Use callback-capable forwarder release

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.146.0
+version: 0.147.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -99,6 +99,37 @@ spec:
         - name: RABBITMQ_PASSWORD
           value: "{{ $root.Values.rabbitmq.password }}"
 
+        {{- with $svc.rabbitmqDestination }}
+        # Outbound RabbitMQ destination for an integration boundary worker. Empty
+        # host/credential values inherit the Hub broker while remaining a separate
+        # connection and queue from the stage's inbound dispatch queue.
+        - name: FORWARDER_RABBITMQ_HOST
+          value: {{ default $root.Values.rabbitmq.host .host | quote }}
+        - name: FORWARDER_RABBITMQ_USERNAME
+          value: {{ default $root.Values.rabbitmq.username .username | quote }}
+        - name: FORWARDER_RABBITMQ_PASSWORD
+          value: {{ default $root.Values.rabbitmq.password .password | quote }}
+        - name: FORWARDER_RABBITMQ_QUEUE
+          value: {{ required (printf "kerberoshub.services.%s.rabbitmqDestination.queue is required" $name) .queue | quote }}
+        - name: FORWARDER_RABBITMQ_VHOST
+          value: {{ default "/" .virtualHost | quote }}
+        - name: FORWARDER_RABBITMQ_TLS
+          value: {{ default false .tls | quote }}
+        - name: FORWARDER_RABBITMQ_TLS_INSECURE_SKIP_VERIFY
+          value: {{ default false .tlsInsecureSkipVerify | quote }}
+        - name: FORWARDER_RABBITMQ_TLS_CA_CERT_FILE
+          value: {{ default "" .tlsCACertFile | quote }}
+        - name: FORWARDER_RABBITMQ_DECLARE_QUEUE
+          value: {{ .declareQueue | quote }}
+        - name: FORWARDER_RABBITMQ_DEADLETTER_QUEUE
+          value: {{ default (printf "%s.forwarder-dead-letter" .queue) .deadletterQueue | quote }}
+        {{- end }}
+
+        {{- with $svc.callback }}
+        - name: FORWARDER_CALLBACK_BASE_URL
+          value: {{ default (printf "%s://%s" $root.Values.kerberoshub.api.schema $root.Values.kerberoshub.api.url) .baseURL | quote }}
+        {{- end }}
+
         # Kerberos Vault — global storage credentials this stage uses to fetch
         # the media it operates on.
         - name: KERBEROS_STORAGE_URI

charts/hub/values.yaml

@@ -814,7 +814,18 @@ kerberoshub:
     # Every stage `operation` must have a deployed worker under
     # kerberoshub.services.<operation> (deploy the objecttracking / loitering
     # workers below).
-    definitions: {}
+    definitions:
+      # Minimal opt-in workflow for validating the external forwarding boundary.
+      # Enable this definition together with services.forwarder and the workflows
+      # master switch. Every automatically opened run is sent to the configured
+      # FORWARDER_RABBITMQ_QUEUE and remains open until its callback is accepted.
+      forwarder-test:
+        enabled: false
+        triggers:
+          - type: automatic
+        stages:
+          - operation: forwarder
+            dispatch: always
     #tracking-workflow:
     #  enabled: true
     #  triggers:
@@ -865,6 +876,45 @@ kerberoshub:
         requests:
           memory: 10Mi
           cpu: 10m
+    # hub-workflows-forwarder — an opt-in boundary worker for testing external
+    # workflow delivery. It consumes WorkflowRun dispatches from `queue`, strips
+    # internal credentials, and publishes a versioned invocation to the separate
+    # RabbitMQ destination below.
+    forwarder:
+      enabled: false
+      repository: ghcr.io/uug-ai/hub-workflows-forwarder
+      pullPolicy: IfNotPresent
+      tag: "v1.0.1"
+      replicas: 1
+      topologySpreadConstraints: []
+      logLevel: "info"
+      queue: "kcloud-forwarder-queue.fifo"
+      rabbitmqDestination:
+        # Empty connection values inherit the chart's top-level rabbitmq values,
+        # which makes the first test use a second queue on the existing broker.
+        host: ""
+        username: ""
+        password: ""
+        queue: "hub-workflows-forwarder-test"
+        virtualHost: "/"
+        tls: false
+        tlsInsecureSkipVerify: false
+        tlsCACertFile: ""
+        # The test queue and its dead-letter queue are durable quorum queues.
+        # Set this false when both queues are provisioned outside this service.
+        declareQueue: true
+        deadletterQueue: "hub-workflows-forwarder-test.forwarder-dead-letter"
+      callback:
+        # Empty uses the Hub API endpoint configured by kerberoshub.api.
+        baseURL: ""
+      env:
+        FORWARDER_OPERATION: "forwarder"
+        FORWARDER_COMPLETION_MODE: "callback"
+        FORWARDER_MAX_RETRIES: "5"
+      resources:
+        requests:
+          memory: 16Mi
+          cpu: 10m
           # ---------------------------------------------------------------------
           # EXAMPLE custom stage worker (commented out) — hub-loitering.
           #