+##       enabled: true
+##     directoryPerDB: false
+##   # where to write logging data
+##   systemLog:
+##     destination: file
+##     quiet: false
+##     logAppend: true
+##     logRotate: reopen
+##     path: /opt/bitnami/mongodb/logs/mongodb.log
+##     verbosity: 0
+##   # network interfaces
+##   net:
+##     port: 27017
+##     unixDomainSocket:
+##       enabled: true
+##       pathPrefix: /opt/bitnami/mongodb/tmp
+##     ipv6: false
+##     bindIpAll: true
+##   # replica set options
+##   #replication:
+##     #replSetName: replicaset
+##     #enableMajorityReadConcern: true
+##   # process management options
+##   processManagement:
+##      fork: false
+##      pidFilePath: /opt/bitnami/mongodb/tmp/mongodb.pid
+##   # set parameter options
+##   setParameter:
+##      enableLocalhostAuthBypass: true
+##   # security options
+##   security:
+##     authorization: disabled
+##     #keyFile: /opt/bitnami/mongodb/conf/keyfile
+##
+configuration: ""
+
+## ConfigMap with MongoDB configuration for Primary and Secondary nodes
+## NOTE: When it's set the arbiter.configuration parameter is ignored
+##
+# existingConfigmap:
+
+## initdb scripts
+## Specify dictionary of scripts to be run at first boot
+## Example:
+## initdbScripts:
+##   my_init_script.sh: |
+##      #!/bin/bash
+##      echo "Do something."
+initdbScripts: {}
+
+## Existing ConfigMap with custom init scripts
+##
+# initdbScriptsConfigMap:
+
+## Command and args for running the container (set to default if not set). Use array form
+##
+# command:
+# args:
+
+## Additional command line flags
+## Example:
+## extraFlags:
+##  - "--wiredTigerCacheSizeGB=2"
+##
+extraFlags: []
+
+## Additional environment variables to set
+## E.g:
+## extraEnvVars:
+##   - name: FOO
+##     value: BAR
+##
+extraEnvVars: []
+
+## ConfigMap with extra environment variables
+##
+# extraEnvVarsCM:
+
+## Secret with extra environment variables
+##
+# extraEnvVarsSecret:
+
+## Annotations to be added to the MongoDB statefulset. Evaluated as a template.
+##
+annotations: {}
+
+## Additional labels to be added to the MongoDB statefulset. Evaluated as a template.
+##
+labels: {}
+
+## Number of MongoDB replicas to deploy.
+## Ignored when mongodb.architecture=standalone
+##
+replicaCount: 2
+
+## StrategyType for MongoDB statefulset
+## It can be set to RollingUpdate or Recreate by default.
+##
+strategyType: RollingUpdate
+
+## MongoDB should be initialized one by one when building the replicaset for the first time.
+##
+podManagementPolicy: OrderedReady
+
+## Affinity for pod assignment. Evaluated as a template.
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+##
+affinity: {}
+
+## Node labels for pod assignment. Evaluated as a template.
+## ref: https://kubernetes.io/docs/user-guide/node-selection/
+##
+nodeSelector: {}
+
+## Tolerations for pod assignment. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+##
+tolerations: []
+
+## Lables for MongoDB pods. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+##
+podLabels: {}
+
+## Annotations for MongoDB pods. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+##
+podAnnotations: {}
+
+## MongoDB pods' priority.
+## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+##
+# priorityClassName: ""
+
+## MongoDB pods' Security Context.
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+##
+podSecurityContext:
+  enabled: true
+  fsGroup: 1001
+  ## sysctl settings
+  ## Example:
+  ## sysctls:
+  ## - name: net.core.somaxconn
+  ##   value: "10000"
+  ##
+  sysctls: []
+
+## MongoDB containers' Security Context (main and metrics container).
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+##
+containerSecurityContext:
+  enabled: true
+  runAsUser: 1001
+  runAsNonRoot: true
+
+## MongoDB containers' resource requests and limits.
+## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+##
+resources:
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  limits:
+    cpu: 2048m
+    memory: 4096Mi
+  requests:
+    cpu: 512m
+    memory: 1024Mi
+
+## MongoDB pods' liveness and readiness probes. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+##
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+
+## Custom Liveness probes for MongoDB pods
+##
+customLivenessProbe: {}
+
+## Custom Rediness probes MongoDB pods
+##
+customReadinessProbe: {}
+
+## Add init containers to the MongoDB pods.
+## Example:
+## initContainers:
+##   - name: your-image-name
+##     image: your-image
+##     imagePullPolicy: Always
+##     ports:
+##       - name: portname
+##         containerPort: 1234
+##
+initContainers: {}
+
+## Add sidecars to the MongoDB pods.
+## Example:
+## sidecars:
+##   - name: your-image-name
+##     image: your-image
+##     imagePullPolicy: Always
+##     ports:
+##       - name: portname
+##         containerPort: 1234
+##
+sidecars: {}
+
+## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB pods
+## Examples:
+## extraVolumeMounts:
+##   - name: extras
+##     mountPath: /usr/share/extras
+##     readOnly: true
+## extraVolumes:
+##   - name: extras
+##     emptyDir: {}
+extraVolumeMounts: []
+extraVolumes: []
+
+## MongoDB Pod Disruption Budget configuration
+## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+##
+pdb:
+  create: false
+  ## Min number of pods that must still be available after the eviction
+  ##
+  minAvailable: 1
+  ## Max number of pods that can be unavailable after the eviction
+  ##
+  # maxUnavailable: 1
+
+## Enable persistence using Persistent Volume Claims
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+##
+persistence:
+  enabled: true
+  ## A manually managed Persistent Volume and Claim
+  ## Requires persistence.enabled: true
+  ## If defined, PVC must be created manually before volume will be bound
+  ## Ignored when mongodb.architecture=replicaset
+  ##
+  # existingClaim:
+  ## PV Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ## set, choosing the default provisioner.
+  ##
+  # storageClass: "-"
+  ## PV Access Mode
+  ##
+  accessModes:
+    - ReadWriteOnce
+  ## PVC size
+  ##
+  size: 8Gi
+  ## PVC annotations
+  ##
+  annotations: {}
+  ## The path the volume will be mounted at, useful when using different
+  ## MongoDB images.
+  ##
+  mountPath: /bitnami/mongodb
+  ## The subdirectory of the volume to mount to, useful in dev environments
+  ## and one PV for multiple services.
+  ##
+  subPath: ""
+
+## Service parameters
+##
+service:
+  ## Service type
+  ##
+  type: ClusterIP
+  ## MongoDB service port
+  ##
+  port: 27017
+  ## MongoDB service port name
+  ##
+  portName: mongodb
+  ## Specify the nodePort value for the LoadBalancer and NodePort service types.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
+  ##
+  nodePort: ""
+  ## MongoDB service clusterIP IP
+  ##
+  # clusterIP: None
+  ## Specify the externalIP value ClusterIP service type.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
+  ##
+  externalIPs: []
+  ## Specify the loadBalancerIP value for LoadBalancer service types.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+  ##
+  # loadBalancerIP:
+  ## Specify the loadBalancerSourceRanges value for LoadBalancer service types.
+  ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+  ##
+  loadBalancerSourceRanges: []
+  ## Provide any additional annotations which may be required. Evaluated as a template
+  ##
+  annotations: {}
+
+## External Access to MongoDB nodes configuration
+##
+externalAccess:
+  ## Enable Kubernetes external cluster access to MongoDB nodes
+  ##
+  enabled: false
+  ## External IPs auto-discovery configuration
+  ## An init container is used to auto-detect LB IPs or node ports by querying the K8s API
+  ## Note: RBAC might be required
+  ##
+  autoDiscovery:
+    ## Enable external IP/ports auto-discovery
+    ##
+    enabled: false
+    ## Bitnami Kubectl image
+    ## ref: https://hub.docker.com/r/bitnami/kubectl/tags/
+    ##
+    image:
+      registry: docker.io
+      repository: bitnami/kubectl
+      tag: 1.18.12-debian-10-r2
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
+      ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    ## Init Container resource requests and limits
+    ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+    ##
+    resources:
+      # We usually recommend not to specify default resources and to leave this as a conscious
+      # choice for the user. This also increases chances charts run on environments with little
+      # resources, such as Minikube. If you do want to specify resources, uncomment the following
+      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+      limits: {}
+      #   cpu: 100m
+      #   memory: 128Mi
+      requests: {}
+      #   cpu: 100m
+      #   memory: 128Mi
+  ## Parameters to configure K8s service(s) used to externally access MongoDB
+  ## A new service per broker will be created
+  ##
+  service:
+    ## Service type. Allowed values: LoadBalancer or NodePort
+    ##
+    type: LoadBalancer
+    ## Port used when service type is LoadBalancer
+    ##
+    port: 27017
+    ## Array of load balancer IPs for each MongoDB node. Length must be the same as replicaCount
+    ## Example:
+    ## loadBalancerIPs:
+    ##   - X.X.X.X
+    ##   - Y.Y.Y.Y
+    ##
+    loadBalancerIPs: []
+    ## Load Balancer sources
+    ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+    ## Example:
+    ## loadBalancerSourceRanges:
+    ## - 10.10.10.0/24
+    ##
+    loadBalancerSourceRanges: []
+    ## Array of node ports used for each MongoDB nodes. Length must be the same as replicaCount
+    ## Example:
+    ## nodePorts:
+    ##   - 30001
+    ##   - 30002
+    ##
+    nodePorts: []
+    ## When service type is NodePort, you can specify the domain used for MongoDB advertised hostnames.
+    ## If not specified, the container will try to get the kubernetes node external IP
+    ##
+    # domain: mydomain.com
+    ## Provide any additional annotations which may be required. Evaluated as a template
+    ##
+    annotations: {}
+
+##
+## MongoDB Arbiter parameters.
+##
+arbiter:
+  ## Enable deploying the MongoDB Arbiter
+  ##   https://docs.mongodb.com/manual/tutorial/add-replica-set-arbiter/
+  enabled: true
+
+  ## MongoDB configuration file for the Arbiter. For documentation of all options, see:
+  ##   http://docs.mongodb.org/manual/reference/configuration-options/
+  ##
+  configuration: ""
+
+  ## ConfigMap with MongoDB configuration for the Arbiter
+  ## NOTE: When it's set the arbiter.configuration parameter is ignored
+  ##
+  # existingConfigmap:
+
+  ## Command and args for running the container (set to default if not set). Use array form
+  ##
+  # command:
+  # args:
+
+  ## Additional command line flags
+  ## Example:
+  ## extraFlags:
+  ##  - "--wiredTigerCacheSizeGB=2"
+  ##
+  extraFlags: []
+
+  ## Additional environment variables to set
+  ## E.g:
+  ## extraEnvVars:
+  ##   - name: FOO
+  ##     value: BAR
+  ##
+  extraEnvVars: []
+
+  ## ConfigMap with extra environment variables
+  ##
+  # extraEnvVarsCM:
+
+  ## Secret with extra environment variables
+  ##
+  # extraEnvVarsSecret:
+
+  ## Annotations to be added to the Arbiter statefulset. Evaluated as a template.
+  ##
+  annotations: {}
+
+  ## Additional to be added to the Arbiter statefulset. Evaluated as a template.
+  ##
+  labels: {}
+
+  ## Affinity for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Lables for MongoDB Arbiter pods. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  ##
+  podLabels: {}
+
+  ## Annotations for MongoDB Arbiter pods. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## MongoDB Arbiter pods' priority.
+  ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+  ##
+  # priorityClassName: ""
+
+  ## MongoDB Arbiter pods' Security Context.
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroup: 1001
+    ## sysctl settings
+    ## Example:
+    ## sysctls:
+    ## - name: net.core.somaxconn
+    ##   value: "10000"
+    ##
+    sysctls: []
+
+  ## MongoDB Arbiter containers' Security Context (only main container).
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ##
+  containerSecurityContext:
+    enabled: true
+    runAsUser: 1001
+
+  ## MongoDB Arbiter containers' resource requests and limits.
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  ## MongoDB Arbiter pods' liveness and readiness probes. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+  ##
+  livenessProbe:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+  readinessProbe:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+
+  ## Custom Liveness probes for MongoDB Arbiter pods
+  ##
+  customLivenessProbe: {}
+
+  ## Custom Rediness probes MongoDB Arbiter pods
+  ##
+  customReadinessProbe: {}
+
+  ## Add init containers to the MongoDB Arbiter pods.
+  ## Example:
+  ## initContainers:
+  ##   - name: your-image-name
+  ##     image: your-image
+  ##     imagePullPolicy: Always
+  ##     ports:
+  ##       - name: portname
+  ##         containerPort: 1234
+  ##
+  initContainers: {}
+
+  ## Add sidecars to the MongoDB Arbiter pods.
+  ## Example:
+  ## sidecars:
+  ##   - name: your-image-name
+  ##     image: your-image
+  ##     imagePullPolicy: Always
+  ##     ports:
+  ##       - name: portname
+  ##         containerPort: 1234
+  ##
+  sidecars: {}
+
+  ## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB Arbiter pods
+  ## Examples:
+  ## extraVolumeMounts:
+  ##   - name: extras
+  ##     mountPath: /usr/share/extras
+  ##     readOnly: true
+  ## extraVolumes:
+  ##   - name: extras
+  ##     emptyDir: {}
+  extraVolumeMounts: []
+  extraVolumes: []
+
+  ## MongoDB Arbiter Pod Disruption Budget configuration
+  ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+  ##
+  pdb:
+    create: false
+    ## Min number of pods that must still be available after the eviction
+    ##
+    minAvailable: 1
+    ## Max number of pods that can be unavailable after the eviction
+    ##
+    # maxUnavailable: 1
+
+## ServiceAccount
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+##
+serviceAccount:
+  ## Specifies whether a ServiceAccount should be created
+  ##
+  create: true
+  ## The name of the ServiceAccount to use.
+  ## If not set and create is true, a name is generated using the rabbitmq.fullname template
+  ##
+  # name:
+
+## Role Based Access
+## ref: https://kubernetes.io/docs/admin/authorization/rbac/
+##
+rbac:
+  ## Specifies whether RBAC rules should be created
+  ## binding MongoDB ServiceAccount to a role
+  ## that allows MongoDB pods querying the K8s API
+  ##
+  create: false
+
+## Init Container paramaters
+## Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each component
+## values from the securityContext section of the component
+##
+volumePermissions:
+  enabled: false
+  ## Bitnami Minideb image
+  ## ref: https://hub.docker.com/r/bitnami/minideb/tags/
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/minideb
+    tag: buster
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: Always
+    ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
+    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+  ## Init Container resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+  ## Init container Security Context
+  ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser
+  ## and not the below volumePermissions.securityContext.runAsUser
+  ## When runAsUser is set to special value "auto", init container will try to chwon the
+  ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`
+  ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed).
+  ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with
+  ## podSecurityContext.enabled=false,containerSecurityContext.enabled=false and shmVolume.chmod.enabled=false
+  ##
+  securityContext:
+    runAsUser: 0
+
+## Prometheus Exporter / Metrics
+##
+metrics:
+  enabled: false
+  ## Bitnami MongoDB Promtheus Exporter image
+  ## ref: https://hub.docker.com/r/bitnami/mongodb-exporter/tags/
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/mongodb-exporter
+    tag: 0.11.2-debian-10-r44
+    pullPolicy: IfNotPresent
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+    ##
+    # pullSecrets:
+    #   - myRegistryKeySecretName
+
+  ## String with extra flags to the metrics exporter
+  ## ref: https://github.com/percona/mongodb_exporter/blob/master/mongodb_exporter.go
+  ##
+  extraFlags: ""
+
+  ## String with additional URI options to the metrics exporter
+  ## ref: https://docs.mongodb.com/manual/reference/connection-string
+  ##
+  extraUri: ""
+
+  ## Metrics exporter container resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  ## Prometheus Exporter service configuration
+  ##
+  service:
+    ## Annotations for Prometheus Exporter pods. Evaluated as a template.
+    ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+    ##
+    annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "{{ .Values.metrics.service.port }}"
+      prometheus.io/path: "/metrics"
+    type: ClusterIP
+    port: 9216
+
+  ## Metrics exporter liveness and readiness probes
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
+  ##
+  livenessProbe:
+    enabled: true
+    initialDelaySeconds: 15
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  readinessProbe:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+
+  ## Prometheus Service Monitor
+  ## ref: https://github.com/coreos/prometheus-operator
+  ##      https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md
+  ##
+  serviceMonitor:
+    ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
+    enabled: false
+
+    ## Specify the namespace where Prometheus Operator is running
+    ##
+    # namespace: monitoring
+
+    ## Specify the interval at which metrics should be scraped
+    ##
+    interval: 30s
+    ## Specify the timeout after which the scrape is ended
+    ##
+    # scrapeTimeout: 30s
+    ## Used to pass Labels that are used by the Prometheus installed in your cluster to select Service Monitors to work with
+    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
+    ##
+    additionalLabels: {}
+
+  ## Custom PrometheusRule to be defined
+  ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions
+  ##
+  prometheusRule:
+    enabled: false
+    additionalLabels: {}
+    ## Specify the namespace where Prometheus Operator is running
+    ##
+    # namespace: monitoring
+
+    ## Define individual alerting rules as required
+    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#rulegroup
+    ##      https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
+    ##
+    ## This is an example of a rule, you should add the below code block under the "rules" param, removing the brackets
+    ## - name: example
+    ##   rules:
+    ##   - alert: HighRequestLatency
+    ##     expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5
+    ##     for: 10m
+    ##     labels:
+    ##       severity: page
+    ##     annotations:
+    ##       summary: High request latency
+    ##
+    rules: {}

charts/hub/regcred.yaml

@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: xxxxkeytoberequestedxxx

charts/hub/schemas/catalog.schema.json

@@ -1,17 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Hub shared choice catalog v1",
-  "description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
-  "type": "array",
-  "minItems": 1,
-  "items": {
-    "type": "object",
-    "additionalProperties": false,
-    "required": ["key", "label"],
-    "properties": {
-      "key": {"type": "string", "minLength": 1},
-      "label": {"type": "string", "minLength": 1},
-      "icon": {"type": "string", "minLength": 1}
-    }
-  }
-}

charts/hub/schemas/workflow-contract.schema.json

@@ -1,321 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Hub workflow editor contract v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["schemaVersion", "stage", "contractVersion", "fields"],
-  "properties": {
-    "schemaVersion": {"const": 1},
-    "stage": {
-      "type": "string",
-      "pattern": "^[a-z][a-z0-9-]*$",
-      "description": "Stage type, not a node instance. start describes initial context."
-    },
-    "contractVersion": {"const": 1},
-    "presentation": {
-      "type": "object",
-      "additionalProperties": false,
-      "description": "How the editor shows this node. Icons and colours come from approved sets.",
-      "properties": {
-        "name": {"type": "string", "minLength": 1, "maxLength": 80},
-        "description": {"type": "string", "minLength": 1, "maxLength": 500},
-        "icon": {"enum": ["play", "camera", "person", "eye-crossed", "car", "clock", "mlModel", "share"]},
-        "color": {
-          "enum": ["blue", "teal", "rose", "amber", "indigo", "violet", "green", "grey"],
-          "description": "Theme colour token."
-        }
-      }
-    },
-    "params": {
-      "type": "array",
-      "maxItems": 64,
-      "description": "Worker-stage settings authors enter, stored per node. An explicit list (even empty) replaces kerberoshub.workflows.editorStages params. Not supported on start.",
-      "items": {"$ref": "#/definitions/param"}
-    },
-    "fields": {
-      "type": "array",
-      "description": "Typed values conditions may test. Start: the selectors device, sites, groups and classifications plus condition-only fields whose path exists in the condition root schema (models.WorkflowConditionRootSchema), e.g. device.deviceName or inputs.classify.details.*.isStatic; other inputs.<operation> paths are worker-defined. Stage: outputs relative to results.<stage>. New conditions may only use declared fields. An empty array is valid.",
-      "items": {"$ref": "#/definitions/field"},
-      "maxItems": 128
-    },
-    "controls": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["id", "label"],
-        "properties": {
-          "id": {"enum": ["weeklySchedule", "conditions"]},
-          "label": {"type": "string", "minLength": 1}
-        }
-      },
-      "description": "Start only. Controls offered for new authoring; omitted offers none. conditions applies to edges leaving Start.",
-      "maxItems": 16
-    },
-    "triggerModes": {
-      "type": "array",
-      "minItems": 1,
-      "uniqueItems": true,
-      "items": {"enum": ["automatic", "manual"]},
-      "description": "Start only. Trigger modes offered for new authoring; omitted offers both."
-    },
-    "panel": {"$ref": "#/definitions/panel"}
-  },
-  "definitions": {
-    "choices": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "source": {
-          "type": "string",
-          "description": "Built-in authorized project-resource resolver; not a database path.",
-          "oneOf": [
-            {
-              "const": "project.devices",
-              "description": "Device keys as values, device names as labels."
-            },
-            {"const": "project.sites", "description": "Site IDs as values, site names as labels."},
-            {
-              "const": "project.groups",
-              "description": "Group IDs as values, group names as labels."
-            }
-          ]
-        },
-        "file": {
-          "type": "string",
-          "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
-          "description": "Direct shared catalog file relative to the contract; no URLs or nested references."
-        },
-        "values": {
-          "type": "array",
-          "minItems": 1,
-          "uniqueItems": true,
-          "items": {"type": ["string", "number", "boolean"]}
-        }
-      },
-      "oneOf": [{"required": ["source"]}, {"required": ["file"]}, {"required": ["values"]}]
-    },
-    "field": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "label", "path", "type", "operators"],
-      "properties": {
-        "id": {
-          "type": "string",
-          "pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
-          "description": "Stable identifier, unique within this contract."
-        },
-        "label": {"type": "string", "minLength": 1},
-        "path": {
-          "type": "string",
-          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
-          "description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
-        },
-        "type": {"enum": ["string", "integer", "number", "boolean"]},
-        "operators": {
-          "type": "array",
-          "minItems": 1,
-          "uniqueItems": true,
-          "items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
-        },
-        "optional": {
-          "type": "boolean",
-          "default": false,
-          "description": "Field may be absent even when the node completes; branch availability is determined separately."
-        },
-        "minimum": {"type": "number"},
-        "maximum": {"type": "number"},
-        "choices": {"$ref": "#/definitions/choices"}
-      },
-      "allOf": [
-        {
-          "if": {"properties": {"type": {"const": "string"}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
-              "choices": {"properties": {"values": {"items": {"type": "string"}}}}
-            },
-            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "boolean"}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
-              "choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
-            },
-            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["integer", "number"]}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
-              "choices": {"properties": {"values": {"items": {"type": "number"}}}}
-            }
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "integer"}}},
-          "then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
-          "then": {
-            "properties": {"choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}}
-          }
-        }
-      ]
-    },
-    "param": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "type"],
-      "properties": {
-        "name": {
-          "type": "string",
-          "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
-          "maxLength": 64,
-          "description": "Key in node data; unique within the contract."
-        },
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "description": {"type": "string", "minLength": 1, "maxLength": 500},
-        "group": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 80,
-          "description": "Editor section; params sharing a group appear together."
-        },
-        "placeholder": {"type": "string", "minLength": 1, "maxLength": 160},
-        "type": {"enum": ["string", "number", "boolean", "select", "multiselect", "secret"]},
-        "required": {"type": "boolean"},
-        "default": {
-          "description": "Value the editor pre-fills and the API stores when a node leaves the setting unset; never for secrets. Typically the worker's own default."
-        },
-        "options": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 256,
-          "uniqueItems": true,
-          "items": {"type": "string", "minLength": 1, "maxLength": 160}
-        },
-        "optionLabels": {
-          "type": "object",
-          "additionalProperties": {"type": "string", "minLength": 1, "maxLength": 160}
-        },
-        "minimum": {"type": "number", "description": "Inclusive lower bound for a number setting."},
-        "maximum": {"type": "number", "description": "Inclusive upper bound for a number setting."},
-        "choices": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["file"],
-          "properties": {
-            "file": {"type": "string", "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$"}
-          },
-          "description": "Options for a select or multiselect setting from a shared catalog file (keys become options, labels become optionLabels). Use instead of options."
-        }
-      },
-      "allOf": [
-        {
-          "if": {"properties": {"type": {"enum": ["select", "multiselect"]}}},
-          "then": {"oneOf": [{"required": ["options"]}, {"required": ["choices"]}]},
-          "else": {
-            "not": {
-              "anyOf": [{"required": ["options"]}, {"required": ["optionLabels"]}, {"required": ["choices"]}]
-            }
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "secret"}}},
-          "then": {"not": {"required": ["default"]}}
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["string", "select"]}}},
-          "then": {"properties": {"default": {"type": "string"}}}
-        },
-        {
-          "if": {"properties": {"type": {"const": "multiselect"}}},
-          "then": {
-            "properties": {"default": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "number"}}},
-          "then": {"properties": {"default": {"type": "number"}}},
-          "else": {"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}}
-        },
-        {
-          "if": {"properties": {"type": {"const": "boolean"}}},
-          "then": {"properties": {"default": {"type": "boolean"}}}
-        }
-      ]
-    },
-    "panel": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["sections"],
-      "description": "Layout of connections leaving this node. Without it, a default panel is used. A section with picker: true positions the Extra conditions catch-all; without one it is appended collapsed. On start, a panel replaces the top-level controls list.",
-      "properties": {
-        "sections": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 16,
-          "items": {"$ref": "#/definitions/panelSection"}
-        }
-      }
-    },
-    "panelSection": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "label"],
-      "properties": {
-        "id": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*$", "maxLength": 80},
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "collapsed": {"type": "boolean"},
-        "picker": {
-          "type": "boolean",
-          "description": "This section is the Extra conditions catch-all over every declared field of Start and upstream stages; it holds no fields or controls."
-        },
-        "controls": {
-          "type": "array",
-          "items": {"const": "weeklySchedule"},
-          "maxItems": 1,
-          "description": "Start only."
-        },
-        "fields": {"type": "array", "maxItems": 32, "items": {"$ref": "#/definitions/panelField"}}
-      },
-      "if": {"properties": {"picker": {"const": true}}, "required": ["picker"]},
-      "then": {"not": {"anyOf": [{"required": ["fields"]}, {"required": ["controls"]}]}}
-    },
-    "panelField": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["field", "widget"],
-      "properties": {
-        "field": {
-          "type": "string",
-          "description": "ID of a field declared in this contract; each field is placed at most once."
-        },
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "widget": {
-          "enum": ["multiselect", "select", "text", "number", "toggle"],
-          "description": "multiselect: string with choices (in); select: choices (eq, ne); text: string (eq, contains, matches, ne, in); number: integer or number (gte, gt, lte, lt, eq, ne); toggle: boolean (eq, ne)."
-        },
-        "operator": {
-          "enum": ["eq", "ne", "in", "contains", "matches", "gt", "gte", "lt", "lte"],
-          "description": "Fixed operator; must be declared by the field and supported by the widget. Defaults to the first widget operator the field declares."
-        }
-      }
-    }
-  },
-  "allOf": [
-    {
-      "if": {"properties": {"stage": {"const": "start"}}, "required": ["stage"]},
-      "then": {"not": {"required": ["params"]}},
-      "else": {"not": {"anyOf": [{"required": ["controls"]}, {"required": ["triggerModes"]}]}}
-    },
-    {"if": {"required": ["panel"]}, "then": {"not": {"required": ["controls"]}}}
-  ]
-}

charts/hub/templates/_configuration.tpl

@@ -1,128 +0,0 @@
-{{- define "hub.workflowConfiguration.bundledPaths" -}}
-{{- list "workflow-contracts/start.yaml" "workflow-contracts/anpr.yaml" "workflow-contracts/forwarder.yaml" "catalogs/classifications.json" | toYaml -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.anpr.configMapName" -}}
-{{- printf "%s-workflow-contract-anpr" (.Release.Name | trunc 40 | trimSuffix "-") -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.forwarder.configMapName" -}}
-{{- printf "%s-workflow-contract-forwarder" (.Release.Name | trunc 40 | trimSuffix "-") -}}
-{{- end -}}
-
-{{- define "hub.classificationCatalog.configMapName" -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- $replacement := index $config.replacements "catalogs/classifications.json" | default dict -}}
-{{- if $replacement -}}
-{{- $replacement.name -}}
-{{- else -}}
-{{- default "classification-catalog" .Values.classificationCatalogExistingConfigMap -}}
-{{- end -}}
-{{- end -}}
-
-{{/* Normalize both interfaces without changing the caller's values. */}}
-{{- define "hub.workflowConfiguration.settings" -}}
-{{- $config := .Values.workflowConfiguration | default dict -}}
-{{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
-{{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
-{{- if and $unified $legacy -}}
-{{- fail "workflowConfiguration cannot mix includeDefaults/configMaps with existingConfigMap/items/extraConfigMaps" -}}
-{{- end -}}
-{{- $includeDefaults := true -}}
-{{- $sources := $config.extraConfigMaps | default list -}}
-{{- if $unified -}}
-{{- $sources = $config.configMaps | default list -}}
-{{- if hasKey $config "includeDefaults" -}}
-{{- $includeDefaults = $config.includeDefaults -}}
-{{- end -}}
-{{- else -}}
-{{- if $config.existingConfigMap -}}
-{{- if and $config.enabled (not $config.items) -}}
-{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
-{{- end -}}
-{{- $includeDefaults = false -}}
-{{- $sources = prepend $sources (dict "name" $config.existingConfigMap "items" ($config.items | default list)) -}}
-{{- else if and $config.enabled $config.items -}}
-{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
-{{- end -}}
-{{- end -}}
-{{- $enabled := $config.enabled | default false -}}
-{{- $replacements := dict -}}
-{{- $normalizedSources := list -}}
-{{- $bundledPaths := include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray -}}
-{{- range $sources -}}
-{{- $name := .name -}}
-{{- $items := list -}}
-{{- range .items -}}
-{{- if and $enabled .replace -}}
-{{- if or (not $unified) (not $includeDefaults) -}}
-{{- fail "workflowConfiguration item replace: true requires configMaps with includeDefaults: true" -}}
-{{- end -}}
-{{- if not (has .path $bundledPaths) -}}
-{{- fail (printf "workflowConfiguration item replace: true targets unknown bundled path %q" .path) -}}
-{{- end -}}
-{{- if hasKey $replacements .path -}}
-{{- fail (printf "duplicate workflowConfiguration replacement path %q" .path) -}}
-{{- end -}}
-{{- $_ := set $replacements .path (dict "name" $name "key" .key) -}}
-{{- end -}}
-{{- $items = append $items (omit . "replace") -}}
-{{- end -}}
-{{- $normalizedSources = append $normalizedSources (dict "name" $name "items" $items) -}}
-{{- end -}}
-{{- if hasKey $replacements "catalogs/classifications.json" -}}
-{{- if .Values.classificationCatalogExistingConfigMap -}}
-{{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
-{{- end -}}
-{{- end -}}
-{{- if not (kindIs "invalid" .Values.classificationCatalog) -}}
-{{- if not .Values.classificationCatalogEnabled -}}
-{{- fail "classificationCatalog requires classificationCatalogEnabled; remove the inline list to use the API fallback" -}}
-{{- end -}}
-{{- if .Values.classificationCatalogExistingConfigMap -}}
-{{- fail "classificationCatalog cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
-{{- end -}}
-{{- if hasKey $replacements "catalogs/classifications.json" -}}
-{{- fail "classificationCatalog cannot be combined with a classifications.json replacement; choose one override mechanism" -}}
-{{- end -}}
-{{- end -}}
-{{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.validate" -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if $config.enabled -}}
-{{- $paths := dict -}}
-{{- if $config.includeDefaults -}}
-{{- if not .Values.classificationCatalogEnabled -}}
-{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; disable includeDefaults and supply configMaps for a custom bundle" -}}
-{{- end -}}
-{{- range $path := (include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray) -}}
-{{- if not (hasKey $config.replacements $path) -}}
-{{- $_ := set $paths $path true -}}
-{{- end -}}
-{{- end -}}
-{{- else -}}
-{{- if not $config.configMaps -}}
-{{- fail "workflowConfiguration.configMaps must be nonempty when enabled without defaults" -}}
-{{- end -}}
-{{- end -}}
-{{- range $config.configMaps -}}
-{{- if not .items -}}
-{{- fail (printf "workflowConfiguration ConfigMap %q requires nonempty items" .name) -}}
-{{- end -}}
-{{- range .items -}}
-{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
-{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
-{{- end -}}
-{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$" .path)) (ne (clean .path) .path) -}}
-{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
-{{- end -}}
-{{- if hasKey $paths .path -}}
-{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
-{{- end -}}
-{{- $_ := set $paths .path true -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}

charts/hub/templates/_device-tags.tpl

@@ -1,51 +0,0 @@
-{{/*
-The system tag catalog (deviceTags.system.catalog) uses the Hub shared choice
-catalog format: {key, label, description?}. values.schema.json validates each
-entry (key in stored device tag form, models.NormalizeDeviceTags: 1-64
-characters of a-z, 0-9, ".", "_", ":" and "-", starting and ending with a
-letter or digit) and that enabled is a boolean; keys must also be unique.
-*/}}
-{{- define "kerberoshub.deviceTags.system.validate" -}}
-{{- $seen := dict -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $key := toString $tag.key -}}
-{{- if hasKey $seen $key -}}
-{{- fail (printf "deviceTags.system.catalog: duplicate key %q" $key) -}}
-{{- end -}}
-{{- $_ := set $seen $key true -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-The configured system tag catalog as a JSON array, whether or not system tags
-are enabled (missing values read as empty).
-*/}}
-{{- define "kerberoshub.deviceTags.system.catalog" -}}
-{{- $deviceTags := .Values.deviceTags | default dict -}}
-{{- $system := $deviceTags.system | default dict -}}
-{{- $system.catalog | default list | toJson -}}
-{{- end -}}
-
-{{/*
-Whether system tags are enabled (deviceTags.system.enabled): "true" or "".
-*/}}
-{{- define "kerberoshub.deviceTags.system.enabled" -}}
-{{- $deviceTags := .Values.deviceTags | default dict -}}
-{{- $system := $deviceTags.system | default dict -}}
-{{- if and (kindIs "bool" $system.enabled) $system.enabled -}}true{{- end -}}
-{{- end -}}
-
-{{/*
-The system tag catalog file hub-api reads (DEVICE_SYSTEM_TAGS_FILE), rendered
-from deviceTags.system.catalog into the device-system-tags ConfigMap.
-*/}}
-{{- define "kerberoshub.deviceTags.system.json" -}}
-{{- include "kerberoshub.deviceTags.system.validate" . -}}
-{{- $tags := list -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $entry := dict "key" $tag.key "label" $tag.label -}}
-{{- with $tag.description }}{{- $_ := set $entry "description" . -}}{{- end }}
-{{- $tags = append $tags $entry -}}
-{{- end -}}
-{{- $tags | toJson -}}
-{{- end -}}

charts/hub/templates/_helpers.tpl

@@ -1,171 +0,0 @@
-{{/* Build the path to the configured MongoDB CA bundle. */}}
-{{- define "hub.mongodb.tlsCAFile" -}}
-{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
-{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
-{{- end -}}
-{{- end -}}
-
-{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
-{{- define "hub.mongodb.uri" -}}
-{{- $uri := .Values.mongodb.uri | default "" -}}
-{{- if and .Values.mongodb.tls.enabled $uri -}}
-  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
-    {{- $separator := "?" -}}
-    {{- if contains "?" $uri -}}
-      {{- $separator = "&" -}}
-    {{- end -}}
-    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stls=true" $uri $separator -}}
-  {{- end -}}
-  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
-  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
-    {{- $separator := "&" -}}
-    {{- if not (contains "?" $uri) -}}
-      {{- $separator = "?" -}}
-    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
-  {{- end -}}
-{{- end -}}
-{{- $uri -}}
-{{- end -}}
-
-{{/*
-MongoDB URI with appName set to one workload, so the Atlas query profiler and
-currentOp attribute each operation to the service that issued it. Renders
-nothing when no URI is configured or mongodb.appNamePerService is false.
-Usage: include "hub.mongodb.appUri" (dict "root" $ "app" "hub-api")
-*/}}
-{{- define "hub.mongodb.appUri" -}}
-{{- $uri := include "hub.mongodb.uri" .root -}}
-{{- if and $uri .root.Values.mongodb.appNamePerService -}}
-  {{- if regexMatch "(?i)[?&]appName=" $uri -}}
-    {{- $uri = regexReplaceAll "(?i)([?&])appName=[^&]*" $uri (printf "${1}appName=%s" .app) -}}
-  {{- else -}}
-    {{- $separator := "&" -}}
-    {{- if not (contains "?" $uri) -}}
-      {{- $separator = "?" -}}
-    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%sappName=%s" $uri $separator .app -}}
-  {{- end -}}
-  {{- $uri -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Container env entry that overrides MONGODB_URI from mongodb-config with the
-workload's own appName. An explicit env entry takes precedence over envFrom.
-Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
-*/}}
-{{- define "hub.mongodb.appUriEnv" -}}
-{{- with include "hub.mongodb.appUri" . -}}
-- name: MONGODB_URI
-  value: {{ . | quote }}
-{{- end -}}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA Secret volume. */}}
-{{- define "hub.mongodb.tlsVolume" -}}
-- name: mongodb-tls
-  secret:
-    secretName: {{ .Values.mongodb.tls.existingSecret }}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA volume mount. */}}
-{{- define "hub.mongodb.tlsVolumeMount" -}}
-- name: mongodb-tls
-  mountPath: {{ .Values.mongodb.tls.mountPath }}
-  readOnly: true
-{{- end -}}
-
-{{/*
-OpenTelemetry sampling env.
-"hub.opentelemetry.samplerEnv" is for the services that only continue traces
-started elsewhere (hub-workflows, pipe-*, workflow stages): they follow the
-parent's sampling decision and never start traces of their own.
-"hub.opentelemetry.apiSamplerEnv" renders hub-api's per-class sampling ratios
-(opentelemetry.apiSamplingRatios) as TRACE_SAMPLER_RATIO_<CLASS>; empty values
-are not rendered.
-Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-*/}}
-{{- define "hub.opentelemetry.samplerEnv" -}}
-- name: OTEL_TRACES_SAMPLER
-  value: "parentbased_always_off"
-{{- end -}}
-
-{{- define "hub.opentelemetry.apiSamplerEnv" -}}
-{{- range $class, $ratio := (.Values.opentelemetry.apiSamplingRatios | default dict) }}
-{{- if ne (toString $ratio) "" }}
-- name: TRACE_SAMPLER_RATIO_{{ upper $class }}
-  value: {{ toString $ratio | quote }}
-{{- end }}
-{{- end }}
-{{- end -}}
-
-{{/*
-hub.audit.destinations resolves the audit destinations into JSON. Inline
-credentials (s3.accessKey / s3.secretKey on S3 destinations, bearerToken and
-secretHeaders.<name>.value on webhooks) are the only way to pass credentials.
-They are stored in a chart-created Secret named hub-audit-<id>-credentials;
-the internal credentialsSecret / bearerTokenSecret / secretHeaders entries
-below describe that Secret for the other templates.
-Use: fromJsonArray (include "hub.audit.destinations" .)
-*/}}
-{{- define "hub.audit.destinations" -}}
-{{- $resolved := list -}}
-{{- range $index, $original := .Values.kerberoshub.audit.destinations -}}
-  {{- $destination := deepCopy $original -}}
-  {{- $label := default (printf "%d" $index) $destination.id -}}
-  {{- if hasKey $destination "credentialsSecret" -}}
-    {{- fail (printf "audit destination %s: credentialsSecret is not supported; set s3.accessKey and s3.secretKey" $label) -}}
-  {{- end -}}
-  {{- if hasKey $destination "bearerTokenSecret" -}}
-    {{- fail (printf "audit destination %s: bearerTokenSecret is not supported; set bearerToken" $label) -}}
-  {{- end -}}
-  {{- $s3 := default dict $destination.s3 -}}
-  {{- if or (hasKey $s3 "accessKey") (hasKey $s3 "secretKey") -}}
-    {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
-    {{- if not (and $s3.accessKey $s3.secretKey) -}}
-      {{- fail (printf "audit destination %s must set both s3.accessKey and s3.secretKey, and neither may be empty" $id) -}}
-    {{- end -}}
-    {{- $_ := set $destination "credentialsSecret" (dict
-        "name" (printf "hub-audit-%s-credentials" $id)
-        "create" true
-        "accessKeyId" $s3.accessKey
-        "secretAccessKey" $s3.secretKey) -}}
-    {{- $_ := unset $s3 "accessKey" -}}
-    {{- $_ := unset $s3 "secretKey" -}}
-  {{- end -}}
-  {{- if hasKey $destination "bearerToken" -}}
-    {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
-    {{- if not $destination.bearerToken -}}
-      {{- fail (printf "audit destination %s sets an empty bearerToken" $id) -}}
-    {{- end -}}
-    {{- $_ := set $destination "bearerTokenSecret" (dict
-        "name" (printf "hub-audit-%s-credentials" $id)
-        "key" "bearer-token"
-        "create" true
-        "value" $destination.bearerToken) -}}
-    {{- $_ := unset $destination "bearerToken" -}}
-  {{- end -}}
-  {{- range $header, $secret := (default dict $destination.secretHeaders) -}}
-    {{- if or (not (kindIs "map" $secret)) (not (hasKey $secret "value")) (hasKey $secret "secretName") (hasKey $secret "secretKey") -}}
-      {{- fail (printf "audit destination %s header %s: set secretHeaders.%s.value" $label $header $header) -}}
-    {{- end -}}
-    {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
-    {{- if not $secret.value -}}
-      {{- fail (printf "audit destination %s header %s sets an empty value" $id $header) -}}
-    {{- end -}}
-    {{- $_ := set $secret "secretName" (printf "hub-audit-%s-credentials" $id) -}}
-    {{- $_ := set $secret "secretKey" (printf "header-%s" (sha256sum $header | trunc 12)) -}}
-    {{- $_ := set $secret "create" true -}}
-  {{- end -}}
-  {{- $resolved = append $resolved $destination -}}
-{{- end -}}
-{{- toJson $resolved -}}
-{{- end -}}

charts/hub/templates/admin/deployment.yaml

@@ -1,69 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: admin
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.admin.replicas }}
-  selector:
-    matchLabels:
-      app: admin
-  template:
-    metadata:
-      labels:
-        app: admin
-    spec:
-      {{- with .Values.admin.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admin.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: admin
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.admin.repository }}:{{ .Values.admin.tag }}"
-          imagePullPolicy: {{ .Values.admin.pullPolicy }}
-          {{- with .Values.admin.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.admin.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.admin.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: {{ .Values.admin.containerPort | default 80 }}
-              protocol: TCP
-          {{- with .Values.admin.readinessProbe }}
-          readinessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.admin.livenessProbe }}
-          livenessProbe:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          env:
-            - name: LOG_LEVEL
-              value: "{{ .Values.admin.logLevel }}"
-            - name: API_URL
-              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
-            - name: TITLE
-              value: Hub Admin | Scale for everyone, anywhere
-            - name: LOGO_NAME
-            - name: ENVIRONMENT
-              value: staging
-            - name: PRIVATE_EDITION
-              value: "false"
-            - name: PRODUCTION
-              value: "true"
-            - name: DEMO
-              value: "false"
-{{- end }}

charts/hub/templates/admin/ingress.yaml

@@ -1,52 +0,0 @@
-
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{ if ne .Values.ingress "" }}
-{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{- else }}
-apiVersion: networking.k8s.io/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: admin-ingress
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{- if eq .Values.admin.oauth2Proxy.enabled true  }}
-    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
-    {{- end }}
-    {{- if eq .Values.ingress "nginx" }}
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  {{- with .Values.admin.tls }}
-  tls:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: admin-svc
-              port:
-                number: 80
-  {{- else }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: admin-svc
-              servicePort: 80
-  {{- end }}
-{{- end }}
-{{- end }}

charts/hub/templates/admin/oauth2-proxy.yaml

@@ -1,108 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) (eq .Values.admin.oauth2Proxy.enabled true) }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: oauth2-proxy-admin
-  namespace: kube-system
-  annotations:
-    {{- if eq .Values.ingress "nginx" }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: oauth2-proxy-admin
-                port:
-                  number: 4180
-  tls:
-    - hosts:
-        - "{{ .Values.admin.url }}"
-      secretName: 
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy-admin
-  namespace: kube-system
-  labels:
-    k8s-app: oauth2-proxy-admin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      k8s-app: oauth2-proxy-admin
-  template:
-    metadata:
-      labels:
-        k8s-app: oauth2-proxy-admin
-    spec:
-      {{- with .Values.admin.oauth2Proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admin.oauth2Proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - args:
-            - --provider=github
-            - --email-domain=*
-            - --upstream=file:///dev/null
-            - --http-address=0.0.0.0:4180
-            - --skip-auth-preflight=true
-          {{- with .Values.admin.oauth2Proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              value: "{{ .Values.admin.oauth2Proxy.github.clientId }}"
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              value: "{{ .Values.admin.oauth2Proxy.github.clientSecret }}"
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              value: "{{ .Values.admin.oauth2Proxy.github.cookieSecret }}"
-            - name: OAUTH2_PROXY_GITHUB_ORG
-              value: "{{ .Values.admin.oauth2Proxy.github.organization }}"
-            - name: OAUTH2_PROXY_GITHUB_TEAM
-              value: "{{ .Values.admin.oauth2Proxy.github.team }}"
-          image: quay.io/oauth2-proxy/oauth2-proxy:latest
-          imagePullPolicy: Always
-          name: oauth2-proxy
-          ports:
-            - containerPort: 4180
-              protocol: TCP
-          resources:
-            limits:
-              cpu: 100m
-              memory: 50Mi
-            requests:
-              cpu: 100m
-              memory: 50Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    k8s-app: oauth2-proxy-admin
-  name: oauth2-proxy-admin
-  namespace: kube-system
-spec:
-  ports:
-    - name: http
-      port: 4180
-      protocol: TCP
-      targetPort: 4180
-  selector:
-    k8s-app: oauth2-proxy-admin
-{{- end -}}

charts/hub/templates/admin/service.yaml

@@ -1,17 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: admin-svc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: admin-svc
-spec:
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: http
-      name: http
-  selector:
-    app: admin
-{{- end }}

charts/hub/templates/configMaps/catalogs/classifications.yaml

@@ -1,46 +0,0 @@
-{{- define "hub.classificationCatalog.defaults" -}}
-[
-  {"key": "animal", "label": "Animal", "icon": "animal"},
-  {"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
-  {"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
-  {"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
-  {"key": "lorry", "label": "Lorry", "icon": "lorry"},
-  {"key": "car", "label": "Car", "icon": "car"},
-  {"key": "handbag", "label": "Handbag", "icon": "handbag"},
-  {"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
-  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
-]
-{{- end -}}
-{{/*
-The effective chart-rendered catalog: the inline classificationCatalog values
-list when set, otherwise the bundled defaults above. values.schema.json
-validates each entry ({key, label, icon?}); keys must also be unique.
-*/}}
-{{- define "hub.classificationCatalog.json" -}}
-{{- if kindIs "invalid" .Values.classificationCatalog -}}
-{{- include "hub.classificationCatalog.defaults" . | mustFromJson | toJson -}}
-{{- else if and (kindIs "slice" .Values.classificationCatalog) .Values.classificationCatalog -}}
-{{- $seen := dict -}}
-{{- range $entry := .Values.classificationCatalog -}}
-{{- $key := toString $entry.key -}}
-{{- if hasKey $seen $key -}}
-{{- fail (printf "classificationCatalog: duplicate key %q" $key) -}}
-{{- end -}}
-{{- $_ := set $seen $key true -}}
-{{- end -}}
-{{- .Values.classificationCatalog | toJson -}}
-{{- else -}}
-{{- fail "classificationCatalog must be omitted (bundled defaults) or a nonempty list; to use the API fallback set classificationCatalogEnabled: false" -}}
-{{- end -}}
-{{- end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: classification-catalog
-  namespace: {{ .Release.Namespace }}
-data:
-  classifications.json: |-
-    {{- include "hub.classificationCatalog.json" . | mustFromJson | toPrettyJson | nindent 4 }}
-{{- end -}}

charts/hub/templates/configMaps/catalogs/device-system-tags.yaml

@@ -1,12 +0,0 @@
-{{- if include "kerberoshub.deviceTags.system.enabled" . }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: device-system-tags
-  namespace: {{ .Release.Namespace }}
-data:
-  # Rendered from deviceTags.system.catalog; hub-api reads it through
-  # DEVICE_SYSTEM_TAGS_FILE.
-  system-tags.json: |-
-    {{- include "kerberoshub.deviceTags.system.json" . | mustFromJson | toPrettyJson | nindent 4 }}
-{{- end -}}

charts/hub/templates/configMaps/configmap-hub-audit.yaml

@@ -1,78 +0,0 @@
-{{- if .Values.audit.enabled -}}
-{{- $destinations := list -}}
-{{- $destinationIDs := dict -}}
-{{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" .) -}}
-  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
-  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
-    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
-  {{- end -}}
-  {{- if hasKey $destinationIDs $id -}}
-    {{- fail (printf "duplicate audit destination id %q" $id) -}}
-  {{- end -}}
-  {{- $_ := set $destinationIDs $id true -}}
-  {{- $type := default "webhook" $destination.type -}}
-  {{- $entry := dict
-      "id" $id
-      "type" $type
-      "enabled" (ternary $destination.enabled true (hasKey $destination "enabled"))
-      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
-      "batchSize" (default 100 $destination.batchSize)
-      "maxAttempts" (default 10 $destination.maxAttempts)
-      "startAt" (default "latest" $destination.startAt)
-      "filters" (default dict $destination.filters) -}}
-  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
-  {{- if eq $type "webhook" -}}
-    {{- if or $destination.s3 $destination.credentialsSecret -}}
-      {{- fail (printf "audit destination %s is a webhook and cannot set s3 or credentialsSecret" $id) -}}
-    {{- end -}}
-    {{- $_ := set $entry "url" (required (printf "url is required for audit destination %s" $id) $destination.url) -}}
-    {{- $_ := set $entry "headers" (default dict $destination.headers) -}}
-    {{- $bearer := default dict $destination.bearerTokenSecret -}}
-    {{- if gt (len $bearer) 0 -}}
-      {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
-      {{- $secretKey := default "token" $bearer.key -}}
-      {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
-    {{- end -}}
-    {{- $headerFiles := dict -}}
-    {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
-      {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
-      {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
-      {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
-    {{- end -}}
-    {{- if gt (len $headerFiles) 0 -}}
-      {{- $_ := set $entry "headerFiles" $headerFiles -}}
-    {{- end -}}
-  {{- else if eq $type "s3" -}}
-    {{- if or $destination.url $destination.headers $destination.bearerTokenSecret $destination.secretHeaders -}}
-      {{- fail (printf "audit destination %s is s3 and cannot set url, headers, bearerToken, bearerTokenSecret or secretHeaders" $id) -}}
-    {{- end -}}
-    {{- $s3 := required (printf "s3 is required for audit destination %s" $id) $destination.s3 -}}
-    {{- $settings := dict
-        "bucket" (required (printf "s3.bucket is required for audit destination %s" $id) $s3.bucket)
-        "region" (required (printf "s3.region is required for audit destination %s" $id) $s3.region) -}}
-    {{- range $key := list "prefix" "endpoint" "forcePathStyle" "allowUnlockedBucket" -}}
-      {{- if hasKey $s3 $key -}}
-        {{- $_ := set $settings $key (get $s3 $key) -}}
-      {{- end -}}
-    {{- end -}}
-    {{- $credentials := default dict $destination.credentialsSecret -}}
-    {{- if gt (len $credentials) 0 -}}
-      {{- $secretName := required (printf "credentialsSecret.name is required for destination %s" $id) $credentials.name -}}
-      {{- $_ := set $settings "accessKeyIdFile" (printf "%s/access-key-id-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "access-key-id" $credentials.accessKeyIdKey)) | trunc 12)) -}}
-      {{- $_ := set $settings "secretAccessKeyFile" (printf "%s/secret-access-key-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "secret-access-key" $credentials.secretAccessKeyKey)) | trunc 12)) -}}
-    {{- end -}}
-    {{- $_ := set $entry "s3" $settings -}}
-  {{- else -}}
-    {{- fail (printf "audit destination %s has unsupported type %q (webhook or s3)" $id $type) -}}
-  {{- end -}}
-  {{- $destinations = append $destinations $entry -}}
-{{- end -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-data:
-  destinations.json: |
-    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
-{{- end }}

charts/hub/templates/configMaps/configmap-mongodb.yaml

@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mongodb-config
-  namespace: {{ .Release.Namespace }}
-data:
-  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
-  MONGODB_HOST: "{{ .Values.mongodb.host }}"
-  MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
-  MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
-  MONGODB_USERNAME: "{{ .Values.mongodb.username }}"
-  MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
-  MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
-  MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
-  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
-  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
-  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
-  MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/configMaps/workflow-contracts/anpr.yaml

@@ -1,135 +0,0 @@
-{{/* Validate the rendered anpr.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.anpr" -}}
-schemaVersion: 1
-stage: anpr
-contractVersion: 1
-presentation:
-  name: Number plate recognition
-  description: Read the number plates of vehicles in the recording.
-  icon: car
-  color: amber
-
-# Node settings hub-anpr reads per run (see its README, "Node settings"). Each
-# overrides the matching ANPR_* environment variable; the defaults below equal
-# the worker's built-in defaults. A deployment that changes those variables
-# should change these defaults too, because new nodes store them on save.
-params:
-  - name: plateClasses
-    label: Read plates for
-    description: Vehicle classes whose plates are read (ANPR_PLATE_CLASSES).
-    type: multiselect
-    choices: {file: ../catalogs/classifications.json}
-    default: [car]
-    group: Which vehicles
-  - name: minMovement
-    label: Minimum movement
-    description: Skip vehicles that barely moved; 0 reads every vehicle (ANPR_READ_MOVEMENT_MIN).
-    type: number
-    minimum: 0
-    default: 0
-    group: Which vehicles
-  - name: maxJump
-    label: Maximum jump between frames
-    description: Drop unstable tracks; 0 disables the check (ANPR_READ_MAX_JUMP).
-    type: number
-    minimum: 0
-    default: 0
-    group: Which vehicles
-  - name: readFrames
-    label: Frames to read per vehicle
-    description: Frames OCR'd per vehicle; 0 disables OCR (ANPR_READ_FRAMES).
-    type: number
-    minimum: 0
-    maximum: 10
-    default: 1
-    group: Recognition
-  - name: readQuorum
-    label: Agreeing reads required
-    description: Reads that must agree before a plate is accepted; 0 accepts any read (ANPR_READ_QUORUM).
-    type: number
-    minimum: 0
-    maximum: 10
-    default: 0
-    group: Recognition
-  - name: minConfidence
-    label: Minimum OCR confidence
-    description: Ignore reads below this confidence (ANPR_READ_CONF_MIN).
-    type: number
-    minimum: 0
-    maximum: 1
-    default: 0
-    group: Recognition
-
-# Paths are relative to results.anpr (models.WorkflowAnprResult): one track and
-# one marker per vehicle. Plate, unread and class can be tied to the same
-# vehicle with "Must match the same item"; OCR confidence and engine live on
-# the markers and cannot be tied to a plate.
-fields:
-  - id: plate
-    label: Number plate
-    path: detections.*.tracks.*.meta.plate
-    type: string
-    operators: [eq, in, contains, matches]   # stored uppercase, letters and digits only, e.g. AB123CD
-    optional: true
-  - id: unread
-    label: Plate could not be read
-    path: detections.*.tracks.*.meta.unread
-    type: boolean
-    operators: [eq]
-    optional: true
-  - id: vehicleClass
-    label: Vehicle class (from classification)
-    path: detections.*.tracks.*.meta.classifiedAs
-    type: string
-    operators: [eq, in]
-    optional: true
-    choices: {file: ../catalogs/classifications.json}
-  - id: ocrConfidence
-    label: OCR confidence
-    path: markers.*.metadata.confidence
-    type: number
-    operators: [gte, gt, lte, lt]   # read plates only; about 0-1 for fast, 0.5 for tesseract
-    minimum: 0
-    optional: true
-  - id: ocrEngine
-    label: OCR engine
-    path: markers.*.metadata.engine
-    type: string
-    operators: [eq, in]   # read plates only
-    optional: true
-    choices: {values: [fast, tesseract, tesseract+opencv, http]}
-  - id: secondsVisible
-    label: Seconds visible
-    path: markers.*.duration
-    type: integer
-    operators: [gte, lte]
-    minimum: 0
-    optional: true
-
-# Connections leaving this stage; Extra conditions are appended collapsed.
-panel:
-  sections:
-    - id: plate
-      label: Plate
-      fields:
-        - {field: plate, widget: text, operator: contains, label: Plate contains (e.g. AB123)}
-        - {field: unread, widget: toggle, label: Plate could not be read}
-    - id: recognition
-      label: Recognition
-      collapsed: true
-      fields:
-        - {field: ocrConfidence, widget: number, operator: gte, label: Minimum OCR confidence}
-        - {field: vehicleClass, widget: multiselect}
-        - {field: secondsVisible, widget: number, operator: gte, label: Visible for at least (seconds)}
-{{ end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/anpr.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  anpr.yaml: |-
-    {{- include "hub.workflowConfiguration.anpr" . | nindent 4 }}
-{{- end }}

charts/hub/templates/configMaps/workflow-contracts/forwarder.yaml

@@ -1,95 +0,0 @@
-{{/* Validate the rendered forwarder.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.forwarder" -}}
-schemaVersion: 1
-stage: forwarder
-contractVersion: 1
-presentation:
-  name: Forward to my system
-  description: Send the run's data to your own RabbitMQ destination.
-  icon: share
-  color: green
-
-# Custom workflows supply their own connection; deployment credentials are never
-# inherited. These non-secret defaults are stored on save, not read from the worker.
-params:
-  - name: broker
-    label: Provider
-    description: Custom workflows use their own RabbitMQ destination. Shared deployment integrations are reserved for global workflows.
-    type: select
-    required: true
-    options: [rabbitmq]
-    optionLabels: {rabbitmq: RabbitMQ}
-    default: rabbitmq
-    group: Delivery
-  - name: mode
-    label: Completion mode
-    description: Complete after delivery, or wait for the external result. Callback requires a deployment-configured Hub callback URL.
-    type: select
-    required: true
-    options: [delivered, callback]
-    optionLabels: {delivered: Complete after delivery, callback: Wait for result}
-    default: delivered
-    group: Delivery
-  - name: host
-    label: Host
-    description: Your RabbitMQ destination host. Required before enabling the workflow.
-    type: string
-    required: true
-    placeholder: rabbitmq.example.com
-    group: RabbitMQ destination
-  - name: port
-    label: Port
-    description: Your RabbitMQ destination port, a whole number (usually 5671 with TLS or 5672 without TLS).
-    type: number
-    required: true
-    minimum: 1
-    maximum: 65535
-    group: RabbitMQ destination
-  - name: queue
-    label: Queue
-    description: Your destination queue. Its dead-letter queue is this name followed by .forwarder-dead-letter.
-    type: string
-    required: true
-    group: RabbitMQ destination
-  - name: vhost
-    label: Virtual host
-    description: Your RabbitMQ virtual host. Use / for the broker's default virtual host.
-    type: string
-    required: true
-    placeholder: /
-    group: RabbitMQ destination
-  - name: tls
-    label: Use TLS
-    description: Encrypt the connection and verify the broker certificate using system trust roots. Deployment TLS overrides are never inherited.
-    type: boolean
-    required: true
-    default: true
-    group: RabbitMQ destination
-  - name: username
-    label: Username
-    description: Your RabbitMQ destination username. Deployment credentials are never used.
-    type: string
-    required: true
-    group: RabbitMQ credentials
-  - name: password
-    label: Password
-    description: Your RabbitMQ destination password. Required before enabling the workflow; masked after saving.
-    type: secret
-    required: true
-    group: RabbitMQ credentials
-
-# It contributes no output fields: connections after it can still use Start and
-# earlier stages in Extra conditions.
-fields: []
-{{ end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/forwarder.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  forwarder.yaml: |-
-    {{- include "hub.workflowConfiguration.forwarder" . | nindent 4 }}
-{{- end }}

charts/hub/templates/configMaps/workflow-contracts/start.yaml

@@ -1,75 +0,0 @@
-{{/* Validate the rendered start.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.start" -}}
-schemaVersion: 1
-stage: start
-contractVersion: 1
-
-# Paths refer to the safe initial context, not the full event or credentials.
-fields:
-  - id: device
-    label: Device
-    path: device.deviceKey
-    type: string
-    operators: [eq, in]
-    choices:
-      source: project.devices
-  - id: sites
-    label: Sites
-    path: device.siteIds.*
-    type: string
-    operators: [in]
-    choices:
-      source: project.sites
-  - id: groups
-    label: Groups
-    path: device.groupIds.*
-    type: string
-    operators: [in]
-    choices:
-      source: project.groups
-  - id: classifications
-    label: Initial classifications
-    path: inputs.classify.details.*.classified
-    type: string
-    operators: [in]
-    optional: true
-    choices:
-      file: ../catalogs/classifications.json
-  # Condition-only context fields (not selectors): advanced conditions on
-  # Start connections may test only declared fields, under device. or inputs.
-  - id: deviceName
-    label: Camera name
-    path: device.deviceName
-    type: string
-    operators: [eq, in, contains, matches]
-  - id: objectClass
-    label: Detected object
-    path: inputs.classify.details.*.classified
-    type: string
-    operators: [eq, ne, in, exists]
-    optional: true
-    choices:
-      file: ../catalogs/classifications.json
-
-# Controls offered for new authoring; an omitted control is not offered.
-controls:
-  - id: weeklySchedule
-    label: Weekly schedule
-  - id: conditions
-    label: Advanced conditions
-
-# Trigger modes offered for new authoring; omitted offers both.
-triggerModes: [automatic, manual]
-{{ end -}}
-{{- include "hub.workflowConfiguration.validate" . -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/start.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
-  namespace: {{ .Release.Namespace }}
-data:
-  start.yaml: |-
-    {{- include "hub.workflowConfiguration.start" . | nindent 4 }}
-{{- end }}

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -1,12 +1,7 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{- $workflowConfiguration := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- $catalogReplacement := index $workflowConfiguration.replacements "catalogs/classifications.json" | default dict -}}
-{{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-api-svc
-  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-api-svc
 spec:
@@ -21,33 +16,47 @@ spec:
       protocol: TCP
   selector:
     app: hub-api
-{{- end }}
-{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
+{{ else }}
+apiVersion: networking.k8s.io/v1
 {{ end }}
 kind: Ingress
 metadata:
   name: hub-api-ingress
-  namespace: {{ .Release.Namespace }}
   annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: 200m # This might throw a 413 Entity Too Large when uploading large recordings.
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
   {{- with .Values.kerberoshub.api.tls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
 
-  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
+  rules:
+    - host: "{{ .Values.kerberoshub.api.url }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- if .Values.kerberoshub.api.legacyUrl }}
+    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- end }}
+  {{- else }}
   rules:
     - host: "{{ .Values.kerberoshub.api.url }}"
       http:
@@ -81,32 +90,12 @@ spec:
                 name: hub-api-svc
                 port:
                   number: 80
-  {{ else }}
-    rules:
-    - host: "{{ .Values.kerberoshub.api.url }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- if .Values.kerberoshub.api.legacyUrl }}
-    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- end }}
-  {{ end }}
-{{- end }}
+  {{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-api
-  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.api.replicas }}
   selector:
@@ -120,220 +109,41 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-        {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
-        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if include "kerberoshub.deviceTags.system.enabled" . }}
-        checksum/device-system-tags: {{ include (print $.Template.BasePath "/configMaps/catalogs/device-system-tags.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
-        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml")) }}
-        checksum/workflow-contract-anpr: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/anpr.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml")) }}
-        checksum/workflow-contract-forwarder: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/forwarder.yaml") . | sha256sum }}
-        {{- end }}
       labels:
         app: hub-api
     spec:
-      {{- with .Values.kerberoshub.api.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
-      {{- $deviceSystemTagsEnabled := include "kerberoshub.deviceTags.system.enabled" . }}
-      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- if $workflowConfiguration.enabled }}
-        - name: workflow-configuration
-          projected:
-            sources:
-              {{- if $workflowConfiguration.includeDefaults }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml") }}
-              - configMap:
-                  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
-                  items:
-                    - key: start.yaml
-                      path: workflow-contracts/start.yaml
-              {{- end }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml") }}
-              - configMap:
-                  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
-                  items:
-                    - key: anpr.yaml
-                      path: workflow-contracts/anpr.yaml
-              {{- end }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml") }}
-              - configMap:
-                  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
-                  items:
-                    - key: forwarder.yaml
-                      path: workflow-contracts/forwarder.yaml
-              {{- end }}
-              {{- if not $catalogReplacement }}
-              - configMap:
-                  name: {{ include "hub.classificationCatalog.configMapName" . }}
-                  items:
-                    - key: classifications.json
-                      path: catalogs/classifications.json
-              {{- end }}
-              {{- end }}
-              {{- range $workflowConfiguration.configMaps }}
-              - configMap:
-                  name: {{ .name | quote }}
-                  items:
-                    {{- toYaml .items | nindent 20 }}
-              {{- end }}
-      {{- end }}
-      {{- if $classificationCatalogEnabled }}
-        - name: classification-catalog
-          configMap:
-            name: {{ include "hub.classificationCatalog.configMapName" . }}
-            {{- if or .Values.classificationCatalogExistingConfigMap $catalogReplacement }}
-            items:
-              - key: {{ default "classifications.json" $catalogReplacement.key | quote }}
-                path: classifications.json
-            {{- end }}
-      {{- end }}
-      {{- if $deviceSystemTagsEnabled }}
-        - name: device-system-tags
-          configMap:
-            name: device-system-tags
-      {{- end }}
       {{- with .Values.kerberoshub.api.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $serverTLS.enabled $serverTLS.secretName }}
-        - name: hub-api-server-tls
-          secret:
-            secretName: {{ $serverTLS.secretName }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
         - name: hub-api
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
+          image: "{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.api.pullPolicy }}
-          {{- with .Values.kerberoshub.api.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.kerberoshub.api.resources }}
           resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
+            requests:
+              memory: 100Mi
+              cpu: 50m
           ports:
             - containerPort: 80
-              name: http
-          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- if $workflowConfiguration.enabled }}
-            - name: workflow-configuration
-              mountPath: /etc/kerberos/configuration
-              readOnly: true
-          {{- end }}
-          {{- if $classificationCatalogEnabled }}
-            - name: classification-catalog
-              mountPath: /etc/kerberos/classifications
-              readOnly: true
-          {{- end }}
-          {{- if $deviceSystemTagsEnabled }}
-            - name: device-system-tags
-              mountPath: /etc/kerberos/device-tags
-              readOnly: true
-          {{- end }}
+              name: http  
           {{- with .Values.kerberoshub.api.volumeMounts}}
+          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- if and $serverTLS.enabled $serverTLS.secretName }}
-            - name: hub-api-server-tls
-              mountPath: {{ $serverTLS.mountPath }}
-              readOnly: true
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          # Mongodb - loaded from ConfigMap
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
           env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
-            {{- if $classificationCatalogEnabled }}
-            - name: CLASSIFICATION_CATALOG_FILE
-              value: /etc/kerberos/classifications/classifications.json
-            {{- end }}
-            {{- if $deviceSystemTagsEnabled }}
-            # System tag catalog (deviceTags.system.catalog): the only system
-            # tags owners can assign. Unset (disabled) disables system tags.
-            - name: DEVICE_SYSTEM_TAGS_FILE
-              value: /etc/kerberos/device-tags/system-tags.json
-            {{- end }}
-            - name: ENVIRONMENT
-              value: "{{ .Values.environment }}"
             - name: READ_ONLY
-              value: "{{ .Values.readOnly }}"
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.api.logLevel }}"
-            - name: SUPPORT_ENABLED
-              value: "{{ .Values.kerberoshub.support.enabled }}"
+              value: "{{ .Values.readonly }}"
             - name: CLOUD_API_URL
               value: "{{ .Values.kerberoshub.api.url }}"
             - name: API_URL
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
-            - name: ACCESS_TOKEN_TIMEOUT
-              value: {{ .Values.kerberoshub.api.session.accessTokenTimeout | quote }}
-            - name: SESSION_IDLE_TIMEOUT
-              value: {{ .Values.kerberoshub.api.session.idleTimeout | quote }}
-            - name: SESSION_MAX_LIFETIME
-              value: {{ .Values.kerberoshub.api.session.maxLifetime | quote }}
-            - name: REFRESH_COOKIE_SECURE
-              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
-            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
-            {{- with .Values.kerberoshub.frontend.legacyUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- range .Values.kerberoshub.frontend.domains }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
-            {{- end }}
-            {{- range .Values.kerberoshub.api.corsAllowedOrigins }}
-            {{- $corsOrigins = append $corsOrigins . }}
-            {{- end }}
-            - name: CORS_ALLOWED_ORIGINS
-              value: {{ join "," $corsOrigins | quote }}
-            {{- $mcp := .Values.kerberoshub.api.mcp | default dict }}
-            - name: MCP_ENABLED
-              value: {{ $mcp.enabled | default false | quote }}
-            - name: MCP_ALLOWED_ORIGINS
-              value: {{ join "," ($mcp.allowedOrigins | default list) | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"
@@ -348,26 +158,6 @@ spec:
             - name: API_KEY
               value: "{{ .Values.kerberoshub.api.apiKey }}"
 
-            # MQTT credentials (served via /runtime/config to authenticated
-            # frontend clients; no longer exposed in the public env.js).
-            - name: MQTT_USERNAME
-              value: "{{ .Values.mqtt.username }}"
-            - name: MQTT_PASSWORD
-              value: "{{ .Values.mqtt.password }}"
-
-            # TURN credentials (served via /runtime/config to authenticated
-            # frontend clients; no longer exposed in the public env.js).
-            - name: TURN_USERNAME
-              value: "{{ .Values.turn.username }}"
-            - name: TURN_PASSWORD
-              value: "{{ .Values.turn.password }}"
-            {{- if .Values.kerberoshub.api.serverTLS.enabled }}
-            - name: TLS_CERT_FILE
-              value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"
-            - name: TLS_KEY_FILE
-              value: "{{ .Values.kerberoshub.api.serverTLS.keyFile }}"
-            {{- end }}
-
             # Kerberos Hub
             - name: LICENSE_KEY
               value: "{{ .Values.license }}"
@@ -375,51 +165,20 @@ spec:
               value: "{{ .Values.licenseServer.url }}"
             - name: LICENSE_PUBLIC_API_TOKEN
               value: "{{ .Values.licenseServer.token }}"
-
+              
             # Authorization - Authentication secret
             - name: KERBEROS_JWT_SECRET
               value: "{{ .Values.kerberoshub.api.jwtSecret }}"
-
-            # Temporarily stop serving the polled GET /devices list (204, no DB reads).
-            - name: DISABLE_AGENT_HEARTBEAT
-              value: {{ .Values.kerberoshub.api.disableAgentHeartbeat | default false | quote }}
-
-            # Media proxy: hide Vault/storage endpoints behind hub-api URLs.
-            {{- $mediaProxy := .Values.kerberoshub.api.mediaProxy | default dict }}
-            - name: MEDIA_PROXY_ENABLED
-              value: {{ $mediaProxy.enabled | default false | quote }}
-            {{- if $mediaProxy.publicUrl }}
-            - name: MEDIA_PROXY_PUBLIC_URL
-              value: {{ $mediaProxy.publicUrl | quote }}
-            {{- end }}
-            {{- if $mediaProxy.key }}
-            - name: MEDIA_PROXY_KEY
-              value: {{ $mediaProxy.key | quote }}
-            {{- end }}
-            {{- if $mediaProxy.ttl }}
-            - name: MEDIA_PROXY_TTL
-              value: {{ $mediaProxy.ttl | quote }}
-            {{- end }}
-
+              
             # SSO (OIDC) setup
-            - name: SSO_DOMAINS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-            - name: SSO_REDIRECTURLS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .redirectUrl }};{{- end }}"
-            - name: SSO_CLAIMIDS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .claimId }};{{- end }}"
-            - name: SSO_ISSUERS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .issuer }};{{- end }}"
-            - name: SSO_CLIENTIDS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientId }};{{- end }}"
-            - name: SSO_CLIENTSECRETS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientSecret }};{{- end }}"
-            - name: SSO_CLIENTVERIFICATIONIDS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientVerificationId }};{{- end }}"
-            - name: SSO_FORCE_SSO
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
-            - name: SSO_EXTRA_HEADERS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{- if .extraHeaders }}{{- range .extraHeaders }}{{ .name }}:{{ .value }};{{- end }}{{- else }}{{- end }}*{{- end }}"
+            - name: SSO_ISSUER
+              value: "{{ .Values.kerberoshub.api.sso.issuer }}"
+            - name: SSO_CLIENTID
+              value: "{{ .Values.kerberoshub.api.sso.clientId }}"
+            - name: SSO_CLIENTSECRET
+              value: "{{ .Values.kerberoshub.api.sso.clientSecret }}"
+            - name: SSO_REDIRECTURL
+              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}{{ .Values.kerberoshub.api.sso.redirectUrl }}"
 
             # Kerberos pipeline
             - name: QUEUE_SYSTEM
@@ -427,45 +186,10 @@ spec:
             - name: QUEUE_NAME
               value: "{{ .Values.queueName }}"
 
-            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
-            # SAME set the workflows engine consumes, assembled from the enabled
-            # definitions under kerberoshub.workflows.definitions (see
-            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
-            # read-only to surface config workflows alongside the user workflows
-            # it stores in the database; the config workflows are never persisted.
-            - name: WORKFLOW_DEFINITIONS
-              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
-            # Deployment service routing catalog used by API-owned embedded
-            # workflows (for example the one-stage case redaction modal flow).
-            - name: WORKFLOW_STAGE_QUEUES
-              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
-            # Stages tenants may place in the workflow editor (see workflows.editorStages).
-            - name: WORKFLOW_EDITOR_STAGES
-              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
-
             # Stripe for billing
             - name: STRIPE_KEY
               value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
 
-            # OpenAI
-            - name: OPENAI_API_KEY
-              value: "{{ .Values.openai.apikey }}"
-
-            # MFA Issuer name (Will be shown when scanning in)
-            - name: MFA_ISSUER
-              value: "{{ .Values.kerberoshub.api.mfaIssuer }}"
-
-            {{- if .Values.kerberoshub.api.passkeys.enabled }}
-            - name: FEATURE_PASSKEYS_ENABLED
-              value: "true"
-            - name: PASSKEY_RP_ID
-              value: {{ required "kerberoshub.api.passkeys.rpId is required when passkeys are enabled" .Values.kerberoshub.api.passkeys.rpId | quote }}
-            - name: PASSKEY_ORIGINS
-              value: {{ required "kerberoshub.api.passkeys.origins is required when passkeys are enabled" .Values.kerberoshub.api.passkeys.origins | join "," | quote }}
-            - name: PASSKEY_RP_NAME
-              value: {{ .Values.kerberoshub.api.passkeys.rpName | quote }}
-            {{- end }}
-
             # AWS (Legacy, use Kerberos Vault instead)
             - name: AWS_REGION
               value: "{{ .Values.kerberoshub.api.aws.region }}"
@@ -505,23 +229,17 @@ spec:
             - name: KAFKA_SECURITY
               value: "{{ .Values.kafka.security }}"
 
-            # RabbitMQ settings
-            - name: RABBITMQ_HOST
-              value: "{{ .Values.rabbitmq.host }}"
-            - name: RABBITMQ_EXCHANGE
-              value: "{{ .Values.rabbitmq.exchange }}"
-            - name: RABBITMQ_USERNAME
-              value: "{{ .Values.rabbitmq.username }}"
-            - name: RABBITMQ_PASSWORD
-              value: "{{ .Values.rabbitmq.password }}"
-            - name: AUDIT_ENABLED
-              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
-            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
-            - name: AUDIT_QUEUE
-              value: {{ .Values.audit.intake.queue | quote }}
-            - name: AUDIT_DEADLETTER_QUEUE
-              value: {{ .Values.audit.intake.deadletterQueue | quote }}
-            {{- end }}
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
 
             # Slack notifications (this will send events/logs to a specific channel).
             - name: SLACK_ENABLED
@@ -531,6 +249,22 @@ spec:
             - name: SLACK_USERNAME
               value: "{{ .Values.kerberoshub.api.slack.username }}"
 
+            # Elastic search - Kibana
+            - name: LOGGING_ELASTICSEARCH
+              value: "{{ .Values.kerberoshub.api.elasticsearch.enabled }}"
+            - name: LOGGING_ELASTICSEARCH_PROTOCOL
+              value: "{{ .Values.kerberoshub.api.elasticsearch.protocol }}"
+            - name: LOGGING_ELASTICSEARCH_HOST
+              value: "{{ .Values.kerberoshub.api.elasticsearch.host }}"
+            - name: LOGGING_ELASTICSEARCH_PORT
+              value: "{{ .Values.kerberoshub.api.elasticsearch.port }}"
+            - name: LOGGING_ELASTICSEARCH_INDEX
+              value: "{{ .Values.kerberoshub.api.elasticsearch.index }}"
+            - name: LOGGING_ELASTICSEARCH_USERNAME
+              value: "{{ .Values.kerberoshub.api.elasticsearch.username }}"
+            - name: LOGGING_ELASTICSEARCH_PASSWORD
+              value: "{{ .Values.kerberoshub.api.elasticsearch.password }}"
+
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -538,7 +272,7 @@ spec:
               value: "{{ .Values.email.from }}"
             - name: EMAIL_FROM_DISPLAYNAME
               value: "{{ .Values.email.displayName }}"
-
+              
             # Mail templates
             - name: WELCOME_TEMPLATE
               value: "{{ .Values.email.templates.welcome }}"
@@ -556,26 +290,6 @@ spec:
               value: "{{ .Values.email.templates.share }}"
             - name: SHARE_TITLE
               value: "{{ .Values.email.templates.shareTitle }}"
-            - name: CASE_SHARE_TEMPLATE
-              value: "{{ .Values.email.templates.caseShare }}"
-            - name: CASE_SHARE_TITLE
-              value: "{{ .Values.email.templates.caseShareTitle }}"
-            - name: CASE_SHARE_OTP_TEMPLATE
-              value: "{{ .Values.email.templates.caseShareOtp }}"
-            - name: CASE_SHARE_OTP_TITLE
-              value: "{{ .Values.email.templates.caseShareOtpTitle }}"
-            - name: ASSIGN_TASK_TEMPLATE
-              value: "{{ .Values.email.templates.assignTask }}"
-            - name: ASSIGN_TASK_TITLE
-              value: "{{ .Values.email.templates.assignTaskTitle }}"
-            - name: DEFAULT_TASK_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.api.defaultTaskRetentionDays }}"
-            - name: CASES_MAX_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.api.casesMaxRetentionDays }}"
-            {{- with .Values.kerberoshub.api.auditExportMaxEventsPerFile }}
-            - name: AUDIT_EXPORT_MAX_EVENTS_PER_FILE
-              value: {{ . | int64 | toString | quote }}
-            {{- end }}
 
             # SMTP
             - name: SMTP_SERVER
@@ -586,51 +300,9 @@ spec:
               value: "{{ .Values.email.smtp.username }}"
             - name: SMTP_PASSWORD
               value: "{{ .Values.email.smtp.password }}"
-
+              
             # Mailgun
             - name: MAILGUN_DOMAIN
               value: "{{ .Values.email.mailgun.domain }}"
             - name: MAILGUN_API_KEY
               value: "{{ .Values.email.mailgun.apikey }}"
-
-            # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-            # This will lower storage in mongodb.
-            - name: THUMBNAIL_VAULT_ENABLED
-              value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-            - name: VAULT_THUMBNAIL_PROVIDER
-              value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-            - name: VAULT_THUMBNAIL_ACCESS_KEY
-              value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-            - name: VAULT_THUMBNAIL_SECRET_KEY
-              value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-
-            # There is an option to store the sprites in a storage provider in Kerberos Vault.
-            - name: VAULT_SPRITE_ENABLED
-              value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-            - name: VAULT_SPRITE_PROVIDER
-              value: "{{ .Values.kerberosvault.sprite.provider }}"
-            - name: VAULT_SPRITE_ACCESS_KEY
-              value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-            - name: VAULT_SPRITE_SECRET_KEY
-              value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-            - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberospipeline.sprite.interval }}"
-            - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberospipeline.sprite.width }}"
-            - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberospipeline.sprite.height }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-
-            {{- if .Values.opentelemetry.enabled }}
-            # Open Telemetry tracing
-            - name: OTEL_EXPORTED_OTLP_ENABLED
-              value: "{{ .Values.opentelemetry.enabled }}"
-            - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-              value: "{{ .Values.opentelemetry.routingEnabled }}"
-            - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "{{ .Values.opentelemetry.collector.endpoint }}"
-            {{- include "hub.opentelemetry.apiSamplerEnv" $ | trim | nindent 12 }}
-            {{- end }}
-{{- end }}

charts/hub/templates/kerberos-hub/hub-audit-credentials-secret.yaml

@@ -1,53 +0,0 @@
-{{- if .Values.audit.enabled }}
-{{- /*
-Secret the chart creates per audit destination from its inline credentials
-(s3.accessKey / s3.secretKey, bearerToken, secretHeaders.<name>.value).
-*/}}
-{{- $created := dict }}
-{{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" .) }}
-{{- $data := dict }}
-{{- $name := "" }}
-{{- $credentials := default dict $destination.credentialsSecret }}
-{{- if $credentials.create }}
-{{- $name = required (printf "credentialsSecret.name is required for destination %s" $destination.id) $credentials.name }}
-{{- $accessKeyIdKey := default "access-key-id" $credentials.accessKeyIdKey }}
-{{- $secretAccessKeyKey := default "secret-access-key" $credentials.secretAccessKeyKey }}
-{{- if eq $accessKeyIdKey $secretAccessKeyKey }}
-{{- fail (printf "credentialsSecret.accessKeyIdKey and secretAccessKeyKey must differ for destination %s" $destination.id) }}
-{{- end }}
-{{- $_ := set $data $accessKeyIdKey (required (printf "credentialsSecret.accessKeyId is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.accessKeyId) }}
-{{- $_ := set $data $secretAccessKeyKey (required (printf "credentialsSecret.secretAccessKey is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.secretAccessKey) }}
-{{- end }}
-{{- $bearer := default dict $destination.bearerTokenSecret }}
-{{- if $bearer.create }}
-{{- $name = $bearer.name }}
-{{- $_ := set $data $bearer.key $bearer.value }}
-{{- end }}
-{{- range $header, $secret := (default dict $destination.secretHeaders) }}
-{{- if $secret.create }}
-{{- $name = $secret.secretName }}
-{{- $_ := set $data $secret.secretKey $secret.value }}
-{{- end }}
-{{- end }}
-{{- if $name }}
-{{- if hasKey $created $name }}
-{{- fail (printf "audit destinations %s and %s both create Secret %q" (get $created $name) $destination.id $name) }}
-{{- end }}
-{{- $_ := set $created $name $destination.id }}
----
-apiVersion: v1
-kind: Secret
-metadata:
-  name: {{ $name }}
-  namespace: {{ $.Release.Namespace }}
-  labels:
-    app: hub-audit
-    audit-destination: {{ $destination.id }}
-type: Opaque
-stringData:
-  {{- range $key, $value := $data }}
-  {{ $key | quote }}: {{ toString $value | quote }}
-  {{- end }}
-{{- end }}
-{{- end }}
-{{- end }}

charts/hub/templates/kerberos-hub/hub-audit-serviceaccount.yaml

@@ -1,16 +0,0 @@
-{{- if and .Values.audit.enabled (default dict .Values.kerberoshub.audit.serviceAccount).create }}
-{{- $serviceAccount := .Values.kerberoshub.audit.serviceAccount }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ default "hub-audit" $serviceAccount.name }}
-  namespace: {{ .Release.Namespace }}
-  {{- with $serviceAccount.annotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-  {{- with $serviceAccount.labels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/hub/templates/kerberos-hub/hub-audit-servicemonitor.yaml

@@ -1,18 +0,0 @@
-{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-audit-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: hub-audit
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: hub-audit
-  endpoints:
-    - port: metrics
-      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
-      path: /metrics
-{{- end }}

charts/hub/templates/kerberos-hub/hub-audit.yaml

@@ -1,185 +0,0 @@
-{{- if .Values.audit.enabled -}}
-{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
-{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
-{{- end -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.audit.replicas }}
-  selector:
-    matchLabels:
-      app: hub-audit
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: hub-audit
-    spec:
-      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
-      {{- $auditServiceAccount := default dict .Values.kerberoshub.audit.serviceAccount }}
-      {{- if $auditServiceAccount.create }}
-      serviceAccountName: {{ default "hub-audit" $auditServiceAccount.name }}
-      {{- else if $auditServiceAccount.name }}
-      serviceAccountName: {{ $auditServiceAccount.name }}
-      {{- else if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      volumes:
-        - name: destinations
-          configMap:
-            name: hub-audit
-          {{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" $) }}
-      {{- $bearer := default dict $destination.bearerTokenSecret }}
-      {{- $secretHeaders := default dict $destination.secretHeaders }}
-      {{- $credentials := default dict $destination.credentialsSecret }}
-      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) (gt (len $credentials) 0) }}
-        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
-          projected:
-            sources:
-            {{- if gt (len $credentials) 0 }}
-            {{- $accessKeyIdKey := default "access-key-id" $credentials.accessKeyIdKey }}
-            {{- $secretAccessKeyKey := default "secret-access-key" $credentials.secretAccessKeyKey }}
-              - secret:
-                  name: {{ required (printf "credentialsSecret.name is required for destination %s" $destination.id) $credentials.name | quote }}
-                  items:
-                    - key: {{ $accessKeyIdKey | quote }}
-                      path: access-key-id-{{ sha256sum (printf "%s:%s" $credentials.name $accessKeyIdKey) | trunc 12 }}
-                    - key: {{ $secretAccessKeyKey | quote }}
-                      path: secret-access-key-{{ sha256sum (printf "%s:%s" $credentials.name $secretAccessKeyKey) | trunc 12 }}
-            {{- end }}
-            {{- if gt (len $bearer) 0 }}
-              - secret:
-                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
-                  items:
-                    - key: {{ default "token" $bearer.key | quote }}
-                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
-            {{- end }}
-            {{- range $headerName, $secret := $secretHeaders }}
-              - secret:
-                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
-                  items:
-                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
-                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
-            {{- end }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.audit.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: hub-audit
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
-          {{- with .Values.kerberoshub.audit.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - name: metrics
-              containerPort: 2112
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: metrics
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: metrics
-          volumeMounts:
-            - name: destinations
-              mountPath: /etc/hub-audit
-              readOnly: true
-          {{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" $) }}
-          {{- $bearer := default dict $destination.bearerTokenSecret }}
-          {{- $secretHeaders := default dict $destination.secretHeaders }}
-          {{- $credentials := default dict $destination.credentialsSecret }}
-          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) (gt (len $credentials) 0) }}
-            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
-              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
-              readOnly: true
-          {{- end }}
-          {{- end }}
-          {{- with .Values.kerberoshub.audit.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
-          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-audit") | nindent 12 }}
-            - name: RABBITMQ_HOST
-              value: {{ .Values.rabbitmq.host | quote }}
-            - name: RABBITMQ_EXCHANGE
-              value: {{ .Values.rabbitmq.exchange | quote }}
-            - name: RABBITMQ_USERNAME
-              value: {{ .Values.rabbitmq.username | quote }}
-            - name: RABBITMQ_PASSWORD
-              value: {{ .Values.rabbitmq.password | quote }}
-            - name: AUDIT_QUEUE
-              value: {{ .Values.audit.intake.queue | quote }}
-            - name: AUDIT_DEADLETTER_QUEUE
-              value: {{ .Values.audit.intake.deadletterQueue | quote }}
-            - name: AUDIT_MAX_RETRIES
-              value: {{ .Values.audit.intake.maxRetries | quote }}
-            - name: AUDIT_PREFETCH_COUNT
-              value: {{ .Values.audit.intake.prefetchCount | quote }}
-            - name: AUDIT_PERSIST_TIMEOUT
-              value: {{ .Values.audit.intake.persistTimeout | quote }}
-            - name: DISPATCH_INTERVAL
-              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
-            - name: LEASE_DURATION
-              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          {{- with .Values.kerberoshub.audit.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.kerberoshub.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-audit
-    service: hub-audit
-spec:
-  ports:
-    - name: metrics
-      port: 2112
-      targetPort: metrics
-      protocol: TCP
-  selector:
-    app: hub-audit
-{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup-servicemonitor.yaml

@@ -1,18 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-cleanup-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: hub-cleanup
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: hub-cleanup
-  endpoints:
-    - port: hub-metrics
-      interval: 15s
-      path: /metrics
-{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-cleanup
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.cleanup.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: hub-cleanup
@@ -17,128 +15,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-cleanup
     spec:
-      {{- with .Values.kerberoshub.cleanup.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.cleanup.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         - name: hub-cleanup
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
+          image: "{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.cleanup.pullPolicy }}
-          {{- with .Values.kerberoshub.cleanup.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.kerberoshub.cleanup.resources }}
           resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
-          ports:
-            - containerPort: 8080
+            requests:
+              memory: 10Mi
+              cpu: 10m
           env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-cleanup") | nindent 12 }}
-            - name: MODE
-              value: "{{ .Values.kerberoshub.cleanup.mode }}"
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.cleanup.logLevel }}"
-            - name: RUN_INTERVAL_MINUTES
-              value: "{{ .Values.kerberoshub.cleanup.runIntervalMinutes }}"
-            - name: CLEANUP_USERNAMES
-              value: "{{ .Values.kerberoshub.cleanup.cleanupUsernames }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readOnly }}"
             - name: MAX_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.maxDays }}"
-            - name: BATCH_SIZE
-              value: "{{ .Values.kerberoshub.cleanup.batchSize }}"
-            - name: USER_BATCH_SIZE
-              value: "{{ .Values.kerberoshub.cleanup.userBatchSize }}"
-            - name: MAX_USERS_PER_RUN
-              value: "{{ .Values.kerberoshub.cleanup.maxUsersPerRun }}"
-            - name: PROGRESS_EVERY
-              value: "{{ .Values.kerberoshub.cleanup.progressEvery }}"
-            - name: ACTIVE_USER_RESCAN_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.activeUserRescanHours }}"
-            - name: INACTIVE_USER_RESCAN_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.inactiveUserRescanHours }}"
-            - name: READ_TIMEOUT_SECONDS
-              value: "{{ .Values.kerberoshub.cleanup.readTimeoutSeconds }}"
-            - name: DELETE_TIMEOUT_SECONDS
-              value: "{{ .Values.kerberoshub.cleanup.deleteTimeoutSeconds }}"
-            - name: REPORT_INCLUDE_STATS
-              value: "{{ .Values.kerberoshub.cleanup.reportIncludeStats }}"
-            - name: DRY_RUN
-              value: "{{ .Values.kerberoshub.cleanup.dryRun }}"
-            - name: DEBUG
-              value: "{{ .Values.kerberoshub.cleanup.debug }}"
-            - name: GLOBAL_PASS_ENABLED
-              value: "{{ .Values.kerberoshub.cleanup.globalPassEnabled }}"
-            - name: GLOBAL_PASS_INTERVAL_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.globalPassIntervalHours }}"
-            - name: GLOBAL_PASS_DELETE_BUDGET
-              value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
-            - name: DEFAULT_TASK_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
-            - name: AUDIT_EVENT_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
-            - name: WORKFLOW_RUN_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.workflowRunRetentionDays | default "0" }}"
-          {{- if .Values.kerberoshub.extraEnv }}
-          {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-          {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-cleanup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-cleanup
-    service: hub-cleanup
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-cleanup
-{{- end }}
+              value: "30"
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -1,43 +1,50 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.frontend.demoEnabled -}}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-frontend-demo-svc
-  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-frontend-demo-svc
 spec:
   ports:
   - protocol: TCP
     port: 80
-    targetPort: http
+    targetPort: 80
     name: http
   selector:
     app: hub-frontend-demo
-{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
+{{ else }}
+apiVersion: networking.k8s.io/v1
 {{ end }}
 kind: Ingress
 metadata:
   name: hub-frontend-demo-ingress
-  namespace: {{ .Release.Namespace }}
   annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
+
   {{- with .Values.kerberoshub.frontend.demoTls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
-  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
+  rules:
+    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-frontend-demo-svc
+              servicePort: 80
+  {{- else }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
       http:
@@ -49,23 +56,12 @@ spec:
               name: hub-frontend-demo-svc
               port:
                 number: 80
-  {{ else }}
-  rules:
-    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-demo-svc
-              servicePort: 80
-  {{ end }}
-{{ end }}
+  {{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-frontend-demo
-  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.frontend.replicas }}
   selector:
@@ -82,9 +78,6 @@ spec:
       labels:
         app: hub-frontend-demo
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -93,42 +86,28 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: hub-frontend-demo
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
         imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
-        {{- with .Values.kerberoshub.frontend.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberoshub.frontend.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
         ports:
-        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 8080 }}
+        - containerPort: 80
           name: http
         {{- with .Values.kerberoshub.frontend.volumeMounts}}
         volumeMounts:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        - name: SSO_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-        - name: SSO_FORCE_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
+        - name: SSO_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
         - name: TITLE
           value: "{{ .Values.kerberoshub.frontend.title }}"
         - name: LOGO_NAME
           value: "{{ .Values.kerberoshub.frontend.logo }}"
-        - name: ENVIRONMENT
-          value: "demo"
         - name: API_URL
           value: "" # legacy
         - name: NEW_API_URL
@@ -144,10 +123,6 @@ spec:
           value: "true"
         - name: DEMO
           value: "true"
-        - name: MULTI_TENANT
-          value: "{{ .Values.kerberoshub.frontend.multiTenant }}"
-        - name: TENANT_BASE_DOMAIN
-          value: "{{ .Values.kerberoshub.frontend.tenantBaseDomain }}"
 
         # Mqtt (VERNEMQ)
         - name: MQTT_PROTOCOL
@@ -156,24 +131,18 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
-        - name: MQTT_LEGACY_SERVER
-          value: "{{ .Values.mqtt.legacy.host }}"
-        - name: MQTT_LEGACY_PORT
-          value: "{{ .Values.mqtt.legacy.port }}"
-
-        # OpenAI
-        - name: OPENAI_ENABLED
-          value: "{{ .Values.openai.enabled }}"
+        - name: MQTT_USERNAME
+          value: "{{ .Values.mqtt.username }}"
+        - name: MQTT_PASSWORD
+          value: "{{ .Values.mqtt.password }}"
 
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: TURN_USERNAME
+          value: "{{ .Values.turn.username }}"
+        - name: TURN_PASSWORD
+          value: "{{ .Values.turn.password }}"
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -196,217 +165,37 @@ spec:
         # Google maps for using and displaying cameras, sites on a map
         - name: GOOGLEMAPS_KEY
           value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
-        - name: GOOGLEMAPS_PLACES_API
-          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"
-
-        # features > chart
-        - name: CHART_COLORS
-          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
 
         # Zendesk for support
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        - name: HIDE_ADD_AGENT
-          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
-
-        # Navigation links
-        - name: NAVIGATION_LINK_TITLE_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
-        - name: NAVIGATION_LINK_URL_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
-        - name: NAVIGATION_LINK_TITLE_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
-        - name: NAVIGATION_LINK_URL_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
-        - name: NAVIGATION_LINK_TITLE_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
-        - name: NAVIGATION_LINK_URL_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
-        - name: NAVIGATION_LINK_TITLE_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
-        - name: NAVIGATION_LINK_URL_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
-        - name: NAVIGATION_LINK_TITLE_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
-        - name: NAVIGATION_LINK_URL_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
-        - name: CASE_FILTER_ASSIGNEES_DEFAULT
-          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
-
-        # features > general
-        - name: FEATURE_CASE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
-        - name: FEATURE_WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_AUDIT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
-        - name: FEATURE_PASSKEYS_ENABLED
-          value: "{{ .Values.kerberoshub.api.passkeys.enabled }}"
-        - name: FEATURE_DAY_OVERVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
-        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
-        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
-        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
-        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
-        - name: FEATURE_ORGANISATION_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
-        - name: FEATURE_DARK_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
-        - name: FEATURE_SPLASH_SCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
-        - name: FEATURE_LANDING_PAGE
-          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
-
-        # features > internationalization (i18n)
-        - name: FEATURE_I18N_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
-        - name: DEFAULT_LANGUAGE
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
-
-        # features > liveview
-        - name: FEATURE_LIVE_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
-        - name: FEATURE_HLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
-        - name: FEATURE_MOQ_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
-        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
-        - name: MOQ_RELAY_URL
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
-        - name: MOQ_BROADCAST_PREFIX
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
-        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
-        - name: FEATURE_LIVEVIEW_PAGE_SIZE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
-        - name: FEATURE_LIVEVIEW_MAX_STREAMS
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
-
-        # features > devices
-        - name: FEATURE_DEVICES_HIDE_AGENT
-          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
-
-        # features > floorplan
-        - name: FEATURE_FLOORPLAN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
-        # features > map
-        - name: MAP_TILE_URL_LIGHT
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
-        - name: MAP_TILE_URL_DARK
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
-        - name: MAP_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
-
-        - name: COLOR_TRACK_BOX
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
-        - name: COLOR_TRACK_BOX_HOVER
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
-        - name: COLOR_TRACK_BOX_DRAWING
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
-        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
-        - name: COLOR_DEVICE_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
-        - name: COLOR_DEVICE_INACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
-        - name: COLOR_DEVICE_IDLE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
-        - name: COLOR_DEVICE_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
-        - name: COLOR_DEVICE_MARKER_BORDER
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
-
-        # features > video edits
-        - name: FEATURE_VIDEO_EDITS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
-
-        # features > face redaction 
-        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
-        
-        # features > media
-        - name: FEATURE_MEDIA_FORWARD_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.forward.enabled }}"
-        - name: FEATURE_MEDIA_DETAIL_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.detail.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
-          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
-        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
-        
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
-        {{- end }}
-      {{- end }}
+        # Titles and descriptions on pages
+        - name: LOGIN_DESCRIPTION
+          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
+        - name: LOGIN_COPYRIGHT
+          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
+        - name: PAGE_DASHBOARD_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
+        - name: PAGE_DASHBOARD_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
+        - name: PAGE_LATESTEVENTS_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
+        - name: PAGE_LATESTEVENTS_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
+        - name: PAGE_LIVESTREAM_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
+        - name: PAGE_LIVESTREAM_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
+        - name: PAGE_MEDIA_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
+        - name: PAGE_MEDIA_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
+        - name: PAGE_DASHBOARD_CPU_USAGE
+          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
+        - name: PAGE_DASHBOARD_FPS
+          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
+        - name: PAGE_DASHBOARD_MLA
+          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
+        - name: PAGE_DASHBOARD_OBJECTS
+          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -1,152 +1,88 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{- if .Values.kerberoshub.frontend.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-frontend-svc
-  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-frontend-svc
 spec:
   ports:
   - protocol: TCP
     port: 80
-    targetPort: http
+    targetPort: 80
     name: http
   selector:
     app: hub-frontend
-{{- end }}
-{{ if ne .Values.ingress "" }}
 ---
-{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{- else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
-{{- end }}
+{{ else }}
+apiVersion: networking.k8s.io/v1
+{{ end }}
 kind: Ingress
 metadata:
   name: hub-frontend-ingress
-  namespace: {{ .Release.Namespace }}
   annotations:
-    {{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
-    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
-    {{- end }}
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
+
   {{- with .Values.kerberoshub.frontend.tls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.url }}"
       http:
         paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
     {{- if .Values.kerberoshub.frontend.legacyUrl }}
     - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
       http:
         paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
     {{- end }}
-    {{- range .Values.kerberoshub.frontend.domains }}
-    - host: "{{ . }}"
-      http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
-    {{- end }}
-
   {{- else }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.url }}"
       http:
         paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
     {{- if .Values.kerberoshub.frontend.legacyUrl }}
     - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
       http:
         paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
-    {{- end }}
-    {{- range .Values.kerberoshub.frontend.domains }}
-    - host: "{{ . }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
     {{- end }}
   {{- end }}
-{{- end }}
-{{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
----
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: oauth2-proxy-frontend
-  namespace: kube-system
-  annotations:
-    {{- if eq .Values.ingress "nginx" }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  rules:
-    - host: "{{ .Values.kerberoshub.frontend.url }}"
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: oauth2-proxy
-                port:
-                  number: 4180
-  tls:
-    - hosts:
-        - "{{ .Values.kerberoshub.frontend.url }}"
-      secretName:
-{{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-frontend
-  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.frontend.replicas }}
   selector:
@@ -163,9 +99,6 @@ spec:
       labels:
         app: hub-frontend
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -174,44 +107,28 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: hub-frontend
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
         imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
-        {{- with .Values.kerberoshub.frontend.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberoshub.frontend.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
         ports:
-        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 8080 }}
+        - containerPort: 80
           name: http
         {{- with .Values.kerberoshub.frontend.volumeMounts}}
         volumeMounts:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberoshub.frontend.logLevel }}"
-        - name: SSO_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-        - name: SSO_FORCE_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
+        - name: SSO_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
         - name: TITLE
           value: "{{ .Values.kerberoshub.frontend.title }}"
         - name: LOGO_NAME
           value: "{{ .Values.kerberoshub.frontend.logo }}"
-        - name: ENVIRONMENT
-          value: "{{ .Values.environment }}"
         - name: API_URL
           value: "" # legacy
         - name: NEW_API_URL
@@ -239,24 +156,22 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: MQTT_USERNAME
+          value: "{{ .Values.mqtt.username }}"
+        - name: MQTT_PASSWORD
+          value: "{{ .Values.mqtt.password }}"
         - name: MQTT_LEGACY_SERVER
           value: "{{ .Values.mqtt.legacy.host }}"
         - name: MQTT_LEGACY_PORT
           value: "{{ .Values.mqtt.legacy.port }}"
 
-        # OpenAI
-        - name: OPENAI_ENABLED
-          value: "{{ .Values.openai.enabled }}"
-
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: TURN_USERNAME
+          value: "{{ .Values.turn.username }}"
+        - name: TURN_PASSWORD
+          value: "{{ .Values.turn.password }}"
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -279,229 +194,37 @@ spec:
         # Google maps for using and displaying cameras, sites on a map
         - name: GOOGLEMAPS_KEY
           value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
-        - name: GOOGLEMAPS_PLACES_API
-          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"
 
         # Zendesk for support
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        - name: HIDE_ADD_AGENT
-          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
-
-        # Navigation links
-        - name: NAVIGATION_LINK_TITLE_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
-        - name: NAVIGATION_LINK_URL_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
-        - name: NAVIGATION_LINK_TITLE_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
-        - name: NAVIGATION_LINK_URL_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
-        - name: NAVIGATION_LINK_TITLE_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
-        - name: NAVIGATION_LINK_URL_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
-        - name: NAVIGATION_LINK_TITLE_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
-        - name: NAVIGATION_LINK_URL_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
-        - name: NAVIGATION_LINK_TITLE_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
-        - name: NAVIGATION_LINK_URL_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
-        - name: CASE_FILTER_ASSIGNEES_DEFAULT
-          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
-
-        # features > general
-        - name: FEATURE_CASE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
-        - name: FEATURE_WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_AUDIT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
-        - name: FEATURE_PASSKEYS_ENABLED
-          value: "{{ .Values.kerberoshub.api.passkeys.enabled }}"
-        - name: FEATURE_DAY_OVERVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
-        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
-        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
-        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
-        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
-        - name: FEATURE_ORGANISATION_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
-        - name: FEATURE_DARK_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
-        - name: FEATURE_SPLASH_SCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
-        - name: FEATURE_LANDING_PAGE
-          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
-
-        # features > internationalization (i18n)
-        - name: FEATURE_I18N_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
-        - name: DEFAULT_LANGUAGE
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
-
-        # features > liveview
-        - name: FEATURE_DEFAULT_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
-        - name: FEATURE_LIVE_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
-        - name: FEATURE_HLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
-        - name: FEATURE_MOQ_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
-        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
-        - name: MOQ_RELAY_URL
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
-        - name: MOQ_BROADCAST_PREFIX
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
-        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
-        - name: FEATURE_LIVEVIEW_PAGE_SIZE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
-        - name: FEATURE_LIVEVIEW_MAX_STREAMS
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
-
-        # features > devices
-        - name: FEATURE_DEVICES_HIDE_AGENT
-          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
-
-        # features > floorplan
-        - name: FEATURE_FLOORPLAN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
-
-        # features > map
-        - name: MAP_TILE_URL_LIGHT
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
-        - name: MAP_TILE_URL_DARK
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
-        - name: MAP_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
-
-        - name: COLOR_TRACK_BOX
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
-        - name: COLOR_TRACK_BOX_HOVER
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
-        - name: COLOR_TRACK_BOX_DRAWING
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
-        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
-        - name: COLOR_DEVICE_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
-        - name: COLOR_DEVICE_INACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
-        - name: COLOR_DEVICE_IDLE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
-        - name: COLOR_DEVICE_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
-        - name: COLOR_DEVICE_MARKER_BORDER
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
-
-        # features > chart
-        - name: CHART_COLORS
-          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
-        - name: COLOR_CHART_SELECTION_FILL
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
-        - name: COLOR_CHART_SELECTION_STROKE
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionStroke }}"
-        - name: COLOR_CHART_GRID_STROKE
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartGridStroke }}"
-
-        # features > video edits
-        - name: FEATURE_VIDEO_EDITS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
-
-        # features > face redaction 
-        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
-        
-        # features > media
-        - name: FEATURE_MEDIA_FORWARD_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.forward.enabled }}"
-        - name: FEATURE_MEDIA_DETAIL_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.detail.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
-          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
-        - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
-        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
-        
-
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
-        {{- end }}
-      {{- end }}
+        # Titles and descriptions on pages
+        - name: LOGIN_DESCRIPTION
+          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
+        - name: LOGIN_COPYRIGHT
+          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
+        - name: PAGE_DASHBOARD_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
+        - name: PAGE_DASHBOARD_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
+        - name: PAGE_LATESTEVENTS_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
+        - name: PAGE_LATESTEVENTS_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
+        - name: PAGE_LIVESTREAM_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
+        - name: PAGE_LIVESTREAM_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
+        - name: PAGE_MEDIA_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
+        - name: PAGE_MEDIA_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
+        - name: PAGE_DASHBOARD_CPU_USAGE
+          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
+        - name: PAGE_DASHBOARD_FPS
+          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
+        - name: PAGE_DASHBOARD_MLA
+          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
+        - name: PAGE_DASHBOARD_OBJECTS
+          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-monitor-device
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.monitordevice.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: hub-monitor-device
@@ -17,68 +15,34 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-monitor-device
     spec:
-      {{- with .Values.kerberoshub.monitordevice.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
         - name: hub-monitor-device
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
+          image: "{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.monitordevice.pullPolicy }}
-          {{- with .Values.kerberoshub.monitordevice.securityContext }}
-          securityContext:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.kerberoshub.monitordevice.resources }}
           resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
+            requests:
+              memory: 10Mi
+              cpu: 10m
           env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
-            - name: DEVICE_SCAN_INTERVAL_SECONDS
-              value: "{{ .Values.kerberoshub.monitordevice.scanIntervalSeconds | default 60 }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -86,28 +50,11 @@ spec:
               value: "{{ .Values.email.from }}"
             - name: EMAIL_FROM_DISPLAYNAME
               value: "{{ .Values.email.displayName }}"
-
+              
             # Mail templates
             - name: DEVICE_TEMPLATE
               value: "{{ .Values.email.templates.device }}"
-            - name: DEVICE_TITLE
-              value: "{{ .Values.email.templates.deviceTitle }}"
-            - name: DEVICE_GROUP_TEMPLATE
-              value: "{{ .Values.email.templates.deviceGroup | default "device_group" }}"
-            - name: DEVICE_GROUP_TITLE
-              value: "{{ .Values.email.templates.deviceGroupTitle | default "[Device] Several cameras changed status" }}"
-            {{- with .Values.email.templates.recording }}
-            - name: RECORDING_TEMPLATE
-              value: {{ . | quote }}
-            {{- end }}
-            {{- with .Values.email.templates.recordingTitle }}
-            - name: RECORDING_TITLE
-              value: {{ . | quote }}
-            {{- end }}
-            # Base URL for the link in grouped device notifications.
-            - name: PUBLIC_URL
-              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
-
+              
             # - Plain SMTP
             - name: SMTP_SERVER
               value: "{{ .Values.email.smtp.server }}"
@@ -117,13 +64,3 @@ spec:
               value: "{{ .Values.email.smtp.username }}"
             - name: SMTP_PASSWORD
               value: "{{ .Values.email.smtp.password }}"
-
-            # Mailgun
-            - name: MAILGUN_DOMAIN
-              value: "{{ .Values.email.mailgun.domain }}"
-            - name: MAILGUN_API_KEY
-              value: "{{ .Values.email.mailgun.apikey }}"
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-        {{- end }}
-      {{- end }}

charts/hub/templates/kerberos-hub/hub-oauth2-proxy.yaml

@@ -1,81 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.oauth2Proxy.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: kube-system
-  labels:
-    k8s-app: oauth2-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      k8s-app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        k8s-app: oauth2-proxy
-    spec:
-      {{- with .Values.kerberoshub.oauth2Proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.oauth2Proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - args:
-            - --provider=github
-            - --email-domain=*
-            - --upstream=file:///dev/null
-            - --http-address=0.0.0.0:4180
-            - --skip-auth-preflight=true
-          {{- with .Values.kerberoshub.oauth2Proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientId }}"
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientSecret }}"
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.cookieSecret }}"
-            - name: OAUTH2_PROXY_GITHUB_ORG
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.organization }}"
-            - name: OAUTH2_PROXY_GITHUB_TEAM
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.team }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-          image: quay.io/oauth2-proxy/oauth2-proxy:latest
-          imagePullPolicy: Always
-          name: oauth2-proxy
-          ports:
-            - containerPort: 4180
-              protocol: TCP
-          resources:
-            limits:
-              cpu: 100m
-              memory: 50Mi
-            requests:
-              cpu: 100m
-              memory: 50Mi
----
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    k8s-app: oauth2-proxy
-  name: oauth2-proxy
-  namespace: kube-system
-spec:
-  ports:
-    - name: http
-      port: 4180
-      protocol: TCP
-      targetPort: 4180
-  selector:
-    k8s-app: oauth2-proxy
-{{- end -}}

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-reactivate-subscription
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.reactivate.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: hub-reactivate-subscription
@@ -17,56 +15,25 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-reactivate-subscription
     spec:
-      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.reactivate.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        - name: regcred
       containers:
         - name: hub-reactivate-subscription
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
+          image: "{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
           env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-reactivatesubscriptions") | nindent 12 }}
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
             - name: AWS_ACCESS_KEY_ID
               value: "{{ .Values.kerberoshub.api.aws.accessKey }}"
             - name: AWS_SECRET_ACCESS_KEY
               value: "{{ .Values.kerberoshub.api.aws.secretKey }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-{{- end }}

charts/hub/templates/kerberos-hub/hub-serviceaccount.yaml

@@ -1,13 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui") (eq .Values.mode "pipeline")) .Values.kerberoshub.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{- toYaml .Values.kerberoshub.serviceAccount.annotations | nindent 4 }}
-  {{- with .Values.kerberoshub.serviceAccount.labels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -1,154 +0,0 @@
-{{/*
-Reserve every effective identity, including disabled definitions, so enabling a
-workflow later cannot silently alias another workflow's runs or references.
-*/}}
-{{- define "kerberoshub.workflows.validateDefinitions" -}}
-{{- $identities := dict -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- $id := sha256sum $name | trunc 24 -}}
-{{- if hasKey $wf "id" -}}
-{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
-{{- if not (kindIs "string" $wf.id) -}}
-{{- fail $invalid -}}
-{{- end -}}
-{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
-{{- fail $invalid -}}
-{{- end -}}
-{{- $id = lower $wf.id -}}
-{{- end -}}
-{{- if hasKey $identities $id -}}
-{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
-{{- end -}}
-{{- $_ := set $identities $id $name -}}
-{{- end -}}
-{{- include "kerberoshub.workflows.validateSystemTags" . -}}
-{{- end -}}
-
-{{/*
-Guard the definitions that can select devices by system tag. The engine reads
-JSON keys case-insensitively and ignores unknown ones, so a misspelled or
-re-cased key silently changes what a definition selects (a dropped
-systemTags scope makes a global workflow run on every device). Therefore:
-  - definitions and triggers may only use the keys the engine knows, spelled
-    exactly (definition: id, enabled, triggers, stages; trigger: the
-    models.WorkflowTrigger fields);
-  - while deviceTags.system.enabled is false, no definition may mention system
-    tags anywhere (trigger systemTags, or a device.systemTags condition at any
-    depth, in triggers, shared conditions or stage needs), matched
-    case-insensitively on the whole definition;
-  - every system tag a trigger selects must be in deviceTags.system.catalog,
-    so a typo fails rendering instead of never matching a device.
-Disabled definitions are checked too, so enabling one cannot fail later.
-*/}}
-{{- define "kerberoshub.workflows.validateSystemTags" -}}
-{{- include "kerberoshub.deviceTags.system.validate" . -}}
-{{- $catalog := dict -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $_ := set $catalog (toString $tag.key) true -}}
-{{- end -}}
-{{- $enabled := include "kerberoshub.deviceTags.system.enabled" . -}}
-{{- $definitionKeys := list "id" "enabled" "triggers" "stages" -}}
-{{- $triggerKeys := list "type" "edgeId" "sharedConditions" "devices" "siteIds" "groupIds" "systemTags" "classifications" "conditionMode" "conditions" "weeklySchedule" "surfaces" -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- if $wf -}}
-{{- if not (kindIs "map" $wf) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q] must be an object" $name) -}}
-{{- end -}}
-{{- if and (not $enabled) (contains "systemtags" (lower (toJson $wf))) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q] selects devices by system tag (systemTags or a device.systemTags condition), but deviceTags.system.enabled is false" $name) -}}
-{{- end -}}
-{{- range $key, $_ := $wf -}}
-{{- if not (has $key $definitionKeys) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored" $name $key (join ", " $definitionKeys)) -}}
-{{- end -}}
-{{- end -}}
-{{- range $i, $trigger := ($wf.triggers | default list) -}}
-{{- if not (kindIs "map" $trigger) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d] must be an object" $name $i) -}}
-{{- end -}}
-{{- range $key, $_ := $trigger -}}
-{{- if not (has $key $triggerKeys) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored and widen the trigger" $name $i $key (join ", " $triggerKeys)) -}}
-{{- end -}}
-{{- end -}}
-{{- range $tag := ($trigger.systemTags | default list) -}}
-{{- if not (hasKey $catalog (toString $tag)) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d].systemTags: %q is not in deviceTags.system.catalog; add it to the system tag catalog" $name $i (toString $tag)) -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
-JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
-This is the engine's boot-loaded configuration source and deployment stage
-catalog: several distinct config workflows can run over one recording — each
-opens its own run and dispatches only its own stages. Organisation-scoped
-database workflows are discovered separately at runtime.
-
-Each enabled definition contributes one workflow object:
-  id        optional explicit stable identity, normalized to lowercase. Omitted
-            for legacy definitions; their effective id is SHA256(name)[:24].
-  name      the map key (mutable display name when an explicit id is supplied).
-  enabled   always true here (a disabled definition is skipped entirely).
-  source    "config" — provenance marking a Helm-defined, deployment-global,
-            ops-managed workflow (read-only in the API, no owning organisation).
-  triggers  how a run OPENS. Defaults to a single bare automatic trigger
-            (opens for every recording); narrow with device/schedule triggers.
-            Per-stage `needs` (below) decide which stages then FIRE.
-  stages    the executable stage set, each contributing the same routing
-            descriptor the stageRegistry emits:
-              operation  the stage's operation (unique within the workflow).
-              dispatch   "always" (default) | "conditional".
-              queue      from the matching services.<operation>.queue
-                         (authoritative; omitted when unset so the engine
-                         derives "kcloud-<operation>-queue.fifo").
-              needs      conditional stages only: upstream dependencies, each
-                         {operation?, condition?}, carried through verbatim.
-              needsMode  conditional stages: "any" (default) | "all".
-*/}}
-{{- define "kerberoshub.workflows.workflowDefinitions" -}}
-{{- include "kerberoshub.workflows.validateDefinitions" . -}}
-{{- $defs := list -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- if $wf.enabled -}}
-{{- $stages := list -}}
-{{- range $stage := $wf.stages -}}
-{{- $op := $stage.operation -}}
-{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
-{{- $service := index $services $op -}}
-{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
-{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
-{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
-{{- $stages = append $stages $entry -}}
-{{- end -}}
-{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
-{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
-{{- $defs = append $defs $def -}}
-{{- end -}}
-{{- end -}}
-{{- $defs | toJson -}}
-{{- end -}}
-
-{{/*
-Expose the deployment's operation→queue catalog to API producers that seed
-embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
-are enabled for internal flows but are absent from user-visible workflow
-definitions. The workflows engine remains authoritative for dispatch; producers
-use this only to embed the same queue on a synthetic stage.
-*/}}
-{{- define "kerberoshub.workflows.stageQueues" -}}
-{{- $queues := dict -}}
-{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
-{{- if ne $operation "workflows" -}}
-{{- with $service.queue -}}
-{{- $_ := set $queues $operation . -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- $queues | toJson -}}
-{{- end -}}

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -1,177 +0,0 @@
-{{- /*
-  Generic workflow-stage worker.
-
-  Renders a Deployment + Service for every enabled worker under
-  kerberoshub.services.<name> other than the `workflows` engine itself. A custom
-  stage joins the pipeline by values alone — declare its worker here and route to
-  it from a kerberoshub.workflows.definitions stage of the same operation; no
-  per-stage template is needed.
-
-  Every stage worker receives the same connection contract; the only value that
-  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
-  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
-  a worker outside the chart instead, leave services.<name>.enabled unset (or
-  false) and point its workflow stage at the queue you publish.
-
-  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
-  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
-  redaction) declares its destination provider with the named field
-  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
-  read-only stage omits it and gets no provider env.
-
-  Worker-specific settings go in services.<name>.env (plain values) and
-  services.<name>.secretEnv (references to keys in an existing Secret).
-*/ -}}
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-{{- $root := . -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $svc := $services -}}
-{{- if and (ne $name "workflows") $svc $svc.enabled -}}
-{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
----
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-spec:
-  replicas: {{ $svc.replicas | default 1 }}
-  selector:
-    matchLabels:
-      app: hub-{{ $name }}
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: hub-{{ $name }}
-    spec:
-      {{- with $svc.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if $root.Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with $root.Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-{{ $name }}
-        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
-        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
-        {{- with $svc.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with $svc.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with $svc.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ $svc.logLevel | default "info" }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ $root.Values.queueProvider }}"
-
-        # The queue this stage worker consumes dispatched "{{ $name }}" stages
-        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
-        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
-        # any stage that needs "{{ $name }}" can fire).
-        - name: {{ $queueEnv }}
-          value: "{{ $svc.queue }}"
-        - name: WORKFLOWS_QUEUE
-          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ $root.Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ $root.Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ $root.Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ $root.Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials this stage uses to fetch
-        # the media it operates on.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ $root.Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ $root.Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ $root.Values.kerberosvault.secretkey }}"
-        {{- with $svc.storageProvider }}
-        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
-        # that write an artefact back (e.g. redaction) set services.<name>.
-        # storageProvider; read-only stages omit it and get no provider env.
-        - name: KERBEROS_STORAGE_PROVIDER
-          value: {{ . | quote }}
-        {{- end }}
-        {{- if $root.Values.opentelemetry.enabled }}
-
-        # OpenTelemetry tracing: the stage continues the engine's dispatch span
-        # (the run's traceparent) and follows its sampling decision.
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ $root.Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $root | trim | nindent 8 }}
-        {{- end }}
-
-        # Per-stage tuning knobs. Any key/value under services.<name>.env is
-        # rendered verbatim as container env, so a worker can be tuned from
-        # values without a per-stage template. These override the image's own
-        # ENV defaults; the fixed contract env above is not overridable here.
-        {{- range $key, $value := $svc.env }}
-        - name: {{ $key }}
-          value: {{ $value | quote }}
-        {{- end }}        {{- with $svc.secretEnv }}
-
-        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
-        # container env var to a key in an existing Kubernetes Secret
-        # ({name, key}), so credentials such as a model API key stay out of
-        # values. The Secret must exist in the release namespace.
-        {{- range $key, $ref := . }}
-        - name: {{ $key }}
-          valueFrom:
-            secretKeyRef:
-              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
-              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
-        {{- end }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-  labels:
-    app: hub-{{ $name }}
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-{{ $name }}
-{{ end -}}
-{{- end }}
-{{- end }}

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -1,145 +0,0 @@
-{{- include "kerberoshub.workflows.validateDefinitions" . -}}
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
-  selector:
-    matchLabels:
-      app: hub-workflows
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: hub-workflows
-    spec:
-      {{- with .Values.kerberoshub.services.workflows.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.services.workflows.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-workflows
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
-        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
-        {{- with .Values.kerberoshub.services.workflows.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberoshub.services.workflows.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
-        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-workflows") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
-        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
-        # trigger and executable stages, assembled from the enabled definitions
-        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
-        # Definitions are the engine's boot-loaded config source and deployment
-        # stage catalog. Organisation-scoped database workflows are read per
-        # recording; an in-cluster engine refuses to start only when both the
-        # config definitions and the stage-queue catalog below are empty.
-        - name: WORKFLOWS_QUEUE
-          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
-        - name: WORKFLOW_DEFINITIONS
-          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
-        # Operation→queue catalog so DB workflows reach workers no config workflow references.
-        - name: WORKFLOW_STAGE_QUEUES
-          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials a dispatched stage worker
-        # uses to fetch the media. Per-recording vault overrides (site/account)
-        # are resolved at dispatch time from the database.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-workflows
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-workflows
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-analysis
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.analysis.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-analysis
@@ -21,61 +15,37 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-analysis
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.analysis.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-analysis
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
+        image: "{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.analysis.pullPolicy }}
-        {{- with .Values.kerberospipeline.analysis.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-analysis") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -88,83 +58,10 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # When true, analysis tees the classify result to the hub-workflows
-        # service in parallel with the throttler/notification tail (which still
-        # runs unchanged). Kept in sync with whether the workflows service runs.
-        - name: WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.workflows.enabled }}"
-
-        # Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
-        # taken from the workflows service's queue so analysis and the engine
-        # always agree on the queue name (no drift).
-        - name: WORKFLOWS_QUEUE
-          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
-          
         # Kerberos Vault
         - name: KERBEROS_STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
         - name: KERBEROS_STORAGE_ACCESS_KEY
           value: "{{ .Values.kerberosvault.accesskey }}"
         - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Sprites
-        - name: SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-
-        # Dominant colors
-        - name: DOMINANTCOLOR_ENABLED
-          value: "{{ .Values.kerberospipeline.dominantColor.enabled }}"
-
-        # Thumbnail regeneration from classified frames (opt-in)
-        - name: THUMBNAIL_REGENERATION_ENABLED
-          value: {{ .Values.kerberospipeline.analysis.thumbnailRegeneration.enabled | default false | quote }}
-        # Skip regeneration when the object first appears within this many seconds
-        - name: THUMBNAIL_REGENERATION_MIN_SECONDS
-          {{- $regeneration := .Values.kerberospipeline.analysis.thumbnailRegeneration }}
-          value: {{ ternary $regeneration.minSeconds 3 (hasKey $regeneration "minSeconds") | quote }}
-
-        # In-memory cache for hot-path MongoDB lookups
-        - name: DB_CACHE_ENABLED
-          value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
-        - name: DB_CACHE_TTL
-          value: {{ .Values.kerberospipeline.analysis.dbCache.ttl | default "5m" | quote }}
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-analysis
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-analysis
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-analysis
-{{- end }}
+          value: "{{ .Values.kerberosvault.secretkey }}"

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-counting
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.counting.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-counting
@@ -24,44 +18,19 @@ spec:
       labels:
         app: pipe-counting
     spec:
-      {{- with .Values.kerberospipeline.counting.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.counting.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.counting.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-counting
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
+        image: "{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.counting.pullPolicy }}
-        {{- with .Values.kerberospipeline.counting.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.counting.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.counting.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.counting.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -77,43 +46,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-counting
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-counting
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-counting
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -1,15 +1,9 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.dominantColor.enabled true) -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-dominantcolor
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-dominantcolor
@@ -24,44 +18,19 @@ spec:
       labels:
         app: pipe-dominantcolor
     spec:
-      {{- with .Values.kerberospipeline.dominantColor.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.dominantColor.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.dominantColor.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-dominantcolor
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
+        image: "{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.dominantColor.pullPolicy }}
-        {{- with .Values.kerberospipeline.dominantColor.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.dominantColor.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.dominantColor.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.dominantColor.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -77,43 +46,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-dominantcolor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-dominantcolor
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-dominantcolor
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-event
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.event.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-event
@@ -21,65 +15,37 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-event
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.event.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-event
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
+        image: "{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.event.pullPolicy }}
-        {{- with .Values.kerberospipeline.event.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.event.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        ports:
-          - containerPort: 8080
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-event") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.event.logLevel }}"
-        - name: READ_ONLY
-          value: "{{ .Values.readonly }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -90,43 +56,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-event
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-event
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-event
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -1,164 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-export
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberospipeline.export.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-export
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: pipe-export
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.export.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-export
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.export.repository }}:{{ .Values.kerberospipeline.export.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.export.pullPolicy }}
-        {{- with .Values.kerberospipeline.export.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.export.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
-        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-export") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.export.logLevel }}"
-        {{- if .Values.kerberospipeline.export.playerAssetsPath }}
-        - name: PLAYER_ASSETS_PATH
-          value: "{{ .Values.kerberospipeline.export.playerAssetsPath }}"
-        {{- end }}
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-          
-        # Kerberos Vault (Main instance, within Kerberos Hub you can assign additional Vaults to sites).
-        - name: STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: STORAGE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Kerberos Vault: archiving credentials. When creating a task, the underlying recording will be
-        # copied to this storage provider, using the specific account credentials, for deletion/retention.
-        - name: STORAGE_ARCHIVE_PROVIDER
-          value: "{{ .Values.kerberosvault.archive.provider }}"
-        - name: STORAGE_ARCHIVE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.archive.accesskey }}"
-        - name: STORAGE_ARCHIVE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.archive.secretkey }}"
-
-        # Sprites
-        - name: SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        # Thumbnails
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-export
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-export
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-export
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-monitor
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.monitor.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-monitor
@@ -21,58 +15,32 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-monitor
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.monitor.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-monitor
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
+        image: "{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.monitor.pullPolicy }}
-        {{- with .Values.kerberospipeline.monitor.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-monitor") | nindent 8 }}
-        # Application
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
-
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+  
         # Queue      
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -89,16 +57,6 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
         # Mail settings
         - name: MAIL_PROVIDER
           value: "{{ .Values.email.provider }}"
@@ -122,32 +80,3 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-monitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-monitor
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-monitor
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-notify-test
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberospipeline.notifyTest.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-notify-test
@@ -17,57 +15,43 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify-test
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.notifyTest.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
       - name: pipe-notify-test
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
+        image: "{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.notifyTest.pullPolicy }}
-        {{- with .Values.kerberospipeline.notifyTest.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
+          requests:
+            memory: 10Mi
+            cpu: 10m
         {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification-test") | nindent 8 }}
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
         # Kerberos Vault
         - name: STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
@@ -88,16 +72,6 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
         # Mail settings
         - name: MAIL_PROVIDER
           value: "{{ .Values.email.provider }}"
@@ -105,8 +79,6 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
-        - name: PUBLIC_URL
-          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates
         - name: DETECT_TEMPLATE
@@ -121,32 +93,3 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-notify-test
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-notify-test
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-notify-test
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-notify
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.notify.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-notify
@@ -21,69 +15,44 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify
     spec:
-      {{- with .Values.kerberospipeline.notify.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
       {{- with .Values.kerberospipeline.notify.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
       - name: pipe-notify
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
+        image: "{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.notify.pullPolicy }}
-        {{- with .Values.kerberospipeline.notify.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.notify.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
+          requests:
+            memory: 10Mi
+            cpu: 10m
         {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.notify.logLevel }}"
-        - name: NOTIFICATION_EXPIRY_MINUTES
-          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
-        # Queue
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
+        - name: MAIL_PROVIDER
+          value: "{{ .Values.email.provider }}"
+
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
 
         # Kafka settings
         - name: KAFKA_BROKER
@@ -97,24 +66,6 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        - name: AUDIT_ENABLED
-          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
-        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
-        - name: AUDIT_QUEUE
-          value: {{ .Values.audit.intake.queue | quote }}
-        - name: AUDIT_DEADLETTER_QUEUE
-          value: {{ .Values.audit.intake.deadletterQueue | quote }}
-        {{- end }}
-
         # Kerberos Vault
         - name: STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
@@ -130,14 +81,10 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
-        - name: PUBLIC_URL
-          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates 
         - name: DETECT_TEMPLATE
           value: "{{ .Values.email.templates.detection }}"
-        - name: ALERT_TITLE
-          value: "{{ .Values.email.templates.alertTitle }}"
 
         # SMTP
         - name: SMTP_SERVER
@@ -154,53 +101,3 @@ spec:
           value: "{{ .Values.email.mailgun.domain }}"
         - name: MAILGUN_API_KEY
           value: "{{ .Values.email.mailgun.apikey }}"
-
-        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-        # This will lower storage in mongodb.
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-      
-        # There is an option to store the sprites in a storage provider in Kerberos Vault.
-        - name: VAULT_SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-notify
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-notify
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-notify
-{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-sequence
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.sequence.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-sequence
@@ -21,61 +15,37 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-sequence
     spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.sequence.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-sequence
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
+        image: "{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.sequence.pullPolicy }}
-        {{- with .Values.kerberospipeline.sequence.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.sequence.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -86,43 +56,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-sequence
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-sequence
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-sequence
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -1,138 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.sprite.enabled true) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-sprite
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  replicas: {{ .Values.kerberospipeline.sprite.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-sprite
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: pipe-sprite
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sprite.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sprite.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-sprite
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sprite.repository }}:{{ .Values.kerberospipeline.sprite.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.sprite.pullPolicy }}        
-        {{- with .Values.kerberospipeline.sprite.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.sprite.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.sprite.logLevel }}"
-        {{ if .Values.isPrivate }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "true"
-        {{ else }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "false"
-        {{ end }}
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        {{- with .Values.kerberospipeline.sprite.prefetchCount }}
-        - name: RABBITMQ_PREFETCH_COUNT
-          value: {{ . | quote }}
-        {{- end }}
-
-        # There is an option to store the sprites in a storage provider in Kerberos Vault.
-        - name: VAULT_SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        - name: VAULT_SPRITE_INTERVAL
-          value: "{{ .Values.kerberospipeline.sprite.interval }}"
-        - name: VAULT_SPRITE_WIDTH
-          value: "{{ .Values.kerberospipeline.sprite.width }}"
-        - name: VAULT_SPRITE_HEIGHT
-          value: "{{ .Values.kerberospipeline.sprite.height }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-sprite
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-sprite
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-sprite
-{{ end }}

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-throttler
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.throttler.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-throttler
@@ -21,69 +15,37 @@ spec:
       maxSurge: 1
   template:
     metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-throttler
     spec:
-      {{- with .Values.kerberospipeline.throttler.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.throttler.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-throttler
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
+        image: "{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.throttler.pullPolicy }}
-        {{- with .Values.kerberospipeline.throttler.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.throttler.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-throttler") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -94,43 +56,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-throttler
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-throttler
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-throttler
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-thumbnail
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
+  replicas: 1
   selector:
     matchLabels:
       app: pipe-thumbnail
@@ -24,51 +18,19 @@ spec:
       labels:
         app: pipe-thumbnail
     spec:
-      {{- with .Values.kerberospipeline.thumbnail.podSecurityContext }}
-      securityContext:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.thumbnail.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.thumbnail.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
       containers:
       - name: pipe-thumbnail
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
+        image: "{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.thumbnail.pullPolicy }}
-        {{- with .Values.kerberospipeline.thumbnail.securityContext }}
-        securityContext:
-          {{- toYaml . | nindent 10 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.thumbnail.resources }}
         resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.thumbnail.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
         env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.thumbnail.logLevel }}"
-        {{ if .Values.isPrivate }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "true"
-        {{ else }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "false"
-        {{ end }}
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -84,69 +46,4 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        {{- with .Values.kerberospipeline.thumbnail.prefetchCount }}
-        - name: RABBITMQ_PREFETCH_COUNT
-          value: {{ . | quote }}
-        {{- end }}
-
-        # Thumbnail generation
-        - name: THUMBNAIL_QUALITY
-          value: "{{ .Values.kerberospipeline.thumbnail.quality }}"
-        - name: THUMBNAIL_WIDTH
-          value: "{{ .Values.kerberospipeline.thumbnail.width }}"
-        - name: THUMBNAIL_HEIGHT
-          value: "{{ .Values.kerberospipeline.thumbnail.height }}"
-        - name: THUMBNAIL_SKIP_NON_KEYFRAMES
-          value: "{{ .Values.kerberospipeline.thumbnail.skipNonKeyframes }}"
-
-        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-        # This will lower storage in mongodb.
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
-
----
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-thumbnail
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-thumbnail
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-thumbnail
-{{- end }}
+          value: "{{ .Values.kafka.security }}"

charts/hub/templates/kerberos-pipeline/servicemonitor.yaml

@@ -1,18 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-metrics-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: pipe
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: pipe
-  endpoints:
-    - port: hub-metrics
-      interval: 15s
-      path: /metrics
-{{- end }}

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -0,0 +1,56 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vault-forwarder
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: vault-forwarder
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: vault-forwarder
+    spec:
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: vault-forwarder
+          image: "{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
+          resources:
+            requests:
+              memory: 10Mi
+              cpu: 10m
+          env:
+            - name: ITERATION_SPEED
+              value: "5"
+            - name: BUFFER_TIME
+              value: "3"
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+
+            # Mqtt (VERNEMQ)
+            - name: MQTT_URI
+              value: "{{ .Values.mqtt.host }}"
+            - name: MQTT_USERNAME
+              value: "{{ .Values.mqtt.username }}"
+            - name: MQTT_PASSWORD
+              value: "{{ .Values.mqtt.password }}"

charts/hub/templates/kerberos-vault/vault-proxy.yaml

@@ -0,0 +1,58 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: vault-proxy
+spec:
+  replicas: 3
+  selector:
+    matchLabels:
+      app: vault-proxy
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: vault-proxy
+    spec:
+      imagePullSecrets:
+        - name: regcred
+      containers:
+        - name: vault-proxy
+          image: "{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
+          imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
+          ports:
+            - containerPort: 8080
+              name: http
+          env:
+            # Kerberos Hub API
+            - name: KERBEROS_API_CHECK_SUBSCRIPTION
+              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
+            # Kerberos Vault
+            - name: KSTORAGE_URI
+              value: "{{ .Values.kerberosvault.uri }}/storage"
+            - name: KSTORAGE_ACCESSKEY
+              value: "{{ .Values.kerberosvault.accesskey }}"
+            - name: KSTORAGE_SECRET
+              value: "{{ .Values.kerberosvault.secretkey }}"
+            - name: KSTORAGE_PROVIDER
+              value: "{{ .Values.kerberosvault.provider }}"
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: vault-proxy-svc
+  labels:
+    app: vault-proxy-svc
+spec:
+  type: LoadBalancer
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 8080
+      name: http
+  selector:
+    app: vault-proxy

charts/hub/templates/kyverno/admin-hardened-images.yaml

@@ -1,65 +0,0 @@
-{{- /*
-admin images must come from a hardened release: they carry the signed
-image-hardening attestation (result "passed") that the UUG.AI release workflow
-adds after all hardening gates pass, for uug-ai/admin.
-The signature itself is checked by admin-signed-images.yaml.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageHardening.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: admin-hardened-images
-  annotations:
-    policies.kyverno.io/title: admin images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Image hardening
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, attestation required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
-  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-admin-hardened
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/admin:*"
-            - "ghcr.io/uug-ai/admin@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestations:
-            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
-              attestors:
-                - entries:
-                    - keyless:
-                        issuer: https://token.actions.githubusercontent.com
-                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                        additionalExtensions:
-                          githubWorkflowRepository: uug-ai/admin
-                        rekor:
-                          url: https://rekor.sigstore.dev
-              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
-              # syntax, escaped so Helm leaves it alone.
-              conditions:
-                - all:
-                    - key: "{{`{{ result }}`}}"
-                      operator: Equals
-                      value: passed
-                    - key: "{{`{{ repository }}`}}"
-                      operator: Equals
-                      value: uug-ai/admin
-{{- end }}

charts/hub/templates/kyverno/admin-signed-images.yaml

@@ -1,53 +0,0 @@
-{{- /*
-admin images must be signed by UUG.AI: a keyless cosign signature issued by
-GitHub Actions, made by the UUG.AI release workflow, for uug-ai/admin.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageVerification.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: admin-signed-images
-  annotations:
-    policies.kyverno.io/title: admin images must be signed by UUG.AI
-    policies.kyverno.io/category: Image signing
-    policies.kyverno.io/severity: high
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, signature required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report unsigned images, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
-  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-admin
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/admin:*"
-            - "ghcr.io/uug-ai/admin@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestors:
-            - entries:
-                - keyless:
-                    issuer: https://token.actions.githubusercontent.com
-                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                    additionalExtensions:
-                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to admin's own repository.
-                      githubWorkflowRepository: uug-ai/admin
-                    rekor:
-                      url: https://rekor.sigstore.dev
-{{- end }}

charts/hub/templates/kyverno/hub-api-hardened-images.yaml

@@ -1,65 +0,0 @@
-{{- /*
-hub-api images must come from a hardened release: they carry the signed
-image-hardening attestation (result "passed") that the UUG.AI release workflow
-adds after all hardening gates pass, for uug-ai/hub-api.
-The signature itself is checked by hub-api-signed-images.yaml.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageHardening.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-api-hardened-images
-  annotations:
-    policies.kyverno.io/title: hub-api images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Image hardening
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, attestation required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-api pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-api-hardened
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-api:*"
-            - "ghcr.io/uug-ai/hub-api@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestations:
-            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
-              attestors:
-                - entries:
-                    - keyless:
-                        issuer: https://token.actions.githubusercontent.com
-                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                        additionalExtensions:
-                          githubWorkflowRepository: uug-ai/hub-api
-                        rekor:
-                          url: https://rekor.sigstore.dev
-              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
-              # syntax, escaped so Helm leaves it alone.
-              conditions:
-                - all:
-                    - key: "{{`{{ result }}`}}"
-                      operator: Equals
-                      value: passed
-                    - key: "{{`{{ repository }}`}}"
-                      operator: Equals
-                      value: uug-ai/hub-api
-{{- end }}

charts/hub/templates/kyverno/hub-api-signed-images.yaml

@@ -1,53 +0,0 @@
-{{- /*
-hub-api images must be signed by UUG.AI: a keyless cosign signature issued by
-GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-api.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageVerification.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-api-signed-images
-  annotations:
-    policies.kyverno.io/title: hub-api images must be signed by UUG.AI
-    policies.kyverno.io/category: Image signing
-    policies.kyverno.io/severity: high
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, signature required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report unsigned images, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-api pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-api
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-api:*"
-            - "ghcr.io/uug-ai/hub-api@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestors:
-            - entries:
-                - keyless:
-                    issuer: https://token.actions.githubusercontent.com
-                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                    additionalExtensions:
-                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to hub-api's own repository.
-                      githubWorkflowRepository: uug-ai/hub-api
-                    rekor:
-                      url: https://rekor.sigstore.dev
-{{- end }}

charts/hub/templates/kyverno/hub-audit-hardened-images.yaml

@@ -1,65 +0,0 @@
-{{- /*
-hub-audit images must come from a hardened release: they carry the signed
-image-hardening attestation (result "passed") that the UUG.AI release workflow
-adds after all hardening gates pass, for uug-ai/hub-audit.
-The signature itself is checked by hub-audit-signed-images.yaml.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageHardening.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-audit-hardened-images
-  annotations:
-    policies.kyverno.io/title: hub-audit images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Image hardening
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, attestation required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-audit-hardened
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-audit:*"
-            - "ghcr.io/uug-ai/hub-audit@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestations:
-            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
-              attestors:
-                - entries:
-                    - keyless:
-                        issuer: https://token.actions.githubusercontent.com
-                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                        additionalExtensions:
-                          githubWorkflowRepository: uug-ai/hub-audit
-                        rekor:
-                          url: https://rekor.sigstore.dev
-              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
-              # syntax, escaped so Helm leaves it alone.
-              conditions:
-                - all:
-                    - key: "{{`{{ result }}`}}"
-                      operator: Equals
-                      value: passed
-                    - key: "{{`{{ repository }}`}}"
-                      operator: Equals
-                      value: uug-ai/hub-audit
-{{- end }}

charts/hub/templates/kyverno/hub-audit-signed-images.yaml

@@ -1,53 +0,0 @@
-{{- /*
-hub-audit images must be signed by UUG.AI: a keyless cosign signature issued by
-GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-audit.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageVerification.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-audit-signed-images
-  annotations:
-    policies.kyverno.io/title: hub-audit images must be signed by UUG.AI
-    policies.kyverno.io/category: Image signing
-    policies.kyverno.io/severity: high
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, signature required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report unsigned images, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-audit
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-audit:*"
-            - "ghcr.io/uug-ai/hub-audit@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestors:
-            - entries:
-                - keyless:
-                    issuer: https://token.actions.githubusercontent.com
-                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                    additionalExtensions:
-                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to hub-audit's own repository.
-                      githubWorkflowRepository: uug-ai/hub-audit
-                    rekor:
-                      url: https://rekor.sigstore.dev
-{{- end }}

charts/hub/templates/kyverno/hub-cleanup-hardened-images.yaml

@@ -1,65 +0,0 @@
-{{- /*
-hub-cleanup images must come from a hardened release: they carry the signed
-image-hardening attestation (result "passed") that the UUG.AI release workflow
-adds after all hardening gates pass, for uug-ai/hub-cleanup.
-The signature itself is checked by hub-cleanup-signed-images.yaml.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageHardening.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-cleanup-hardened-images
-  annotations:
-    policies.kyverno.io/title: hub-cleanup images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Image hardening
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, attestation required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-cleanup-hardened
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-cleanup:*"
-            - "ghcr.io/uug-ai/hub-cleanup@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestations:
-            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
-              attestors:
-                - entries:
-                    - keyless:
-                        issuer: https://token.actions.githubusercontent.com
-                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                        additionalExtensions:
-                          githubWorkflowRepository: uug-ai/hub-cleanup
-                        rekor:
-                          url: https://rekor.sigstore.dev
-              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
-              # syntax, escaped so Helm leaves it alone.
-              conditions:
-                - all:
-                    - key: "{{`{{ result }}`}}"
-                      operator: Equals
-                      value: passed
-                    - key: "{{`{{ repository }}`}}"
-                      operator: Equals
-                      value: uug-ai/hub-cleanup
-{{- end }}

charts/hub/templates/kyverno/hub-cleanup-signed-images.yaml

@@ -1,53 +0,0 @@
-{{- /*
-hub-cleanup images must be signed by UUG.AI: a keyless cosign signature issued by
-GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-cleanup.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageVerification.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-cleanup-signed-images
-  annotations:
-    policies.kyverno.io/title: hub-cleanup images must be signed by UUG.AI
-    policies.kyverno.io/category: Image signing
-    policies.kyverno.io/severity: high
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, signature required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report unsigned images, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-cleanup pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-cleanup
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-cleanup:*"
-            - "ghcr.io/uug-ai/hub-cleanup@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestors:
-            - entries:
-                - keyless:
-                    issuer: https://token.actions.githubusercontent.com
-                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                    additionalExtensions:
-                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to hub-cleanup's own repository.
-                      githubWorkflowRepository: uug-ai/hub-cleanup
-                    rekor:
-                      url: https://rekor.sigstore.dev
-{{- end }}

charts/hub/templates/kyverno/hub-frontend-hardened-images.yaml

@@ -1,65 +0,0 @@
-{{- /*
-hub-frontend images must come from a hardened release: they carry the signed
-image-hardening attestation (result "passed") that the UUG.AI release workflow
-adds after all hardening gates pass, for uug-ai/hub-frontend.
-The signature itself is checked by hub-frontend-signed-images.yaml.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageHardening.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-frontend-hardened-images
-  annotations:
-    policies.kyverno.io/title: hub-frontend images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Image hardening
-    policies.kyverno.io/severity: medium
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, attestation required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-frontend-hardened
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-frontend:*"
-            - "ghcr.io/uug-ai/hub-frontend@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestations:
-            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
-              attestors:
-                - entries:
-                    - keyless:
-                        issuer: https://token.actions.githubusercontent.com
-                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                        additionalExtensions:
-                          githubWorkflowRepository: uug-ai/hub-frontend
-                        rekor:
-                          url: https://rekor.sigstore.dev
-              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
-              # syntax, escaped so Helm leaves it alone.
-              conditions:
-                - all:
-                    - key: "{{`{{ result }}`}}"
-                      operator: Equals
-                      value: passed
-                    - key: "{{`{{ repository }}`}}"
-                      operator: Equals
-                      value: uug-ai/hub-frontend
-{{- end }}

charts/hub/templates/kyverno/hub-frontend-signed-images.yaml

@@ -1,53 +0,0 @@
-{{- /*
-hub-frontend images must be signed by UUG.AI: a keyless cosign signature issued by
-GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-frontend.
-A namespaced Policy, so it applies only to the release namespace.
-Rendered only when imageVerification.enabled is true and Kyverno is installed.
-*/ -}}
-{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
-apiVersion: kyverno.io/v1
-kind: Policy
-metadata:
-  name: hub-frontend-signed-images
-  annotations:
-    policies.kyverno.io/title: hub-frontend images must be signed by UUG.AI
-    policies.kyverno.io/category: Image signing
-    policies.kyverno.io/severity: high
-    policies.kyverno.io/subject: Pod
-# Kyverno defaults apply: background scans of running pods, signature required.
-# Only settings whose Kyverno default would change behaviour are set below.
-spec:
-  # Audit: report unsigned images, don't block. Enforce: reject the pod.
-  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
-  # Kyverno's default (Fail) would stop hub-frontend pods starting while Kyverno is down.
-  failurePolicy: Ignore
-  # Verifying against GHCR and Rekor can exceed the 10s default.
-  webhookTimeoutSeconds: 30
-  rules:
-    - name: verify-hub-frontend
-      match:
-        any:
-          - resources:
-              kinds:
-                - Pod
-      verifyImages:
-        - imageReferences:
-            - "ghcr.io/uug-ai/hub-frontend:*"
-            - "ghcr.io/uug-ai/hub-frontend@*"
-          # Kyverno's defaults (true) would rewrite pod images to digests and
-          # report every tag-based image; enable together with Enforce.
-          mutateDigest: false
-          verifyDigest: false
-          attestors:
-            - entries:
-                - keyless:
-                    issuer: https://token.actions.githubusercontent.com
-                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
-                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
-                    additionalExtensions:
-                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to hub-frontend's own repository.
-                      githubWorkflowRepository: uug-ai/hub-frontend
-                    rekor:
-                      url: https://rekor.sigstore.dev
-{{- end }}