mirror of
https://github.com/kerberos-io/helm-charts.git
synced 2026-10-21 17:58:27 +00:00
Compare commits
1
Commits
| Author | SHA1 | Date | |
|---|---|---|---|
 Kilian
|
7a37d2456d |
@@ -0,0 +1,31 @@
|
||||
name: Workflows queue consistency
|
||||
|
||||
# Fails the build if the analysis producer, the workflows engine and the stage
|
||||
# workers would render onto different WORKFLOWS_QUEUE names — the silent
|
||||
# producer/consumer queue-name drift that leaves runs piling up with no
|
||||
# consumer. Pure `helm template` render check, no cluster required.
|
||||
on:
|
||||
workflow_dispatch:
|
||||
pull_request:
|
||||
paths:
|
||||
- 'charts/hub/**'
|
||||
- 'scripts/check-workflows-queue-consistency.sh'
|
||||
- '.github/workflows/workflows-queue-consistency.yaml'
|
||||
|
||||
permissions:
|
||||
contents: read
|
||||
|
||||
jobs:
|
||||
check:
|
||||
runs-on: ubuntu-24.04
|
||||
steps:
|
||||
- name: Checkout repository
|
||||
uses: actions/checkout@v4
|
||||
|
||||
- name: Set up Helm
|
||||
uses: azure/setup-helm@v4
|
||||
with:
|
||||
version: v3.16.2
|
||||
|
||||
- name: Check WORKFLOWS_QUEUE consistency
|
||||
run: ./scripts/check-workflows-queue-consistency.sh charts/hub
|
||||
@@ -16,7 +16,7 @@ type: application
|
||||
# This is the chart version. This version number should be incremented each time you make changes
|
||||
# to the chart and its templates, including the app version.
|
||||
# Versions are expected to follow Semantic Versioning (https://semver.org/)
|
||||
version: 0.164.0
|
||||
version: 0.126.2
|
||||
|
||||
# This is the version number of the application being deployed. This version number should be
|
||||
# incremented each time you make changes to the application. Versions are not expected to
|
||||
|
||||
+5
-910
File diff suppressed because it is too large
Load Diff
@@ -44,8 +44,7 @@
|
||||
"incomplete": "Enter all 4 characters to continue.",
|
||||
"unlock": "Unlock encrypted data",
|
||||
"switchAccount": "or switch account",
|
||||
"ariaCharacter": "Passphrase character",
|
||||
"rememberCode": "Remember code for 24 hours on this device"
|
||||
"ariaCharacter": "Passphrase character"
|
||||
},
|
||||
"darkMode": {
|
||||
"switchToLight": "Switch to light mode",
|
||||
@@ -125,7 +124,6 @@
|
||||
"recording": "Recording",
|
||||
"dayOverview": "Day overview",
|
||||
"analytics": "Analytics",
|
||||
"markers": "Markers",
|
||||
"watchlist": "Watchlist",
|
||||
"cases": "Cases",
|
||||
"alerts": "Alerts",
|
||||
@@ -136,257 +134,7 @@
|
||||
"allOf": "All {{name}}s",
|
||||
"accounts": "Accounts",
|
||||
"roles": "Roles",
|
||||
"audit": "Audit events",
|
||||
"settings": "Settings",
|
||||
"context": {
|
||||
"label": "Workspace",
|
||||
"title": "Switch workspace",
|
||||
"open": "Choose organisation and project",
|
||||
"resize": "Resize organisation column"
|
||||
},
|
||||
"projects": {
|
||||
"label": "Project",
|
||||
"open": "Show projects",
|
||||
"search": "Search projects",
|
||||
"noResults": "No matching projects",
|
||||
"fallback": "Project 1",
|
||||
"empty": "No projects",
|
||||
"unavailable": "Projects unavailable",
|
||||
"loading": "Loading projects..."
|
||||
},
|
||||
"organisations": {
|
||||
"label": "Organisation",
|
||||
"search": "Search organisations",
|
||||
"noResults": "No matching organisations",
|
||||
"current": "Current organisation",
|
||||
"none": "No organisation",
|
||||
"select": "Select organisation",
|
||||
"unavailable": "Organisation unavailable",
|
||||
"loading": "Loading organisations...",
|
||||
"empty": "No organisations yet",
|
||||
"create": "Create organisation",
|
||||
"name": "Organisation name",
|
||||
"modal": {
|
||||
"title": "Create organisation",
|
||||
"subtitle": "Add the essentials now. Company and contact details can be completed later.",
|
||||
"create": "Create organisation",
|
||||
"tabs": {
|
||||
"general": "General",
|
||||
"company": "Company",
|
||||
"contact": "Contact & location"
|
||||
},
|
||||
"fields": {
|
||||
"name": "Organisation name *",
|
||||
"description": "Description",
|
||||
"domain": "Email domain",
|
||||
"legalName": "Legal name",
|
||||
"tradingName": "Trading name",
|
||||
"industry": "Industry",
|
||||
"website": "Website",
|
||||
"email": "Contact email",
|
||||
"phone": "Contact phone",
|
||||
"street": "Street address",
|
||||
"street2": "Address line 2",
|
||||
"city": "City",
|
||||
"region": "State / region",
|
||||
"postalCode": "Postal code",
|
||||
"country": "Country"
|
||||
},
|
||||
"placeholders": {
|
||||
"name": "For example, Acme Security",
|
||||
"description": "What this organisation is used for",
|
||||
"domain": "example.com",
|
||||
"website": "https://example.com",
|
||||
"email": "contact@example.com"
|
||||
},
|
||||
"errors": {
|
||||
"form": "Please complete all the missing fields.",
|
||||
"nameRequired": "Enter an organisation name.",
|
||||
"nameLength": "Use at least 2 characters.",
|
||||
"email": "Enter a valid email address."
|
||||
}
|
||||
},
|
||||
"settings": {
|
||||
"title": "Organisation settings",
|
||||
"open": "Open organisation settings",
|
||||
"loading": "Loading organisation...",
|
||||
"loadFailed": "The organisation could not be loaded.",
|
||||
"save": "Save changes",
|
||||
"saving": "Saving...",
|
||||
"tabs": {
|
||||
"general": "General",
|
||||
"company": "Company",
|
||||
"address": "Billing address",
|
||||
"contacts": "Contacts",
|
||||
"regional": "Regional",
|
||||
"users": "Users",
|
||||
"subscription": "Subscription"
|
||||
},
|
||||
"cards": {
|
||||
"userTitle": "{{count}} user",
|
||||
"usersTitle": "{{count}} users",
|
||||
"usersSubtitle": "People with access to this organisation",
|
||||
"usersFooter": "Organisation users",
|
||||
"viewUsers": "View users"
|
||||
},
|
||||
"subscription": {
|
||||
"currentPlan": "Current plan",
|
||||
"noPlan": "No active plan",
|
||||
"description": "Manage the plan, billing method, limits, and integrations for this organisation.",
|
||||
"manage": "Manage subscription",
|
||||
"status": {
|
||||
"no-plan": "No subscription is currently active.",
|
||||
"active": "The subscription is active.",
|
||||
"cancelled": "The subscription has been cancelled.",
|
||||
"reached-limit": "The subscription limit has been reached."
|
||||
}
|
||||
},
|
||||
"users": {
|
||||
"title": "Organisation users",
|
||||
"descriptionSingle": "{{count}} person currently has access to this organisation.",
|
||||
"description": "{{count}} people currently have access to this organisation.",
|
||||
"manage": "Manage users",
|
||||
"inactive": "Inactive",
|
||||
"empty": "No users found",
|
||||
"emptyDescription": "Add users to give them access to this organisation."
|
||||
},
|
||||
"contacts": {
|
||||
"primary": "Primary contact",
|
||||
"financial": "Financial contact",
|
||||
"technical": "Technical contact"
|
||||
},
|
||||
"fields": {
|
||||
"name": "Organisation name *",
|
||||
"description": "Description",
|
||||
"domain": "Email domain",
|
||||
"legalName": "Legal name",
|
||||
"tradingName": "Trading name",
|
||||
"registrationNumber": "Registration number",
|
||||
"vatNumber": "VAT number",
|
||||
"industry": "Industry",
|
||||
"website": "Website",
|
||||
"email": "Contact email",
|
||||
"phone": "Contact phone",
|
||||
"street": "Street address",
|
||||
"street2": "Address line 2",
|
||||
"city": "City",
|
||||
"region": "State / region",
|
||||
"postalCode": "Postal code",
|
||||
"country": "Country",
|
||||
"timezone": "Timezone",
|
||||
"locale": "Locale",
|
||||
"currency": "Currency",
|
||||
"contactName": "Name",
|
||||
"contactEmail": "Email",
|
||||
"contactPhone": "Phone"
|
||||
},
|
||||
"placeholders": {
|
||||
"domain": "example.com",
|
||||
"website": "https://example.com",
|
||||
"email": "contact@example.com",
|
||||
"timezone": "Europe/Brussels",
|
||||
"locale": "en-US",
|
||||
"currency": "EUR"
|
||||
},
|
||||
"errors": {
|
||||
"form": "Please correct the highlighted fields.",
|
||||
"nameRequired": "Enter an organisation name.",
|
||||
"nameLength": "Use at least 2 characters.",
|
||||
"email": "Enter a valid email address."
|
||||
}
|
||||
}
|
||||
},
|
||||
"projects": {
|
||||
"label": "Project",
|
||||
"current": "Current project",
|
||||
"none": "No project",
|
||||
"select": "Select project",
|
||||
"unavailable": "Project unavailable",
|
||||
"loading": "Loading projects...",
|
||||
"empty": "No projects yet",
|
||||
"search": "Search projects",
|
||||
"create": "Create project",
|
||||
"name": "Project name",
|
||||
"settings": {
|
||||
"title": "Project settings",
|
||||
"details": "Project details",
|
||||
"tabs": {
|
||||
"general": "General",
|
||||
"credentials": "Credentials"
|
||||
},
|
||||
"encryption": "Encryption keys",
|
||||
"publicKey": "RSA public key",
|
||||
"privateKey": "RSA private key",
|
||||
"legacyPublicKey": "Agent public key",
|
||||
"legacyPrivateKey": "Agent private key",
|
||||
"encryptionKey": "Encryption key",
|
||||
"secretKeys": "Secret keys",
|
||||
"generate": "Generate credentials",
|
||||
"regenerate": "Regenerate credentials",
|
||||
"generating": "Generating keys...",
|
||||
"generateHint": "Generate keys for this project.",
|
||||
"oneTimeHint": "Copy these keys now. They will not be shown again.",
|
||||
"copyPublicKey": "Copy RSA public key",
|
||||
"copyPrivateKey": "Copy RSA private key",
|
||||
"copyLegacyPublicKey": "Copy Agent public key",
|
||||
"copyLegacyPrivateKey": "Copy Agent private key",
|
||||
"copyEncryptionKey": "Copy encryption key",
|
||||
"pincode": {
|
||||
"generateTitle": "Generate project credentials?",
|
||||
"generateMessage": "Generate new keys for this project.",
|
||||
"label": "PIN code (optional)",
|
||||
"hint": "Enter exactly 4 digits to encrypt the stored encryption key. The PIN is never saved.",
|
||||
"error": "Enter exactly 4 digits or leave the PIN empty.",
|
||||
"statusLabel": "PIN protection",
|
||||
"enabled": "Enabled",
|
||||
"disabled": "Disabled"
|
||||
},
|
||||
"import": {
|
||||
"open": "Bring your own keys",
|
||||
"title": "Bring your own keys",
|
||||
"description": "Import an RSA-4096 public key generated outside the platform and provide your encryption key.",
|
||||
"replacementWarning": "This replaces the current credentials. Cameras using them may disconnect.",
|
||||
"formatHint": "The public key may be OpenSSL PEM or single-line Base64 DER. The encryption key must contain exactly 32 hexadecimal characters.",
|
||||
"encryptionKeyError": "Enter exactly 32 hexadecimal characters.",
|
||||
"cancel": "Cancel",
|
||||
"confirm": "Import credentials",
|
||||
"importing": "Importing..."
|
||||
},
|
||||
"regenerateWarning": {
|
||||
"title": "Regenerate project credentials?",
|
||||
"message": "This immediately replaces the current public, private and encryption keys. This action cannot be undone.",
|
||||
"cameraImpact": "Cameras using the current credentials may disconnect and must be configured with the new credentials.",
|
||||
"cancel": "Cancel",
|
||||
"confirm": "Regenerate credentials"
|
||||
}
|
||||
},
|
||||
"modal": {
|
||||
"title": "Create project",
|
||||
"subtitle": "A project keeps its devices, sites and recordings separate from the rest of the organisation.",
|
||||
"create": "Create project",
|
||||
"fields": {
|
||||
"name": "Project name *",
|
||||
"slug": "Handle *",
|
||||
"description": "Description"
|
||||
},
|
||||
"placeholders": {
|
||||
"name": "For example, Warehouse North",
|
||||
"slug": "warehouse-north",
|
||||
"description": "What this project is used for"
|
||||
},
|
||||
"hints": {
|
||||
"slug": "Lowercase letters, numbers and single hyphens. Used to reference the project later."
|
||||
},
|
||||
"errors": {
|
||||
"form": "Please complete all the missing fields.",
|
||||
"nameRequired": "Enter a project name.",
|
||||
"nameLength": "Use at least 2 characters.",
|
||||
"slugRequired": "Enter a handle.",
|
||||
"slugFormat": "Use lowercase letters, numbers and single hyphens only.",
|
||||
"slugLength": "Use at most 63 characters."
|
||||
}
|
||||
}
|
||||
},
|
||||
"plansIntegrations": "Plans & integrations",
|
||||
"dataUploaded": "Data uploaded",
|
||||
"dailyLimit": "{{percent}}% – {{usage}}/{{max}} GB daily limit",
|
||||
@@ -460,57 +208,6 @@
|
||||
"Vault": "Vault"
|
||||
},
|
||||
"pages": {
|
||||
"audit": {
|
||||
"title": "Audit events",
|
||||
"refresh": "Refresh",
|
||||
"loadError": "Audit events could not be loaded. Try again.",
|
||||
"metadata": "Metadata",
|
||||
"noMetadata": "No metadata was recorded for this event.",
|
||||
"changes": "Changes",
|
||||
"filters": {
|
||||
"actor": "Actor",
|
||||
"actorPlaceholder": "Name or ID",
|
||||
"action": "Action",
|
||||
"target": "Target",
|
||||
"targetPlaceholder": "Name or ID",
|
||||
"operation": "Operation",
|
||||
"permission": "Permission",
|
||||
"category": "Category",
|
||||
"outcome": "Outcome",
|
||||
"search": "Search all fields",
|
||||
"searchPlaceholder": "Actor, action, target, device...",
|
||||
"from": "From",
|
||||
"to": "To",
|
||||
"any": "Any",
|
||||
"clear": "Clear filters"
|
||||
},
|
||||
"table": {
|
||||
"timestamp": "Timestamp",
|
||||
"actor": "Actor",
|
||||
"action": "Action",
|
||||
"target": "Target",
|
||||
"outcome": "Outcome",
|
||||
"details": "Event details",
|
||||
"showDetails": "Show metadata",
|
||||
"hideDetails": "Hide metadata"
|
||||
},
|
||||
"authorization": "Authorization",
|
||||
"request": "Request",
|
||||
"policy": "Policy",
|
||||
"granted": "Granted",
|
||||
"denied": "Denied",
|
||||
"noResults": {
|
||||
"title": "No audit events found",
|
||||
"description": "Events will appear here as activity is recorded."
|
||||
},
|
||||
"pagination": {
|
||||
"showing": "Showing {{start}}–{{end}} of {{total}}",
|
||||
"rows": "Rows",
|
||||
"previous": "Previous",
|
||||
"next": "Next",
|
||||
"page": "Page {{page}}"
|
||||
}
|
||||
},
|
||||
"floorplans": {
|
||||
"noneUploaded": "No floor plans uploaded yet",
|
||||
"uploadFirstHint": "Upload your first floor plan to visualize your devices on this site",
|
||||
@@ -563,13 +260,6 @@
|
||||
"completeAllFields": "Please complete all the missing fields",
|
||||
"nameExists": "This name already exists",
|
||||
"badgeColor": "Badge color (HEX)",
|
||||
"fineTuneLocation": "Fine-tune map position",
|
||||
"fineTuneInstructions": "Move the map so the pin marks the exact site location.",
|
||||
"latitude": "Latitude",
|
||||
"longitude": "Longitude",
|
||||
"invalidCoordinates": "Enter valid coordinates.",
|
||||
"selectAddressBeforeFineTune": "Select an address before fine-tuning its map position.",
|
||||
"resetLocation": "Reset position",
|
||||
"vaultSaveToUse": "Save changes to use this Vault",
|
||||
"vaultCheckCredentials": "Check credentials and try again"
|
||||
},
|
||||
@@ -614,85 +304,6 @@
|
||||
"analytics": {
|
||||
"manageAlerts": "Manage alerts",
|
||||
"subscribePrompt": "Subscribe to a plan to generate notifications",
|
||||
"markers": {
|
||||
"title": "Markers",
|
||||
"overview": "Overview",
|
||||
"searchPlaceholder": "Search marker names, e.g. a license plate",
|
||||
"clearFilters": "Clear filters",
|
||||
"loading": "Loading markers",
|
||||
"loadError": "Markers could not be loaded. Please try again.",
|
||||
"invalidDateRange": "The start date must be before the end date.",
|
||||
"openDetails": "Open marker details",
|
||||
"openMarkerDetails": "Open details for marker {{name}}",
|
||||
"openMedia": "Open recording",
|
||||
"noMedia": "No linked recording",
|
||||
"mediaErrorTitle": "Recording unavailable",
|
||||
"mediaErrorMessage": "The recording linked to this marker could not be opened.",
|
||||
"detail": {
|
||||
"title": "Marker details",
|
||||
"recording": "Marker recording",
|
||||
"loadingRecording": "Loading linked recording...",
|
||||
"videoUnavailable": "The linked recording has no playable video.",
|
||||
"markerPosition": "Marker starts {{offset}} into this recording",
|
||||
"openFullRecording": "Open full recording",
|
||||
"overview": "Overview",
|
||||
"start": "Start",
|
||||
"end": "End",
|
||||
"description": "Description",
|
||||
"classification": "Classification",
|
||||
"metadata": "Metadata",
|
||||
"source": "Source",
|
||||
"engine": "Engine",
|
||||
"modelVersion": "Model version",
|
||||
"boundingBox": "Bounding box",
|
||||
"rawMetadata": "Raw metadata",
|
||||
"comments": "Comments",
|
||||
"identifiers": "Identifiers",
|
||||
"markerId": "Marker ID",
|
||||
"deviceId": "Device ID",
|
||||
"siteId": "Site ID",
|
||||
"groupId": "Group ID",
|
||||
"organisationId": "Organisation ID",
|
||||
"mediaKey": "Media key",
|
||||
"audit": "Audit information"
|
||||
},
|
||||
"filters": {
|
||||
"categories": "Categories",
|
||||
"from": "From",
|
||||
"to": "To",
|
||||
"sort": "Sort markers"
|
||||
},
|
||||
"sort": {
|
||||
"latest": "Latest first",
|
||||
"oldest": "Oldest first",
|
||||
"nameAsc": "Name A-Z",
|
||||
"nameDesc": "Name Z-A"
|
||||
},
|
||||
"table": {
|
||||
"timestamp": "Timestamp",
|
||||
"marker": "Marker",
|
||||
"categories": "Categories",
|
||||
"device": "Device",
|
||||
"duration": "Duration",
|
||||
"source": "Source",
|
||||
"signals": "Events & tags",
|
||||
"events": "Events",
|
||||
"tags": "Tags",
|
||||
"confidence": "Confidence",
|
||||
"media": "Recording"
|
||||
},
|
||||
"noResults": {
|
||||
"title": "No markers found",
|
||||
"description": "Adjust the filters or search for another marker name."
|
||||
},
|
||||
"pagination": {
|
||||
"showing": "Showing {{start}}-{{end}}",
|
||||
"rows": "Rows",
|
||||
"previous": "Previous",
|
||||
"next": "Next",
|
||||
"page": "Page {{page}}"
|
||||
}
|
||||
},
|
||||
"noAlerts": {
|
||||
"description": "Create an alert or enable existing ones to start receiving analytics.",
|
||||
"button": "Alerts"
|
||||
@@ -729,19 +340,6 @@
|
||||
"placeholderDescription": "To create your first case go to the media section, and select a media item. Create a new case and assign it to the relevant person.",
|
||||
"goToMedia": "Go to Media",
|
||||
"myCases": "My cases",
|
||||
"loadError": "Something went wrong while loading the case. Please try again.",
|
||||
"autoplayNextOn": "Autoplay next: On",
|
||||
"autoplayNextOff": "Autoplay next: Off",
|
||||
"mediaProcessing": "Processing",
|
||||
"mediaFailed": "Failed",
|
||||
"a11y": {
|
||||
"toggleCase": "Toggle case details",
|
||||
"statusOpen": "Case status: open",
|
||||
"statusApproved": "Case status: approved",
|
||||
"statusRejected": "Case status: rejected",
|
||||
"loadingCases": "Loading cases",
|
||||
"caseThumbnail": "Case thumbnail"
|
||||
},
|
||||
"actions": {
|
||||
"reopenCase": "Reopen case",
|
||||
"approveCase": "Approve case",
|
||||
@@ -965,8 +563,6 @@
|
||||
"filter": {
|
||||
"date": "Date",
|
||||
"region": "Region",
|
||||
"regionExcluded": "Not in results",
|
||||
"regionExcludedHint": "No region drawn on this camera, so it is left out of the results. Draw a region to include it again.",
|
||||
"categories": "Categories",
|
||||
"markers": "Markers",
|
||||
"events": "Events",
|
||||
@@ -974,15 +570,7 @@
|
||||
"newest": "Newest",
|
||||
"oldest": "Oldest",
|
||||
"showAllRecordings": "Show all recordings",
|
||||
"showStarredRecordings": "Show starred recordings only",
|
||||
"synchronisedPlayer": "Synchronised player",
|
||||
"synchronisedPlayerHint": "Play all recordings of the selected region, one player per camera",
|
||||
"synchronisedPlayerRequirement": "Select a time region of maximum 60 minutes on the timeline to enable the synchronised player",
|
||||
"synchronisedPlayerPlay": "Play",
|
||||
"synchronisedPlayerPause": "Pause",
|
||||
"synchronisedPlayerNoFootage": "No recording at this moment",
|
||||
"synchronisedPlayerEmpty": "No playable recordings found in the selected time region.",
|
||||
"timelinePreviewPlayVideo": "Play video"
|
||||
"showStarredRecordings": "Show starred recordings only"
|
||||
},
|
||||
"emptyState": {
|
||||
"selectDayAndDevice": "Select day and device",
|
||||
@@ -998,12 +586,8 @@
|
||||
"timeline": {
|
||||
"title": "Timeline",
|
||||
"clearSelectedTime": "Clear selected time",
|
||||
"selectionStart": "Start of the selected time range",
|
||||
"selectionEnd": "End of the selected time range",
|
||||
"fetching": "Fetching timeline rows for selected devices.",
|
||||
"noRecordings": "No recordings are available for the selected date and devices.",
|
||||
"resizeHint": "Drag to resize the timeline",
|
||||
"rowHeight": "Drag to change the height of the recording bars"
|
||||
"noRecordings": "No recordings are available for the selected date and devices."
|
||||
},
|
||||
"chart": {
|
||||
"title": "Chart",
|
||||
@@ -1024,13 +608,8 @@
|
||||
"copyVideoUrl": "Copy Video URL",
|
||||
"verifyVideo": "Verify video",
|
||||
"shareRecording": "Share Recording",
|
||||
"runWorkflow": "Run workflow",
|
||||
"runWorkflowSubtitle": "Choose a workflow to run on this recording.",
|
||||
"noMediaWorkflows": "No workflows are available for recordings.",
|
||||
"newCase": "New case",
|
||||
"addToCase": "Add to case",
|
||||
"assignToCase": "Assign to case",
|
||||
"caseActions": "Case actions",
|
||||
"share": "Share",
|
||||
"save": "Save",
|
||||
"loading": "Loading...",
|
||||
@@ -1547,7 +1126,7 @@
|
||||
"k1": "Add a Dataset",
|
||||
"k2": "Are you sure you want to remove device",
|
||||
"k3": "Search dataset..",
|
||||
"k4": "Set up your first Agent",
|
||||
"k4": "Set up your first Kerberos Agent",
|
||||
"k5": "No devices are available",
|
||||
"k6": "Subscribe to a plan",
|
||||
"k7": "Dataset",
|
||||
@@ -1595,12 +1174,12 @@
|
||||
},
|
||||
"new": {
|
||||
"new": {
|
||||
"k1": "Before you will see your recordings shown up on Kerberos Hub, you first need to install and configure an Agent. An Agent is a piece of software that processes a device, and will make recordings when a portion of the video stream has changed. These recordings will then be send to, and processed by the Kerberos Hub application.",
|
||||
"k2": "After you've properly installed one or more Agents, you can link it to the Kerberos Hub application using your",
|
||||
"k1": "Before you will see your recordings shown up on Kerberos Hub, you first need to install and configure a Kerberos Agent. A Kerberos Agent is a piece of software that processes a device, and will make recordings when a portion of the video stream has changed. These recordings will then be send to, and processed by the Kerberos Hub application.",
|
||||
"k2": "After you've properly installed one or more Kerberos Agents, you can link it to the Kerberos Hub application using your",
|
||||
"k3": "cloud credentials",
|
||||
"k4": ". When linked successfully, your device will show up on the devices page.",
|
||||
"k5": "Get started",
|
||||
"k6": "We have different ways to get your Agent up and running. You can install the Agent using a prebuilt Docker container, inside your Kubernetes Cluster, on your Raspberry Pi (or any other compatible board) or on a simple VM. Please select the most appropriate solution to get started. Visit",
|
||||
"k6": "We have different ways to get your Kerberos Agent up and running. You can install the Kerberos Agent using a prebuilt Docker container, inside your Kubernetes Cluster, on your Raspberry Pi (or any other compatible board) or on a simple VM. Please select the most appropriate solution to get started. Visit",
|
||||
"k7": "our documentation website to learn more",
|
||||
"k8": "A Docker image (amd64, armv7, arm64) is",
|
||||
"k9": "available on the Docker Hub",
|
||||
@@ -1610,8 +1189,8 @@
|
||||
"k13": "Go to the plan page",
|
||||
"k14": "on your cloud account and copy your cloud credentials.",
|
||||
"k15": "When created successfully, you can navigate to the Kerberos Factory interface, and enter your cloud credentials in your deployment of global configuration.",
|
||||
"k16": "Your new Agent will show up on the devices page.",
|
||||
"k17": "If you want to manage Agents at scale with Kubernetes, then",
|
||||
"k16": "Your new Kerberos Agent will show up on the devices page.",
|
||||
"k17": "If you want to manage Kerberos Agents at scale with Kubernetes, then",
|
||||
"k18": "Kerberos Factory is what you are looking for",
|
||||
"k19": "Setup a Kubernetes cluster or use your existing Kubernetes cluster.",
|
||||
"k20": "Install the different components of",
|
||||
@@ -1620,7 +1199,7 @@
|
||||
"k23": "Go to the plans & integrations page",
|
||||
"k24": "on your Kerberos Hub account and copy your credentials.",
|
||||
"k25": "When configured Kerberos Factory successfully, you can modify the global settings, and enter your credentials.",
|
||||
"k26": "All Agent you will now add, will show up on your devices page.",
|
||||
"k26": "All Kerberos Agent you will now add, will show up on your devices page.",
|
||||
"k27": "KiOS is a custom linux OS, created for the Raspberry Pi, which runs Kerberos.io out-of-the-box. This is the most simple and basic installation procedure.",
|
||||
"k28": "Download",
|
||||
"k29": "the KiOS installer",
|
||||
@@ -2047,7 +1626,7 @@
|
||||
"k11": "Delete attachment",
|
||||
"k12": "Are you sure you want to delete this attachment? This action cannot be undone.",
|
||||
"k13": "Yes, delete",
|
||||
"k14": "Redact"
|
||||
"k14": "Redact faces"
|
||||
}
|
||||
},
|
||||
"media": {
|
||||
@@ -2107,7 +1686,7 @@
|
||||
"blocks": {
|
||||
"face_redaction": {
|
||||
"face_redaction": {
|
||||
"k1": "Redact video",
|
||||
"k1": "Edit video",
|
||||
"k2": "Edit video tools",
|
||||
"k3": "This editing tool is coming soon.",
|
||||
"k4": "No detections available",
|
||||
@@ -2349,15 +1928,13 @@
|
||||
"k62": "Expiry date",
|
||||
"k63": "Open update access token",
|
||||
"k64": "No access tokens found",
|
||||
"k65": "time",
|
||||
"k65": "date, time",
|
||||
"k66": "ip",
|
||||
"k67": "device",
|
||||
"k68": "status",
|
||||
"k67": "browser",
|
||||
"k68": "os",
|
||||
"k69": "No login history found.",
|
||||
"k70": "My account",
|
||||
"k71": "Manage your profile, billing methods and invoices",
|
||||
"k72": "Success",
|
||||
"k73": "Failed"
|
||||
"k71": "Manage your profile, billing methods and invoices"
|
||||
}
|
||||
},
|
||||
"roles": {
|
||||
@@ -2566,9 +2143,9 @@
|
||||
"k20": "Kerberos Hub credentials",
|
||||
"k21": "Cloud credentials",
|
||||
"k22": "Media storage region",
|
||||
"k23": "Your media can be stored in one of the following regions. Different Agents can store in different regions.",
|
||||
"k23": "Your media can be stored in one of the following regions. Different Kerberos agents can store in different regions.",
|
||||
"k24": "Copy",
|
||||
"k25": "Use the below credentials to connect your Agents to your Kerberos Hub.",
|
||||
"k25": "Use the below credentials to connect your Kerberos Agents to your Kerberos Hub.",
|
||||
"k26": "Use the below credentials to connect your devices to our cloud.",
|
||||
"k27": "How to connect Agents to Kerberos Hub",
|
||||
"k28": "Public key",
|
||||
@@ -3007,7 +2584,7 @@
|
||||
"k2": "draft",
|
||||
"k3": "Device detail",
|
||||
"k4": "Kerberos Factory",
|
||||
"k5": "Agent",
|
||||
"k5": "Kerberos Agent",
|
||||
"k6": "n/a",
|
||||
"k7": "Remove device"
|
||||
}
|
||||
@@ -3243,7 +2820,7 @@
|
||||
"k2": "PREVIEW",
|
||||
"k3": "Switch to live [Shift + L]",
|
||||
"k4": "LIVE",
|
||||
"k5": "Make sure you are using the latest Agent and a Gold subscription",
|
||||
"k5": "Make sure you are using the latest Kerberos agent and a Gold subscription",
|
||||
"k6": "You are not allowed to watch a live stream.",
|
||||
"k7": "Turn sound off",
|
||||
"k8": "Turn sound on",
|
||||
@@ -3255,22 +2832,7 @@
|
||||
"k14": "Device Idle",
|
||||
"k15": "The agent is online, but the device stream seems to be offline",
|
||||
"k16": "No permissions",
|
||||
"k17": "You aren't allowed to view this livestream.",
|
||||
"k18": "Record",
|
||||
"k19": "Recording",
|
||||
"k20": "REC",
|
||||
"k21": "Stop recording",
|
||||
"k22": "Camera is set to continuous recording",
|
||||
"k23": "Show motion detection",
|
||||
"k24": "Hide motion detection",
|
||||
"k25": "Recent recordings",
|
||||
"k26": "No recordings available",
|
||||
"k27": "Back 5 seconds",
|
||||
"k28": "Play",
|
||||
"k29": "Pause",
|
||||
"k30": "Forward 5 seconds",
|
||||
"k31": "Previous time window",
|
||||
"k32": "Next time window"
|
||||
"k17": "You aren't allowed to view this livestream."
|
||||
}
|
||||
},
|
||||
"tags": {
|
||||
@@ -3330,13 +2892,6 @@
|
||||
"k3": "End time"
|
||||
}
|
||||
},
|
||||
"time_spinner": {
|
||||
"time_spinner": {
|
||||
"hours": "Hours",
|
||||
"minutes": "Minutes",
|
||||
"seconds": "Seconds"
|
||||
}
|
||||
},
|
||||
"video_js": {
|
||||
"video_js": {
|
||||
"k1": "To view this video please enable JavaScript, and consider upgrading to a web browser that",
|
||||
|
||||
@@ -1,5 +0,0 @@
|
||||
[
|
||||
{"key": "nose", "label": "Nose"},
|
||||
{"key": "left_shoulder", "label": "Left shoulder"},
|
||||
{"key": "right_shoulder", "label": "Right shoulder"}
|
||||
]
|
||||
@@ -1,24 +0,0 @@
|
||||
# Create these ConfigMaps in the release namespace before deploying the chart.
|
||||
# Keys contain complete contracts/catalogs; they are not merged with chart data.
|
||||
# Do not also set classificationCatalog or classificationCatalogExistingConfigMap.
|
||||
classificationCatalogEnabled: true
|
||||
workflowConfiguration:
|
||||
enabled: true
|
||||
includeDefaults: true
|
||||
configMaps:
|
||||
- name: deployment-workflow-overrides
|
||||
items:
|
||||
- key: start.yaml
|
||||
path: workflow-contracts/start.yaml
|
||||
replace: true
|
||||
- key: deployment-classifications.json
|
||||
path: catalogs/classifications.json
|
||||
replace: true
|
||||
- name: custom-workflow-contracts
|
||||
items:
|
||||
- key: pose.yaml
|
||||
path: workflow-contracts/pose.yaml
|
||||
- name: shared-pose-catalog
|
||||
items:
|
||||
- key: pose-keypoints.json
|
||||
path: catalogs/pose-keypoints.json
|
||||
@@ -1,13 +0,0 @@
|
||||
# Packaging only; does not activate contract loading or deploy a pose worker.
|
||||
workflowConfiguration:
|
||||
enabled: true
|
||||
includeDefaults: true
|
||||
configMaps:
|
||||
- name: custom-workflow-contracts
|
||||
items:
|
||||
- key: pose.yaml
|
||||
path: workflow-contracts/pose.yaml
|
||||
- name: shared-pose-catalog
|
||||
items:
|
||||
- key: pose-keypoints.json
|
||||
path: catalogs/pose-keypoints.json
|
||||
@@ -1,53 +0,0 @@
|
||||
# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
|
||||
# Hypothetical custom worker output; not an installed stage or universal pose schema.
|
||||
schemaVersion: 1
|
||||
stage: pose
|
||||
contractVersion: 1
|
||||
presentation:
|
||||
name: Detect poses
|
||||
description: Estimate body keypoints and posture for people in the recording.
|
||||
icon: person
|
||||
color: teal
|
||||
# Settings authors enter per node; the worker receives them as node data.
|
||||
params:
|
||||
- name: minConfidence
|
||||
label: Minimum keypoint confidence
|
||||
type: number
|
||||
default: 0.5
|
||||
- name: model
|
||||
label: Model
|
||||
type: select
|
||||
options: [fast, accurate]
|
||||
optionLabels: {fast: Fast, accurate: Accurate}
|
||||
default: fast
|
||||
fields:
|
||||
- id: keypoint
|
||||
label: Keypoint
|
||||
path: people.*.keypoints.*.name
|
||||
type: string
|
||||
operators: [in]
|
||||
choices:
|
||||
file: ../catalogs/pose-keypoints.json
|
||||
- id: posture
|
||||
label: Posture
|
||||
path: people.*.posture
|
||||
type: string
|
||||
operators: [in]
|
||||
choices:
|
||||
values: [standing, sitting, lying]
|
||||
- id: confidence
|
||||
label: Keypoint confidence
|
||||
path: people.*.keypoints.*.confidence
|
||||
type: number
|
||||
operators: [gt, gte, lt, lte]
|
||||
minimum: 0
|
||||
maximum: 1
|
||||
# Connections leaving this stage: one section with fixed inputs, then the
|
||||
# Extra conditions catch-all (appended collapsed when not placed explicitly).
|
||||
panel:
|
||||
sections:
|
||||
- id: posture
|
||||
label: Posture
|
||||
fields:
|
||||
- {field: posture, widget: multiselect}
|
||||
- {field: confidence, widget: number, operator: gte, label: Minimum confidence}
|
||||
@@ -1,17 +0,0 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"title": "Hub shared choice catalog v1",
|
||||
"description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["key", "label"],
|
||||
"properties": {
|
||||
"key": {"type": "string", "minLength": 1},
|
||||
"label": {"type": "string", "minLength": 1},
|
||||
"icon": {"type": "string", "minLength": 1}
|
||||
}
|
||||
}
|
||||
}
|
||||
@@ -1,321 +0,0 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"title": "Hub workflow editor contract v1",
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["schemaVersion", "stage", "contractVersion", "fields"],
|
||||
"properties": {
|
||||
"schemaVersion": {"const": 1},
|
||||
"stage": {
|
||||
"type": "string",
|
||||
"pattern": "^[a-z][a-z0-9-]*$",
|
||||
"description": "Stage type, not a node instance. start describes initial context."
|
||||
},
|
||||
"contractVersion": {"const": 1},
|
||||
"presentation": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"description": "How the editor shows this node. Icons and colours come from approved sets.",
|
||||
"properties": {
|
||||
"name": {"type": "string", "minLength": 1, "maxLength": 80},
|
||||
"description": {"type": "string", "minLength": 1, "maxLength": 500},
|
||||
"icon": {"enum": ["play", "camera", "person", "eye-crossed", "car", "clock", "mlModel", "share"]},
|
||||
"color": {
|
||||
"enum": ["blue", "teal", "rose", "amber", "indigo", "violet", "green", "grey"],
|
||||
"description": "Theme colour token."
|
||||
}
|
||||
}
|
||||
},
|
||||
"params": {
|
||||
"type": "array",
|
||||
"maxItems": 64,
|
||||
"description": "Worker-stage settings authors enter, stored per node. An explicit list (even empty) replaces kerberoshub.workflows.editorStages params. Not supported on start.",
|
||||
"items": {"$ref": "#/definitions/param"}
|
||||
},
|
||||
"fields": {
|
||||
"type": "array",
|
||||
"description": "Typed values conditions may test. Start: the selectors device, sites, groups and classifications plus condition-only fields whose path exists in the condition root schema (models.WorkflowConditionRootSchema), e.g. device.deviceName or inputs.classify.details.*.isStatic; other inputs.<operation> paths are worker-defined. Stage: outputs relative to results.<stage>. New conditions may only use declared fields. An empty array is valid.",
|
||||
"items": {"$ref": "#/definitions/field"},
|
||||
"maxItems": 128
|
||||
},
|
||||
"controls": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["id", "label"],
|
||||
"properties": {
|
||||
"id": {"enum": ["weeklySchedule", "conditions"]},
|
||||
"label": {"type": "string", "minLength": 1}
|
||||
}
|
||||
},
|
||||
"description": "Start only. Controls offered for new authoring; omitted offers none. conditions applies to edges leaving Start.",
|
||||
"maxItems": 16
|
||||
},
|
||||
"triggerModes": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"uniqueItems": true,
|
||||
"items": {"enum": ["automatic", "manual"]},
|
||||
"description": "Start only. Trigger modes offered for new authoring; omitted offers both."
|
||||
},
|
||||
"panel": {"$ref": "#/definitions/panel"}
|
||||
},
|
||||
"definitions": {
|
||||
"choices": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"source": {
|
||||
"type": "string",
|
||||
"description": "Built-in authorized project-resource resolver; not a database path.",
|
||||
"oneOf": [
|
||||
{
|
||||
"const": "project.devices",
|
||||
"description": "Device keys as values, device names as labels."
|
||||
},
|
||||
{"const": "project.sites", "description": "Site IDs as values, site names as labels."},
|
||||
{
|
||||
"const": "project.groups",
|
||||
"description": "Group IDs as values, group names as labels."
|
||||
}
|
||||
]
|
||||
},
|
||||
"file": {
|
||||
"type": "string",
|
||||
"pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
|
||||
"description": "Direct shared catalog file relative to the contract; no URLs or nested references."
|
||||
},
|
||||
"values": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"uniqueItems": true,
|
||||
"items": {"type": ["string", "number", "boolean"]}
|
||||
}
|
||||
},
|
||||
"oneOf": [{"required": ["source"]}, {"required": ["file"]}, {"required": ["values"]}]
|
||||
},
|
||||
"field": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["id", "label", "path", "type", "operators"],
|
||||
"properties": {
|
||||
"id": {
|
||||
"type": "string",
|
||||
"pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
|
||||
"description": "Stable identifier, unique within this contract."
|
||||
},
|
||||
"label": {"type": "string", "minLength": 1},
|
||||
"path": {
|
||||
"type": "string",
|
||||
"pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
|
||||
"description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
|
||||
},
|
||||
"type": {"enum": ["string", "integer", "number", "boolean"]},
|
||||
"operators": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"uniqueItems": true,
|
||||
"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
|
||||
},
|
||||
"optional": {
|
||||
"type": "boolean",
|
||||
"default": false,
|
||||
"description": "Field may be absent even when the node completes; branch availability is determined separately."
|
||||
},
|
||||
"minimum": {"type": "number"},
|
||||
"maximum": {"type": "number"},
|
||||
"choices": {"$ref": "#/definitions/choices"}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "string"}}},
|
||||
"then": {
|
||||
"properties": {
|
||||
"operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
|
||||
"choices": {"properties": {"values": {"items": {"type": "string"}}}}
|
||||
},
|
||||
"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "boolean"}}},
|
||||
"then": {
|
||||
"properties": {
|
||||
"operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
|
||||
"choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
|
||||
},
|
||||
"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"enum": ["integer", "number"]}}},
|
||||
"then": {
|
||||
"properties": {
|
||||
"operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
|
||||
"choices": {"properties": {"values": {"items": {"type": "number"}}}}
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "integer"}}},
|
||||
"then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
|
||||
"then": {
|
||||
"properties": {"choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}}
|
||||
}
|
||||
}
|
||||
]
|
||||
},
|
||||
"param": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["name", "type"],
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string",
|
||||
"pattern": "^[A-Za-z][A-Za-z0-9_]*$",
|
||||
"maxLength": 64,
|
||||
"description": "Key in node data; unique within the contract."
|
||||
},
|
||||
"label": {"type": "string", "minLength": 1, "maxLength": 160},
|
||||
"description": {"type": "string", "minLength": 1, "maxLength": 500},
|
||||
"group": {
|
||||
"type": "string",
|
||||
"minLength": 1,
|
||||
"maxLength": 80,
|
||||
"description": "Editor section; params sharing a group appear together."
|
||||
},
|
||||
"placeholder": {"type": "string", "minLength": 1, "maxLength": 160},
|
||||
"type": {"enum": ["string", "number", "boolean", "select", "multiselect", "secret"]},
|
||||
"required": {"type": "boolean"},
|
||||
"default": {
|
||||
"description": "Value the editor pre-fills and the API stores when a node leaves the setting unset; never for secrets. Typically the worker's own default."
|
||||
},
|
||||
"options": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"maxItems": 256,
|
||||
"uniqueItems": true,
|
||||
"items": {"type": "string", "minLength": 1, "maxLength": 160}
|
||||
},
|
||||
"optionLabels": {
|
||||
"type": "object",
|
||||
"additionalProperties": {"type": "string", "minLength": 1, "maxLength": 160}
|
||||
},
|
||||
"minimum": {"type": "number", "description": "Inclusive lower bound for a number setting."},
|
||||
"maximum": {"type": "number", "description": "Inclusive upper bound for a number setting."},
|
||||
"choices": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["file"],
|
||||
"properties": {
|
||||
"file": {"type": "string", "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$"}
|
||||
},
|
||||
"description": "Options for a select or multiselect setting from a shared catalog file (keys become options, labels become optionLabels). Use instead of options."
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {"properties": {"type": {"enum": ["select", "multiselect"]}}},
|
||||
"then": {"oneOf": [{"required": ["options"]}, {"required": ["choices"]}]},
|
||||
"else": {
|
||||
"not": {
|
||||
"anyOf": [{"required": ["options"]}, {"required": ["optionLabels"]}, {"required": ["choices"]}]
|
||||
}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "secret"}}},
|
||||
"then": {"not": {"required": ["default"]}}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"enum": ["string", "select"]}}},
|
||||
"then": {"properties": {"default": {"type": "string"}}}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "multiselect"}}},
|
||||
"then": {
|
||||
"properties": {"default": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}}
|
||||
}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "number"}}},
|
||||
"then": {"properties": {"default": {"type": "number"}}},
|
||||
"else": {"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}}
|
||||
},
|
||||
{
|
||||
"if": {"properties": {"type": {"const": "boolean"}}},
|
||||
"then": {"properties": {"default": {"type": "boolean"}}}
|
||||
}
|
||||
]
|
||||
},
|
||||
"panel": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["sections"],
|
||||
"description": "Layout of connections leaving this node. Without it, a default panel is used. A section with picker: true positions the Extra conditions catch-all; without one it is appended collapsed. On start, a panel replaces the top-level controls list.",
|
||||
"properties": {
|
||||
"sections": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"maxItems": 16,
|
||||
"items": {"$ref": "#/definitions/panelSection"}
|
||||
}
|
||||
}
|
||||
},
|
||||
"panelSection": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["id", "label"],
|
||||
"properties": {
|
||||
"id": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*$", "maxLength": 80},
|
||||
"label": {"type": "string", "minLength": 1, "maxLength": 160},
|
||||
"collapsed": {"type": "boolean"},
|
||||
"picker": {
|
||||
"type": "boolean",
|
||||
"description": "This section is the Extra conditions catch-all over every declared field of Start and upstream stages; it holds no fields or controls."
|
||||
},
|
||||
"controls": {
|
||||
"type": "array",
|
||||
"items": {"const": "weeklySchedule"},
|
||||
"maxItems": 1,
|
||||
"description": "Start only."
|
||||
},
|
||||
"fields": {"type": "array", "maxItems": 32, "items": {"$ref": "#/definitions/panelField"}}
|
||||
},
|
||||
"if": {"properties": {"picker": {"const": true}}, "required": ["picker"]},
|
||||
"then": {"not": {"anyOf": [{"required": ["fields"]}, {"required": ["controls"]}]}}
|
||||
},
|
||||
"panelField": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["field", "widget"],
|
||||
"properties": {
|
||||
"field": {
|
||||
"type": "string",
|
||||
"description": "ID of a field declared in this contract; each field is placed at most once."
|
||||
},
|
||||
"label": {"type": "string", "minLength": 1, "maxLength": 160},
|
||||
"widget": {
|
||||
"enum": ["multiselect", "select", "text", "number", "toggle"],
|
||||
"description": "multiselect: string with choices (in); select: choices (eq, ne); text: string (eq, contains, matches, ne, in); number: integer or number (gte, gt, lte, lt, eq, ne); toggle: boolean (eq, ne)."
|
||||
},
|
||||
"operator": {
|
||||
"enum": ["eq", "ne", "in", "contains", "matches", "gt", "gte", "lt", "lte"],
|
||||
"description": "Fixed operator; must be declared by the field and supported by the widget. Defaults to the first widget operator the field declares."
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"allOf": [
|
||||
{
|
||||
"if": {"properties": {"stage": {"const": "start"}}, "required": ["stage"]},
|
||||
"then": {"not": {"required": ["params"]}},
|
||||
"else": {"not": {"anyOf": [{"required": ["controls"]}, {"required": ["triggerModes"]}]}}
|
||||
},
|
||||
{"if": {"required": ["panel"]}, "then": {"not": {"required": ["controls"]}}}
|
||||
]
|
||||
}
|
||||
@@ -1,128 +0,0 @@
|
||||
{{- define "hub.workflowConfiguration.bundledPaths" -}}
|
||||
{{- list "workflow-contracts/start.yaml" "workflow-contracts/anpr.yaml" "workflow-contracts/forwarder.yaml" "catalogs/classifications.json" | toYaml -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.workflowConfiguration.anpr.configMapName" -}}
|
||||
{{- printf "%s-workflow-contract-anpr" (.Release.Name | trunc 40 | trimSuffix "-") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.workflowConfiguration.forwarder.configMapName" -}}
|
||||
{{- printf "%s-workflow-contract-forwarder" (.Release.Name | trunc 40 | trimSuffix "-") -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.classificationCatalog.configMapName" -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- $replacement := index $config.replacements "catalogs/classifications.json" | default dict -}}
|
||||
{{- if $replacement -}}
|
||||
{{- $replacement.name -}}
|
||||
{{- else -}}
|
||||
{{- default "classification-catalog" .Values.classificationCatalogExistingConfigMap -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Normalize both interfaces without changing the caller's values. */}}
|
||||
{{- define "hub.workflowConfiguration.settings" -}}
|
||||
{{- $config := .Values.workflowConfiguration | default dict -}}
|
||||
{{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
|
||||
{{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
|
||||
{{- if and $unified $legacy -}}
|
||||
{{- fail "workflowConfiguration cannot mix includeDefaults/configMaps with existingConfigMap/items/extraConfigMaps" -}}
|
||||
{{- end -}}
|
||||
{{- $includeDefaults := true -}}
|
||||
{{- $sources := $config.extraConfigMaps | default list -}}
|
||||
{{- if $unified -}}
|
||||
{{- $sources = $config.configMaps | default list -}}
|
||||
{{- if hasKey $config "includeDefaults" -}}
|
||||
{{- $includeDefaults = $config.includeDefaults -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if $config.existingConfigMap -}}
|
||||
{{- if and $config.enabled (not $config.items) -}}
|
||||
{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
|
||||
{{- end -}}
|
||||
{{- $includeDefaults = false -}}
|
||||
{{- $sources = prepend $sources (dict "name" $config.existingConfigMap "items" ($config.items | default list)) -}}
|
||||
{{- else if and $config.enabled $config.items -}}
|
||||
{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $enabled := $config.enabled | default false -}}
|
||||
{{- $replacements := dict -}}
|
||||
{{- $normalizedSources := list -}}
|
||||
{{- $bundledPaths := include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray -}}
|
||||
{{- range $sources -}}
|
||||
{{- $name := .name -}}
|
||||
{{- $items := list -}}
|
||||
{{- range .items -}}
|
||||
{{- if and $enabled .replace -}}
|
||||
{{- if or (not $unified) (not $includeDefaults) -}}
|
||||
{{- fail "workflowConfiguration item replace: true requires configMaps with includeDefaults: true" -}}
|
||||
{{- end -}}
|
||||
{{- if not (has .path $bundledPaths) -}}
|
||||
{{- fail (printf "workflowConfiguration item replace: true targets unknown bundled path %q" .path) -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $replacements .path -}}
|
||||
{{- fail (printf "duplicate workflowConfiguration replacement path %q" .path) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $replacements .path (dict "name" $name "key" .key) -}}
|
||||
{{- end -}}
|
||||
{{- $items = append $items (omit . "replace") -}}
|
||||
{{- end -}}
|
||||
{{- $normalizedSources = append $normalizedSources (dict "name" $name "items" $items) -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $replacements "catalogs/classifications.json" -}}
|
||||
{{- if .Values.classificationCatalogExistingConfigMap -}}
|
||||
{{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- if not (kindIs "invalid" .Values.classificationCatalog) -}}
|
||||
{{- if not .Values.classificationCatalogEnabled -}}
|
||||
{{- fail "classificationCatalog requires classificationCatalogEnabled; remove the inline list to use the API fallback" -}}
|
||||
{{- end -}}
|
||||
{{- if .Values.classificationCatalogExistingConfigMap -}}
|
||||
{{- fail "classificationCatalog cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $replacements "catalogs/classifications.json" -}}
|
||||
{{- fail "classificationCatalog cannot be combined with a classifications.json replacement; choose one override mechanism" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.workflowConfiguration.validate" -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- if $config.enabled -}}
|
||||
{{- $paths := dict -}}
|
||||
{{- if $config.includeDefaults -}}
|
||||
{{- if not .Values.classificationCatalogEnabled -}}
|
||||
{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; disable includeDefaults and supply configMaps for a custom bundle" -}}
|
||||
{{- end -}}
|
||||
{{- range $path := (include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray) -}}
|
||||
{{- if not (hasKey $config.replacements $path) -}}
|
||||
{{- $_ := set $paths $path true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- else -}}
|
||||
{{- if not $config.configMaps -}}
|
||||
{{- fail "workflowConfiguration.configMaps must be nonempty when enabled without defaults" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- range $config.configMaps -}}
|
||||
{{- if not .items -}}
|
||||
{{- fail (printf "workflowConfiguration ConfigMap %q requires nonempty items" .name) -}}
|
||||
{{- end -}}
|
||||
{{- range .items -}}
|
||||
{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
|
||||
{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
|
||||
{{- end -}}
|
||||
{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$" .path)) (ne (clean .path) .path) -}}
|
||||
{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $paths .path -}}
|
||||
{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $paths .path true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -1,51 +0,0 @@
|
||||
{{/*
|
||||
The system tag catalog (deviceTags.system.catalog) uses the Hub shared choice
|
||||
catalog format: {key, label, description?}. values.schema.json validates each
|
||||
entry (key in stored device tag form, models.NormalizeDeviceTags: 1-64
|
||||
characters of a-z, 0-9, ".", "_", ":" and "-", starting and ending with a
|
||||
letter or digit) and that enabled is a boolean; keys must also be unique.
|
||||
*/}}
|
||||
{{- define "kerberoshub.deviceTags.system.validate" -}}
|
||||
{{- $seen := dict -}}
|
||||
{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
|
||||
{{- $key := toString $tag.key -}}
|
||||
{{- if hasKey $seen $key -}}
|
||||
{{- fail (printf "deviceTags.system.catalog: duplicate key %q" $key) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $seen $key true -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The configured system tag catalog as a JSON array, whether or not system tags
|
||||
are enabled (missing values read as empty).
|
||||
*/}}
|
||||
{{- define "kerberoshub.deviceTags.system.catalog" -}}
|
||||
{{- $deviceTags := .Values.deviceTags | default dict -}}
|
||||
{{- $system := $deviceTags.system | default dict -}}
|
||||
{{- $system.catalog | default list | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Whether system tags are enabled (deviceTags.system.enabled): "true" or "".
|
||||
*/}}
|
||||
{{- define "kerberoshub.deviceTags.system.enabled" -}}
|
||||
{{- $deviceTags := .Values.deviceTags | default dict -}}
|
||||
{{- $system := $deviceTags.system | default dict -}}
|
||||
{{- if and (kindIs "bool" $system.enabled) $system.enabled -}}true{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
The system tag catalog file hub-api reads (DEVICE_SYSTEM_TAGS_FILE), rendered
|
||||
from deviceTags.system.catalog into the device-system-tags ConfigMap.
|
||||
*/}}
|
||||
{{- define "kerberoshub.deviceTags.system.json" -}}
|
||||
{{- include "kerberoshub.deviceTags.system.validate" . -}}
|
||||
{{- $tags := list -}}
|
||||
{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
|
||||
{{- $entry := dict "key" $tag.key "label" $tag.label -}}
|
||||
{{- with $tag.description }}{{- $_ := set $entry "description" . -}}{{- end }}
|
||||
{{- $tags = append $tags $entry -}}
|
||||
{{- end -}}
|
||||
{{- $tags | toJson -}}
|
||||
{{- end -}}
|
||||
@@ -1,113 +0,0 @@
|
||||
{{/* Build the path to the configured MongoDB CA bundle. */}}
|
||||
{{- define "hub.mongodb.tlsCAFile" -}}
|
||||
{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
|
||||
{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
|
||||
{{- define "hub.mongodb.uri" -}}
|
||||
{{- $uri := .Values.mongodb.uri | default "" -}}
|
||||
{{- if and .Values.mongodb.tls.enabled $uri -}}
|
||||
{{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
|
||||
{{- $separator := "?" -}}
|
||||
{{- if contains "?" $uri -}}
|
||||
{{- $separator = "&" -}}
|
||||
{{- end -}}
|
||||
{{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
|
||||
{{- $separator = "" -}}
|
||||
{{- end -}}
|
||||
{{- $uri = printf "%s%stls=true" $uri $separator -}}
|
||||
{{- end -}}
|
||||
{{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
|
||||
{{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
|
||||
{{- $separator := "&" -}}
|
||||
{{- if not (contains "?" $uri) -}}
|
||||
{{- $separator = "?" -}}
|
||||
{{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
|
||||
{{- $separator = "" -}}
|
||||
{{- end -}}
|
||||
{{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $uri -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
MongoDB URI with appName set to one workload, so the Atlas query profiler and
|
||||
currentOp attribute each operation to the service that issued it. Renders
|
||||
nothing when no URI is configured or mongodb.appNamePerService is false.
|
||||
Usage: include "hub.mongodb.appUri" (dict "root" $ "app" "hub-api")
|
||||
*/}}
|
||||
{{- define "hub.mongodb.appUri" -}}
|
||||
{{- $uri := include "hub.mongodb.uri" .root -}}
|
||||
{{- if and $uri .root.Values.mongodb.appNamePerService -}}
|
||||
{{- if regexMatch "(?i)[?&]appName=" $uri -}}
|
||||
{{- $uri = regexReplaceAll "(?i)([?&])appName=[^&]*" $uri (printf "${1}appName=%s" .app) -}}
|
||||
{{- else -}}
|
||||
{{- $separator := "&" -}}
|
||||
{{- if not (contains "?" $uri) -}}
|
||||
{{- $separator = "?" -}}
|
||||
{{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
|
||||
{{- $separator = "" -}}
|
||||
{{- end -}}
|
||||
{{- $uri = printf "%s%sappName=%s" $uri $separator .app -}}
|
||||
{{- end -}}
|
||||
{{- $uri -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Container env entry that overrides MONGODB_URI from mongodb-config with the
|
||||
workload's own appName. An explicit env entry takes precedence over envFrom.
|
||||
Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
|
||||
*/}}
|
||||
{{- define "hub.mongodb.appUriEnv" -}}
|
||||
{{- with include "hub.mongodb.appUri" . -}}
|
||||
- name: MONGODB_URI
|
||||
value: {{ . | quote }}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the shared MongoDB CA Secret volume. */}}
|
||||
{{- define "hub.mongodb.tlsVolume" -}}
|
||||
- name: mongodb-tls
|
||||
secret:
|
||||
secretName: {{ .Values.mongodb.tls.existingSecret }}
|
||||
{{- end -}}
|
||||
|
||||
{{/* Render the shared MongoDB CA volume mount. */}}
|
||||
{{- define "hub.mongodb.tlsVolumeMount" -}}
|
||||
- name: mongodb-tls
|
||||
mountPath: {{ .Values.mongodb.tls.mountPath }}
|
||||
readOnly: true
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
OpenTelemetry sampler env entries, rendered only when configured. The OTel SDKs
|
||||
read these natively; unset keeps the SDK default (parentbased_always_on).
|
||||
"hub.opentelemetry.samplerEnv" renders opentelemetry.sampler, the sampler of the
|
||||
services downstream of the Vault (pipeline, workflows engine and stages), which
|
||||
continue the Vault's trace; "hub.opentelemetry.apiSamplerEnv" renders
|
||||
opentelemetry.apiSampler for hub-api, which starts its own traces for user
|
||||
requests.
|
||||
Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
*/}}
|
||||
{{- define "hub.opentelemetry.samplerEnv" -}}
|
||||
{{- include "hub.opentelemetry.samplerEnvFrom" .Values.opentelemetry.sampler -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.opentelemetry.apiSamplerEnv" -}}
|
||||
{{- include "hub.opentelemetry.samplerEnvFrom" (.Values.opentelemetry.apiSampler | default dict) -}}
|
||||
{{- end -}}
|
||||
|
||||
{{- define "hub.opentelemetry.samplerEnvFrom" -}}
|
||||
{{- with .type }}
|
||||
- name: OTEL_TRACES_SAMPLER
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- with .arg }}
|
||||
- name: OTEL_TRACES_SAMPLER_ARG
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- end -}}
|
||||
@@ -1,46 +0,0 @@
|
||||
{{- define "hub.classificationCatalog.defaults" -}}
|
||||
[
|
||||
{"key": "animal", "label": "Animal", "icon": "animal"},
|
||||
{"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
|
||||
{"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
|
||||
{"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
|
||||
{"key": "lorry", "label": "Lorry", "icon": "lorry"},
|
||||
{"key": "car", "label": "Car", "icon": "car"},
|
||||
{"key": "handbag", "label": "Handbag", "icon": "handbag"},
|
||||
{"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
|
||||
{"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
|
||||
]
|
||||
{{- end -}}
|
||||
{{/*
|
||||
The effective chart-rendered catalog: the inline classificationCatalog values
|
||||
list when set, otherwise the bundled defaults above. values.schema.json
|
||||
validates each entry ({key, label, icon?}); keys must also be unique.
|
||||
*/}}
|
||||
{{- define "hub.classificationCatalog.json" -}}
|
||||
{{- if kindIs "invalid" .Values.classificationCatalog -}}
|
||||
{{- include "hub.classificationCatalog.defaults" . | mustFromJson | toJson -}}
|
||||
{{- else if and (kindIs "slice" .Values.classificationCatalog) .Values.classificationCatalog -}}
|
||||
{{- $seen := dict -}}
|
||||
{{- range $entry := .Values.classificationCatalog -}}
|
||||
{{- $key := toString $entry.key -}}
|
||||
{{- if hasKey $seen $key -}}
|
||||
{{- fail (printf "classificationCatalog: duplicate key %q" $key) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $seen $key true -}}
|
||||
{{- end -}}
|
||||
{{- .Values.classificationCatalog | toJson -}}
|
||||
{{- else -}}
|
||||
{{- fail "classificationCatalog must be omitted (bundled defaults) or a nonempty list; to use the API fallback set classificationCatalogEnabled: false" -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: classification-catalog
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
classifications.json: |-
|
||||
{{- include "hub.classificationCatalog.json" . | mustFromJson | toPrettyJson | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -1,12 +0,0 @@
|
||||
{{- if include "kerberoshub.deviceTags.system.enabled" . }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: device-system-tags
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
# Rendered from deviceTags.system.catalog; hub-api reads it through
|
||||
# DEVICE_SYSTEM_TAGS_FILE.
|
||||
system-tags.json: |-
|
||||
{{- include "kerberoshub.deviceTags.system.json" . | mustFromJson | toPrettyJson | nindent 4 }}
|
||||
{{- end -}}
|
||||
@@ -1,51 +0,0 @@
|
||||
{{- if .Values.audit.enabled -}}
|
||||
{{- $destinations := list -}}
|
||||
{{- $destinationIDs := dict -}}
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
|
||||
{{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
|
||||
{{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $destinationIDs $id -}}
|
||||
{{- fail (printf "duplicate audit destination id %q" $id) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $destinationIDs $id true -}}
|
||||
{{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
|
||||
{{- $entry := dict
|
||||
"id" $id
|
||||
"type" (default "webhook" $destination.type)
|
||||
"enabled" $destination.enabled
|
||||
"url" $url
|
||||
"timeoutSeconds" (default 10 $destination.timeoutSeconds)
|
||||
"batchSize" (default 100 $destination.batchSize)
|
||||
"maxAttempts" (default 10 $destination.maxAttempts)
|
||||
"startAt" (default "latest" $destination.startAt)
|
||||
"headers" (default dict $destination.headers)
|
||||
"filters" (default dict $destination.filters) -}}
|
||||
{{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret -}}
|
||||
{{- if gt (len $bearer) 0 -}}
|
||||
{{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
|
||||
{{- $secretKey := default "token" $bearer.key -}}
|
||||
{{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- $headerFiles := dict -}}
|
||||
{{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
|
||||
{{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
|
||||
{{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
|
||||
{{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
|
||||
{{- end -}}
|
||||
{{- if gt (len $headerFiles) 0 -}}
|
||||
{{- $_ := set $entry "headerFiles" $headerFiles -}}
|
||||
{{- end -}}
|
||||
{{- $destinations = append $destinations $entry -}}
|
||||
{{- end -}}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
destinations.json: |
|
||||
{{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -1,135 +0,0 @@
|
||||
{{/* Validate the rendered anpr.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
|
||||
{{- define "hub.workflowConfiguration.anpr" -}}
|
||||
schemaVersion: 1
|
||||
stage: anpr
|
||||
contractVersion: 1
|
||||
presentation:
|
||||
name: Number plate recognition
|
||||
description: Read the number plates of vehicles in the recording.
|
||||
icon: car
|
||||
color: amber
|
||||
|
||||
# Node settings hub-anpr reads per run (see its README, "Node settings"). Each
|
||||
# overrides the matching ANPR_* environment variable; the defaults below equal
|
||||
# the worker's built-in defaults. A deployment that changes those variables
|
||||
# should change these defaults too, because new nodes store them on save.
|
||||
params:
|
||||
- name: plateClasses
|
||||
label: Read plates for
|
||||
description: Vehicle classes whose plates are read (ANPR_PLATE_CLASSES).
|
||||
type: multiselect
|
||||
choices: {file: ../catalogs/classifications.json}
|
||||
default: [car]
|
||||
group: Which vehicles
|
||||
- name: minMovement
|
||||
label: Minimum movement
|
||||
description: Skip vehicles that barely moved; 0 reads every vehicle (ANPR_READ_MOVEMENT_MIN).
|
||||
type: number
|
||||
minimum: 0
|
||||
default: 0
|
||||
group: Which vehicles
|
||||
- name: maxJump
|
||||
label: Maximum jump between frames
|
||||
description: Drop unstable tracks; 0 disables the check (ANPR_READ_MAX_JUMP).
|
||||
type: number
|
||||
minimum: 0
|
||||
default: 0
|
||||
group: Which vehicles
|
||||
- name: readFrames
|
||||
label: Frames to read per vehicle
|
||||
description: Frames OCR'd per vehicle; 0 disables OCR (ANPR_READ_FRAMES).
|
||||
type: number
|
||||
minimum: 0
|
||||
maximum: 10
|
||||
default: 1
|
||||
group: Recognition
|
||||
- name: readQuorum
|
||||
label: Agreeing reads required
|
||||
description: Reads that must agree before a plate is accepted; 0 accepts any read (ANPR_READ_QUORUM).
|
||||
type: number
|
||||
minimum: 0
|
||||
maximum: 10
|
||||
default: 0
|
||||
group: Recognition
|
||||
- name: minConfidence
|
||||
label: Minimum OCR confidence
|
||||
description: Ignore reads below this confidence (ANPR_READ_CONF_MIN).
|
||||
type: number
|
||||
minimum: 0
|
||||
maximum: 1
|
||||
default: 0
|
||||
group: Recognition
|
||||
|
||||
# Paths are relative to results.anpr (models.WorkflowAnprResult): one track and
|
||||
# one marker per vehicle. Plate, unread and class can be tied to the same
|
||||
# vehicle with "Must match the same item"; OCR confidence and engine live on
|
||||
# the markers and cannot be tied to a plate.
|
||||
fields:
|
||||
- id: plate
|
||||
label: Number plate
|
||||
path: detections.*.tracks.*.meta.plate
|
||||
type: string
|
||||
operators: [eq, in, contains, matches] # stored uppercase, letters and digits only, e.g. AB123CD
|
||||
optional: true
|
||||
- id: unread
|
||||
label: Plate could not be read
|
||||
path: detections.*.tracks.*.meta.unread
|
||||
type: boolean
|
||||
operators: [eq]
|
||||
optional: true
|
||||
- id: vehicleClass
|
||||
label: Vehicle class (from classification)
|
||||
path: detections.*.tracks.*.meta.classifiedAs
|
||||
type: string
|
||||
operators: [eq, in]
|
||||
optional: true
|
||||
choices: {file: ../catalogs/classifications.json}
|
||||
- id: ocrConfidence
|
||||
label: OCR confidence
|
||||
path: markers.*.metadata.confidence
|
||||
type: number
|
||||
operators: [gte, gt, lte, lt] # read plates only; about 0-1 for fast, 0.5 for tesseract
|
||||
minimum: 0
|
||||
optional: true
|
||||
- id: ocrEngine
|
||||
label: OCR engine
|
||||
path: markers.*.metadata.engine
|
||||
type: string
|
||||
operators: [eq, in] # read plates only
|
||||
optional: true
|
||||
choices: {values: [fast, tesseract, tesseract+opencv, http]}
|
||||
- id: secondsVisible
|
||||
label: Seconds visible
|
||||
path: markers.*.duration
|
||||
type: integer
|
||||
operators: [gte, lte]
|
||||
minimum: 0
|
||||
optional: true
|
||||
|
||||
# Connections leaving this stage; Extra conditions are appended collapsed.
|
||||
panel:
|
||||
sections:
|
||||
- id: plate
|
||||
label: Plate
|
||||
fields:
|
||||
- {field: plate, widget: text, operator: contains, label: Plate contains (e.g. AB123)}
|
||||
- {field: unread, widget: toggle, label: Plate could not be read}
|
||||
- id: recognition
|
||||
label: Recognition
|
||||
collapsed: true
|
||||
fields:
|
||||
- {field: ocrConfidence, widget: number, operator: gte, label: Minimum OCR confidence}
|
||||
- {field: vehicleClass, widget: multiselect}
|
||||
- {field: secondsVisible, widget: number, operator: gte, label: Visible for at least (seconds)}
|
||||
{{ end -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/anpr.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
anpr.yaml: |-
|
||||
{{- include "hub.workflowConfiguration.anpr" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -1,95 +0,0 @@
|
||||
{{/* Validate the rendered forwarder.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
|
||||
{{- define "hub.workflowConfiguration.forwarder" -}}
|
||||
schemaVersion: 1
|
||||
stage: forwarder
|
||||
contractVersion: 1
|
||||
presentation:
|
||||
name: Forward to my system
|
||||
description: Send the run's data to your own RabbitMQ destination.
|
||||
icon: share
|
||||
color: green
|
||||
|
||||
# Custom workflows supply their own connection; deployment credentials are never
|
||||
# inherited. These non-secret defaults are stored on save, not read from the worker.
|
||||
params:
|
||||
- name: broker
|
||||
label: Provider
|
||||
description: Custom workflows use their own RabbitMQ destination. Shared deployment integrations are reserved for global workflows.
|
||||
type: select
|
||||
required: true
|
||||
options: [rabbitmq]
|
||||
optionLabels: {rabbitmq: RabbitMQ}
|
||||
default: rabbitmq
|
||||
group: Delivery
|
||||
- name: mode
|
||||
label: Completion mode
|
||||
description: Complete after delivery, or wait for the external result. Callback requires a deployment-configured Hub callback URL.
|
||||
type: select
|
||||
required: true
|
||||
options: [delivered, callback]
|
||||
optionLabels: {delivered: Complete after delivery, callback: Wait for result}
|
||||
default: delivered
|
||||
group: Delivery
|
||||
- name: host
|
||||
label: Host
|
||||
description: Your RabbitMQ destination host. Required before enabling the workflow.
|
||||
type: string
|
||||
required: true
|
||||
placeholder: rabbitmq.example.com
|
||||
group: RabbitMQ destination
|
||||
- name: port
|
||||
label: Port
|
||||
description: Your RabbitMQ destination port, a whole number (usually 5671 with TLS or 5672 without TLS).
|
||||
type: number
|
||||
required: true
|
||||
minimum: 1
|
||||
maximum: 65535
|
||||
group: RabbitMQ destination
|
||||
- name: queue
|
||||
label: Queue
|
||||
description: Your destination queue. Its dead-letter queue is this name followed by .forwarder-dead-letter.
|
||||
type: string
|
||||
required: true
|
||||
group: RabbitMQ destination
|
||||
- name: vhost
|
||||
label: Virtual host
|
||||
description: Your RabbitMQ virtual host. Use / for the broker's default virtual host.
|
||||
type: string
|
||||
required: true
|
||||
placeholder: /
|
||||
group: RabbitMQ destination
|
||||
- name: tls
|
||||
label: Use TLS
|
||||
description: Encrypt the connection and verify the broker certificate using system trust roots. Deployment TLS overrides are never inherited.
|
||||
type: boolean
|
||||
required: true
|
||||
default: true
|
||||
group: RabbitMQ destination
|
||||
- name: username
|
||||
label: Username
|
||||
description: Your RabbitMQ destination username. Deployment credentials are never used.
|
||||
type: string
|
||||
required: true
|
||||
group: RabbitMQ credentials
|
||||
- name: password
|
||||
label: Password
|
||||
description: Your RabbitMQ destination password. Required before enabling the workflow; masked after saving.
|
||||
type: secret
|
||||
required: true
|
||||
group: RabbitMQ credentials
|
||||
|
||||
# It contributes no output fields: connections after it can still use Start and
|
||||
# earlier stages in Extra conditions.
|
||||
fields: []
|
||||
{{ end -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/forwarder.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
forwarder.yaml: |-
|
||||
{{- include "hub.workflowConfiguration.forwarder" . | nindent 4 }}
|
||||
{{- end }}
|
||||
@@ -1,75 +0,0 @@
|
||||
{{/* Validate the rendered start.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
|
||||
{{- define "hub.workflowConfiguration.start" -}}
|
||||
schemaVersion: 1
|
||||
stage: start
|
||||
contractVersion: 1
|
||||
|
||||
# Paths refer to the safe initial context, not the full event or credentials.
|
||||
fields:
|
||||
- id: device
|
||||
label: Device
|
||||
path: device.deviceKey
|
||||
type: string
|
||||
operators: [eq, in]
|
||||
choices:
|
||||
source: project.devices
|
||||
- id: sites
|
||||
label: Sites
|
||||
path: device.siteIds.*
|
||||
type: string
|
||||
operators: [in]
|
||||
choices:
|
||||
source: project.sites
|
||||
- id: groups
|
||||
label: Groups
|
||||
path: device.groupIds.*
|
||||
type: string
|
||||
operators: [in]
|
||||
choices:
|
||||
source: project.groups
|
||||
- id: classifications
|
||||
label: Initial classifications
|
||||
path: inputs.classify.details.*.classified
|
||||
type: string
|
||||
operators: [in]
|
||||
optional: true
|
||||
choices:
|
||||
file: ../catalogs/classifications.json
|
||||
# Condition-only context fields (not selectors): advanced conditions on
|
||||
# Start connections may test only declared fields, under device. or inputs.
|
||||
- id: deviceName
|
||||
label: Camera name
|
||||
path: device.deviceName
|
||||
type: string
|
||||
operators: [eq, in, contains, matches]
|
||||
- id: objectClass
|
||||
label: Detected object
|
||||
path: inputs.classify.details.*.classified
|
||||
type: string
|
||||
operators: [eq, ne, in, exists]
|
||||
optional: true
|
||||
choices:
|
||||
file: ../catalogs/classifications.json
|
||||
|
||||
# Controls offered for new authoring; an omitted control is not offered.
|
||||
controls:
|
||||
- id: weeklySchedule
|
||||
label: Weekly schedule
|
||||
- id: conditions
|
||||
label: Advanced conditions
|
||||
|
||||
# Trigger modes offered for new authoring; omitted offers both.
|
||||
triggerModes: [automatic, manual]
|
||||
{{ end -}}
|
||||
{{- include "hub.workflowConfiguration.validate" . -}}
|
||||
{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/start.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
|
||||
apiVersion: v1
|
||||
kind: ConfigMap
|
||||
metadata:
|
||||
name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
start.yaml: |-
|
||||
{{- include "hub.workflowConfiguration.start" . | nindent 4 }}
|
||||
{{- end }}
|
||||
+1
-4
@@ -4,7 +4,7 @@ metadata:
|
||||
name: mongodb-config
|
||||
namespace: {{ .Release.Namespace }}
|
||||
data:
|
||||
MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
|
||||
MONGODB_URI: "{{ .Values.mongodb.uri }}"
|
||||
MONGODB_HOST: "{{ .Values.mongodb.host }}"
|
||||
MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
|
||||
MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
|
||||
@@ -12,7 +12,4 @@ data:
|
||||
MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
|
||||
MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
|
||||
MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
|
||||
MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
|
||||
MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
|
||||
MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
|
||||
MONGODB_DATABASE_CLOUD: "Kerberos"
|
||||
@@ -1,6 +1,4 @@
|
||||
{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
|
||||
{{- $workflowConfiguration := include "hub.workflowConfiguration.settings" . | fromYaml -}}
|
||||
{{- $catalogReplacement := index $workflowConfiguration.replacements "catalogs/classifications.json" | default dict -}}
|
||||
{{- if .Values.kerberoshub.api.serviceEnabled }}
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
@@ -121,22 +119,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
|
||||
checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if include "kerberoshub.deviceTags.system.enabled" . }}
|
||||
checksum/device-system-tags: {{ include (print $.Template.BasePath "/configMaps/catalogs/device-system-tags.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
|
||||
checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml")) }}
|
||||
checksum/workflow-contract-anpr: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/anpr.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
{{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml")) }}
|
||||
checksum/workflow-contract-forwarder: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/forwarder.yaml") . | sha256sum }}
|
||||
{{- end }}
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-api
|
||||
spec:
|
||||
@@ -148,67 +131,8 @@ spec:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
|
||||
{{- $deviceSystemTagsEnabled := include "kerberoshub.deviceTags.system.enabled" . }}
|
||||
{{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
{{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
|
||||
volumes:
|
||||
{{- if $workflowConfiguration.enabled }}
|
||||
- name: workflow-configuration
|
||||
projected:
|
||||
sources:
|
||||
{{- if $workflowConfiguration.includeDefaults }}
|
||||
{{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml") }}
|
||||
- configMap:
|
||||
name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
|
||||
items:
|
||||
- key: start.yaml
|
||||
path: workflow-contracts/start.yaml
|
||||
{{- end }}
|
||||
{{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml") }}
|
||||
- configMap:
|
||||
name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
|
||||
items:
|
||||
- key: anpr.yaml
|
||||
path: workflow-contracts/anpr.yaml
|
||||
{{- end }}
|
||||
{{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml") }}
|
||||
- configMap:
|
||||
name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
|
||||
items:
|
||||
- key: forwarder.yaml
|
||||
path: workflow-contracts/forwarder.yaml
|
||||
{{- end }}
|
||||
{{- if not $catalogReplacement }}
|
||||
- configMap:
|
||||
name: {{ include "hub.classificationCatalog.configMapName" . }}
|
||||
items:
|
||||
- key: classifications.json
|
||||
path: catalogs/classifications.json
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- range $workflowConfiguration.configMaps }}
|
||||
- configMap:
|
||||
name: {{ .name | quote }}
|
||||
items:
|
||||
{{- toYaml .items | nindent 20 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: classification-catalog
|
||||
configMap:
|
||||
name: {{ include "hub.classificationCatalog.configMapName" . }}
|
||||
{{- if or .Values.classificationCatalogExistingConfigMap $catalogReplacement }}
|
||||
items:
|
||||
- key: {{ default "classifications.json" $catalogReplacement.key | quote }}
|
||||
path: classifications.json
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- if $deviceSystemTagsEnabled }}
|
||||
- name: device-system-tags
|
||||
configMap:
|
||||
name: device-system-tags
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
@@ -217,9 +141,6 @@ spec:
|
||||
secret:
|
||||
secretName: {{ $serverTLS.secretName }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
@@ -236,23 +157,8 @@ spec:
|
||||
ports:
|
||||
- containerPort: 80
|
||||
name: http
|
||||
{{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
{{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
|
||||
volumeMounts:
|
||||
{{- if $workflowConfiguration.enabled }}
|
||||
- name: workflow-configuration
|
||||
mountPath: /etc/kerberos/configuration
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: classification-catalog
|
||||
mountPath: /etc/kerberos/classifications
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if $deviceSystemTagsEnabled }}
|
||||
- name: device-system-tags
|
||||
mountPath: /etc/kerberos/device-tags
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.api.volumeMounts}}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -261,26 +167,12 @@ spec:
|
||||
mountPath: {{ $serverTLS.mountPath }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
# Mongodb - loaded from ConfigMap
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
|
||||
{{- if $classificationCatalogEnabled }}
|
||||
- name: CLASSIFICATION_CATALOG_FILE
|
||||
value: /etc/kerberos/classifications/classifications.json
|
||||
{{- end }}
|
||||
{{- if $deviceSystemTagsEnabled }}
|
||||
# System tag catalog (deviceTags.system.catalog): the only system
|
||||
# tags owners can assign. Unset (disabled) disables system tags.
|
||||
- name: DEVICE_SYSTEM_TAGS_FILE
|
||||
value: /etc/kerberos/device-tags/system-tags.json
|
||||
{{- end }}
|
||||
- name: ENVIRONMENT
|
||||
value: "{{ .Values.environment }}"
|
||||
- name: READ_ONLY
|
||||
@@ -295,26 +187,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
|
||||
- name: PUBLIC_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
|
||||
- name: REFRESH_COOKIE_SECURE
|
||||
value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
|
||||
{{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
|
||||
{{- with .Values.kerberoshub.frontend.legacyUrl }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
|
||||
{{- end }}
|
||||
{{- range .Values.kerberoshub.frontend.domains }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
|
||||
{{- end }}
|
||||
{{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
|
||||
{{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
|
||||
{{- end }}
|
||||
{{- range .Values.kerberoshub.api.corsAllowedOrigins }}
|
||||
{{- $corsOrigins = append $corsOrigins . }}
|
||||
{{- end }}
|
||||
- name: CORS_ALLOWED_ORIGINS
|
||||
value: {{ join "," $corsOrigins | quote }}
|
||||
{{ if .Values.isPrivate }}
|
||||
- name: KERBEROS_PRIVATE_CLOUD
|
||||
value: "true"
|
||||
@@ -361,27 +233,6 @@ spec:
|
||||
- name: KERBEROS_JWT_SECRET
|
||||
value: "{{ .Values.kerberoshub.api.jwtSecret }}"
|
||||
|
||||
# Temporarily stop serving the polled GET /devices list (204, no DB reads).
|
||||
- name: DISABLE_AGENT_HEARTBEAT
|
||||
value: {{ .Values.kerberoshub.api.disableAgentHeartbeat | default false | quote }}
|
||||
|
||||
# Media proxy: hide Vault/storage endpoints behind hub-api URLs.
|
||||
{{- $mediaProxy := .Values.kerberoshub.api.mediaProxy | default dict }}
|
||||
- name: MEDIA_PROXY_ENABLED
|
||||
value: {{ $mediaProxy.enabled | default false | quote }}
|
||||
{{- if $mediaProxy.publicUrl }}
|
||||
- name: MEDIA_PROXY_PUBLIC_URL
|
||||
value: {{ $mediaProxy.publicUrl | quote }}
|
||||
{{- end }}
|
||||
{{- if $mediaProxy.key }}
|
||||
- name: MEDIA_PROXY_KEY
|
||||
value: {{ $mediaProxy.key | quote }}
|
||||
{{- end }}
|
||||
{{- if $mediaProxy.ttl }}
|
||||
- name: MEDIA_PROXY_TTL
|
||||
value: {{ $mediaProxy.ttl | quote }}
|
||||
{{- end }}
|
||||
|
||||
# SSO (OIDC) setup
|
||||
- name: SSO_DOMAINS
|
||||
value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
|
||||
@@ -420,9 +271,6 @@ spec:
|
||||
# workflows (for example the one-stage case redaction modal flow).
|
||||
- name: WORKFLOW_STAGE_QUEUES
|
||||
value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
|
||||
# Stages tenants may place in the workflow editor (see workflows.editorStages).
|
||||
- name: WORKFLOW_EDITOR_STAGES
|
||||
value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
|
||||
|
||||
# Stripe for billing
|
||||
- name: STRIPE_KEY
|
||||
@@ -484,14 +332,6 @@ spec:
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
- name: AUDIT_ENABLED
|
||||
value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
|
||||
{{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
|
||||
- name: AUDIT_QUEUE
|
||||
value: {{ .Values.audit.intake.queue | quote }}
|
||||
- name: AUDIT_DEADLETTER_QUEUE
|
||||
value: {{ .Values.audit.intake.deadletterQueue | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Slack notifications (this will send events/logs to a specific channel).
|
||||
- name: SLACK_ENABLED
|
||||
@@ -580,11 +420,11 @@ spec:
|
||||
- name: VAULT_SPRITE_SECRET_KEY
|
||||
value: "{{ .Values.kerberosvault.sprite.secretKey }}"
|
||||
- name: VAULT_SPRITE_INTERVAL
|
||||
value: "{{ .Values.kerberospipeline.sprite.interval }}"
|
||||
value: "{{ .Values.kerberosvault.sprite.interval }}"
|
||||
- name: VAULT_SPRITE_WIDTH
|
||||
value: "{{ .Values.kerberospipeline.sprite.width }}"
|
||||
value: "{{ .Values.kerberosvault.sprite.width }}"
|
||||
- name: VAULT_SPRITE_HEIGHT
|
||||
value: "{{ .Values.kerberospipeline.sprite.height }}"
|
||||
value: "{{ .Values.kerberosvault.sprite.height }}"
|
||||
{{- if .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
|
||||
{{- end }}
|
||||
@@ -597,6 +437,5 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.apiSamplerEnv" $ | trim | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
|
||||
@@ -1,18 +0,0 @@
|
||||
{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
|
||||
apiVersion: monitoring.coreos.com/v1
|
||||
kind: ServiceMonitor
|
||||
metadata:
|
||||
name: hub-audit-servicemonitor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
service: hub-audit
|
||||
release: prometheus
|
||||
spec:
|
||||
selector:
|
||||
matchLabels:
|
||||
service: hub-audit
|
||||
endpoints:
|
||||
- port: metrics
|
||||
interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
|
||||
path: /metrics
|
||||
{{- end }}
|
||||
@@ -1,167 +0,0 @@
|
||||
{{- if .Values.audit.enabled -}}
|
||||
{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
|
||||
{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
|
||||
{{- end -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberoshub.audit.replicas }}
|
||||
selector:
|
||||
matchLabels:
|
||||
app: hub-audit
|
||||
minReadySeconds: 10
|
||||
strategy:
|
||||
type: RollingUpdate
|
||||
rollingUpdate:
|
||||
maxUnavailable: 1
|
||||
maxSurge: 1
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
spec:
|
||||
terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
|
||||
{{- if .Values.kerberoshub.serviceAccount.create }}
|
||||
serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
|
||||
{{- end }}
|
||||
{{- with .Values.imagePullSecrets }}
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
volumes:
|
||||
- name: destinations
|
||||
configMap:
|
||||
name: hub-audit
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
projected:
|
||||
sources:
|
||||
{{- if gt (len $bearer) 0 }}
|
||||
- secret:
|
||||
name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
|
||||
items:
|
||||
- key: {{ default "token" $bearer.key | quote }}
|
||||
path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- range $headerName, $secret := $secretHeaders }}
|
||||
- secret:
|
||||
name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
|
||||
items:
|
||||
- key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
|
||||
path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumes }}
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
containers:
|
||||
- name: hub-audit
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
|
||||
{{- with .Values.kerberoshub.audit.resources }}
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- name: metrics
|
||||
containerPort: 2112
|
||||
protocol: TCP
|
||||
readinessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
livenessProbe:
|
||||
httpGet:
|
||||
path: /healthz
|
||||
port: metrics
|
||||
volumeMounts:
|
||||
- name: destinations
|
||||
mountPath: /etc/hub-audit
|
||||
readOnly: true
|
||||
{{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
|
||||
{{- $bearer := default dict $destination.bearerTokenSecret }}
|
||||
{{- $secretHeaders := default dict $destination.secretHeaders }}
|
||||
{{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
|
||||
- name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
|
||||
mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
|
||||
readOnly: true
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.audit.volumeMounts }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-audit") | nindent 12 }}
|
||||
- name: RABBITMQ_HOST
|
||||
value: {{ .Values.rabbitmq.host | quote }}
|
||||
- name: RABBITMQ_EXCHANGE
|
||||
value: {{ .Values.rabbitmq.exchange | quote }}
|
||||
- name: RABBITMQ_USERNAME
|
||||
value: {{ .Values.rabbitmq.username | quote }}
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: {{ .Values.rabbitmq.password | quote }}
|
||||
- name: AUDIT_QUEUE
|
||||
value: {{ .Values.audit.intake.queue | quote }}
|
||||
- name: AUDIT_DEADLETTER_QUEUE
|
||||
value: {{ .Values.audit.intake.deadletterQueue | quote }}
|
||||
- name: AUDIT_MAX_RETRIES
|
||||
value: {{ .Values.audit.intake.maxRetries | quote }}
|
||||
- name: AUDIT_PREFETCH_COUNT
|
||||
value: {{ .Values.audit.intake.prefetchCount | quote }}
|
||||
- name: AUDIT_PERSIST_TIMEOUT
|
||||
value: {{ .Values.audit.intake.persistTimeout | quote }}
|
||||
- name: DISPATCH_INTERVAL
|
||||
value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
|
||||
- name: LEASE_DURATION
|
||||
value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
|
||||
- name: POD_NAME
|
||||
valueFrom:
|
||||
fieldRef:
|
||||
fieldPath: metadata.name
|
||||
{{- with .Values.kerberoshub.audit.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
kind: Service
|
||||
metadata:
|
||||
name: hub-audit
|
||||
namespace: {{ .Release.Namespace }}
|
||||
labels:
|
||||
app: hub-audit
|
||||
service: hub-audit
|
||||
spec:
|
||||
ports:
|
||||
- name: metrics
|
||||
port: 2112
|
||||
targetPort: metrics
|
||||
protocol: TCP
|
||||
selector:
|
||||
app: hub-audit
|
||||
{{- end }}
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-cleanup
|
||||
spec:
|
||||
@@ -29,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.cleanup.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -51,22 +45,16 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.cleanup.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-cleanup") | nindent 12 }}
|
||||
- name: MODE
|
||||
value: "{{ .Values.kerberoshub.cleanup.mode }}"
|
||||
- name: LOG_LEVEL
|
||||
@@ -109,10 +97,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
|
||||
- name: DEFAULT_TASK_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
|
||||
- name: AUDIT_EVENT_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
|
||||
- name: WORKFLOW_RUN_RETENTION_DAYS
|
||||
value: "{{ .Values.kerberoshub.cleanup.workflowRunRetentionDays | default "0" }}"
|
||||
{{- if .Values.kerberoshub.extraEnv }}
|
||||
{{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
|
||||
{{- end }}
|
||||
|
||||
@@ -192,12 +192,6 @@ spec:
|
||||
# Google maps for using and displaying cameras, sites on a map
|
||||
- name: GOOGLEMAPS_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
|
||||
- name: GOOGLEMAPS_PLACES_API
|
||||
value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"
|
||||
|
||||
# features > chart
|
||||
- name: CHART_COLORS
|
||||
value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
|
||||
|
||||
# Zendesk for support
|
||||
- name: ZENDESK_URL
|
||||
@@ -235,32 +229,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_DAY_OVERVIEW_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
|
||||
- name: FEATURE_DEVICE_ANALYTICS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
|
||||
- name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
|
||||
- name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
|
||||
- name: FEATURE_PROJECTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
|
||||
- name: FEATURE_PROJECT_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
|
||||
- name: FEATURE_PROJECT_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
|
||||
- name: FEATURE_PROJECT_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
|
||||
- name: FEATURE_DARK_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
|
||||
- name: FEATURE_SPLASH_SCREEN_ENABLED
|
||||
@@ -281,10 +249,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
|
||||
- name: FEATURE_MOQ_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
|
||||
- name: FEATURE_REMOTE_RECORDING_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
|
||||
- name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
|
||||
- name: MOQ_RELAY_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
|
||||
- name: MOQ_BROADCAST_PREFIX
|
||||
@@ -303,26 +267,6 @@ spec:
|
||||
# features > floorplan
|
||||
- name: FEATURE_FLOORPLAN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
|
||||
# features > map
|
||||
- name: MAP_TILE_URL_LIGHT
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
|
||||
- name: MAP_TILE_URL_DARK
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
|
||||
- name: MAP_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
|
||||
- name: MAP_OVERLAY_TILE_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
|
||||
- name: MAP_OVERLAY_API_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
|
||||
- name: MAP_OVERLAY_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
|
||||
- name: MAP_OVERLAY_MIN_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
|
||||
- name: MAP_OVERLAY_MAX_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
|
||||
- name: MAP_OVERLAY_OPACITY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
|
||||
|
||||
- name: COLOR_TRACK_BOX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
|
||||
- name: COLOR_TRACK_BOX_HOVER
|
||||
@@ -356,9 +300,7 @@ spec:
|
||||
|
||||
# features > face redaction
|
||||
- name: FEATURE_FACE_REDACTION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
- name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
|
||||
# features > media
|
||||
- name: FEATURE_MEDIA_FILTER_DATE_ENABLED
|
||||
@@ -373,8 +315,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_STAR_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_REGION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_SORT_ENABLED
|
||||
@@ -383,12 +323,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
|
||||
value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
|
||||
|
||||
@@ -275,8 +275,6 @@ spec:
|
||||
# Google maps for using and displaying cameras, sites on a map
|
||||
- name: GOOGLEMAPS_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
|
||||
- name: GOOGLEMAPS_PLACES_API
|
||||
value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"
|
||||
|
||||
# Zendesk for support
|
||||
- name: ZENDESK_URL
|
||||
@@ -314,32 +312,10 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
|
||||
- name: FEATURE_WORKFLOWS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
|
||||
- name: FEATURE_AUDIT_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
|
||||
- name: FEATURE_DAY_OVERVIEW_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
|
||||
- name: FEATURE_DEVICE_ANALYTICS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
|
||||
- name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
|
||||
- name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
|
||||
- name: FEATURE_ORGANISATIONS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
|
||||
- name: FEATURE_ORGANISATION_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
|
||||
- name: FEATURE_ORGANISATION_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
|
||||
- name: FEATURE_PROJECTS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
|
||||
- name: FEATURE_PROJECT_SWITCHER_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
|
||||
- name: FEATURE_PROJECT_CREATION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
|
||||
- name: FEATURE_PROJECT_SETTINGS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
|
||||
- name: FEATURE_DARK_MODE
|
||||
value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
|
||||
- name: FEATURE_SPLASH_SCREEN_ENABLED
|
||||
@@ -362,10 +338,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
|
||||
- name: FEATURE_MOQ_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
|
||||
- name: FEATURE_REMOTE_RECORDING_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
|
||||
- name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
|
||||
- name: MOQ_RELAY_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
|
||||
- name: MOQ_BROADCAST_PREFIX
|
||||
@@ -392,18 +364,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
|
||||
- name: MAP_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
|
||||
- name: MAP_OVERLAY_TILE_URL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
|
||||
- name: MAP_OVERLAY_API_KEY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
|
||||
- name: MAP_OVERLAY_ATTRIBUTION
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
|
||||
- name: MAP_OVERLAY_MIN_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
|
||||
- name: MAP_OVERLAY_MAX_ZOOM
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
|
||||
- name: MAP_OVERLAY_OPACITY
|
||||
value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
|
||||
|
||||
- name: COLOR_TRACK_BOX
|
||||
value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
|
||||
@@ -433,8 +393,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
|
||||
|
||||
# features > chart
|
||||
- name: CHART_COLORS
|
||||
value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
|
||||
- name: COLOR_CHART_SELECTION_FILL
|
||||
value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
|
||||
- name: COLOR_CHART_SELECTION_STROKE
|
||||
@@ -448,9 +406,7 @@ spec:
|
||||
|
||||
# features > face redaction
|
||||
- name: FEATURE_FACE_REDACTION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
- name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
|
||||
value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
|
||||
|
||||
# features > media
|
||||
- name: FEATURE_MEDIA_FILTER_DATE_ENABLED
|
||||
@@ -465,8 +421,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_STAR_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_REGION_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_SORT_ENABLED
|
||||
@@ -475,12 +429,6 @@ spec:
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
|
||||
- name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
|
||||
value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
|
||||
- name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
|
||||
value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
|
||||
- name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
|
||||
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-monitor-device
|
||||
spec:
|
||||
@@ -29,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.monitordevice.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -51,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.monitordevice.volumeMounts}}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
|
||||
- name: READ_ONLY
|
||||
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-reactivate-subscription
|
||||
spec:
|
||||
@@ -26,16 +26,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.reactivate.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -44,20 +38,14 @@ spec:
|
||||
- name: hub-reactivate-subscription
|
||||
image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
|
||||
imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
|
||||
{{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.reactivate.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-reactivatesubscriptions") | nindent 12 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
|
||||
- name: READ_ONLY
|
||||
|
||||
@@ -1,100 +1,15 @@
|
||||
{{/*
|
||||
Reserve every effective identity, including disabled definitions, so enabling a
|
||||
workflow later cannot silently alias another workflow's runs or references.
|
||||
*/}}
|
||||
{{- define "kerberoshub.workflows.validateDefinitions" -}}
|
||||
{{- $identities := dict -}}
|
||||
{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
|
||||
{{- $id := sha256sum $name | trunc 24 -}}
|
||||
{{- if hasKey $wf "id" -}}
|
||||
{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
|
||||
{{- if not (kindIs "string" $wf.id) -}}
|
||||
{{- fail $invalid -}}
|
||||
{{- end -}}
|
||||
{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
|
||||
{{- fail $invalid -}}
|
||||
{{- end -}}
|
||||
{{- $id = lower $wf.id -}}
|
||||
{{- end -}}
|
||||
{{- if hasKey $identities $id -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
|
||||
{{- end -}}
|
||||
{{- $_ := set $identities $id $name -}}
|
||||
{{- end -}}
|
||||
{{- include "kerberoshub.workflows.validateSystemTags" . -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Guard the definitions that can select devices by system tag. The engine reads
|
||||
JSON keys case-insensitively and ignores unknown ones, so a misspelled or
|
||||
re-cased key silently changes what a definition selects (a dropped
|
||||
systemTags scope makes a global workflow run on every device). Therefore:
|
||||
- definitions and triggers may only use the keys the engine knows, spelled
|
||||
exactly (definition: id, enabled, triggers, stages; trigger: the
|
||||
models.WorkflowTrigger fields);
|
||||
- while deviceTags.system.enabled is false, no definition may mention system
|
||||
tags anywhere (trigger systemTags, or a device.systemTags condition at any
|
||||
depth, in triggers, shared conditions or stage needs), matched
|
||||
case-insensitively on the whole definition;
|
||||
- every system tag a trigger selects must be in deviceTags.system.catalog,
|
||||
so a typo fails rendering instead of never matching a device.
|
||||
Disabled definitions are checked too, so enabling one cannot fail later.
|
||||
*/}}
|
||||
{{- define "kerberoshub.workflows.validateSystemTags" -}}
|
||||
{{- include "kerberoshub.deviceTags.system.validate" . -}}
|
||||
{{- $catalog := dict -}}
|
||||
{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
|
||||
{{- $_ := set $catalog (toString $tag.key) true -}}
|
||||
{{- end -}}
|
||||
{{- $enabled := include "kerberoshub.deviceTags.system.enabled" . -}}
|
||||
{{- $definitionKeys := list "id" "enabled" "triggers" "stages" -}}
|
||||
{{- $triggerKeys := list "type" "edgeId" "sharedConditions" "devices" "siteIds" "groupIds" "systemTags" "classifications" "conditionMode" "conditions" "weeklySchedule" "surfaces" -}}
|
||||
{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
|
||||
{{- if $wf -}}
|
||||
{{- if not (kindIs "map" $wf) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q] must be an object" $name) -}}
|
||||
{{- end -}}
|
||||
{{- if and (not $enabled) (contains "systemtags" (lower (toJson $wf))) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q] selects devices by system tag (systemTags or a device.systemTags condition), but deviceTags.system.enabled is false" $name) -}}
|
||||
{{- end -}}
|
||||
{{- range $key, $_ := $wf -}}
|
||||
{{- if not (has $key $definitionKeys) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored" $name $key (join ", " $definitionKeys)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- range $i, $trigger := ($wf.triggers | default list) -}}
|
||||
{{- if not (kindIs "map" $trigger) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d] must be an object" $name $i) -}}
|
||||
{{- end -}}
|
||||
{{- range $key, $_ := $trigger -}}
|
||||
{{- if not (has $key $triggerKeys) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored and widen the trigger" $name $i $key (join ", " $triggerKeys)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- range $tag := ($trigger.systemTags | default list) -}}
|
||||
{{- if not (hasKey $catalog (toString $tag)) -}}
|
||||
{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d].systemTags: %q is not in deviceTags.system.catalog; add it to the system tag catalog" $name $i (toString $tag)) -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
|
||||
{{/*
|
||||
Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
|
||||
JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
|
||||
This is the engine's boot-loaded configuration source and deployment stage
|
||||
catalog: several distinct config workflows can run over one recording — each
|
||||
opens its own run and dispatches only its own stages. Organisation-scoped
|
||||
database workflows are discovered separately at runtime.
|
||||
This is the engine's single routing source: several distinct workflows can run
|
||||
over one recording — each opens its own run and dispatches only its own stages.
|
||||
|
||||
Each enabled definition contributes one workflow object:
|
||||
id optional explicit stable identity, normalized to lowercase. Omitted
|
||||
for legacy definitions; their effective id is SHA256(name)[:24].
|
||||
name the map key (mutable display name when an explicit id is supplied).
|
||||
name the map key (the workflow's human-readable name; also its identity —
|
||||
the engine derives a stable id from it when the definition carries
|
||||
no explicit id).
|
||||
enabled always true here (a disabled definition is skipped entirely).
|
||||
source "config" — provenance marking a Helm-defined, deployment-global,
|
||||
source "config" — provenance marking a Helm-seeded, deployment-global,
|
||||
ops-managed workflow (read-only in the API, no owning organisation).
|
||||
triggers how a run OPENS. Defaults to a single bare automatic trigger
|
||||
(opens for every recording); narrow with device/schedule triggers.
|
||||
@@ -111,7 +26,6 @@ Each enabled definition contributes one workflow object:
|
||||
needsMode conditional stages: "any" (default) | "all".
|
||||
*/}}
|
||||
{{- define "kerberoshub.workflows.workflowDefinitions" -}}
|
||||
{{- include "kerberoshub.workflows.validateDefinitions" . -}}
|
||||
{{- $defs := list -}}
|
||||
{{- $services := .Values.kerberoshub.services | default dict -}}
|
||||
{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
|
||||
@@ -127,7 +41,6 @@ Each enabled definition contributes one workflow object:
|
||||
{{- $stages = append $stages $entry -}}
|
||||
{{- end -}}
|
||||
{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
|
||||
{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
|
||||
{{- $defs = append $defs $def -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
@@ -144,11 +57,9 @@ use this only to embed the same queue on a synthetic stage.
|
||||
{{- define "kerberoshub.workflows.stageQueues" -}}
|
||||
{{- $queues := dict -}}
|
||||
{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
|
||||
{{- if ne $operation "workflows" -}}
|
||||
{{- with $service.queue -}}
|
||||
{{- $_ := set $queues $operation . -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- end -}}
|
||||
{{- $queues | toJson -}}
|
||||
{{- end -}}
|
||||
|
||||
@@ -18,9 +18,6 @@
|
||||
redaction) declares its destination provider with the named field
|
||||
services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
|
||||
read-only stage omits it and gets no provider env.
|
||||
|
||||
Worker-specific settings go in services.<name>.env (plain values) and
|
||||
services.<name>.secretEnv (references to keys in an existing Secret).
|
||||
*/ -}}
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
|
||||
{{- $root := . -}}
|
||||
@@ -117,14 +114,6 @@ spec:
|
||||
- name: KERBEROS_STORAGE_PROVIDER
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
{{- if $root.Values.opentelemetry.enabled }}
|
||||
|
||||
# OpenTelemetry tracing: the stage continues the engine's dispatch span
|
||||
# (the run's traceparent) and follows its sampling decision.
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ $root.Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $root | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
# Per-stage tuning knobs. Any key/value under services.<name>.env is
|
||||
# rendered verbatim as container env, so a worker can be tuned from
|
||||
@@ -133,19 +122,6 @@ spec:
|
||||
{{- range $key, $value := $svc.env }}
|
||||
- name: {{ $key }}
|
||||
value: {{ $value | quote }}
|
||||
{{- end }} {{- with $svc.secretEnv }}
|
||||
|
||||
# Per-stage secret env. Each key under services.<name>.secretEnv maps a
|
||||
# container env var to a key in an existing Kubernetes Secret
|
||||
# ({name, key}), so credentials such as a model API key stay out of
|
||||
# values. The Secret must exist in the release namespace.
|
||||
{{- range $key, $ref := . }}
|
||||
- name: {{ $key }}
|
||||
valueFrom:
|
||||
secretKeyRef:
|
||||
name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
|
||||
key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -1,4 +1,3 @@
|
||||
{{- include "kerberoshub.workflows.validateDefinitions" . -}}
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
@@ -19,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: hub-workflows
|
||||
spec:
|
||||
@@ -30,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.services.workflows.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -52,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.services.workflows.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-workflows") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
|
||||
- name: QUEUE_SYSTEM
|
||||
@@ -75,17 +62,12 @@ spec:
|
||||
# named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
|
||||
# trigger and executable stages, assembled from the enabled definitions
|
||||
# under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
|
||||
# Definitions are the engine's boot-loaded config source and deployment
|
||||
# stage catalog. Organisation-scoped database workflows are read per
|
||||
# recording; an in-cluster engine refuses to start only when both the
|
||||
# config definitions and the stage-queue catalog below are empty.
|
||||
# Definitions are the engine's single routing source; empty means no
|
||||
# workflows run.
|
||||
- name: WORKFLOWS_QUEUE
|
||||
value: "{{ .Values.kerberoshub.services.workflows.queue }}"
|
||||
- name: WORKFLOW_DEFINITIONS
|
||||
value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
|
||||
# Operation→queue catalog so DB workflows reach workers no config workflow references.
|
||||
- name: WORKFLOW_STAGE_QUEUES
|
||||
value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
|
||||
|
||||
# RabbitMQ settings
|
||||
- name: RABBITMQ_HOST
|
||||
@@ -115,7 +97,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-analysis
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.analysis.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-analysis
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.analysis.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.analysis.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-analysis") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
|
||||
- name: CLOUD_PROVIDER
|
||||
@@ -121,20 +105,6 @@ spec:
|
||||
# Sprites
|
||||
- name: SPRITE_ENABLED
|
||||
value: "{{ .Values.kerberospipeline.sprite.enabled }}"
|
||||
|
||||
# Dominant colors
|
||||
- name: DOMINANTCOLOR_ENABLED
|
||||
value: "{{ .Values.kerberospipeline.dominantColor.enabled }}"
|
||||
|
||||
# Thumbnail regeneration from classified frames (opt-in)
|
||||
- name: THUMBNAIL_REGENERATION_ENABLED
|
||||
value: {{ .Values.kerberospipeline.analysis.thumbnailRegeneration.enabled | default false | quote }}
|
||||
|
||||
# In-memory cache for hot-path MongoDB lookups
|
||||
- name: DB_CACHE_ENABLED
|
||||
value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
|
||||
- name: DB_CACHE_TTL
|
||||
value: {{ .Values.kerberospipeline.analysis.dbCache.ttl | default "5m" | quote }}
|
||||
|
||||
{{- if .Values.opentelemetry.enabled }}
|
||||
# Open Telemetry tracing
|
||||
@@ -144,7 +114,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-counting
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.counting.replicas }}
|
||||
selector:
|
||||
@@ -89,7 +85,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -1,13 +1,9 @@
|
||||
{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.dominantColor.enabled true) -}}
|
||||
{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
name: pipe-dominantcolor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
|
||||
selector:
|
||||
@@ -89,7 +85,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-event
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.event.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.event.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-event
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.event.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,22 +45,16 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.event.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
ports:
|
||||
- containerPort: 8080
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-event") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.event.logLevel }}"
|
||||
- name: READ_ONLY
|
||||
@@ -110,7 +94,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-export
|
||||
spec:
|
||||
@@ -29,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.export.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -51,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.export.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-export") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.export.logLevel }}"
|
||||
{{- if .Values.kerberospipeline.export.playerAssetsPath }}
|
||||
@@ -142,7 +130,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-monitor
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.monitor.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-monitor
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.monitor.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,24 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.monitor.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-monitor") | nindent 8 }}
|
||||
# Application
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
|
||||
|
||||
# Queue
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
@@ -131,7 +111,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -18,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-notify-test
|
||||
spec:
|
||||
@@ -29,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -51,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification-test") | nindent 8 }}
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
|
||||
@@ -130,7 +118,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-notify
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.notify.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-notify
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.notify.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,24 +45,16 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.notify.volumeMounts}}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.notify.logLevel }}"
|
||||
- name: NOTIFICATION_EXPIRY_MINUTES
|
||||
value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
|
||||
# Queue
|
||||
- name: QUEUE_SYSTEM
|
||||
value: "{{ .Values.queueProvider }}"
|
||||
@@ -98,14 +80,6 @@ spec:
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
- name: AUDIT_ENABLED
|
||||
value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
|
||||
{{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
|
||||
- name: AUDIT_QUEUE
|
||||
value: {{ .Values.audit.intake.queue | quote }}
|
||||
- name: AUDIT_DEADLETTER_QUEUE
|
||||
value: {{ .Values.audit.intake.deadletterQueue | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Kerberos Vault
|
||||
- name: STORAGE_URI
|
||||
@@ -176,7 +150,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-sequence
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.sequence.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-sequence
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.sequence.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.sequence.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
|
||||
- name: CLOUD_PROVIDER
|
||||
value: "{{ .Values.cloudProvider }}"
|
||||
- name: QUEUE_SYSTEM
|
||||
@@ -104,7 +88,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-sprite
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.sprite.replicas }}
|
||||
selector:
|
||||
@@ -87,10 +83,6 @@ spec:
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
{{- with .Values.kerberospipeline.sprite.prefetchCount }}
|
||||
- name: RABBITMQ_PREFETCH_COUNT
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
# There is an option to store the sprites in a storage provider in Kerberos Vault.
|
||||
- name: VAULT_SPRITE_ENABLED
|
||||
@@ -116,7 +108,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-throttler
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.throttler.replicas }}
|
||||
selector:
|
||||
@@ -22,7 +18,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: pipe-throttler
|
||||
spec:
|
||||
@@ -33,16 +29,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberospipeline.throttler.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -55,20 +45,14 @@ spec:
|
||||
resources:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberospipeline.throttler.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-throttler") | nindent 8 }}
|
||||
- name: LOG_LEVEL
|
||||
value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
|
||||
- name: CLOUD_PROVIDER
|
||||
@@ -106,7 +90,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
---
|
||||
apiVersion: v1
|
||||
|
||||
@@ -4,10 +4,6 @@ kind: Deployment
|
||||
metadata:
|
||||
name: pipe-thumbnail
|
||||
namespace: {{ .Release.Namespace }}
|
||||
{{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
|
||||
annotations:
|
||||
{{- toYaml . | nindent 4 }}
|
||||
{{- end }}
|
||||
spec:
|
||||
replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
|
||||
selector:
|
||||
@@ -87,10 +83,6 @@ spec:
|
||||
value: "{{ .Values.rabbitmq.username }}"
|
||||
- name: RABBITMQ_PASSWORD
|
||||
value: "{{ .Values.rabbitmq.password }}"
|
||||
{{- with .Values.kerberospipeline.thumbnail.prefetchCount }}
|
||||
- name: RABBITMQ_PREFETCH_COUNT
|
||||
value: {{ . | quote }}
|
||||
{{- end }}
|
||||
|
||||
# Thumbnail generation
|
||||
- name: THUMBNAIL_QUALITY
|
||||
@@ -119,7 +111,6 @@ spec:
|
||||
value: "{{ .Values.opentelemetry.routingEnabled }}"
|
||||
- name: OTEL_EXPORTER_OTLP_ENDPOINT
|
||||
value: "{{ .Values.opentelemetry.collector.endpoint }}"
|
||||
{{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
|
||||
{{- end }}
|
||||
|
||||
---
|
||||
|
||||
@@ -19,7 +19,7 @@ spec:
|
||||
template:
|
||||
metadata:
|
||||
annotations:
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
|
||||
checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
|
||||
labels:
|
||||
app: vault-forwarder
|
||||
spec:
|
||||
@@ -27,16 +27,10 @@ spec:
|
||||
imagePullSecrets:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- $mongodbTLS := .Values.mongodb.tls }}
|
||||
{{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumes:
|
||||
{{- with .Values.kerberoshub.forwarder.volumes }}
|
||||
volumes:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
{{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
|
||||
topologySpreadConstraints:
|
||||
{{- toYaml . | nindent 8 }}
|
||||
@@ -49,20 +43,14 @@ spec:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
{{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
|
||||
volumeMounts:
|
||||
{{- with .Values.kerberoshub.forwarder.volumeMounts }}
|
||||
volumeMounts:
|
||||
{{- toYaml . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
|
||||
{{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
|
||||
{{- end }}
|
||||
{{- end }}
|
||||
envFrom:
|
||||
- configMapRef:
|
||||
name: mongodb-config
|
||||
env:
|
||||
{{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
|
||||
- name: ITERATION_SPEED
|
||||
value: "5"
|
||||
- name: BUFFER_TIME
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
|
||||
{{- if eq .Values.mode "all" -}}
|
||||
apiVersion: apps/v1
|
||||
kind: Deployment
|
||||
metadata:
|
||||
|
||||
@@ -1,146 +0,0 @@
|
||||
{
|
||||
"$schema": "http://json-schema.org/draft-07/schema#",
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"classificationCatalogExistingConfigMap": {
|
||||
"type": "string",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
|
||||
},
|
||||
"classificationCatalog": {
|
||||
"type": ["array", "null"],
|
||||
"minItems": 1,
|
||||
"description": "Optional inline classification catalog in the Hub shared choice catalog format; replaces the bundled defaults in the chart's classification-catalog ConfigMap. Omit (or null) for the bundled defaults. Keys must be unique (checked when rendering).",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["key", "label"],
|
||||
"properties": {
|
||||
"key": {"type": "string", "minLength": 1},
|
||||
"label": {"type": "string", "minLength": 1},
|
||||
"icon": {"type": "string", "minLength": 1}
|
||||
}
|
||||
}
|
||||
},
|
||||
"deviceTags": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"system": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"properties": {
|
||||
"enabled": {
|
||||
"type": "boolean",
|
||||
"description": "Owners may assign system tags and global workflows may select devices by them. Only for deployments whose owners are trusted (self-hosted)."
|
||||
},
|
||||
"catalog": {
|
||||
"type": "array",
|
||||
"description": "The system tags owners can assign, in the Hub shared choice catalog format (key, label) plus an optional description. Keys must be unique (checked when rendering).",
|
||||
"items": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["key", "label"],
|
||||
"properties": {
|
||||
"key": {
|
||||
"type": "string",
|
||||
"maxLength": 64,
|
||||
"pattern": "^[a-z0-9]([a-z0-9._:-]*[a-z0-9])?$"
|
||||
},
|
||||
"label": {"type": "string", "minLength": 1},
|
||||
"description": {"type": "string"}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"kerberoshub": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"api": {
|
||||
"type": "object",
|
||||
"properties": {
|
||||
"corsAllowedOrigins": {
|
||||
"type": "array",
|
||||
"items": {
|
||||
"type": "string",
|
||||
"pattern": "^https?://[^/?#]+$"
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"workflowConfiguration": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["enabled"],
|
||||
"not": {
|
||||
"allOf": [
|
||||
{"anyOf": [{"required": ["includeDefaults"]}, {"required": ["configMaps"]}]},
|
||||
{"anyOf": [{"required": ["existingConfigMap"]}, {"required": ["items"]}, {"required": ["extraConfigMaps"]}]}
|
||||
]
|
||||
},
|
||||
"properties": {
|
||||
"enabled": {"type": "boolean"},
|
||||
"includeDefaults": {
|
||||
"type": "boolean",
|
||||
"description": "Include bundled files not explicitly replaced by configMaps items; true when omitted."
|
||||
},
|
||||
"configMaps": {
|
||||
"type": "array",
|
||||
"items": {"$ref": "#/definitions/configMapSource"},
|
||||
"description": "Add files or explicitly replace a bundled file using replace: true on an item."
|
||||
},
|
||||
"extraConfigMaps": {
|
||||
"type": "array",
|
||||
"description": "Legacy additive sources; use configMaps for new deployments.",
|
||||
"items": {"$ref": "#/definitions/configMapSource"}
|
||||
},
|
||||
"existingConfigMap": {
|
||||
"type": "string",
|
||||
"maxLength": 253,
|
||||
"pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
|
||||
},
|
||||
"items": {
|
||||
"type": "array",
|
||||
"items": {"$ref": "#/definitions/configMapItem"}
|
||||
}
|
||||
}
|
||||
}
|
||||
},
|
||||
"definitions": {
|
||||
"configMapSource": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["name", "items"],
|
||||
"properties": {
|
||||
"name": {
|
||||
"type": "string",
|
||||
"maxLength": 253,
|
||||
"pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
|
||||
},
|
||||
"items": {
|
||||
"type": "array",
|
||||
"minItems": 1,
|
||||
"items": {"$ref": "#/definitions/configMapItem"}
|
||||
}
|
||||
}
|
||||
},
|
||||
"configMapItem": {
|
||||
"type": "object",
|
||||
"additionalProperties": false,
|
||||
"required": ["key", "path"],
|
||||
"properties": {
|
||||
"key": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
|
||||
"path": {"type": "string", "pattern": "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$"},
|
||||
"replace": {
|
||||
"type": "boolean",
|
||||
"description": "Replace this whole bundled file, not individual fields/entries. Requires configMaps and includeDefaults: true; the path must identify a bundled file."
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
}
|
||||
+98
-444
@@ -46,10 +46,6 @@ mongodb:
|
||||
# MongoDB URI (for example for a SaaS service like MongoDB Atlas)
|
||||
# If uri is set, the below properties are not used (host, adminDatabase, username, password)
|
||||
#uri: "mongodb+srv://xx:xx@kerberos-hub.xxx.mongodb.net/?retryWrites=true&w=majority&appName=xxx"
|
||||
# When uri is set, give each workload its own appName (hub-api,
|
||||
# hub-pipeline-monitor, ...) instead of the one in uri, so the Atlas query
|
||||
# profiler and currentOp show which service issued an operation.
|
||||
appNamePerService: true
|
||||
|
||||
# Self-hosted mongodb, you could also use the uri property above.
|
||||
host: mongodb.mongodb
|
||||
@@ -64,74 +60,6 @@ mongodb:
|
||||
# and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
|
||||
# should also set retryWrites: "false".
|
||||
flavor: "mongodb"
|
||||
# TLS for MongoDB-compatible backends. When uri is set, missing TLS query
|
||||
# parameters are appended automatically. AWS DocumentDB requires TLS and a
|
||||
# trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
|
||||
tls:
|
||||
enabled: false
|
||||
existingSecret: ""
|
||||
caFileName: ""
|
||||
mountPath: "/etc/mongodb/tls"
|
||||
insecureSkipVerify: false
|
||||
|
||||
# Classifications supported by Hub filters, alerts, markers, and other
|
||||
# downstream processing. Classifier output keys must match these values.
|
||||
# Disable this to use the legacy classification catalog stored in MongoDB.
|
||||
classificationCatalogEnabled: true
|
||||
# Optional existing ConfigMap in the release namespace with classifications.json.
|
||||
# When set, do not create a catalog ConfigMap; this replaces bundled defaults.
|
||||
classificationCatalogExistingConfigMap: ""
|
||||
# Defaults live in templates/configMaps/catalogs/classifications.yaml.
|
||||
# Optionally define the complete catalog inline instead; it replaces the
|
||||
# defaults in the chart's classification-catalog ConfigMap (and so the bundled
|
||||
# catalogs/classifications.json). Entries are {key, label, icon?} with unique
|
||||
# keys. Do not combine it with classificationCatalogExistingConfigMap or a
|
||||
# catalogs/classifications.json replacement in workflowConfiguration.
|
||||
# classificationCatalog:
|
||||
# - key: car
|
||||
# label: Car
|
||||
# icon: car
|
||||
|
||||
# Device tags, grouped by type. System tags are defined here and assigned by
|
||||
# owners (a multi-select on the device page); global workflows select devices
|
||||
# across organisations by system tag (`systemTags` in a trigger). Owners set
|
||||
# them, so any owner could enroll devices into such a workflow: enable only
|
||||
# where owners are the deployment's administrators (self-hosted), never on
|
||||
# multi-tenant SaaS. While disabled, hub-api gets an empty catalog (system tags
|
||||
# cannot be set) and rendering fails on workflows that select devices by
|
||||
# system tag.
|
||||
deviceTags:
|
||||
system:
|
||||
enabled: false # a boolean (true/false), not a string
|
||||
# The only system tags owners can assign, in the Hub shared choice catalog
|
||||
# format (as catalogs/classifications.json) plus an optional description.
|
||||
# Rendered into the device-system-tags ConfigMap for hub-api.
|
||||
# key stored tag: 1-64 characters of a-z, 0-9, ".", "_", ":" or
|
||||
# "-", starting and ending with a letter or digit; unique.
|
||||
# label display name.
|
||||
# description optional help text shown with the tag.
|
||||
# Workflow trigger systemTags must exist here; otherwise rendering fails.
|
||||
catalog: []
|
||||
# - key: anpr-pilot
|
||||
# label: ANPR pilot
|
||||
# description: Runs licence plate recognition on this camera
|
||||
|
||||
# Configuration packaging only: consuming contracts requires a compatible
|
||||
# API/frontend. Enabling this mounts files but does not register stage workers.
|
||||
workflowConfiguration:
|
||||
enabled: false
|
||||
# Omitted includeDefaults means true; false requires a nonempty configMaps list.
|
||||
# includeDefaults: true
|
||||
# configMaps: []
|
||||
# Each ConfigMap supplies name and items [{key, path, replace?}] in the release namespace.
|
||||
# An item with replace: true replaces one bundled file while retaining other defaults.
|
||||
# Replacement requires includeDefaults: true and a known bundled destination path.
|
||||
# Unmarked collisions and repeated custom destinations are rejected.
|
||||
# Replacing catalogs/classifications.json also supplies the classification API:
|
||||
# do not combine it with classificationCatalogExistingConfigMap or classificationCatalog.
|
||||
# Legacy existingConfigMap/items/extraConfigMaps remain supported, but cannot
|
||||
# be mixed with includeDefaults/configMaps. Both interfaces are omitted here
|
||||
# so Helm's default merging does not introduce a false mixed configuration.
|
||||
###################################################
|
||||
# MQTT configuration (bi-directional communication)
|
||||
###################################################
|
||||
@@ -165,16 +93,6 @@ rabbitmq:
|
||||
username: "yourusername"
|
||||
password: "yourpassword"
|
||||
exchange: ""
|
||||
# Shared audit transport. The master switch controls the consumer and all
|
||||
# producers; individual services may opt out through their own audit setting.
|
||||
audit:
|
||||
enabled: false
|
||||
intake:
|
||||
queue: "hub-audit-events"
|
||||
deadletterQueue: "hub-audit-dead-letter"
|
||||
maxRetries: 10
|
||||
prefetchCount: 20
|
||||
persistTimeout: "10s"
|
||||
# If you already have a Kafka cluster you might use this instead of RabbitMQ.
|
||||
kafka:
|
||||
broker: "kafka1.yourdomain.com:9094" # can be internal dns name or external
|
||||
@@ -209,28 +127,6 @@ opentelemetry:
|
||||
# the collector terminates TLS. A scheme-less value defaults to TLS and
|
||||
# fails against a plaintext collector ("server gave HTTP response to HTTPS client").
|
||||
endpoint: "http://otel-collector:4318"
|
||||
# Trace sampling, passed to the services as OTEL_TRACES_SAMPLER and
|
||||
# OTEL_TRACES_SAMPLER_ARG. Leave empty to keep the SDK default, which records
|
||||
# every trace.
|
||||
# Supported types: always_on, always_off, traceidratio, parentbased_always_on,
|
||||
# parentbased_always_off, parentbased_traceidratio.
|
||||
#
|
||||
# sampler applies to the services downstream of the Vault: hub-workflows, the
|
||||
# pipe-* services and the workflow stages. They continue the trace the Vault
|
||||
# starts for an upload, so head sampling belongs at the Vault
|
||||
# (parentbased_traceidratio on the Vault deployment) and these follow its
|
||||
# decision without starting traces of their own:
|
||||
# type: "parentbased_always_off"
|
||||
sampler:
|
||||
type: ""
|
||||
arg: ""
|
||||
# apiSampler applies to hub-api, which starts its own traces for user
|
||||
# requests. Example: keep ~10% of them:
|
||||
# type: "parentbased_traceidratio"
|
||||
# arg: "0.1"
|
||||
apiSampler:
|
||||
type: ""
|
||||
arg: ""
|
||||
############################################
|
||||
# OpenAI configuration (semantic search)
|
||||
#
|
||||
@@ -335,10 +231,8 @@ kerberoshub:
|
||||
api:
|
||||
repository: ghcr.io/uug-ai/hub-api
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.9.51"
|
||||
tag: "v1.9.29"
|
||||
replicas: 2
|
||||
audit:
|
||||
enabled: true
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Set to false to skip rendering the hub-api Service (e.g. when an
|
||||
# external/shared Service is managed elsewhere).
|
||||
@@ -347,22 +241,6 @@ kerberoshub:
|
||||
jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
|
||||
schema: "https"
|
||||
url: "api.yourdomain.com"
|
||||
# Additional complete HTTP(S) origins allowed to call the Hub API.
|
||||
# The configured frontend origins remain allowed automatically.
|
||||
corsAllowedOrigins: []
|
||||
# Temporarily stop serving the polled GET /devices list: hub-api answers 204
|
||||
# without querying MongoDB. The frontend still loads devices once through
|
||||
# /session/bootstrap, but device online/offline status stops refreshing.
|
||||
disableAgentHeartbeat: false
|
||||
# Media proxy: when enabled, hub-api wraps every media URL it receives from
|
||||
# Kerberos Vault into an opaque hub-api URL ({schema}://{url}/media/proxy?t=...)
|
||||
# and streams the object itself, so clients never see Vault or the
|
||||
# underlying storage endpoint. Increases hub-api egress/bandwidth.
|
||||
mediaProxy:
|
||||
enabled: false
|
||||
publicUrl: "" # Optional override of the public hub-api base URL; defaults to {schema}://{url}.
|
||||
key: "" # Optional encryption key (openssl rand -hex 32); defaults to a key derived from jwtSecret. Must be identical on all replicas.
|
||||
ttl: "" # Optional lifetime of proxied URLs (Go duration, e.g. "12h"); defaults to 24h, max 168h.
|
||||
resources:
|
||||
requests:
|
||||
memory: 100Mi
|
||||
@@ -466,7 +344,7 @@ kerberoshub:
|
||||
frontend:
|
||||
repository: ghcr.io/uug-ai/hub-frontend
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.13.9"
|
||||
tag: "v1.9.32"
|
||||
replicas: 2
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Set to false to skip rendering the hub-frontend Service (e.g. when an
|
||||
@@ -590,42 +468,21 @@ kerberoshub:
|
||||
# Workflows allow you to define automated processes and actions in the front-end.
|
||||
workflows:
|
||||
enabled: "false" # Enable or disable workflows feature 'true' or 'false'
|
||||
# Audit events are visible to owner/admin users when enabled.
|
||||
audit:
|
||||
enabled: "true" # Enable or disable the Audit events page and navigation link 'true' or 'false'
|
||||
# Day overview page and its navigation menu; role page permissions still apply.
|
||||
dayOverview:
|
||||
enabled: "true" # Enable or disable the Day overview page and navigation menu 'true' or 'false'
|
||||
# Organisation controls remain visible as a read-only current organisation when switching is disabled.
|
||||
organisations:
|
||||
enabled: "" # Enable or disable the organisation feature family, including projects; when empty, child groups apply independently
|
||||
switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
|
||||
creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
|
||||
settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
|
||||
projects:
|
||||
enabled: "" # Fallback project group switch used only when organisations.enabled is empty
|
||||
switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
|
||||
creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
|
||||
settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
|
||||
# Map tile configuration
|
||||
map:
|
||||
tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
|
||||
tileUrlDark: "https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png" # Map tile URL for dark mode
|
||||
attribution: "© <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>" # Map attribution
|
||||
overlayTileUrl: "" # Optional XYZ overlay URL; supports {z}, {x}, {y}, and {apiKey}
|
||||
overlayApiKey: "" # Optional browser-visible API key substituted into overlayTileUrl
|
||||
overlayAttribution: "" # Attribution displayed when the overlay is enabled
|
||||
overlayMinZoom: "0" # Minimum overlay zoom level
|
||||
overlayMaxZoom: "19" # Maximum overlay zoom level
|
||||
overlayOpacity: "1" # Overlay opacity from 0 to 1
|
||||
# Live view page
|
||||
liveview:
|
||||
defaultStreamMode: "SD" # Default stream mode 'SD' or 'HD' (will be migrated to 'preview' or 'live')
|
||||
liveStreamMode: "webrtc" # Transport backing the LIVE (HD) mode: 'webrtc' (default), 'hls' or 'moq'
|
||||
hlsEnabled: "true" # Offer HLS as a selectable LIVE transport 'true' or 'false'. When 'false' the HLS option is removed from the front-end and streams use webrtc
|
||||
moqEnabled: "false" # Offer MoQ as a selectable LIVE transport 'true' or 'false'
|
||||
remoteRecordingEnabled: "true" # Show the manual REC control and recording-state overlay in live views
|
||||
deviceStatusEnabled: "true" # Show connectivity and recent-motion status in live view tile headers
|
||||
moqRelayUrl: "https://relay.uug.ai/anon" # WebTransport URL of the MoQ relay
|
||||
moqBroadcastPrefix: "devices" # Prefix used to build devices/<deviceKey>/live.hang broadcast names
|
||||
paginationMode: "scroll" # Pagination mode in live view 'scroll', 'numbered' or 'maxStreams'
|
||||
@@ -634,11 +491,6 @@ kerberoshub:
|
||||
# Device page
|
||||
devices:
|
||||
hideAgent: "false" # Hide the 'add agent' button in the front-end
|
||||
analyticsEnabled: "true" # Enable or disable the Analytics tab on device detail pages 'true' or 'false'
|
||||
developerToolsEnabled: "true" # Enable or disable device logs and terminal access 'true' or 'false'
|
||||
# Dashboard page
|
||||
dashboard:
|
||||
sitesFullscreenEnabled: "true" # Enable or disable the fullscreen Sites map 'true' or 'false'
|
||||
# Media page
|
||||
media:
|
||||
filter:
|
||||
@@ -654,8 +506,6 @@ kerberoshub:
|
||||
enabled: "true" # Enable or disable object detection filter in media 'true' or 'false'
|
||||
star:
|
||||
enabled: "true" # Enable or disable star filter in media 'true' or 'false'
|
||||
analysis:
|
||||
enabled: "true" # Enable or disable the "with analysis" filter (hides recordings without markers, description or detections) in media 'true' or 'false'
|
||||
region:
|
||||
enabled: "true" # Enable or disable region filter in media 'true' or 'false'
|
||||
sort:
|
||||
@@ -664,11 +514,6 @@ kerberoshub:
|
||||
enabled: "true" # Enable or disable category filter in media 'true' or 'false'
|
||||
markers:
|
||||
enabled: "true" # Enable or disable markers filter in media 'true' or 'false'
|
||||
markerOptionsByDate:
|
||||
enabled: "false" # Limit marker-related filter options to the selected recording day
|
||||
markerCategoryPriority:
|
||||
enabled: "false" # Order marker options from configured categories before other markers
|
||||
categories: [] # Ordered marker category names, for example ["security", "traffic"]
|
||||
events:
|
||||
enabled: "true" # Enable or disable events filter in media 'true' or 'false'
|
||||
tags:
|
||||
@@ -676,13 +521,6 @@ kerberoshub:
|
||||
defaultView: "timeline" # Default view for media page 'timeline' or 'grid'
|
||||
# Chart feature
|
||||
chart:
|
||||
colors:
|
||||
- "#84569f"
|
||||
- "#3ba7ff"
|
||||
- "#ff5c8a"
|
||||
- "#4ad991"
|
||||
- "#ffb84d"
|
||||
- "#ff7043"
|
||||
colorChartSelectionFill: "rgba(132, 86, 159, 0.07)"
|
||||
colorChartSelectionStroke: "rgba(132, 86, 159, 0.4)"
|
||||
colorChartGridStroke: "rgba(0, 106, 255, 0.18)"
|
||||
@@ -710,7 +548,6 @@ kerberoshub:
|
||||
# Face redaction feature
|
||||
faceRedaction:
|
||||
enabled: "false" # Enable or disable face redaction 'true' or 'false'
|
||||
classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
|
||||
# Optional integrations
|
||||
mixpanel: # We can keep track logging in Mixpanel as well
|
||||
apikey: "xxx"
|
||||
@@ -720,7 +557,6 @@ kerberoshub:
|
||||
publicKey: ""
|
||||
googlemaps: # Google maps is used inside the application to visualise cameras and sites.
|
||||
apikey: "xxxx"
|
||||
placesApi: "legacy" # Places API for address autocomplete: "legacy" (default) or "new" for keys with Places API (New) enabled. Uses the same apikey.
|
||||
zendesk: # We can use different support tools, for now we use Zendesk but others can be integrated
|
||||
url: "yourdomain.zendesk.com"
|
||||
posthog: # Posthog is used for auditing and user interaction logging
|
||||
@@ -747,7 +583,7 @@ kerberoshub:
|
||||
cleanup:
|
||||
repository: ghcr.io/uug-ai/hub-cleanup
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.19"
|
||||
tag: "v1.4.16"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -783,63 +619,10 @@ kerberoshub:
|
||||
# Tasks with `legal_hold=true` are never deleted. Must match the value
|
||||
# used by `kerberoshub.api.defaultTaskRetentionDays`.
|
||||
defaultTaskRetentionDays: "0"
|
||||
# Deployment-wide retention for audit events. This is independent from
|
||||
# recording plans, inactive-account cleanup, and the optional global pass.
|
||||
# Set to "0" or a negative value to retain audit events indefinitely.
|
||||
auditEventRetentionDays: "400"
|
||||
# Deployment-wide cap for workflow runs, anchored on run execution time.
|
||||
# Runs always expire with their media; this only shortens their lifetime.
|
||||
# Set to "0" or a negative value to let runs follow media retention only.
|
||||
workflowRunRetentionDays: "0"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# Dispatches canonical audit_events to one or more external webhook sinks.
|
||||
# Credentials are always read from existing Secrets and never stored here.
|
||||
audit:
|
||||
repository: ghcr.io/uug-ai/hub-audit
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.1"
|
||||
replicas: 1
|
||||
dispatchInterval: "5s"
|
||||
leaseDuration: "2m"
|
||||
terminationGracePeriodSeconds: 150 # Keep above leaseDuration so an in-flight cycle can finish.
|
||||
topologySpreadConstraints: []
|
||||
volumes: []
|
||||
volumeMounts: []
|
||||
extraEnv: []
|
||||
serviceMonitor:
|
||||
enabled: true
|
||||
interval: 15s
|
||||
destinations: []
|
||||
# - id: primary-siem
|
||||
# type: webhook
|
||||
# enabled: true
|
||||
# url: https://siem.example.com/api/audit
|
||||
# timeoutSeconds: 10
|
||||
# batchSize: 100
|
||||
# maxAttempts: 10
|
||||
# startAt: latest # latest | beginning, applied only on first creation
|
||||
# headers:
|
||||
# X-Source: kerberos-hub
|
||||
# bearerTokenSecret:
|
||||
# name: audit-primary-siem
|
||||
# key: token
|
||||
# secretHeaders:
|
||||
# X-Api-Key:
|
||||
# secretName: audit-primary-siem
|
||||
# secretKey: api-key
|
||||
# filters:
|
||||
# organisationIds: []
|
||||
# projectIds: []
|
||||
# actions: []
|
||||
# categories: []
|
||||
# outcomes: [] # success | failure
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 32Mi
|
||||
# cpu: 10m
|
||||
# hub-workflows is the standalone, queue-driven workflow engine. It consumes
|
||||
# pipeline events and dispatches the stages declared in its workflow
|
||||
# definitions, tracking each run in its own `workflow_runs` collection. It shares events
|
||||
@@ -859,41 +642,30 @@ kerberoshub:
|
||||
# -----------------------------------------------------------------------
|
||||
# Global workflow definitions — the named workflows the engine runs.
|
||||
#
|
||||
# `definitions` is the engine's deployment-global configuration source and
|
||||
# stage catalog: several distinct workflows can run over one recording, each
|
||||
# opening its own run and dispatching only its own stages. Database-backed
|
||||
# organisation workflows, when present, are read separately per recording.
|
||||
# This is a MAP keyed by workflow name (names are unique and merge cleanly
|
||||
# across -f / --set overrides). Ships empty; the commented block is a worked
|
||||
# example of an object-tracking + loitering pipeline. Add more keys to run
|
||||
# more config workflows.
|
||||
# `definitions` is the engine's single routing source: several distinct
|
||||
# workflows can run over one recording, each opening its own run and
|
||||
# dispatching only its own stages. It is a MAP keyed by workflow name (names
|
||||
# are unique and merge cleanly across -f / --set overrides). Ships empty; the
|
||||
# commented block is a worked example of an object-tracking + loitering
|
||||
# pipeline. Add more keys to run more workflows.
|
||||
#
|
||||
# Each definition:
|
||||
# id optional stable identity: quote a non-zero 24-hex Mongo ObjectID.
|
||||
# Recommended for new definitions; rendered lowercase. Omit for
|
||||
# legacy SHA256(exact map key)[:24] identity. Pin that old ID before
|
||||
# renaming an existing workflow; changing id creates a new identity.
|
||||
# Invalid IDs and duplicate effective IDs fail Helm rendering,
|
||||
# including disabled definitions. Name/version are not identity
|
||||
# when id is explicit. No per-project on/off overrides are provided.
|
||||
# enabled include this workflow (soft-delete toggle).
|
||||
# source always rendered as "config" (a Helm-defined, ops-managed,
|
||||
# source always rendered as "config" (a Helm-seeded, ops-managed,
|
||||
# deployment-global workflow — read-only in the API).
|
||||
# triggers how a run OPENS. Omit for a single bare automatic trigger
|
||||
# (opens for every recording); the per-stage `needs` then decide
|
||||
# which stages FIRE. Narrow with device/schedule triggers, e.g.
|
||||
# `- {type: automatic, devices: [{key: <device-key>}]}`, or by
|
||||
# device label across organisations, e.g.
|
||||
# `- {type: automatic, systemTags: [anpr-pilot]}` (see deviceTags).
|
||||
# `- {type: automatic, devices: [{key: <device-key>}]}`.
|
||||
# stages the executable stages, each {operation, dispatch?, needs?,
|
||||
# needsMode?}. dispatch is "always" (default) or "conditional";
|
||||
# a conditional stage's `needs` are upstream dependencies, each
|
||||
# {operation?, condition?} — operation is the readiness GATE (the
|
||||
# upstream op whose data must be present before the condition is
|
||||
# read; omit for a check on the run root itself), condition is
|
||||
# {path, op, value} where path is ABSOLUTE from the run root;
|
||||
# a `*` segment fans out across array elements. needsMode combines
|
||||
# multiple needs: "any" (default;
|
||||
# {path, op, value} where path is ABSOLUTE from the run root and
|
||||
# resolves through string-keyed maps only (it cannot index into
|
||||
# arrays). needsMode combines multiple needs: "any" (default;
|
||||
# fire on the first match) or "all" (a join; fire once every need
|
||||
# has resolved and matched). The queue is taken from the matching
|
||||
# services.<operation> entry, so dispatch and consume cannot drift.
|
||||
@@ -902,42 +674,19 @@ kerberoshub:
|
||||
# kerberoshub.services.<operation> (deploy the objecttracking / loitering
|
||||
# workers below).
|
||||
definitions: {}
|
||||
# Replace {} above with the indented examples below to enable them. Their IDs
|
||||
# are pinned to the existing name-derived identities; do not regenerate them.
|
||||
# tracking-workflow:
|
||||
# id: "ec7e72bc4cedd32018e1f92a"
|
||||
# enabled: true
|
||||
# triggers:
|
||||
# - type: automatic
|
||||
# stages:
|
||||
# - operation: objecttracking
|
||||
# dispatch: always
|
||||
# - operation: loitering
|
||||
# dispatch: conditional
|
||||
# # Fire loitering once objecttracking has resolved — a readiness join
|
||||
# # (no condition ⇒ gate on the upstream's presence, not a value).
|
||||
# needs:
|
||||
# - operation: objecttracking
|
||||
# vlm-workflow:
|
||||
# id: "9e3666c56854b2befdb1f645"
|
||||
# # Describe every recording with the hub-vlm worker (services.vlm below).
|
||||
# enabled: true
|
||||
# triggers:
|
||||
# - type: automatic
|
||||
# stages:
|
||||
# - operation: vlm
|
||||
# dispatch: always
|
||||
# Optional editor metadata (name, description, params) per operation. With
|
||||
# workflowConfiguration contracts, a stage is offered when it has a valid
|
||||
# contract and a deployed worker (services.<operation>.queue); contract
|
||||
# presentation and params take precedence over these entries.
|
||||
editorStages: []
|
||||
# - operation: vlm
|
||||
# name: Describe recording
|
||||
# description: Summarise the recording with a vision language model.
|
||||
# - operation: forwarder
|
||||
# name: Forward to my system
|
||||
# description: Send the result to the external destination configured for the forwarder.
|
||||
#tracking-workflow:
|
||||
# enabled: true
|
||||
# triggers:
|
||||
# - type: automatic
|
||||
# stages:
|
||||
# - operation: objecttracking
|
||||
# dispatch: always
|
||||
# - operation: loitering
|
||||
# dispatch: conditional
|
||||
# # Fire loitering once objecttracking has resolved — a readiness join
|
||||
# # (no condition ⇒ gate on the upstream's presence, not a value).
|
||||
# needs:
|
||||
# - operation: objecttracking
|
||||
# Workflow deployments. Every workflows-subsystem Deployment's image/tag/
|
||||
# replicas/resources/queue lives here in a single, uniform shape:
|
||||
# - `workflows` is the engine itself (the orchestrator). It is deployed
|
||||
@@ -948,14 +697,11 @@ kerberoshub:
|
||||
# Deploying a worker (services.<name>.enabled) is independent from routing
|
||||
# to it (a workflows.definitions stage of the same operation) — it runs only
|
||||
# when its own `enabled` is true AND the workflows engine is enabled.
|
||||
# Worker-specific settings go in `env` (plain key/values) and `secretEnv`
|
||||
# (ENV_NAME: {name, key} of an existing Secret, for credentials).
|
||||
services:
|
||||
# hub-workflows — the workflows engine (orchestrator). Consumes the engine
|
||||
# queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
|
||||
# plus organisation-scoped database workflows, and dispatches to the stage
|
||||
# workers below. Deployed when workflows.enabled is true; it has no separate
|
||||
# `enabled` here.
|
||||
# queue, evaluates the workflow definitions (WORKFLOW_DEFINITIONS) and
|
||||
# dispatches to the stage workers below. Deployed when workflows.enabled is
|
||||
# true; it has no separate `enabled` here.
|
||||
workflows:
|
||||
repository: ghcr.io/uug-ai/hub-workflows
|
||||
pullPolicy: IfNotPresent
|
||||
@@ -977,98 +723,61 @@ kerberoshub:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE custom stage worker (commented out) — hub-loitering.
|
||||
#
|
||||
# Companion deployment for the workflows.definitions example above (the
|
||||
# loitering stage of tracking-workflow). Uncomment to deploy the demo
|
||||
# worker. It ships as its own repository/module.
|
||||
# See https://github.com/uug-ai/hub-loitering.
|
||||
#loitering:
|
||||
# # Deploy the hub-loitering worker.
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-loitering
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# #volumes:
|
||||
# # - name: extra
|
||||
# # emptyDir: {}
|
||||
# #volumeMounts:
|
||||
# # - name: extra
|
||||
# # mountPath: /data
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
|
||||
# # same value is taken into the matching workflows.definitions stage, so the
|
||||
# # engine dispatches and the worker consumes the same queue with no drift.
|
||||
# # Convention: "kcloud-<operation>-queue.fifo".
|
||||
# queue: "kcloud-loitering-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE stage worker (commented out) for the workflows.definitions example
|
||||
# above — hub-objecttracking. Uncomment the worker whose operation a
|
||||
# definition references, so the engine dispatches and the worker consumes the
|
||||
# same queue with no drift.
|
||||
#objecttracking:
|
||||
# # Deploy the object-tracking worker (operation "objecttracking").
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-objecttracking
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
|
||||
# queue: "kcloud-objecttracking-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE stage worker (commented out) — hub-vlm (operation "vlm").
|
||||
#
|
||||
# Samples frames from the recording, describes them with an Azure OpenAI
|
||||
# vision model and emits timeline markers plus a recording description.
|
||||
# Route to it with a workflows.definitions stage `- operation: vlm`.
|
||||
# See https://github.com/uug-ai/hub-vlm for every VLM_* / AZURE_OPENAI_*
|
||||
# setting. Create the API key Secret first, e.g.
|
||||
# kubectl create secret generic hub-vlm-azure-openai \
|
||||
# --from-literal=apiKey=<azure-openai-api-key>
|
||||
#vlm:
|
||||
# # Deploy the hub-vlm worker.
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-vlm
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (VLM_QUEUE).
|
||||
# queue: "hub-vlm-queue"
|
||||
# env:
|
||||
# AZURE_OPENAI_ENDPOINT: "https://<resource>.openai.azure.com"
|
||||
# AZURE_OPENAI_DEPLOYMENT: "gpt-5.4-mini" # Name of the model deployment.
|
||||
# AZURE_OPENAI_REASONING_EFFORT: "low" # none | minimal | low | medium | high
|
||||
# VLM_MAX_FRAMES: "8" # Frames sampled per recording (max 32).
|
||||
# VLM_FRAME_WIDTH: "1024" # Maximum frame width in pixels.
|
||||
# VLM_SET_DESCRIPTION: "true" # Write the summary to the recording description.
|
||||
# # The API key is read from an existing Secret, never from values.
|
||||
# secretEnv:
|
||||
# AZURE_OPENAI_API_KEY:
|
||||
# name: hub-vlm-azure-openai
|
||||
# key: apiKey
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 128Mi
|
||||
# cpu: 100m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE custom stage worker (commented out) — hub-loitering.
|
||||
#
|
||||
# Companion deployment for the workflows.definitions example above (the
|
||||
# loitering stage of tracking-workflow). Uncomment to deploy the demo
|
||||
# worker. It ships as its own repository/module.
|
||||
# See https://github.com/uug-ai/hub-loitering.
|
||||
#loitering:
|
||||
# # Deploy the hub-loitering worker.
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-loitering
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# #volumes:
|
||||
# # - name: extra
|
||||
# # emptyDir: {}
|
||||
# #volumeMounts:
|
||||
# # - name: extra
|
||||
# # mountPath: /data
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
|
||||
# # same value is taken into the matching workflows.definitions stage, so the
|
||||
# # engine dispatches and the worker consumes the same queue with no drift.
|
||||
# # Convention: "kcloud-<operation>-queue.fifo".
|
||||
# queue: "kcloud-loitering-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
# ---------------------------------------------------------------------
|
||||
# EXAMPLE stage worker (commented out) for the workflows.definitions example
|
||||
# above — hub-objecttracking. Uncomment the worker whose operation a
|
||||
# definition references, so the engine dispatches and the worker consumes the
|
||||
# same queue with no drift.
|
||||
#objecttracking:
|
||||
# # Deploy the object-tracking worker (operation "objecttracking").
|
||||
# enabled: true
|
||||
# repository: ghcr.io/uug-ai/hub-objecttracking
|
||||
# pullPolicy: IfNotPresent
|
||||
# tag: "v1.0.0"
|
||||
# replicas: 1 # Number of pods for the worker.
|
||||
# topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
|
||||
# queue: "kcloud-objecttracking-queue.fifo"
|
||||
# resources:
|
||||
# requests:
|
||||
# memory: 10Mi
|
||||
# cpu: 10m
|
||||
monitordevice:
|
||||
repository: ghcr.io/uug-ai/hub-monitor-device
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.4.2"
|
||||
tag: "v1.4.0"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
@@ -1088,7 +797,7 @@ kerberoshub:
|
||||
repository: uugai/hub-reactivatesubscriptions
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.2"
|
||||
replicas: 0 # Number of pods for the service. Set to 0 to disable.
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -1121,11 +830,10 @@ kerberoshub:
|
||||
# cpu: 10m
|
||||
# This proxy is legacy for the old agent, will be migrated in the new Hub API.
|
||||
proxy:
|
||||
enabled: false
|
||||
repository: uugai/hub-proxy
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.0.0"
|
||||
replicas: 0 # Number of pods for the service when enabled.
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -1145,13 +853,9 @@ kerberoshub:
|
||||
# The pipeline is a critical component of Kerberos Hub, and should be monitored closely.
|
||||
kerberospipeline:
|
||||
event:
|
||||
deploymentAnnotations: {}
|
||||
# Example (opt-in Argo CD ordering):
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "10"
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-event
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.1"
|
||||
tag: "v1.3.0"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1168,11 +872,8 @@ kerberospipeline:
|
||||
cpu: 10m
|
||||
monitor:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-monitor
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "70"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.13"
|
||||
tag: "v1.3.10"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1182,18 +883,14 @@ kerberospipeline:
|
||||
#volumeMounts:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: debug, info, warn, error
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
sequence:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-sequence
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "60"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.6.26"
|
||||
tag: "v1.6.18"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1209,11 +906,8 @@ kerberospipeline:
|
||||
cpu: 10m
|
||||
throttler:
|
||||
repository: uugai/hub-pipeline-throttler
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "30"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.1"
|
||||
tag: "v1.2.0"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1230,17 +924,11 @@ kerberospipeline:
|
||||
cpu: 10m
|
||||
notify:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-notification
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "20"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.18"
|
||||
tag: "v1.3.9"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
audit:
|
||||
enabled: true
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
notificationExpiryMinutes: "15" # Maximum recording age before notification delivery; 0 disables expiry.
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
@@ -1256,7 +944,7 @@ kerberospipeline:
|
||||
notifyTest:
|
||||
repository: uugai/hub-pipeline-notification-test
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.2"
|
||||
tag: "v1.2.1"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
resources:
|
||||
@@ -1273,11 +961,8 @@ kerberospipeline:
|
||||
# claimName: custom-layout-claim
|
||||
analysis:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-analysis
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "40"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.8.22"
|
||||
tag: "v1.7.17"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1288,32 +973,14 @@ kerberospipeline:
|
||||
# - name: extra
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
# Opt-in: after classification, re-enqueue the recording on the thumbnail
|
||||
# queue to regenerate its thumbnail from the first frame of a tracked moving
|
||||
# object (THUMBNAIL_REGENERATION_ENABLED). Adds one thumbnail job per
|
||||
# classified recording; size pipe-thumbnail accordingly before enabling.
|
||||
thumbnailRegeneration:
|
||||
enabled: false
|
||||
# In-memory cache for hot-path MongoDB lookups (site vault per device).
|
||||
# Site changes apply after at most one TTL; each replica caches separately.
|
||||
dbCache:
|
||||
enabled: false
|
||||
ttl: "5m" # Go duration, e.g. "30s", "5m"
|
||||
resources:
|
||||
requests:
|
||||
memory: 10Mi
|
||||
cpu: 10m
|
||||
dominantColor:
|
||||
# Opt-in: deploys pipe-dominantcolor and tells the analysis stage to schedule
|
||||
# it (DOMINANTCOLOR_ENABLED). Requires an analysis image that reads the flag;
|
||||
# older images always publish to the dominantcolor queue.
|
||||
enabled: false # Enable or disable dominant color extraction 'true' or 'false'
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v2.0.3"
|
||||
tag: "v2.0.2"
|
||||
replicas: 3 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1333,13 +1000,9 @@ kerberospipeline:
|
||||
cpu: 1000m
|
||||
thumbnail:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.3.15"
|
||||
tag: "v1.3.6"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -1363,11 +1026,8 @@ kerberospipeline:
|
||||
cpu: 1000m
|
||||
counting:
|
||||
repository: uugai/hub-pipeline-counting
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v2.0.0"
|
||||
tag: "v1.6.3"
|
||||
replicas: 1 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
@@ -1384,14 +1044,10 @@ kerberospipeline:
|
||||
cpu: 10m
|
||||
sprite:
|
||||
enabled: false # Enable or disable the sprite generation 'true' or 'false
|
||||
deploymentAnnotations: {}
|
||||
# deploymentAnnotations:
|
||||
# argocd.argoproj.io/sync-wave: "50"
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-sprite
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.1.21"
|
||||
tag: "v1.1.14"
|
||||
replicas: 5 # Number of pods for the service.
|
||||
prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
# Optional extra volumes / volumeMounts for this deployment (empty = none).
|
||||
#volumes:
|
||||
@@ -1402,10 +1058,8 @@ kerberospipeline:
|
||||
# mountPath: /data
|
||||
logLevel: "info" # possible values: trace, debug, info, warn,
|
||||
interval: "1" # Number of secondes between each thumbnail in the sprite
|
||||
# Tile size in pixels. Preserve width:height = 16:9 (e.g. 240x135, 480x270, 640x360).
|
||||
# Deploy dimension-aware sprite/analysis workers, Hub API and frontend before increasing.
|
||||
width: "240"
|
||||
height: "135"
|
||||
width: "240" # Should not be changed for the moment (hard coded in UI)
|
||||
height: "135" # Should not be changed for the moment (hard coded in UI)
|
||||
resources:
|
||||
requests:
|
||||
memory: 512Mi
|
||||
@@ -1416,7 +1070,7 @@ kerberospipeline:
|
||||
export:
|
||||
repository: ghcr.io/uug-ai/hub-pipeline-export
|
||||
pullPolicy: IfNotPresent
|
||||
tag: "v1.2.10"
|
||||
tag: "v1.2.8"
|
||||
replicas: 2 # Number of pods for the service.
|
||||
topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
|
||||
logLevel: "info" # possible values: trace, debug, info, warn, error
|
||||
|
||||
@@ -1,81 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
CHART_DIR="${1:-charts/hub}"
|
||||
|
||||
# Supply per-service test overrides without requiring a separate values file.
|
||||
WAVE_FLAGS=()
|
||||
for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
|
||||
service="${setting%%:*}"
|
||||
wave="${setting#*:}"
|
||||
WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
|
||||
done
|
||||
|
||||
# Only read Deployment metadata, never pod-template or Service annotations.
|
||||
extract_waves() {
|
||||
awk '
|
||||
/^---/ { deployment=0; metadata=0; name="" }
|
||||
/^kind: Deployment$/ { deployment=1 }
|
||||
/^metadata:$/ { metadata=1; next }
|
||||
/^[^ #]/ { metadata=0 }
|
||||
deployment && metadata && /^ name:/ { name=$2 }
|
||||
deployment && metadata && /^ argocd.argoproj.io\/sync-wave:/ {
|
||||
value=$2
|
||||
gsub(/"/, "", value)
|
||||
print name, value
|
||||
}
|
||||
' | sort
|
||||
}
|
||||
|
||||
assert_waves() {
|
||||
local rendered="$1"
|
||||
local expected="$2"
|
||||
local actual
|
||||
actual="$(printf '%s\n' "$rendered" | extract_waves)"
|
||||
if [[ "$actual" != "$expected" ]]; then
|
||||
printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
|
||||
return 1
|
||||
fi
|
||||
local all_count expected_count
|
||||
all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
|
||||
expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
|
||||
if [[ "$all_count" != "$expected_count" ]]; then
|
||||
echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
|
||||
return 1
|
||||
fi
|
||||
}
|
||||
|
||||
expected="$(printf '%s\n' \
|
||||
'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
|
||||
'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
|
||||
'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
|
||||
|
||||
for mode in all pipeline; do
|
||||
default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
|
||||
assert_waves "$default_render" ""
|
||||
if printf '%s\n' "$default_render" | grep -q '^ annotations: null'; then
|
||||
echo "Empty annotations must be omitted" >&2
|
||||
exit 1
|
||||
fi
|
||||
configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
|
||||
assert_waves "$configured_render" "$expected"
|
||||
echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
|
||||
done
|
||||
|
||||
disabled_optional="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
|
||||
assert_waves "$disabled_optional" "$(printf '%s\n' "$expected" | grep -v -e '^pipe-sprite ' -e '^pipe-dominantcolor ')"
|
||||
|
||||
ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
|
||||
assert_waves "$ui_render" ""
|
||||
|
||||
# Exercise zero/negative strings and an unrelated annotation on the same map.
|
||||
for wave in 0 -10; do
|
||||
override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
|
||||
--set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
|
||||
--set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
|
||||
assert_waves "$override" "pipe-event $wave"
|
||||
printf '%s\n' "$override" | grep -q "^ argocd.argoproj.io/sync-wave: \"$wave\"$"
|
||||
printf '%s\n' "$override" | grep -q '^ example.com/owner: queue-team$'
|
||||
done
|
||||
|
||||
echo "All pipeline Deployment annotation checks passed."
|
||||
Executable
+97
@@ -0,0 +1,97 @@
|
||||
#!/usr/bin/env bash
|
||||
#
|
||||
# Render the hub chart and assert that every deployment which carries the
|
||||
# workflows hand-off queue (the WORKFLOWS_QUEUE env var) resolves to the SAME,
|
||||
# non-empty value.
|
||||
#
|
||||
# Why: the analysis pipeline (pipe-analysis) publishes opened workflow runs to
|
||||
# WORKFLOWS_QUEUE, the workflows engine (hub-workflows) consumes it, and every
|
||||
# stage worker (hub-stage) routes its result back to it. All three templates
|
||||
# read the single key `kerberoshub.services.workflows.queue`. If a future edit
|
||||
# hardcodes a value, reads the wrong key, or drops the env on one of them, the
|
||||
# producer and consumer silently drift onto different queue names and messages
|
||||
# pile up with no consumer. This check fails the build before that can ship.
|
||||
#
|
||||
# Usage: scripts/check-workflows-queue-consistency.sh [chart-dir]
|
||||
# (chart-dir defaults to charts/hub, relative to the repo root)
|
||||
|
||||
set -euo pipefail
|
||||
|
||||
CHART_DIR="${1:-charts/hub}"
|
||||
PROBE="drift-probe-queue-name"
|
||||
|
||||
# Flags that force all three deployment kinds (analysis, engine and one stage
|
||||
# worker) to render, so the check actually has something to compare. The chart
|
||||
# ships NO enabled stage worker by default (custom stages are values-only and
|
||||
# opt-in), so we synthesise a throwaway stage purely to exercise the generic
|
||||
# hub-stage path. The name is a neutral fixture ("queuecheck") on purpose: any
|
||||
# arbitrary stage key must render the same way, so the check must not depend on
|
||||
# a specific bundled worker.
|
||||
STAGE="queuecheck"
|
||||
RENDER_FLAGS=(
|
||||
--set mode=all
|
||||
--set kerberoshub.workflows.enabled=true
|
||||
--set "kerberoshub.workflows.stages.${STAGE}.enabled=true"
|
||||
--set "kerberoshub.services.${STAGE}.enabled=true"
|
||||
--set "kerberoshub.services.${STAGE}.repository=example.invalid/queuecheck"
|
||||
--set "kerberoshub.services.${STAGE}.tag=test"
|
||||
--set "kerberoshub.services.${STAGE}.queue=queuecheck-fixture-queue"
|
||||
)
|
||||
|
||||
# Read `helm template` output on stdin and print one WORKFLOWS_QUEUE value per
|
||||
# line. Matches the `- name: WORKFLOWS_QUEUE` env entry and captures the value
|
||||
# from the following `value:` line, skipping blank/comment lines in between.
|
||||
extract_workflows_queue() {
|
||||
awk '
|
||||
/^[[:space:]]*-[[:space:]]*name:[[:space:]]*WORKFLOWS_QUEUE[[:space:]]*$/ { want=1; next }
|
||||
want==1 {
|
||||
if ($0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*$/) next
|
||||
v=$0
|
||||
sub(/^[[:space:]]*value:[[:space:]]*/, "", v)
|
||||
sub(/^"/, "", v); sub(/"[[:space:]]*$/, "", v)
|
||||
sub(/[[:space:]]+$/, "", v)
|
||||
print v
|
||||
want=0
|
||||
}
|
||||
'
|
||||
}
|
||||
|
||||
assert_all_equal() {
|
||||
local expected="$1"; shift
|
||||
local label="$1"; shift
|
||||
local -a vals=("$@")
|
||||
|
||||
if [ "${#vals[@]}" -lt 2 ]; then
|
||||
echo "FAIL (${label}): expected at least 2 WORKFLOWS_QUEUE values (analysis + engine), found ${#vals[@]}" >&2
|
||||
return 1
|
||||
fi
|
||||
|
||||
local v
|
||||
for v in "${vals[@]}"; do
|
||||
if [ -z "${v}" ]; then
|
||||
echo "FAIL (${label}): a deployment rendered an empty WORKFLOWS_QUEUE value" >&2
|
||||
return 1
|
||||
fi
|
||||
if [ "${v}" != "${expected}" ]; then
|
||||
echo "FAIL (${label}): WORKFLOWS_QUEUE drift detected — expected '${expected}' but a deployment rendered '${v}'" >&2
|
||||
printf ' rendered values: %s\n' "${vals[*]}" >&2
|
||||
return 1
|
||||
fi
|
||||
done
|
||||
|
||||
echo "OK (${label}): ${#vals[@]} deployments all use WORKFLOWS_QUEUE='${expected}'"
|
||||
}
|
||||
|
||||
echo "== Rendering ${CHART_DIR} with the chart's default workflows queue =="
|
||||
default_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}")"
|
||||
mapfile -t default_vals < <(printf '%s\n' "${default_out}" | extract_workflows_queue)
|
||||
default_queue="${default_vals[0]:-}"
|
||||
assert_all_equal "${default_queue}" "default values" "${default_vals[@]}" || exit 1
|
||||
|
||||
echo "== Rendering ${CHART_DIR} with an overridden workflows queue (-> ${PROBE}) =="
|
||||
probe_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
|
||||
--set kerberoshub.services.workflows.queue="${PROBE}")"
|
||||
mapfile -t probe_vals < <(printf '%s\n' "${probe_out}" | extract_workflows_queue)
|
||||
assert_all_equal "${PROBE}" "override probe" "${probe_vals[@]}" || exit 1
|
||||
|
||||
echo "All WORKFLOWS_QUEUE consistency checks passed."
|
||||
Reference in New Issue
Block a user