Update index.yaml

Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>
Update index.yaml
2026-10-21 17:58:27 +00:00 · 2026-10-19 16:22:46 +00:00 · 2026-10-19 13:24:16 +00:00 · 2026-10-19 13:14:38 +00:00 · 2026-10-16 11:57:54 +00:00 · 2026-10-14 12:52:39 +00:00
91 changed files with 6162 additions and 13225 deletions
@@ -1,28 +0,0 @@
-FROM mcr.microsoft.com/devcontainers/go:1.25-bookworm
-
-# Remove expired Yarn GPG key from base image
-RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
-
-# Remove expired Yarn repository key (inherited from base image)
-RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
-
-# Install AZURE CLI
-RUN curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
-
-# Install helm and kubectl
-RUN curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
-RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
-    && chmod +x ./kubectl \
-    && sudo mv ./kubectl /usr/local/bin/kubectl
-
-# Install Argocd CLI
-RUN VERSION=$(curl -L -s https://raw.githubusercontent.com/argoproj/argo-cd/stable/VERSION)
-RUN curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/v$VERSION/argocd-linux-amd64
-RUN sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
-RUN rm argocd-linux-amd64
-
-# Install google-cloud-sdk
-RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
-RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
-RUN sudo apt-get update && sudo apt-get install -y google-cloud-cli
-RUN sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin
@@ -1,23 +0,0 @@
-{
-	"name": "go:1.25-bookworm",
-	"dockerFile": "Dockerfile",
-	"runArgs": [
-		"--name=helm-charts",
-		"--network=host",
-		 "--privileged"
-	],
-	"customizations": {
-		"vscode": {
-			"extensions": [
-				"ms-kubernetes-tools.vscode-kubernetes-tools",
-				"redhat.vscode-yaml",
-				"Tim-Koehler.helm-intellisense",
-				"ms-vscode.azurecli",
-				"ms-vscode-remote.remote-containers",
-				"GitHub.copilot",
-				"ms-kubernetes-tools.vscode-aks-tools",
-				"fabiospampinato.vscode-diff"
-			]
-		}
-	}
-}
@@ -1,56 +0,0 @@
-name: Deploy on k3d
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        k3d: [v5.7.5]
-    steps:
-      - name: Checkout repository
-        uses: actions/checkout@v4
-      - name: "Create single cluster"
-        uses: AbsaOSS/k3d-action@v2
-        with:
-          k3d-version: ${{ matrix.k3d }}  
-          cluster-name: "k3d-cluster"
-      - name: Print Kubernetes Version
-        run: |
-          kubectl version
-      - name: Test k3d
-        run: |
-          echo "Sleeping for 120 seconds, give time for the cluster to be ready" && sleep 120
-          kubectl get no
-          kubectl get pods -A -o wide
-          kubectl get sc
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ K3d deployment successful on ${{ matrix.os }} (${{ matrix.k3d }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ K3d deployment failed on ${{ matrix.os }} (${{ matrix.k3d }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
@@ -1,52 +0,0 @@
-name: Deploy on kind
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        kind: [v0.25.0]
-    steps:
-      - name: Create kind
-        uses: helm/kind-action@v1
-        with:
-          version: ${{ matrix.kind }}
-      - name: Print Kubernetes Version
-        run: |
-          kubectl version
-      - name: Test kind
-        run: |
-          kubectl get no
-          kubectl get pods -A -o wide
-          kubectl get sc
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ Kind deployment successful on ${{ matrix.os }} (${{ matrix.kind }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ Kind deployment failed on ${{ matrix.os }} (${{ matrix.kind }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
@@ -1,53 +0,0 @@
-name: Deploy on microk8s
-on:
-  workflow_dispatch:
-  pull_request:
-jobs:
-  deploy:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      matrix:
-        os: [ubuntu-22.04, ubuntu-24.04]
-        microk8s: [1.32/stable]
-    steps:
-      - uses: balchua/microk8s-actions@v0.4.3
-        with:
-          channel: ${{ matrix.microk8s }}
-          addons: '["dns", "dashboard", "hostpath-storage", "nvidia"]'
-      - name: Set permissions
-        run: |
-          sudo chown -f -R $USER $HOME/.kube $HOME/.config
-      - name: Test microk8s
-        id: list-pods
-        run: |
-          kubectl get no
-          kubectl get pods -A -o wide
-      - name: Checkout repository
-        uses: actions/checkout@v2
-      - name: Install Prometheus operator
-        id: install-prometheus-operator
-        run: |
-          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
-          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
-          kubectl get crd
-          kubectl get po -A -o wide
-      - name: Install Hub Helm chart
-        id: install-hub
-        run: |
-          helm repo add kerberos https://charts.kerberos.io
-          kubectl create namespace kerberos-hub
-          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
-          kubectl get pods -A -o wide
-      - name: Send Slack Notification on Success
-        if: success()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ MicroK8s deployment successful on ${{ matrix.os }} (${{ matrix.microk8s }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
-      - name: Send Slack Notification on Failure
-        if: failure()
-        env:
-          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
-        run: |
-          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ MicroK8s deployment failed on ${{ matrix.os }} (${{ matrix.microk8s }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
-          
@@ -1,11 +1,9 @@
-name: Create a new release
+name: Release Charts

 on:
  push:
    branches:
      - main
-    paths:
-      - 'charts/**/Chart.yaml'

 jobs:
  release:
@@ -0,0 +1 @@
+charts.kerberos.io
@@ -1,24 +1,19 @@
-## Helm charts
+## Usage

-Kerberos.io ecosystem can be deployed through Helm charts. Use one of the following charts to boost the installation:
-
- [Hub](https://github.com/kerberos-io/helm-charts/tree/main/charts/hub)
-
-## Prerequisite
-
-[Helm](https://helm.sh) must be installed to use the charts. Please refer to Helm's [documentation](https://helm.sh/docs) to get started.
+[Helm](https://helm.sh) must be installed to use the charts. Please refer to
+Helm's [documentation](https://helm.sh/docs) to get started.

 Once Helm has been set up correctly, add the repo as follows:

-    helm repo add kerberos https://charts.kerberos.io
+helm repo add <alias> https://<orgname>.github.io/helm-charts

 If you had already added this repo earlier, run `helm repo update` to retrieve
-the latest versions of the packages. You can then run `helm search repo kerberos` to see the charts.
+the latest versions of the packages. You can then run `helm search repo <alias>` to see the charts.

-To install the `kerberos` chart:
+To install the <chart-name> chart:

-    helm install my-hub kerberos/hub
+    helm install my-<chart-name> <alias>/<chart-name>

 To uninstall the chart:

-    helm delete my-hub
+    helm delete my-<chart-name>
@@ -1,6 +1,6 @@
 apiVersion: v2
 name: hub
-description: A Helm chart to install Kerberos Hub in Kubernetes
+description: A Helm chart for install Kerberos Hub in Kubernetes
 icon: https://doc.kerberos.io/images/kerberos-logo.svg

 # A chart can be either an 'application' or a 'library' chart.
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.164.0
+version: 0.29.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "3.3.0"
+appVersion: "3.0.0"
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: letsencrypt-prod
+spec:
+  acme:
+    # The ACME server URL
+    server: https://acme-v02.api.letsencrypt.org/directory
+    # Email address used for ACME registration
+    email: cedric@verstraeten.io
+    # Name of a secret used to store the ACME account private key
+    privateKeySecretRef:
+      name: letsencrypt-prod
+    # Enable the HTTP-01 challenge provider
+    solvers:
+      - http01:
+          ingress:
+            class: nginx
@@ -1,11 +0,0 @@
-apiVersion: v1
-kind: PersistentVolumeClaim
-metadata:
-  name: custom-i18n-claim
-spec:
-  accessModes:
-    - ReadWriteMany
-  storageClassName: azurefile-premium
-  resources:
-    requests:
-      storage: 25Mi
@@ -1,9 +0,0 @@
-{
-  "nav": {
-    "cases": "Investigations",
-    "dashboard": "Home"
-  },
-  "login": {
-    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
-  }
-}
@@ -1,409 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Hey, {{assignee}}</h4>
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        padding-bottom: 24px;
-                                        padding-left: 0;
-                                        padding-right: 0;">You have been assigned to a task</h2>
-						<p style="font-family: Inter;
-                                        font-size: 18px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;
-						">Task Details:</p>
-						<ul style="font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 0;
-                                        padding-bottom: 12px;
-                                        padding-left: 0;
-                                        padding-right: 0;
-                                        margin-left: 12px">
-							<li>Task Name: {{task_name}}</li>
-							<li>Assigned By: {{user}}</li>
-						</ul>
- 						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 20px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 166px;
-                                                border-radius: 4px;
-                                                cursor: pointer;">View task on kerberos hub</p>
-                        </a>
-						
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>
@@ -1,19 +0,0 @@
-Kerberos.io
------------
-
-Hey, {{assignee}}
-You have been assigned to a new task on Kerberos Hub.
-Task Details:
- Task Name: {{task_name}}
- Assigned By: {{user}}
- Link: {{link}}
-
-Get in touch
------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,31 +1,3 @@
-package templates
-
-var TEMPLATE_DETECTION_TEXT = `
-Kerberos.io
------------
-
-Hey, {{user}}
-Welcome to Kerberos Hub
-Activate your account ->
-{{link}}
-
-Kerberos Hub in a nutshell
-With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
-
-However before you get started this amazing applications, please activate your account.
-
-Get in touch
------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
-`
-
-var TEMPLATE_DETECTION = `
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
@@ -303,25 +275,10 @@ var TEMPLATE_DETECTION = `
                                        letter-spacing: 0em;
                                        text-align: left;
                                        color: #6D6666;
-                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered for your device <b>{{devicename}}</b>. Please watch the recording, by clicking on below button. 
+                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered. Please watch the recording, by clicking on below button. 
 If you believe this event is a false positive, go to your Kerberos Hub account and change the alert settings accordingly.</p>


-                        <p style=" font-family: Inter;
-                        font-size: 14px;
-                        font-style: normal;
-                        font-weight: 400;
-                        line-height: 24px;
-                        mso-line-height-rule:exactly;
-                        letter-spacing: 0em;
-                        text-align: left;
-                        color: #6D6666;
-                        margin-top: 12px;">Following event was detected at {{datetime}}.</p>
-
-						<a style="text-decoration: none;color: none;" href="{{link}}">
-                            {{thumbnail}}
-                        </a>
-
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                            <p style="font-family: Inter;
                                                font-size: 14px;
@@ -472,4 +429,4 @@ If you believe this event is a false positive, go to your Kerberos Hub account a
    </tr>
 </table>
 </body>
-</html>`
+</html>
@@ -1,418 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">A case has been shared with you</h2>
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">{{user}} shared a case with you</h4>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 280px">Open the shared case</h3>
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
-
-
-						<a style="text-decoration: none;color: none;" href="{{url}}">
-                            <p style="font-family: Inter;
-                                                font-size: 14px;
-                                                font-style: normal;
-                                                line-height: 24px;
-                                                mso-line-height-rule:exactly;
-                                                letter-spacing: 0em;
-                                                text-align: left;
-                                                color:#FFFFFF;
-                                                background-color: #84559F;
-                                                padding-top: 6px;
-                                                padding-bottom: 6px;
-                                                padding-right: 16px;
-                                                padding-left: 16px;
-                                                width: 130px;
-                                                border-radius: 4px;
-												text-align: center;
-                                                cursor: pointer;">Open case -></p>
-                        </a>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>
@@ -1,21 +0,0 @@
-Kerberos.io
------------
-
-A case has been shared with you
-{{user}} shared a case with you
-
-Open the shared case
-{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
-{{url}}
-
-This link will expire in {{expiry}}.
-
-Get in touch
------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,425 +0,0 @@
-<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
-<html xmlns="http://www.w3.org/1999/xhtml">
-<head>
-    
-    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
-    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
-    <meta
-            name="viewport"
-            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
-    />
-    <meta name="description" content="Kerberos.io Mailing">
-    <style type="text/css">
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 400;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 500;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter';
-            font-style:  normal;
-            font-weight: 600;
-            font-display: swap;
-            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
-            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
-        }
-
-        @font-face {
-            font-family: 'Inter var';
-            font-weight: 100 900;
-            font-display: swap;
-            font-style: normal;
-            font-named-instance: 'Regular';
-            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
-        }
-
-        body{
-            background: #E5E5E5;
-            margin-top:0;
-            margin-bottom: 0;
-            margin-right: 0;
-            margin-left: 0;
-            padding-top: 0;
-            padding-left: 0;
-            padding-right: 0;
-            padding-bottom: 0;
-            font-family: 'Inter';
-        }
-        a, a:hover, a:active {
-            color: #262424;
-            text-decoration: none;
-        }
-
-        .corner-td{
-            width: 60px;
-        }
-
-        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
-        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
-        .ExternalClass {width: 100%;}
-        @media screen and (max-width:500px){
-            .tab-td{
-                padding-left: 10px!important;
-            }
-            .tab-td a h4{
-                font-size: 14px!important;
-            }
-            .corner-td{
-                width: 20px!important;
-            }
-            .company-name-td h3{
-                font-size: 16px!important;
-            }
-            table.header-table{
-                padding-top: 8px!important;
-                padding-right: 0px!important;
-                padding-bottom: 24px!important;
-                padding-left: 0px!important;
-            }
-            .colored-card-td  h4{
-                font-size: 14px!important;
-            }
-            .colored-card-td  h2{
-                font-size: 20px!important;
-            }
-            .colored-card-td  a p{
-                font-size: 12px!important;
-                width: 143px!important;
-            }
-            .colored-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td{
-                padding-top: 24px!important;
-                padding-right: 24px!important;
-                padding-bottom: 24px!important;
-                padding-left: 24px!important;
-            }
-            .colorless-card-td h3{
-                font-size: 18px!important;
-            }
-            .colorless-card-td p{
-                font-size: 14px!important;
-            }
-            .colorless-card-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 24px!important;
-                margin-bottom: 24px!important;
-            }
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:600px) {
-            .footer-td{
-                display: table-row!important;
-            }
-        }
-        @media screen and (max-width:650px) {
-            .footer-table{
-                margin-left: 0px!important;
-                margin-right: 0px!important;
-                margin-top: 0px!important;
-                margin-bottom: 36px!important;
-            }
-        }
-    </style>
-</head>
-<body height="100%" width="100%">
-<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
-                    <td height="36" align="left" class="company-name-td">
-                        <h3  width="36" height="36" style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;">Kerberos.io</h3>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
-                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab1_title}}</h4>
-                        </a>
-                    </td>
-                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
-                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
-                            <h4 style="font-family: Inter;
-                                            font-size: 16px;
-                                            font-style: normal;
-                                            font-weight: 500;
-                                            line-height: 36px;
-                                            mso-line-height-rule:exactly;
-                                            letter-spacing: 0em;
-                                            text-align: right;
-                                            color: #6D6666;">{{tab2_title}}</h4>
-                        </a>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
-                        <h2 style=" font-family: Inter;
-                                        font-size: 24px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#FFFFFF;
-                                        padding-top: 12px;
-                                        margin-bottom: 0;
-                                        padding-bottom: 0;
-                                        padding-left: 0;
-                                        padding-right: 0;">Verify your access</h2>
-                        <h4 style="font-family: Inter;
-                                        font-size: 16px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color:#b09fb9;">Use the code below to open the shared case</h4>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
-                        <h3 style=" font-family: Inter;
-                                        font-size: 20px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 36px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #262424;
-                                        width: 280px">Your verification code</h3>
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;
-                                        margin-top: 12px;">Enter the code below on the share page to access the case.</p>
-
-                        <p style="font-family: 'Courier New', Courier, monospace;
-                                        font-size: 32px;
-                                        font-style: normal;
-                                        font-weight: 600;
-                                        line-height: 40px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 8px;
-                                        text-align: center;
-                                        color:#262424;
-                                        background-color: #F2F0F4;
-                                        padding-top: 16px;
-                                        padding-bottom: 16px;
-                                        padding-right: 16px;
-                                        padding-left: 16px;
-                                        margin-top: 16px;
-                                        margin-bottom: 16px;
-                                        border-radius: 4px;">{{code}}</p>
-
-                        <p style=" font-family: Inter;
-                                        font-size: 14px;
-                                        font-style: normal;
-                                        font-weight: 400;
-                                        line-height: 24px;
-                                        mso-line-height-rule:exactly;
-                                        letter-spacing: 0em;
-                                        text-align: left;
-                                        color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
-					</td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-    <tr>
-        <td bgcolor="E5E5E5">
-            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
-                <tbody>
-                <tr>
-                    <td class="corner-td" align="left"></td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">Get in touch</h4>
-                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 16px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">support@kerberos.io</p>
-                                    </a>
-                                    <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                    line-height: 16px;
-                                    mso-line-height-rule:exactly;
-                                    letter-spacing: 0em;
-                                    text-align: left;
-                                    color: #A69D9D;">9000 Ghent, BE</p>
-
-                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
-                                        <p style=" font-family: Inter;
-                                                            font-size: 14px;
-                                                            font-style: normal;
-                                                            font-weight: 400;
-                                                            line-height: 24px;
-                                                            mso-line-height-rule:exactly;
-                                                            letter-spacing: 0em;
-                                                            text-align: left;
-                                                            color: #A69D9D;">https://kerberos.io</p>
-                                    </a>
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <!--[if mso | IE]>
-                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
-                    <![endif]-->
-                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
-                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                            <tbody>
-                            <tr>
-                                <td>
-                                    <h4 style=" font-family: Inter;
-                                                        font-size: 16px;
-                                                        font-style: normal;
-                                                        font-weight: 600;
-                                                        line-height: 36px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color:#6D6666;">About Kerberos</h4>
-                                    <p style=" font-family: Inter;
-                                                        font-size: 14px;
-                                                        font-style: normal;
-                                                        font-weight: 400;
-                                                        line-height: 24px;
-                                                        mso-line-height-rule:exactly;
-                                                        letter-spacing: 0em;
-                                                        text-align: left;
-                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
-                                                        
-                                    
-                                    <p style="margin-top: 12px;">
-                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
-                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
-                                        </a>
-                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
-                                        </a>
-                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
-                                        </a>
-                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
-                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
-                                        </a>
-                                    </p>                
-                                </td>
-                            </tr>
-                            </tbody>
-                        </table>
-                    </td>
-                    <td class="corner-td" align="right"></td>
-                </tr>
-                </tbody>
-            </table>
-            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
-                <tbody>
-                    <tr style="height: 50px">
-                        <td></td>
-                    </tr>
-                </tbody>
-            </table>
-        </td>
-    </tr>
-</table>
-</body>
-</html>
@@ -1,21 +0,0 @@
-Kerberos.io
------------
-
-Verify your access
-Use the code below to open the shared case
-
-Your verification code
-{{code}}
-
-Enter this code on the share page to access the case. This code expires in {{expiry}}.
-If you didn't request this, you can safely ignore this email.
-
-Get in touch
------------
-support@kerberos.io
-9000 Ghent, BE
-https://kerberos.io
-
-About Kerberos
------------
-Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
@@ -1,5 +0,0 @@
-[
-  {"key": "nose", "label": "Nose"},
-  {"key": "left_shoulder", "label": "Left shoulder"},
-  {"key": "right_shoulder", "label": "Right shoulder"}
-]
@@ -1,17 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: hub-api-server-tls
-  namespace: kerberos-hub
-type: kubernetes.io/tls
-stringData:
-  # Paste your PEM certificate chain here (e.g., fullchain.pem)
-  tls.crt: |
-    -----BEGIN CERTIFICATE-----
-    REPLACE_WITH_YOUR_CERTIFICATE
-    -----END CERTIFICATE-----
-  # Paste your PEM private key here (e.g., privkey.pem)
-  tls.key: |
-    -----BEGIN PRIVATE KEY-----
-    REPLACE_WITH_YOUR_PRIVATE_KEY
-    -----END PRIVATE KEY-----
@@ -1,24 +0,0 @@
-# Create these ConfigMaps in the release namespace before deploying the chart.
-# Keys contain complete contracts/catalogs; they are not merged with chart data.
-# Do not also set classificationCatalog or classificationCatalogExistingConfigMap.
-classificationCatalogEnabled: true
-workflowConfiguration:
-  enabled: true
-  includeDefaults: true
-  configMaps:
-    - name: deployment-workflow-overrides
-      items:
-        - key: start.yaml
-          path: workflow-contracts/start.yaml
-          replace: true
-        - key: deployment-classifications.json
-          path: catalogs/classifications.json
-          replace: true
-    - name: custom-workflow-contracts
-      items:
-        - key: pose.yaml
-          path: workflow-contracts/pose.yaml
-    - name: shared-pose-catalog
-      items:
-        - key: pose-keypoints.json
-          path: catalogs/pose-keypoints.json
@@ -1,13 +0,0 @@
-# Packaging only; does not activate contract loading or deploy a pose worker.
-workflowConfiguration:
-  enabled: true
-  includeDefaults: true
-  configMaps:
-    - name: custom-workflow-contracts
-      items:
-        - key: pose.yaml
-          path: workflow-contracts/pose.yaml
-    - name: shared-pose-catalog
-      items:
-        - key: pose-keypoints.json
-          path: catalogs/pose-keypoints.json
@@ -1,53 +0,0 @@
-# yaml-language-server: $schema=../../schemas/workflow-contract.schema.json
-# Hypothetical custom worker output; not an installed stage or universal pose schema.
-schemaVersion: 1
-stage: pose
-contractVersion: 1
-presentation:
-  name: Detect poses
-  description: Estimate body keypoints and posture for people in the recording.
-  icon: person
-  color: teal
-# Settings authors enter per node; the worker receives them as node data.
-params:
-  - name: minConfidence
-    label: Minimum keypoint confidence
-    type: number
-    default: 0.5
-  - name: model
-    label: Model
-    type: select
-    options: [fast, accurate]
-    optionLabels: {fast: Fast, accurate: Accurate}
-    default: fast
-fields:
-  - id: keypoint
-    label: Keypoint
-    path: people.*.keypoints.*.name
-    type: string
-    operators: [in]
-    choices:
-      file: ../catalogs/pose-keypoints.json
-  - id: posture
-    label: Posture
-    path: people.*.posture
-    type: string
-    operators: [in]
-    choices:
-      values: [standing, sitting, lying]
-  - id: confidence
-    label: Keypoint confidence
-    path: people.*.keypoints.*.confidence
-    type: number
-    operators: [gt, gte, lt, lte]
-    minimum: 0
-    maximum: 1
-# Connections leaving this stage: one section with fixed inputs, then the
-# Extra conditions catch-all (appended collapsed when not placed explicitly).
-panel:
-  sections:
-    - id: posture
-      label: Posture
-      fields:
-        - {field: posture, widget: multiselect}
-        - {field: confidence, widget: number, operator: gte, label: Minimum confidence}
@@ -0,0 +1,7 @@
+apiVersion: storage.k8s.io/v1
+kind: StorageClass
+metadata:
+  name: fast
+provisioner: kubernetes.io/gce-pd
+parameters:
+  type: pd-ssd
@@ -65,22 +65,4 @@ db.settings.insertMany([
            "dayLimit" : NumberInt(30)
        }
    }
-},
-{ 
-    "_id" : ObjectId("63f346ec64011a574161cf99"), 
-    "key" : "classifications", 
-    "map" : {
-        "objects" : [
-            {
-                "text" : "Car", 
-                "value" : "car", 
-                "icon" : "car"
-            }, 
-            {
-                "text" : "Person", 
-                "value" : "pedestrian", 
-                "icon" : "pedestrian"
-            }
-        ]
-    }
 }])
@@ -0,0 +1,932 @@
+## Global Docker image parameters
+## Please, note that this will override the image parameters, including dependencies, configured to use the global value
+## Current available global Docker image parameters: imageRegistry and imagePullSecrets
+##
+# global:
+#   imageRegistry: myRegistryName
+#   imagePullSecrets:
+#     - myRegistryKeySecretName
+#   storageClass: myStorageClass
+## Override the namespace for resource deployed by the chart, but can itself be overridden by the local namespaceOverride
+#   namespaceOverride: my-global-namespace
+
+image:
+  ## Bitnami MongoDB registry
+  ##
+  registry: docker.io
+  ## Bitnami MongoDB image name
+  ##
+  repository: bitnami/mongodb
+  ## Bitnami MongoDB image tag
+  ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/
+  ##
+  tag: 4.4.2-debian-10-r0
+  ## Specify a imagePullPolicy
+  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+  ##
+  pullPolicy: IfNotPresent
+  ## Optionally specify an array of imagePullSecrets.
+  ## Secrets must be manually created in the namespace.
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+  ##
+  # pullSecrets:
+  #   - myRegistryKeySecretName
+
+  ## Set to true if you would like to see extra information on logs
+  ## It turns on Bitnami debugging in minideb-extras-base
+  ## ref:  https://github.com/bitnami/minideb-extras-base
+  debug: false
+
+## String to partially override mongodb.fullname template (will maintain the release name)
+##
+# nameOverride:
+
+## String to fully override mongodb.fullname template
+##
+# fullnameOverride:
+
+## Kubernetes Cluster Domain
+##
+clusterDomain: cluster.local
+
+## Use an alternate scheduler, e.g. "stork".
+## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
+##
+# schedulerName:
+
+## MongoDB architecture. Allowed values: standalone or replicaset
+##
+architecture: standalone
+
+## Use StatefulSet instead of Deployment when deploying standalone
+##
+useStatefulSet: false
+
+## MongoDB Authentication parameters
+##
+auth:
+  ## Enable authentication
+  ## ref: https://docs.mongodb.com/manual/tutorial/enable-authentication/
+  ##
+  enabled: true
+  ## MongoDB root password
+  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#setting-the-root-password-on-first-run
+  ##
+  rootPassword: "yourmongodbpassword"
+  ## MongoDB custom user and database
+  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#creating-a-user-and-database-on-first-run
+  ##
+  # username: username
+  # password: password
+  # database: database
+  ## Key used for replica set authentication
+  ## Ignored when mongodb.architecture=standalone
+  ##
+  replicaSetKey: ""
+
+  ## Existing secret with MongoDB credentials
+  ## NOTE: When it's set the previous parameters are ignored.
+  ##
+  # existingSecret: name-of-existing-secret
+
+tls:
+  ## Enable or disable MongoDB TLS Support
+  enabled: false
+  ##
+  ## Bitnami Nginx image
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/cert-manager
+    tag: 1.19.4-debian-10-r19
+    pullPolicy: IfNotPresent
+
+## Name of the replica set
+## Ignored when mongodb.architecture=standalone
+##
+replicaSetName: rs0
+
+## Enable DNS hostnames in the replica set config
+## Ignored when mongodb.architecture=standalone
+## Ignored when externalAccess.enabled=true
+##
+replicaSetHostnames: true
+
+## Whether enable/disable IPv6 on MongoDB
+## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-ipv6
+##
+enableIPv6: false
+
+## Whether enable/disable DirectoryPerDB on MongoDB
+## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-directoryperdb
+##
+directoryPerDB: false
+
+## MongoDB System Log configuration
+## ref: https://github.com/bitnami/bitnami-docker-mongodb#configuring-system-log-verbosity-level
+##
+systemLogVerbosity: 0
+disableSystemLog: false
+
+## MongoDB configuration file for Primary and Secondary nodes. For documentation of all options, see:
+##   http://docs.mongodb.org/manual/reference/configuration-options/
+## Example:
+## configuration: |-
+##   # where and how to store data.
+##   storage:
+##     dbPath: /bitnami/mongodb/data/db
+##     journal:
+##       enabled: true
+##     directoryPerDB: false
+##   # where to write logging data
+##   systemLog:
+##     destination: file
+##     quiet: false
+##     logAppend: true
+##     logRotate: reopen
+##     path: /opt/bitnami/mongodb/logs/mongodb.log
+##     verbosity: 0
+##   # network interfaces
+##   net:
+##     port: 27017
+##     unixDomainSocket:
+##       enabled: true
+##       pathPrefix: /opt/bitnami/mongodb/tmp
+##     ipv6: false
+##     bindIpAll: true
+##   # replica set options
+##   #replication:
+##     #replSetName: replicaset
+##     #enableMajorityReadConcern: true
+##   # process management options
+##   processManagement:
+##      fork: false
+##      pidFilePath: /opt/bitnami/mongodb/tmp/mongodb.pid
+##   # set parameter options
+##   setParameter:
+##      enableLocalhostAuthBypass: true
+##   # security options
+##   security:
+##     authorization: disabled
+##     #keyFile: /opt/bitnami/mongodb/conf/keyfile
+##
+configuration: ""
+
+## ConfigMap with MongoDB configuration for Primary and Secondary nodes
+## NOTE: When it's set the arbiter.configuration parameter is ignored
+##
+# existingConfigmap:
+
+## initdb scripts
+## Specify dictionary of scripts to be run at first boot
+## Example:
+## initdbScripts:
+##   my_init_script.sh: |
+##      #!/bin/bash
+##      echo "Do something."
+initdbScripts: {}
+
+## Existing ConfigMap with custom init scripts
+##
+# initdbScriptsConfigMap:
+
+## Command and args for running the container (set to default if not set). Use array form
+##
+# command:
+# args:
+
+## Additional command line flags
+## Example:
+## extraFlags:
+##  - "--wiredTigerCacheSizeGB=2"
+##
+extraFlags: []
+
+## Additional environment variables to set
+## E.g:
+## extraEnvVars:
+##   - name: FOO
+##     value: BAR
+##
+extraEnvVars: []
+
+## ConfigMap with extra environment variables
+##
+# extraEnvVarsCM:
+
+## Secret with extra environment variables
+##
+# extraEnvVarsSecret:
+
+## Annotations to be added to the MongoDB statefulset. Evaluated as a template.
+##
+annotations: {}
+
+## Additional labels to be added to the MongoDB statefulset. Evaluated as a template.
+##
+labels: {}
+
+## Number of MongoDB replicas to deploy.
+## Ignored when mongodb.architecture=standalone
+##
+replicaCount: 2
+
+## StrategyType for MongoDB statefulset
+## It can be set to RollingUpdate or Recreate by default.
+##
+strategyType: RollingUpdate
+
+## MongoDB should be initialized one by one when building the replicaset for the first time.
+##
+podManagementPolicy: OrderedReady
+
+## Affinity for pod assignment. Evaluated as a template.
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+##
+affinity: {}
+
+## Node labels for pod assignment. Evaluated as a template.
+## ref: https://kubernetes.io/docs/user-guide/node-selection/
+##
+nodeSelector: {}
+
+## Tolerations for pod assignment. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+##
+tolerations: []
+
+## Lables for MongoDB pods. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+##
+podLabels: {}
+
+## Annotations for MongoDB pods. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+##
+podAnnotations: {}
+
+## MongoDB pods' priority.
+## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+##
+# priorityClassName: ""
+
+## MongoDB pods' Security Context.
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+##
+podSecurityContext:
+  enabled: true
+  fsGroup: 1001
+  ## sysctl settings
+  ## Example:
+  ## sysctls:
+  ## - name: net.core.somaxconn
+  ##   value: "10000"
+  ##
+  sysctls: []
+
+## MongoDB containers' Security Context (main and metrics container).
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+##
+containerSecurityContext:
+  enabled: true
+  runAsUser: 1001
+  runAsNonRoot: true
+
+## MongoDB containers' resource requests and limits.
+## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+##
+resources:
+  # We usually recommend not to specify default resources and to leave this as a conscious
+  # choice for the user. This also increases chances charts run on environments with little
+  # resources, such as Minikube. If you do want to specify resources, uncomment the following
+  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+  limits:
+    cpu: 2048m
+    memory: 4096Mi
+  requests:
+    cpu: 512m
+    memory: 1024Mi
+
+## MongoDB pods' liveness and readiness probes. Evaluated as a template.
+## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+##
+livenessProbe:
+  enabled: true
+  initialDelaySeconds: 30
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+readinessProbe:
+  enabled: true
+  initialDelaySeconds: 5
+  periodSeconds: 10
+  timeoutSeconds: 5
+  failureThreshold: 6
+  successThreshold: 1
+
+## Custom Liveness probes for MongoDB pods
+##
+customLivenessProbe: {}
+
+## Custom Rediness probes MongoDB pods
+##
+customReadinessProbe: {}
+
+## Add init containers to the MongoDB pods.
+## Example:
+## initContainers:
+##   - name: your-image-name
+##     image: your-image
+##     imagePullPolicy: Always
+##     ports:
+##       - name: portname
+##         containerPort: 1234
+##
+initContainers: {}
+
+## Add sidecars to the MongoDB pods.
+## Example:
+## sidecars:
+##   - name: your-image-name
+##     image: your-image
+##     imagePullPolicy: Always
+##     ports:
+##       - name: portname
+##         containerPort: 1234
+##
+sidecars: {}
+
+## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB pods
+## Examples:
+## extraVolumeMounts:
+##   - name: extras
+##     mountPath: /usr/share/extras
+##     readOnly: true
+## extraVolumes:
+##   - name: extras
+##     emptyDir: {}
+extraVolumeMounts: []
+extraVolumes: []
+
+## MongoDB Pod Disruption Budget configuration
+## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+##
+pdb:
+  create: false
+  ## Min number of pods that must still be available after the eviction
+  ##
+  minAvailable: 1
+  ## Max number of pods that can be unavailable after the eviction
+  ##
+  # maxUnavailable: 1
+
+## Enable persistence using Persistent Volume Claims
+## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+##
+persistence:
+  enabled: true
+  ## A manually managed Persistent Volume and Claim
+  ## Requires persistence.enabled: true
+  ## If defined, PVC must be created manually before volume will be bound
+  ## Ignored when mongodb.architecture=replicaset
+  ##
+  # existingClaim:
+  ## PV Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ## set, choosing the default provisioner.
+  ##
+  # storageClass: "-"
+  ## PV Access Mode
+  ##
+  accessModes:
+    - ReadWriteOnce
+  ## PVC size
+  ##
+  size: 8Gi
+  ## PVC annotations
+  ##
+  annotations: {}
+  ## The path the volume will be mounted at, useful when using different
+  ## MongoDB images.
+  ##
+  mountPath: /bitnami/mongodb
+  ## The subdirectory of the volume to mount to, useful in dev environments
+  ## and one PV for multiple services.
+  ##
+  subPath: ""
+
+## Service parameters
+##
+service:
+  ## Service type
+  ##
+  type: ClusterIP
+  ## MongoDB service port
+  ##
+  port: 27017
+  ## MongoDB service port name
+  ##
+  portName: mongodb
+  ## Specify the nodePort value for the LoadBalancer and NodePort service types.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
+  ##
+  nodePort: ""
+  ## MongoDB service clusterIP IP
+  ##
+  # clusterIP: None
+  ## Specify the externalIP value ClusterIP service type.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
+  ##
+  externalIPs: []
+  ## Specify the loadBalancerIP value for LoadBalancer service types.
+  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
+  ##
+  # loadBalancerIP:
+  ## Specify the loadBalancerSourceRanges value for LoadBalancer service types.
+  ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+  ##
+  loadBalancerSourceRanges: []
+  ## Provide any additional annotations which may be required. Evaluated as a template
+  ##
+  annotations: {}
+
+## External Access to MongoDB nodes configuration
+##
+externalAccess:
+  ## Enable Kubernetes external cluster access to MongoDB nodes
+  ##
+  enabled: false
+  ## External IPs auto-discovery configuration
+  ## An init container is used to auto-detect LB IPs or node ports by querying the K8s API
+  ## Note: RBAC might be required
+  ##
+  autoDiscovery:
+    ## Enable external IP/ports auto-discovery
+    ##
+    enabled: false
+    ## Bitnami Kubectl image
+    ## ref: https://hub.docker.com/r/bitnami/kubectl/tags/
+    ##
+    image:
+      registry: docker.io
+      repository: bitnami/kubectl
+      tag: 1.18.12-debian-10-r2
+      ## Specify a imagePullPolicy
+      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+      ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+      ##
+      pullPolicy: IfNotPresent
+      ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
+      ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+      ## Example:
+      ## pullSecrets:
+      ##   - myRegistryKeySecretName
+      ##
+      pullSecrets: []
+    ## Init Container resource requests and limits
+    ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+    ##
+    resources:
+      # We usually recommend not to specify default resources and to leave this as a conscious
+      # choice for the user. This also increases chances charts run on environments with little
+      # resources, such as Minikube. If you do want to specify resources, uncomment the following
+      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+      limits: {}
+      #   cpu: 100m
+      #   memory: 128Mi
+      requests: {}
+      #   cpu: 100m
+      #   memory: 128Mi
+  ## Parameters to configure K8s service(s) used to externally access MongoDB
+  ## A new service per broker will be created
+  ##
+  service:
+    ## Service type. Allowed values: LoadBalancer or NodePort
+    ##
+    type: LoadBalancer
+    ## Port used when service type is LoadBalancer
+    ##
+    port: 27017
+    ## Array of load balancer IPs for each MongoDB node. Length must be the same as replicaCount
+    ## Example:
+    ## loadBalancerIPs:
+    ##   - X.X.X.X
+    ##   - Y.Y.Y.Y
+    ##
+    loadBalancerIPs: []
+    ## Load Balancer sources
+    ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
+    ## Example:
+    ## loadBalancerSourceRanges:
+    ## - 10.10.10.0/24
+    ##
+    loadBalancerSourceRanges: []
+    ## Array of node ports used for each MongoDB nodes. Length must be the same as replicaCount
+    ## Example:
+    ## nodePorts:
+    ##   - 30001
+    ##   - 30002
+    ##
+    nodePorts: []
+    ## When service type is NodePort, you can specify the domain used for MongoDB advertised hostnames.
+    ## If not specified, the container will try to get the kubernetes node external IP
+    ##
+    # domain: mydomain.com
+    ## Provide any additional annotations which may be required. Evaluated as a template
+    ##
+    annotations: {}
+
+##
+## MongoDB Arbiter parameters.
+##
+arbiter:
+  ## Enable deploying the MongoDB Arbiter
+  ##   https://docs.mongodb.com/manual/tutorial/add-replica-set-arbiter/
+  enabled: true
+
+  ## MongoDB configuration file for the Arbiter. For documentation of all options, see:
+  ##   http://docs.mongodb.org/manual/reference/configuration-options/
+  ##
+  configuration: ""
+
+  ## ConfigMap with MongoDB configuration for the Arbiter
+  ## NOTE: When it's set the arbiter.configuration parameter is ignored
+  ##
+  # existingConfigmap:
+
+  ## Command and args for running the container (set to default if not set). Use array form
+  ##
+  # command:
+  # args:
+
+  ## Additional command line flags
+  ## Example:
+  ## extraFlags:
+  ##  - "--wiredTigerCacheSizeGB=2"
+  ##
+  extraFlags: []
+
+  ## Additional environment variables to set
+  ## E.g:
+  ## extraEnvVars:
+  ##   - name: FOO
+  ##     value: BAR
+  ##
+  extraEnvVars: []
+
+  ## ConfigMap with extra environment variables
+  ##
+  # extraEnvVarsCM:
+
+  ## Secret with extra environment variables
+  ##
+  # extraEnvVarsSecret:
+
+  ## Annotations to be added to the Arbiter statefulset. Evaluated as a template.
+  ##
+  annotations: {}
+
+  ## Additional to be added to the Arbiter statefulset. Evaluated as a template.
+  ##
+  labels: {}
+
+  ## Affinity for pod assignment. Evaluated as a template.
+  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+  ##
+  affinity: {}
+
+  ## Node labels for pod assignment. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/user-guide/node-selection/
+  ##
+  nodeSelector: {}
+
+  ## Tolerations for pod assignment. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
+  ##
+  tolerations: []
+
+  ## Lables for MongoDB Arbiter pods. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
+  ##
+  podLabels: {}
+
+  ## Annotations for MongoDB Arbiter pods. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+  ##
+  podAnnotations: {}
+
+  ## MongoDB Arbiter pods' priority.
+  ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
+  ##
+  # priorityClassName: ""
+
+  ## MongoDB Arbiter pods' Security Context.
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
+  ##
+  podSecurityContext:
+    enabled: true
+    fsGroup: 1001
+    ## sysctl settings
+    ## Example:
+    ## sysctls:
+    ## - name: net.core.somaxconn
+    ##   value: "10000"
+    ##
+    sysctls: []
+
+  ## MongoDB Arbiter containers' Security Context (only main container).
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
+  ##
+  containerSecurityContext:
+    enabled: true
+    runAsUser: 1001
+
+  ## MongoDB Arbiter containers' resource requests and limits.
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  ## MongoDB Arbiter pods' liveness and readiness probes. Evaluated as a template.
+  ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
+  ##
+  livenessProbe:
+    enabled: true
+    initialDelaySeconds: 30
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+  readinessProbe:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 10
+    timeoutSeconds: 5
+    failureThreshold: 6
+    successThreshold: 1
+
+  ## Custom Liveness probes for MongoDB Arbiter pods
+  ##
+  customLivenessProbe: {}
+
+  ## Custom Rediness probes MongoDB Arbiter pods
+  ##
+  customReadinessProbe: {}
+
+  ## Add init containers to the MongoDB Arbiter pods.
+  ## Example:
+  ## initContainers:
+  ##   - name: your-image-name
+  ##     image: your-image
+  ##     imagePullPolicy: Always
+  ##     ports:
+  ##       - name: portname
+  ##         containerPort: 1234
+  ##
+  initContainers: {}
+
+  ## Add sidecars to the MongoDB Arbiter pods.
+  ## Example:
+  ## sidecars:
+  ##   - name: your-image-name
+  ##     image: your-image
+  ##     imagePullPolicy: Always
+  ##     ports:
+  ##       - name: portname
+  ##         containerPort: 1234
+  ##
+  sidecars: {}
+
+  ## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB Arbiter pods
+  ## Examples:
+  ## extraVolumeMounts:
+  ##   - name: extras
+  ##     mountPath: /usr/share/extras
+  ##     readOnly: true
+  ## extraVolumes:
+  ##   - name: extras
+  ##     emptyDir: {}
+  extraVolumeMounts: []
+  extraVolumes: []
+
+  ## MongoDB Arbiter Pod Disruption Budget configuration
+  ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
+  ##
+  pdb:
+    create: false
+    ## Min number of pods that must still be available after the eviction
+    ##
+    minAvailable: 1
+    ## Max number of pods that can be unavailable after the eviction
+    ##
+    # maxUnavailable: 1
+
+## ServiceAccount
+## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
+##
+serviceAccount:
+  ## Specifies whether a ServiceAccount should be created
+  ##
+  create: true
+  ## The name of the ServiceAccount to use.
+  ## If not set and create is true, a name is generated using the rabbitmq.fullname template
+  ##
+  # name:
+
+## Role Based Access
+## ref: https://kubernetes.io/docs/admin/authorization/rbac/
+##
+rbac:
+  ## Specifies whether RBAC rules should be created
+  ## binding MongoDB ServiceAccount to a role
+  ## that allows MongoDB pods querying the K8s API
+  ##
+  create: false
+
+## Init Container paramaters
+## Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each component
+## values from the securityContext section of the component
+##
+volumePermissions:
+  enabled: false
+  ## Bitnami Minideb image
+  ## ref: https://hub.docker.com/r/bitnami/minideb/tags/
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/minideb
+    tag: buster
+    ## Specify a imagePullPolicy
+    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
+    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
+    ##
+    pullPolicy: Always
+    ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
+    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+    ## Example:
+    ## pullSecrets:
+    ##   - myRegistryKeySecretName
+    ##
+    pullSecrets: []
+  ## Init Container resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+  ## Init container Security Context
+  ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser
+  ## and not the below volumePermissions.securityContext.runAsUser
+  ## When runAsUser is set to special value "auto", init container will try to chwon the
+  ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`
+  ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed).
+  ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with
+  ## podSecurityContext.enabled=false,containerSecurityContext.enabled=false and shmVolume.chmod.enabled=false
+  ##
+  securityContext:
+    runAsUser: 0
+
+## Prometheus Exporter / Metrics
+##
+metrics:
+  enabled: false
+  ## Bitnami MongoDB Promtheus Exporter image
+  ## ref: https://hub.docker.com/r/bitnami/mongodb-exporter/tags/
+  ##
+  image:
+    registry: docker.io
+    repository: bitnami/mongodb-exporter
+    tag: 0.11.2-debian-10-r44
+    pullPolicy: IfNotPresent
+    ## Optionally specify an array of imagePullSecrets.
+    ## Secrets must be manually created in the namespace.
+    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
+    ##
+    # pullSecrets:
+    #   - myRegistryKeySecretName
+
+  ## String with extra flags to the metrics exporter
+  ## ref: https://github.com/percona/mongodb_exporter/blob/master/mongodb_exporter.go
+  ##
+  extraFlags: ""
+
+  ## String with additional URI options to the metrics exporter
+  ## ref: https://docs.mongodb.com/manual/reference/connection-string
+  ##
+  extraUri: ""
+
+  ## Metrics exporter container resource requests and limits
+  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
+  ##
+  resources:
+    # We usually recommend not to specify default resources and to leave this as a conscious
+    # choice for the user. This also increases chances charts run on environments with little
+    # resources, such as Minikube. If you do want to specify resources, uncomment the following
+    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+    limits: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+    requests: {}
+    #   cpu: 100m
+    #   memory: 128Mi
+
+  ## Prometheus Exporter service configuration
+  ##
+  service:
+    ## Annotations for Prometheus Exporter pods. Evaluated as a template.
+    ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
+    ##
+    annotations:
+      prometheus.io/scrape: "true"
+      prometheus.io/port: "{{ .Values.metrics.service.port }}"
+      prometheus.io/path: "/metrics"
+    type: ClusterIP
+    port: 9216
+
+  ## Metrics exporter liveness and readiness probes
+  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
+  ##
+  livenessProbe:
+    enabled: true
+    initialDelaySeconds: 15
+    periodSeconds: 5
+    timeoutSeconds: 5
+    failureThreshold: 3
+    successThreshold: 1
+  readinessProbe:
+    enabled: true
+    initialDelaySeconds: 5
+    periodSeconds: 5
+    timeoutSeconds: 1
+    failureThreshold: 3
+    successThreshold: 1
+
+  ## Prometheus Service Monitor
+  ## ref: https://github.com/coreos/prometheus-operator
+  ##      https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md
+  ##
+  serviceMonitor:
+    ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
+    enabled: false
+
+    ## Specify the namespace where Prometheus Operator is running
+    ##
+    # namespace: monitoring
+
+    ## Specify the interval at which metrics should be scraped
+    ##
+    interval: 30s
+    ## Specify the timeout after which the scrape is ended
+    ##
+    # scrapeTimeout: 30s
+    ## Used to pass Labels that are used by the Prometheus installed in your cluster to select Service Monitors to work with
+    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
+    ##
+    additionalLabels: {}
+
+  ## Custom PrometheusRule to be defined
+  ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions
+  ##
+  prometheusRule:
+    enabled: false
+    additionalLabels: {}
+    ## Specify the namespace where Prometheus Operator is running
+    ##
+    # namespace: monitoring
+
+    ## Define individual alerting rules as required
+    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#rulegroup
+    ##      https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
+    ##
+    ## This is an example of a rule, you should add the below code block under the "rules" param, removing the brackets
+    ## - name: example
+    ##   rules:
+    ##   - alert: HighRequestLatency
+    ##     expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5
+    ##     for: 10m
+    ##     labels:
+    ##       severity: page
+    ##     annotations:
+    ##       summary: High request latency
+    ##
+    rules: {}
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: regcred
+type: kubernetes.io/dockerconfigjson
+data:
+  .dockerconfigjson: xxxxkeytoberequestedxxx
@@ -1,17 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Hub shared choice catalog v1",
-  "description": "Compatible with the existing classification JSON format. Keys must be unique; no references to other catalogs.",
-  "type": "array",
-  "minItems": 1,
-  "items": {
-    "type": "object",
-    "additionalProperties": false,
-    "required": ["key", "label"],
-    "properties": {
-      "key": {"type": "string", "minLength": 1},
-      "label": {"type": "string", "minLength": 1},
-      "icon": {"type": "string", "minLength": 1}
-    }
-  }
-}
@@ -1,321 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "title": "Hub workflow editor contract v1",
-  "type": "object",
-  "additionalProperties": false,
-  "required": ["schemaVersion", "stage", "contractVersion", "fields"],
-  "properties": {
-    "schemaVersion": {"const": 1},
-    "stage": {
-      "type": "string",
-      "pattern": "^[a-z][a-z0-9-]*$",
-      "description": "Stage type, not a node instance. start describes initial context."
-    },
-    "contractVersion": {"const": 1},
-    "presentation": {
-      "type": "object",
-      "additionalProperties": false,
-      "description": "How the editor shows this node. Icons and colours come from approved sets.",
-      "properties": {
-        "name": {"type": "string", "minLength": 1, "maxLength": 80},
-        "description": {"type": "string", "minLength": 1, "maxLength": 500},
-        "icon": {"enum": ["play", "camera", "person", "eye-crossed", "car", "clock", "mlModel", "share"]},
-        "color": {
-          "enum": ["blue", "teal", "rose", "amber", "indigo", "violet", "green", "grey"],
-          "description": "Theme colour token."
-        }
-      }
-    },
-    "params": {
-      "type": "array",
-      "maxItems": 64,
-      "description": "Worker-stage settings authors enter, stored per node. An explicit list (even empty) replaces kerberoshub.workflows.editorStages params. Not supported on start.",
-      "items": {"$ref": "#/definitions/param"}
-    },
-    "fields": {
-      "type": "array",
-      "description": "Typed values conditions may test. Start: the selectors device, sites, groups and classifications plus condition-only fields whose path exists in the condition root schema (models.WorkflowConditionRootSchema), e.g. device.deviceName or inputs.classify.details.*.isStatic; other inputs.<operation> paths are worker-defined. Stage: outputs relative to results.<stage>. New conditions may only use declared fields. An empty array is valid.",
-      "items": {"$ref": "#/definitions/field"},
-      "maxItems": 128
-    },
-    "controls": {
-      "type": "array",
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["id", "label"],
-        "properties": {
-          "id": {"enum": ["weeklySchedule", "conditions"]},
-          "label": {"type": "string", "minLength": 1}
-        }
-      },
-      "description": "Start only. Controls offered for new authoring; omitted offers none. conditions applies to edges leaving Start.",
-      "maxItems": 16
-    },
-    "triggerModes": {
-      "type": "array",
-      "minItems": 1,
-      "uniqueItems": true,
-      "items": {"enum": ["automatic", "manual"]},
-      "description": "Start only. Trigger modes offered for new authoring; omitted offers both."
-    },
-    "panel": {"$ref": "#/definitions/panel"}
-  },
-  "definitions": {
-    "choices": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "source": {
-          "type": "string",
-          "description": "Built-in authorized project-resource resolver; not a database path.",
-          "oneOf": [
-            {
-              "const": "project.devices",
-              "description": "Device keys as values, device names as labels."
-            },
-            {"const": "project.sites", "description": "Site IDs as values, site names as labels."},
-            {
-              "const": "project.groups",
-              "description": "Group IDs as values, group names as labels."
-            }
-          ]
-        },
-        "file": {
-          "type": "string",
-          "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$",
-          "description": "Direct shared catalog file relative to the contract; no URLs or nested references."
-        },
-        "values": {
-          "type": "array",
-          "minItems": 1,
-          "uniqueItems": true,
-          "items": {"type": ["string", "number", "boolean"]}
-        }
-      },
-      "oneOf": [{"required": ["source"]}, {"required": ["file"]}, {"required": ["values"]}]
-    },
-    "field": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "label", "path", "type", "operators"],
-      "properties": {
-        "id": {
-          "type": "string",
-          "pattern": "^[A-Za-z][A-Za-z0-9_-]*$",
-          "description": "Stable identifier, unique within this contract."
-        },
-        "label": {"type": "string", "minLength": 1},
-        "path": {
-          "type": "string",
-          "pattern": "^[A-Za-z_][A-Za-z0-9_-]*(\\.(\\*|[A-Za-z_][A-Za-z0-9_-]*))*$",
-          "description": "Safe Start-context path, or relative path inside this node instance's output. Wildcards select scalar candidates."
-        },
-        "type": {"enum": ["string", "integer", "number", "boolean"]},
-        "operators": {
-          "type": "array",
-          "minItems": 1,
-          "uniqueItems": true,
-          "items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches", "gt", "gte", "lt", "lte"]}
-        },
-        "optional": {
-          "type": "boolean",
-          "default": false,
-          "description": "Field may be absent even when the node completes; branch availability is determined separately."
-        },
-        "minimum": {"type": "number"},
-        "maximum": {"type": "number"},
-        "choices": {"$ref": "#/definitions/choices"}
-      },
-      "allOf": [
-        {
-          "if": {"properties": {"type": {"const": "string"}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "contains", "matches"]}},
-              "choices": {"properties": {"values": {"items": {"type": "string"}}}}
-            },
-            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "boolean"}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists"]}},
-              "choices": {"properties": {"values": {"items": {"type": "boolean"}}}}
-            },
-            "not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["integer", "number"]}}},
-          "then": {
-            "properties": {
-              "operators": {"items": {"enum": ["eq", "ne", "in", "exists", "gt", "gte", "lt", "lte"]}},
-              "choices": {"properties": {"values": {"items": {"type": "number"}}}}
-            }
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "integer"}}},
-          "then": {"properties": {"choices": {"properties": {"values": {"items": {"type": "integer"}}}}}}
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["integer", "number", "boolean"]}}},
-          "then": {
-            "properties": {"choices": {"not": {"anyOf": [{"required": ["file"]}, {"required": ["source"]}]}}}
-          }
-        }
-      ]
-    },
-    "param": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "type"],
-      "properties": {
-        "name": {
-          "type": "string",
-          "pattern": "^[A-Za-z][A-Za-z0-9_]*$",
-          "maxLength": 64,
-          "description": "Key in node data; unique within the contract."
-        },
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "description": {"type": "string", "minLength": 1, "maxLength": 500},
-        "group": {
-          "type": "string",
-          "minLength": 1,
-          "maxLength": 80,
-          "description": "Editor section; params sharing a group appear together."
-        },
-        "placeholder": {"type": "string", "minLength": 1, "maxLength": 160},
-        "type": {"enum": ["string", "number", "boolean", "select", "multiselect", "secret"]},
-        "required": {"type": "boolean"},
-        "default": {
-          "description": "Value the editor pre-fills and the API stores when a node leaves the setting unset; never for secrets. Typically the worker's own default."
-        },
-        "options": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 256,
-          "uniqueItems": true,
-          "items": {"type": "string", "minLength": 1, "maxLength": 160}
-        },
-        "optionLabels": {
-          "type": "object",
-          "additionalProperties": {"type": "string", "minLength": 1, "maxLength": 160}
-        },
-        "minimum": {"type": "number", "description": "Inclusive lower bound for a number setting."},
-        "maximum": {"type": "number", "description": "Inclusive upper bound for a number setting."},
-        "choices": {
-          "type": "object",
-          "additionalProperties": false,
-          "required": ["file"],
-          "properties": {
-            "file": {"type": "string", "pattern": "^\\.\\./catalogs/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.json$"}
-          },
-          "description": "Options for a select or multiselect setting from a shared catalog file (keys become options, labels become optionLabels). Use instead of options."
-        }
-      },
-      "allOf": [
-        {
-          "if": {"properties": {"type": {"enum": ["select", "multiselect"]}}},
-          "then": {"oneOf": [{"required": ["options"]}, {"required": ["choices"]}]},
-          "else": {
-            "not": {
-              "anyOf": [{"required": ["options"]}, {"required": ["optionLabels"]}, {"required": ["choices"]}]
-            }
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "secret"}}},
-          "then": {"not": {"required": ["default"]}}
-        },
-        {
-          "if": {"properties": {"type": {"enum": ["string", "select"]}}},
-          "then": {"properties": {"default": {"type": "string"}}}
-        },
-        {
-          "if": {"properties": {"type": {"const": "multiselect"}}},
-          "then": {
-            "properties": {"default": {"type": "array", "items": {"type": "string"}, "uniqueItems": true}}
-          }
-        },
-        {
-          "if": {"properties": {"type": {"const": "number"}}},
-          "then": {"properties": {"default": {"type": "number"}}},
-          "else": {"not": {"anyOf": [{"required": ["minimum"]}, {"required": ["maximum"]}]}}
-        },
-        {
-          "if": {"properties": {"type": {"const": "boolean"}}},
-          "then": {"properties": {"default": {"type": "boolean"}}}
-        }
-      ]
-    },
-    "panel": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["sections"],
-      "description": "Layout of connections leaving this node. Without it, a default panel is used. A section with picker: true positions the Extra conditions catch-all; without one it is appended collapsed. On start, a panel replaces the top-level controls list.",
-      "properties": {
-        "sections": {
-          "type": "array",
-          "minItems": 1,
-          "maxItems": 16,
-          "items": {"$ref": "#/definitions/panelSection"}
-        }
-      }
-    },
-    "panelSection": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["id", "label"],
-      "properties": {
-        "id": {"type": "string", "pattern": "^[A-Za-z][A-Za-z0-9_-]*$", "maxLength": 80},
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "collapsed": {"type": "boolean"},
-        "picker": {
-          "type": "boolean",
-          "description": "This section is the Extra conditions catch-all over every declared field of Start and upstream stages; it holds no fields or controls."
-        },
-        "controls": {
-          "type": "array",
-          "items": {"const": "weeklySchedule"},
-          "maxItems": 1,
-          "description": "Start only."
-        },
-        "fields": {"type": "array", "maxItems": 32, "items": {"$ref": "#/definitions/panelField"}}
-      },
-      "if": {"properties": {"picker": {"const": true}}, "required": ["picker"]},
-      "then": {"not": {"anyOf": [{"required": ["fields"]}, {"required": ["controls"]}]}}
-    },
-    "panelField": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["field", "widget"],
-      "properties": {
-        "field": {
-          "type": "string",
-          "description": "ID of a field declared in this contract; each field is placed at most once."
-        },
-        "label": {"type": "string", "minLength": 1, "maxLength": 160},
-        "widget": {
-          "enum": ["multiselect", "select", "text", "number", "toggle"],
-          "description": "multiselect: string with choices (in); select: choices (eq, ne); text: string (eq, contains, matches, ne, in); number: integer or number (gte, gt, lte, lt, eq, ne); toggle: boolean (eq, ne)."
-        },
-        "operator": {
-          "enum": ["eq", "ne", "in", "contains", "matches", "gt", "gte", "lt", "lte"],
-          "description": "Fixed operator; must be declared by the field and supported by the widget. Defaults to the first widget operator the field declares."
-        }
-      }
-    }
-  },
-  "allOf": [
-    {
-      "if": {"properties": {"stage": {"const": "start"}}, "required": ["stage"]},
-      "then": {"not": {"required": ["params"]}},
-      "else": {"not": {"anyOf": [{"required": ["controls"]}, {"required": ["triggerModes"]}]}}
-    },
-    {"if": {"required": ["panel"]}, "then": {"not": {"required": ["controls"]}}}
-  ]
-}
@@ -1,128 +0,0 @@
-{{- define "hub.workflowConfiguration.bundledPaths" -}}
-{{- list "workflow-contracts/start.yaml" "workflow-contracts/anpr.yaml" "workflow-contracts/forwarder.yaml" "catalogs/classifications.json" | toYaml -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.anpr.configMapName" -}}
-{{- printf "%s-workflow-contract-anpr" (.Release.Name | trunc 40 | trimSuffix "-") -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.forwarder.configMapName" -}}
-{{- printf "%s-workflow-contract-forwarder" (.Release.Name | trunc 40 | trimSuffix "-") -}}
-{{- end -}}
-
-{{- define "hub.classificationCatalog.configMapName" -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- $replacement := index $config.replacements "catalogs/classifications.json" | default dict -}}
-{{- if $replacement -}}
-{{- $replacement.name -}}
-{{- else -}}
-{{- default "classification-catalog" .Values.classificationCatalogExistingConfigMap -}}
-{{- end -}}
-{{- end -}}
-
-{{/* Normalize both interfaces without changing the caller's values. */}}
-{{- define "hub.workflowConfiguration.settings" -}}
-{{- $config := .Values.workflowConfiguration | default dict -}}
-{{- $unified := or (hasKey $config "includeDefaults") (hasKey $config "configMaps") -}}
-{{- $legacy := or (hasKey $config "existingConfigMap") (hasKey $config "items") (hasKey $config "extraConfigMaps") -}}
-{{- if and $unified $legacy -}}
-{{- fail "workflowConfiguration cannot mix includeDefaults/configMaps with existingConfigMap/items/extraConfigMaps" -}}
-{{- end -}}
-{{- $includeDefaults := true -}}
-{{- $sources := $config.extraConfigMaps | default list -}}
-{{- if $unified -}}
-{{- $sources = $config.configMaps | default list -}}
-{{- if hasKey $config "includeDefaults" -}}
-{{- $includeDefaults = $config.includeDefaults -}}
-{{- end -}}
-{{- else -}}
-{{- if $config.existingConfigMap -}}
-{{- if and $config.enabled (not $config.items) -}}
-{{- fail "workflowConfiguration.items is required with existingConfigMap" -}}
-{{- end -}}
-{{- $includeDefaults = false -}}
-{{- $sources = prepend $sources (dict "name" $config.existingConfigMap "items" ($config.items | default list)) -}}
-{{- else if and $config.enabled $config.items -}}
-{{- fail "workflowConfiguration.items requires existingConfigMap" -}}
-{{- end -}}
-{{- end -}}
-{{- $enabled := $config.enabled | default false -}}
-{{- $replacements := dict -}}
-{{- $normalizedSources := list -}}
-{{- $bundledPaths := include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray -}}
-{{- range $sources -}}
-{{- $name := .name -}}
-{{- $items := list -}}
-{{- range .items -}}
-{{- if and $enabled .replace -}}
-{{- if or (not $unified) (not $includeDefaults) -}}
-{{- fail "workflowConfiguration item replace: true requires configMaps with includeDefaults: true" -}}
-{{- end -}}
-{{- if not (has .path $bundledPaths) -}}
-{{- fail (printf "workflowConfiguration item replace: true targets unknown bundled path %q" .path) -}}
-{{- end -}}
-{{- if hasKey $replacements .path -}}
-{{- fail (printf "duplicate workflowConfiguration replacement path %q" .path) -}}
-{{- end -}}
-{{- $_ := set $replacements .path (dict "name" $name "key" .key) -}}
-{{- end -}}
-{{- $items = append $items (omit . "replace") -}}
-{{- end -}}
-{{- $normalizedSources = append $normalizedSources (dict "name" $name "items" $items) -}}
-{{- end -}}
-{{- if hasKey $replacements "catalogs/classifications.json" -}}
-{{- if .Values.classificationCatalogExistingConfigMap -}}
-{{- fail "a classifications.json replacement cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
-{{- end -}}
-{{- end -}}
-{{- if not (kindIs "invalid" .Values.classificationCatalog) -}}
-{{- if not .Values.classificationCatalogEnabled -}}
-{{- fail "classificationCatalog requires classificationCatalogEnabled; remove the inline list to use the API fallback" -}}
-{{- end -}}
-{{- if .Values.classificationCatalogExistingConfigMap -}}
-{{- fail "classificationCatalog cannot be combined with classificationCatalogExistingConfigMap; choose one override mechanism" -}}
-{{- end -}}
-{{- if hasKey $replacements "catalogs/classifications.json" -}}
-{{- fail "classificationCatalog cannot be combined with a classifications.json replacement; choose one override mechanism" -}}
-{{- end -}}
-{{- end -}}
-{{- dict "enabled" $enabled "includeDefaults" $includeDefaults "configMaps" $normalizedSources "replacements" $replacements | toYaml -}}
-{{- end -}}
-
-{{- define "hub.workflowConfiguration.validate" -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if $config.enabled -}}
-{{- $paths := dict -}}
-{{- if $config.includeDefaults -}}
-{{- if not .Values.classificationCatalogEnabled -}}
-{{- fail "bundled workflowConfiguration requires classificationCatalogEnabled; disable includeDefaults and supply configMaps for a custom bundle" -}}
-{{- end -}}
-{{- range $path := (include "hub.workflowConfiguration.bundledPaths" . | fromYamlArray) -}}
-{{- if not (hasKey $config.replacements $path) -}}
-{{- $_ := set $paths $path true -}}
-{{- end -}}
-{{- end -}}
-{{- else -}}
-{{- if not $config.configMaps -}}
-{{- fail "workflowConfiguration.configMaps must be nonempty when enabled without defaults" -}}
-{{- end -}}
-{{- end -}}
-{{- range $config.configMaps -}}
-{{- if not .items -}}
-{{- fail (printf "workflowConfiguration ConfigMap %q requires nonempty items" .name) -}}
-{{- end -}}
-{{- range .items -}}
-{{- if not (regexMatch "^[A-Za-z0-9._-]+$" .key) -}}
-{{- fail "workflowConfiguration.items keys must be valid ConfigMap keys" -}}
-{{- end -}}
-{{- if or (not (regexMatch "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$" .path)) (ne (clean .path) .path) -}}
-{{- fail "workflowConfiguration.items paths must be normalized relative files under workflow-contracts/ or catalogs/" -}}
-{{- end -}}
-{{- if hasKey $paths .path -}}
-{{- fail (printf "duplicate workflowConfiguration.items path %q" .path) -}}
-{{- end -}}
-{{- $_ := set $paths .path true -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
@@ -1,51 +0,0 @@
-{{/*
-The system tag catalog (deviceTags.system.catalog) uses the Hub shared choice
-catalog format: {key, label, description?}. values.schema.json validates each
-entry (key in stored device tag form, models.NormalizeDeviceTags: 1-64
-characters of a-z, 0-9, ".", "_", ":" and "-", starting and ending with a
-letter or digit) and that enabled is a boolean; keys must also be unique.
-*/}}
-{{- define "kerberoshub.deviceTags.system.validate" -}}
-{{- $seen := dict -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $key := toString $tag.key -}}
-{{- if hasKey $seen $key -}}
-{{- fail (printf "deviceTags.system.catalog: duplicate key %q" $key) -}}
-{{- end -}}
-{{- $_ := set $seen $key true -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-The configured system tag catalog as a JSON array, whether or not system tags
-are enabled (missing values read as empty).
-*/}}
-{{- define "kerberoshub.deviceTags.system.catalog" -}}
-{{- $deviceTags := .Values.deviceTags | default dict -}}
-{{- $system := $deviceTags.system | default dict -}}
-{{- $system.catalog | default list | toJson -}}
-{{- end -}}
-
-{{/*
-Whether system tags are enabled (deviceTags.system.enabled): "true" or "".
-*/}}
-{{- define "kerberoshub.deviceTags.system.enabled" -}}
-{{- $deviceTags := .Values.deviceTags | default dict -}}
-{{- $system := $deviceTags.system | default dict -}}
-{{- if and (kindIs "bool" $system.enabled) $system.enabled -}}true{{- end -}}
-{{- end -}}
-
-{{/*
-The system tag catalog file hub-api reads (DEVICE_SYSTEM_TAGS_FILE), rendered
-from deviceTags.system.catalog into the device-system-tags ConfigMap.
-*/}}
-{{- define "kerberoshub.deviceTags.system.json" -}}
-{{- include "kerberoshub.deviceTags.system.validate" . -}}
-{{- $tags := list -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $entry := dict "key" $tag.key "label" $tag.label -}}
-{{- with $tag.description }}{{- $_ := set $entry "description" . -}}{{- end }}
-{{- $tags = append $tags $entry -}}
-{{- end -}}
-{{- $tags | toJson -}}
-{{- end -}}
@@ -1,113 +0,0 @@
-{{/* Build the path to the configured MongoDB CA bundle. */}}
-{{- define "hub.mongodb.tlsCAFile" -}}
-{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
-{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
-{{- end -}}
-{{- end -}}
-
-{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
-{{- define "hub.mongodb.uri" -}}
-{{- $uri := .Values.mongodb.uri | default "" -}}
-{{- if and .Values.mongodb.tls.enabled $uri -}}
-  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
-    {{- $separator := "?" -}}
-    {{- if contains "?" $uri -}}
-      {{- $separator = "&" -}}
-    {{- end -}}
-    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stls=true" $uri $separator -}}
-  {{- end -}}
-  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
-  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
-    {{- $separator := "&" -}}
-    {{- if not (contains "?" $uri) -}}
-      {{- $separator = "?" -}}
-    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
-  {{- end -}}
-{{- end -}}
-{{- $uri -}}
-{{- end -}}
-
-{{/*
-MongoDB URI with appName set to one workload, so the Atlas query profiler and
-currentOp attribute each operation to the service that issued it. Renders
-nothing when no URI is configured or mongodb.appNamePerService is false.
-Usage: include "hub.mongodb.appUri" (dict "root" $ "app" "hub-api")
-*/}}
-{{- define "hub.mongodb.appUri" -}}
-{{- $uri := include "hub.mongodb.uri" .root -}}
-{{- if and $uri .root.Values.mongodb.appNamePerService -}}
-  {{- if regexMatch "(?i)[?&]appName=" $uri -}}
-    {{- $uri = regexReplaceAll "(?i)([?&])appName=[^&]*" $uri (printf "${1}appName=%s" .app) -}}
-  {{- else -}}
-    {{- $separator := "&" -}}
-    {{- if not (contains "?" $uri) -}}
-      {{- $separator = "?" -}}
-    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
-      {{- $separator = "" -}}
-    {{- end -}}
-    {{- $uri = printf "%s%sappName=%s" $uri $separator .app -}}
-  {{- end -}}
-  {{- $uri -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Container env entry that overrides MONGODB_URI from mongodb-config with the
-workload's own appName. An explicit env entry takes precedence over envFrom.
-Usage: {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
-*/}}
-{{- define "hub.mongodb.appUriEnv" -}}
-{{- with include "hub.mongodb.appUri" . -}}
- name: MONGODB_URI
-  value: {{ . | quote }}
-{{- end -}}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA Secret volume. */}}
-{{- define "hub.mongodb.tlsVolume" -}}
- name: mongodb-tls
-  secret:
-    secretName: {{ .Values.mongodb.tls.existingSecret }}
-{{- end -}}
-
-{{/* Render the shared MongoDB CA volume mount. */}}
-{{- define "hub.mongodb.tlsVolumeMount" -}}
- name: mongodb-tls
-  mountPath: {{ .Values.mongodb.tls.mountPath }}
-  readOnly: true
-{{- end -}}
-
-{{/*
-OpenTelemetry sampler env entries, rendered only when configured. The OTel SDKs
-read these natively; unset keeps the SDK default (parentbased_always_on).
-"hub.opentelemetry.samplerEnv" renders opentelemetry.sampler, the sampler of the
-services downstream of the Vault (pipeline, workflows engine and stages), which
-continue the Vault's trace; "hub.opentelemetry.apiSamplerEnv" renders
-opentelemetry.apiSampler for hub-api, which starts its own traces for user
-requests.
-Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-*/}}
-{{- define "hub.opentelemetry.samplerEnv" -}}
-{{- include "hub.opentelemetry.samplerEnvFrom" .Values.opentelemetry.sampler -}}
-{{- end -}}
-
-{{- define "hub.opentelemetry.apiSamplerEnv" -}}
-{{- include "hub.opentelemetry.samplerEnvFrom" (.Values.opentelemetry.apiSampler | default dict) -}}
-{{- end -}}
-
-{{- define "hub.opentelemetry.samplerEnvFrom" -}}
-{{- with .type }}
- name: OTEL_TRACES_SAMPLER
-  value: {{ . | quote }}
-{{- end }}
-{{- with .arg }}
- name: OTEL_TRACES_SAMPLER_ARG
-  value: {{ . | quote }}
-{{- end }}
-{{- end -}}
@@ -1,57 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: admin
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.admin.replicas }}
-  selector:
-    matchLabels:
-      app: admin
-  template:
-    metadata:
-      labels:
-        app: admin
-    spec:
-      {{- with .Values.admin.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admin.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: admin
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.admin.repository }}:{{ .Values.admin.tag }}"
-          imagePullPolicy: {{ .Values.admin.pullPolicy }}
-          {{- with .Values.admin.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.admin.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - name: http
-              containerPort: 80
-              protocol: TCP
-          env:
-            - name: LOG_LEVEL
-              value: "{{ .Values.admin.logLevel }}"
-            - name: API_URL
-              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
-            - name: TITLE
-              value: Hub Admin | Scale for everyone, anywhere
-            - name: LOGO_NAME
-            - name: ENVIRONMENT
-              value: staging
-            - name: PRIVATE_EDITION
-              value: "false"
-            - name: PRODUCTION
-              value: "true"
-            - name: DEMO
-              value: "false"
-{{- end }}
@@ -1,52 +0,0 @@
-
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{ if ne .Values.ingress "" }}
-{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{- else }}
-apiVersion: networking.k8s.io/v1beta1
-{{- end }}
-kind: Ingress
-metadata:
-  name: admin-ingress
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{- if eq .Values.admin.oauth2Proxy.enabled true  }}
-    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
-    {{- end }}
-    {{- if eq .Values.ingress "nginx" }}
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    cert-manager.io/cluster-issuer: "letsencrypt-prod"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  {{- with .Values.admin.tls }}
-  tls:
-    {{- toYaml . | nindent 8 }}
-  {{- end }}
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: admin-svc
-              port:
-                number: 80
-  {{- else }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: admin-svc
-              servicePort: 80
-  {{- end }}
-{{- end }}
-{{- end }}
@@ -1,108 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) (eq .Values.admin.oauth2Proxy.enabled true) }}
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: oauth2-proxy-admin
-  namespace: kube-system
-  annotations:
-    {{- if eq .Values.ingress "nginx" }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  rules:
-    - host: "{{ .Values.admin.url }}"
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: oauth2-proxy-admin
-                port:
-                  number: 4180
-  tls:
-    - hosts:
-        - "{{ .Values.admin.url }}"
-      secretName: 
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy-admin
-  namespace: kube-system
-  labels:
-    k8s-app: oauth2-proxy-admin
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      k8s-app: oauth2-proxy-admin
-  template:
-    metadata:
-      labels:
-        k8s-app: oauth2-proxy-admin
-    spec:
-      {{- with .Values.admin.oauth2Proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.admin.oauth2Proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - args:
-            - --provider=github
-            - --email-domain=*
-            - --upstream=file:///dev/null
-            - --http-address=0.0.0.0:4180
-            - --skip-auth-preflight=true
-          {{- with .Values.admin.oauth2Proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              value: "{{ .Values.admin.oauth2Proxy.github.clientId }}"
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              value: "{{ .Values.admin.oauth2Proxy.github.clientSecret }}"
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              value: "{{ .Values.admin.oauth2Proxy.github.cookieSecret }}"
-            - name: OAUTH2_PROXY_GITHUB_ORG
-              value: "{{ .Values.admin.oauth2Proxy.github.organization }}"
-            - name: OAUTH2_PROXY_GITHUB_TEAM
-              value: "{{ .Values.admin.oauth2Proxy.github.team }}"
-          image: quay.io/oauth2-proxy/oauth2-proxy:latest
-          imagePullPolicy: Always
-          name: oauth2-proxy
-          ports:
-            - containerPort: 4180
-              protocol: TCP
-          resources:
-            limits:
-              cpu: 100m
-              memory: 50Mi
-            requests:
-              cpu: 100m
-              memory: 50Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    k8s-app: oauth2-proxy-admin
-  name: oauth2-proxy-admin
-  namespace: kube-system
-spec:
-  ports:
-    - name: http
-      port: 4180
-      protocol: TCP
-      targetPort: 4180
-  selector:
-    k8s-app: oauth2-proxy-admin
-{{- end -}}
@@ -1,17 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: v1
-kind: Service
-metadata:
-  name: admin-svc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: admin-svc
-spec:
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 80
-      name: http
-  selector:
-    app: admin
-{{- end }}
@@ -1,46 +0,0 @@
-{{- define "hub.classificationCatalog.defaults" -}}
-[
-  {"key": "animal", "label": "Animal", "icon": "animal"},
-  {"key": "pedestrian", "label": "Pedestrian", "icon": "pedestrian"},
-  {"key": "cyclist", "label": "Cyclist", "icon": "cyclist"},
-  {"key": "motorbike", "label": "Motorbike", "icon": "motorbike"},
-  {"key": "lorry", "label": "Lorry", "icon": "lorry"},
-  {"key": "car", "label": "Car", "icon": "car"},
-  {"key": "handbag", "label": "Handbag", "icon": "handbag"},
-  {"key": "suitcase", "label": "Suitcase", "icon": "suitcase"},
-  {"key": "cell phone", "label": "Cell phone", "icon": "cell phone"}
-]
-{{- end -}}
-{{/*
-The effective chart-rendered catalog: the inline classificationCatalog values
-list when set, otherwise the bundled defaults above. values.schema.json
-validates each entry ({key, label, icon?}); keys must also be unique.
-*/}}
-{{- define "hub.classificationCatalog.json" -}}
-{{- if kindIs "invalid" .Values.classificationCatalog -}}
-{{- include "hub.classificationCatalog.defaults" . | mustFromJson | toJson -}}
-{{- else if and (kindIs "slice" .Values.classificationCatalog) .Values.classificationCatalog -}}
-{{- $seen := dict -}}
-{{- range $entry := .Values.classificationCatalog -}}
-{{- $key := toString $entry.key -}}
-{{- if hasKey $seen $key -}}
-{{- fail (printf "classificationCatalog: duplicate key %q" $key) -}}
-{{- end -}}
-{{- $_ := set $seen $key true -}}
-{{- end -}}
-{{- .Values.classificationCatalog | toJson -}}
-{{- else -}}
-{{- fail "classificationCatalog must be omitted (bundled defaults) or a nonempty list; to use the API fallback set classificationCatalogEnabled: false" -}}
-{{- end -}}
-{{- end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not (hasKey $config.replacements "catalogs/classifications.json")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: classification-catalog
-  namespace: {{ .Release.Namespace }}
-data:
-  classifications.json: |-
-    {{- include "hub.classificationCatalog.json" . | mustFromJson | toPrettyJson | nindent 4 }}
-{{- end -}}
@@ -1,12 +0,0 @@
-{{- if include "kerberoshub.deviceTags.system.enabled" . }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: device-system-tags
-  namespace: {{ .Release.Namespace }}
-data:
-  # Rendered from deviceTags.system.catalog; hub-api reads it through
-  # DEVICE_SYSTEM_TAGS_FILE.
-  system-tags.json: |-
-    {{- include "kerberoshub.deviceTags.system.json" . | mustFromJson | toPrettyJson | nindent 4 }}
-{{- end -}}
@@ -1,51 +0,0 @@
-{{- if .Values.audit.enabled -}}
-{{- $destinations := list -}}
-{{- $destinationIDs := dict -}}
-{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
-  {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
-  {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
-    {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
-  {{- end -}}
-  {{- if hasKey $destinationIDs $id -}}
-    {{- fail (printf "duplicate audit destination id %q" $id) -}}
-  {{- end -}}
-  {{- $_ := set $destinationIDs $id true -}}
-  {{- $url := required (printf "url is required for audit destination %s" $id) $destination.url -}}
-  {{- $entry := dict
-      "id" $id
-      "type" (default "webhook" $destination.type)
-      "enabled" $destination.enabled
-      "url" $url
-      "timeoutSeconds" (default 10 $destination.timeoutSeconds)
-      "batchSize" (default 100 $destination.batchSize)
-      "maxAttempts" (default 10 $destination.maxAttempts)
-      "startAt" (default "latest" $destination.startAt)
-      "headers" (default dict $destination.headers)
-      "filters" (default dict $destination.filters) -}}
-  {{- $secretRoot := printf "/var/run/secrets/audit-destinations/%s" $id -}}
-  {{- $bearer := default dict $destination.bearerTokenSecret -}}
-  {{- if gt (len $bearer) 0 -}}
-    {{- $secretName := required (printf "bearerTokenSecret.name is required for destination %s" $id) $bearer.name -}}
-    {{- $secretKey := default "token" $bearer.key -}}
-    {{- $_ := set $entry "bearerTokenFile" (printf "%s/bearer-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName $secretKey) | trunc 12)) -}}
-  {{- end -}}
-  {{- $headerFiles := dict -}}
-  {{- range $headerName, $secret := (default dict $destination.secretHeaders) -}}
-    {{- $secretName := required (printf "secretName is required for destination %s header %s" $id $headerName) $secret.secretName -}}
-    {{- $secretKey := required (printf "secretKey is required for destination %s header %s" $id $headerName) $secret.secretKey -}}
-    {{- $_ := set $headerFiles $headerName (printf "%s/header-%s" $secretRoot (sha256sum (printf "%s:%s:%s" $headerName $secretName $secretKey) | trunc 12)) -}}
-  {{- end -}}
-  {{- if gt (len $headerFiles) 0 -}}
-    {{- $_ := set $entry "headerFiles" $headerFiles -}}
-  {{- end -}}
-  {{- $destinations = append $destinations $entry -}}
-{{- end -}}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-data:
-  destinations.json: |
-    {{ dict "version" 1 "destinations" $destinations | toPrettyJson | nindent 4 }}
-{{- end }}
@@ -1,18 +0,0 @@
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: mongodb-config
-  namespace: {{ .Release.Namespace }}
-data:
-  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
-  MONGODB_HOST: "{{ .Values.mongodb.host }}"
-  MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
-  MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
-  MONGODB_USERNAME: "{{ .Values.mongodb.username }}"
-  MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
-  MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
-  MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
-  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
-  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
-  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
-  MONGODB_DATABASE_CLOUD: "Kerberos"
@@ -1,135 +0,0 @@
-{{/* Validate the rendered anpr.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.anpr" -}}
-schemaVersion: 1
-stage: anpr
-contractVersion: 1
-presentation:
-  name: Number plate recognition
-  description: Read the number plates of vehicles in the recording.
-  icon: car
-  color: amber
-
-# Node settings hub-anpr reads per run (see its README, "Node settings"). Each
-# overrides the matching ANPR_* environment variable; the defaults below equal
-# the worker's built-in defaults. A deployment that changes those variables
-# should change these defaults too, because new nodes store them on save.
-params:
-  - name: plateClasses
-    label: Read plates for
-    description: Vehicle classes whose plates are read (ANPR_PLATE_CLASSES).
-    type: multiselect
-    choices: {file: ../catalogs/classifications.json}
-    default: [car]
-    group: Which vehicles
-  - name: minMovement
-    label: Minimum movement
-    description: Skip vehicles that barely moved; 0 reads every vehicle (ANPR_READ_MOVEMENT_MIN).
-    type: number
-    minimum: 0
-    default: 0
-    group: Which vehicles
-  - name: maxJump
-    label: Maximum jump between frames
-    description: Drop unstable tracks; 0 disables the check (ANPR_READ_MAX_JUMP).
-    type: number
-    minimum: 0
-    default: 0
-    group: Which vehicles
-  - name: readFrames
-    label: Frames to read per vehicle
-    description: Frames OCR'd per vehicle; 0 disables OCR (ANPR_READ_FRAMES).
-    type: number
-    minimum: 0
-    maximum: 10
-    default: 1
-    group: Recognition
-  - name: readQuorum
-    label: Agreeing reads required
-    description: Reads that must agree before a plate is accepted; 0 accepts any read (ANPR_READ_QUORUM).
-    type: number
-    minimum: 0
-    maximum: 10
-    default: 0
-    group: Recognition
-  - name: minConfidence
-    label: Minimum OCR confidence
-    description: Ignore reads below this confidence (ANPR_READ_CONF_MIN).
-    type: number
-    minimum: 0
-    maximum: 1
-    default: 0
-    group: Recognition
-
-# Paths are relative to results.anpr (models.WorkflowAnprResult): one track and
-# one marker per vehicle. Plate, unread and class can be tied to the same
-# vehicle with "Must match the same item"; OCR confidence and engine live on
-# the markers and cannot be tied to a plate.
-fields:
-  - id: plate
-    label: Number plate
-    path: detections.*.tracks.*.meta.plate
-    type: string
-    operators: [eq, in, contains, matches]   # stored uppercase, letters and digits only, e.g. AB123CD
-    optional: true
-  - id: unread
-    label: Plate could not be read
-    path: detections.*.tracks.*.meta.unread
-    type: boolean
-    operators: [eq]
-    optional: true
-  - id: vehicleClass
-    label: Vehicle class (from classification)
-    path: detections.*.tracks.*.meta.classifiedAs
-    type: string
-    operators: [eq, in]
-    optional: true
-    choices: {file: ../catalogs/classifications.json}
-  - id: ocrConfidence
-    label: OCR confidence
-    path: markers.*.metadata.confidence
-    type: number
-    operators: [gte, gt, lte, lt]   # read plates only; about 0-1 for fast, 0.5 for tesseract
-    minimum: 0
-    optional: true
-  - id: ocrEngine
-    label: OCR engine
-    path: markers.*.metadata.engine
-    type: string
-    operators: [eq, in]   # read plates only
-    optional: true
-    choices: {values: [fast, tesseract, tesseract+opencv, http]}
-  - id: secondsVisible
-    label: Seconds visible
-    path: markers.*.duration
-    type: integer
-    operators: [gte, lte]
-    minimum: 0
-    optional: true
-
-# Connections leaving this stage; Extra conditions are appended collapsed.
-panel:
-  sections:
-    - id: plate
-      label: Plate
-      fields:
-        - {field: plate, widget: text, operator: contains, label: Plate contains (e.g. AB123)}
-        - {field: unread, widget: toggle, label: Plate could not be read}
-    - id: recognition
-      label: Recognition
-      collapsed: true
-      fields:
-        - {field: ocrConfidence, widget: number, operator: gte, label: Minimum OCR confidence}
-        - {field: vehicleClass, widget: multiselect}
-        - {field: secondsVisible, widget: number, operator: gte, label: Visible for at least (seconds)}
-{{ end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/anpr.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  anpr.yaml: |-
-    {{- include "hub.workflowConfiguration.anpr" . | nindent 4 }}
-{{- end }}
@@ -1,95 +0,0 @@
-{{/* Validate the rendered forwarder.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.forwarder" -}}
-schemaVersion: 1
-stage: forwarder
-contractVersion: 1
-presentation:
-  name: Forward to my system
-  description: Send the run's data to your own RabbitMQ destination.
-  icon: share
-  color: green
-
-# Custom workflows supply their own connection; deployment credentials are never
-# inherited. These non-secret defaults are stored on save, not read from the worker.
-params:
-  - name: broker
-    label: Provider
-    description: Custom workflows use their own RabbitMQ destination. Shared deployment integrations are reserved for global workflows.
-    type: select
-    required: true
-    options: [rabbitmq]
-    optionLabels: {rabbitmq: RabbitMQ}
-    default: rabbitmq
-    group: Delivery
-  - name: mode
-    label: Completion mode
-    description: Complete after delivery, or wait for the external result. Callback requires a deployment-configured Hub callback URL.
-    type: select
-    required: true
-    options: [delivered, callback]
-    optionLabels: {delivered: Complete after delivery, callback: Wait for result}
-    default: delivered
-    group: Delivery
-  - name: host
-    label: Host
-    description: Your RabbitMQ destination host. Required before enabling the workflow.
-    type: string
-    required: true
-    placeholder: rabbitmq.example.com
-    group: RabbitMQ destination
-  - name: port
-    label: Port
-    description: Your RabbitMQ destination port, a whole number (usually 5671 with TLS or 5672 without TLS).
-    type: number
-    required: true
-    minimum: 1
-    maximum: 65535
-    group: RabbitMQ destination
-  - name: queue
-    label: Queue
-    description: Your destination queue. Its dead-letter queue is this name followed by .forwarder-dead-letter.
-    type: string
-    required: true
-    group: RabbitMQ destination
-  - name: vhost
-    label: Virtual host
-    description: Your RabbitMQ virtual host. Use / for the broker's default virtual host.
-    type: string
-    required: true
-    placeholder: /
-    group: RabbitMQ destination
-  - name: tls
-    label: Use TLS
-    description: Encrypt the connection and verify the broker certificate using system trust roots. Deployment TLS overrides are never inherited.
-    type: boolean
-    required: true
-    default: true
-    group: RabbitMQ destination
-  - name: username
-    label: Username
-    description: Your RabbitMQ destination username. Deployment credentials are never used.
-    type: string
-    required: true
-    group: RabbitMQ credentials
-  - name: password
-    label: Password
-    description: Your RabbitMQ destination password. Required before enabling the workflow; masked after saving.
-    type: secret
-    required: true
-    group: RabbitMQ credentials
-
-# It contributes no output fields: connections after it can still use Start and
-# earlier stages in Extra conditions.
-fields: []
-{{ end -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/forwarder.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
-  namespace: {{ .Release.Namespace }}
-data:
-  forwarder.yaml: |-
-    {{- include "hub.workflowConfiguration.forwarder" . | nindent 4 }}
-{{- end }}
@@ -1,75 +0,0 @@
-{{/* Validate the rendered start.yaml payload against schemas/workflow-contract.schema.json in the chart root. */}}
-{{- define "hub.workflowConfiguration.start" -}}
-schemaVersion: 1
-stage: start
-contractVersion: 1
-
-# Paths refer to the safe initial context, not the full event or credentials.
-fields:
-  - id: device
-    label: Device
-    path: device.deviceKey
-    type: string
-    operators: [eq, in]
-    choices:
-      source: project.devices
-  - id: sites
-    label: Sites
-    path: device.siteIds.*
-    type: string
-    operators: [in]
-    choices:
-      source: project.sites
-  - id: groups
-    label: Groups
-    path: device.groupIds.*
-    type: string
-    operators: [in]
-    choices:
-      source: project.groups
-  - id: classifications
-    label: Initial classifications
-    path: inputs.classify.details.*.classified
-    type: string
-    operators: [in]
-    optional: true
-    choices:
-      file: ../catalogs/classifications.json
-  # Condition-only context fields (not selectors): advanced conditions on
-  # Start connections may test only declared fields, under device. or inputs.
-  - id: deviceName
-    label: Camera name
-    path: device.deviceName
-    type: string
-    operators: [eq, in, contains, matches]
-  - id: objectClass
-    label: Detected object
-    path: inputs.classify.details.*.classified
-    type: string
-    operators: [eq, ne, in, exists]
-    optional: true
-    choices:
-      file: ../catalogs/classifications.json
-
-# Controls offered for new authoring; an omitted control is not offered.
-controls:
-  - id: weeklySchedule
-    label: Weekly schedule
-  - id: conditions
-    label: Advanced conditions
-
-# Trigger modes offered for new authoring; omitted offers both.
-triggerModes: [automatic, manual]
-{{ end -}}
-{{- include "hub.workflowConfiguration.validate" . -}}
-{{- $config := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- if and $config.enabled $config.includeDefaults (not (hasKey $config.replacements "workflow-contracts/start.yaml")) (or (eq .Values.mode "all") (eq .Values.mode "ui")) }}
-apiVersion: v1
-kind: ConfigMap
-metadata:
-  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
-  namespace: {{ .Release.Namespace }}
-data:
-  start.yaml: |-
-    {{- include "hub.workflowConfiguration.start" . | nindent 4 }}
-{{- end }}
@@ -1,12 +1,7 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{- $workflowConfiguration := include "hub.workflowConfiguration.settings" . | fromYaml -}}
-{{- $catalogReplacement := index $workflowConfiguration.replacements "catalogs/classifications.json" | default dict -}}
-{{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
  name: hub-api-svc
-  namespace: {{ .Release.Namespace }}
  labels:
    app: hub-api-svc
 spec:
@@ -21,33 +16,47 @@ spec:
      protocol: TCP
  selector:
    app: hub-api
-{{- end }}
-{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
+{{ else }}
+apiVersion: networking.k8s.io/v1
 {{ end }}
 kind: Ingress
 metadata:
  name: hub-api-ingress
-  namespace: {{ .Release.Namespace }}
  annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
    {{- if eq .Values.ingress "nginx" }}
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/proxy-body-size: 200m # This might throw a 413 Entity Too Large when uploading large recordings.
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
  {{- with .Values.kerberoshub.api.tls }}
  tls:
    {{- toYaml . | nindent 8 }}
  {{- end }}

-  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
+  rules:
+    - host: "{{ .Values.kerberoshub.api.url }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- if .Values.kerberoshub.api.legacyUrl }}
+    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- end }}
+  {{- else }}
  rules:
    - host: "{{ .Values.kerberoshub.api.url }}"
      http:
@@ -81,32 +90,12 @@ spec:
                name: hub-api-svc
                port:
                  number: 80
-  {{ else }}
-    rules:
-    - host: "{{ .Values.kerberoshub.api.url }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- if .Values.kerberoshub.api.legacyUrl }}
-    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- end }}
-  {{ end }}
-{{- end }}
+  {{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-api
-  namespace: {{ .Release.Namespace }}
 spec:
  replicas: {{ .Values.kerberoshub.api.replicas }}
  selector:
@@ -120,201 +109,41 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-        {{- if and .Values.classificationCatalogEnabled (not .Values.classificationCatalogExistingConfigMap) (not $catalogReplacement) }}
-        checksum/classification-catalog: {{ include (print $.Template.BasePath "/configMaps/catalogs/classifications.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if include "kerberoshub.deviceTags.system.enabled" . }}
-        checksum/device-system-tags: {{ include (print $.Template.BasePath "/configMaps/catalogs/device-system-tags.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml")) }}
-        checksum/workflow-configuration: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/start.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml")) }}
-        checksum/workflow-contract-anpr: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/anpr.yaml") . | sha256sum }}
-        {{- end }}
-        {{- if and $workflowConfiguration.enabled $workflowConfiguration.includeDefaults (not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml")) }}
-        checksum/workflow-contract-forwarder: {{ include (print $.Template.BasePath "/configMaps/workflow-contracts/forwarder.yaml") . | sha256sum }}
-        {{- end }}
      labels:
        app: hub-api
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- $classificationCatalogEnabled := .Values.classificationCatalogEnabled }}
-      {{- $deviceSystemTagsEnabled := include "kerberoshub.deviceTags.system.enabled" . }}
-      {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- if $workflowConfiguration.enabled }}
-        - name: workflow-configuration
-          projected:
-            sources:
-              {{- if $workflowConfiguration.includeDefaults }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/start.yaml") }}
-              - configMap:
-                  name: {{ printf "%s-workflow-configuration" .Release.Name | trunc 63 | trimSuffix "-" }}
-                  items:
-                    - key: start.yaml
-                      path: workflow-contracts/start.yaml
-              {{- end }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/anpr.yaml") }}
-              - configMap:
-                  name: {{ include "hub.workflowConfiguration.anpr.configMapName" . }}
-                  items:
-                    - key: anpr.yaml
-                      path: workflow-contracts/anpr.yaml
-              {{- end }}
-              {{- if not (hasKey $workflowConfiguration.replacements "workflow-contracts/forwarder.yaml") }}
-              - configMap:
-                  name: {{ include "hub.workflowConfiguration.forwarder.configMapName" . }}
-                  items:
-                    - key: forwarder.yaml
-                      path: workflow-contracts/forwarder.yaml
-              {{- end }}
-              {{- if not $catalogReplacement }}
-              - configMap:
-                  name: {{ include "hub.classificationCatalog.configMapName" . }}
-                  items:
-                    - key: classifications.json
-                      path: catalogs/classifications.json
-              {{- end }}
-              {{- end }}
-              {{- range $workflowConfiguration.configMaps }}
-              - configMap:
-                  name: {{ .name | quote }}
-                  items:
-                    {{- toYaml .items | nindent 20 }}
-              {{- end }}
-      {{- end }}
-      {{- if $classificationCatalogEnabled }}
-        - name: classification-catalog
-          configMap:
-            name: {{ include "hub.classificationCatalog.configMapName" . }}
-            {{- if or .Values.classificationCatalogExistingConfigMap $catalogReplacement }}
-            items:
-              - key: {{ default "classifications.json" $catalogReplacement.key | quote }}
-                path: classifications.json
-            {{- end }}
-      {{- end }}
-      {{- if $deviceSystemTagsEnabled }}
-        - name: device-system-tags
-          configMap:
-            name: device-system-tags
-      {{- end }}
      {{- with .Values.kerberoshub.api.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $serverTLS.enabled $serverTLS.secretName }}
-        - name: hub-api-server-tls
-          secret:
-            secretName: {{ $serverTLS.secretName }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
        - name: hub-api
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
+          image: "{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.api.pullPolicy }}
-          {{- with .Values.kerberoshub.api.resources }}
          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
+            requests:
+              memory: 100Mi
+              cpu: 50m
          ports:
            - containerPort: 80
-              name: http
-          {{- if or $workflowConfiguration.enabled $classificationCatalogEnabled $deviceSystemTagsEnabled .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- if $workflowConfiguration.enabled }}
-            - name: workflow-configuration
-              mountPath: /etc/kerberos/configuration
-              readOnly: true
-          {{- end }}
-          {{- if $classificationCatalogEnabled }}
-            - name: classification-catalog
-              mountPath: /etc/kerberos/classifications
-              readOnly: true
-          {{- end }}
-          {{- if $deviceSystemTagsEnabled }}
-            - name: device-system-tags
-              mountPath: /etc/kerberos/device-tags
-              readOnly: true
-          {{- end }}
+              name: http  
          {{- with .Values.kerberoshub.api.volumeMounts}}
+          volumeMounts:
            {{- toYaml . | nindent 12 }}
          {{- end }}
-          {{- if and $serverTLS.enabled $serverTLS.secretName }}
-            - name: hub-api-server-tls
-              mountPath: {{ $serverTLS.mountPath }}
-              readOnly: true
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          # Mongodb - loaded from ConfigMap
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-api") | nindent 12 }}
-            {{- if $classificationCatalogEnabled }}
-            - name: CLASSIFICATION_CATALOG_FILE
-              value: /etc/kerberos/classifications/classifications.json
-            {{- end }}
-            {{- if $deviceSystemTagsEnabled }}
-            # System tag catalog (deviceTags.system.catalog): the only system
-            # tags owners can assign. Unset (disabled) disables system tags.
-            - name: DEVICE_SYSTEM_TAGS_FILE
-              value: /etc/kerberos/device-tags/system-tags.json
-            {{- end }}
-            - name: ENVIRONMENT
-              value: "{{ .Values.environment }}"
            - name: READ_ONLY
-              value: "{{ .Values.readOnly }}"
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.api.logLevel }}"
-            - name: SUPPORT_ENABLED
-              value: "{{ .Values.kerberoshub.support.enabled }}"
+              value: "{{ .Values.readonly }}"
            - name: CLOUD_API_URL
              value: "{{ .Values.kerberoshub.api.url }}"
            - name: API_URL
              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
            - name: PUBLIC_URL
              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
-            - name: REFRESH_COOKIE_SECURE
-              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
-            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
-            {{- with .Values.kerberoshub.frontend.legacyUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- range .Values.kerberoshub.frontend.domains }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
-            {{- end }}
-            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
-            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
-            {{- end }}
-            {{- range .Values.kerberoshub.api.corsAllowedOrigins }}
-            {{- $corsOrigins = append $corsOrigins . }}
-            {{- end }}
-            - name: CORS_ALLOWED_ORIGINS
-              value: {{ join "," $corsOrigins | quote }}
            {{ if .Values.isPrivate }}
            - name: KERBEROS_PRIVATE_CLOUD
              value: "true"
@@ -329,26 +158,6 @@ spec:
            - name: API_KEY
              value: "{{ .Values.kerberoshub.api.apiKey }}"

-            # MQTT credentials (served via /runtime/config to authenticated
-            # frontend clients; no longer exposed in the public env.js).
-            - name: MQTT_USERNAME
-              value: "{{ .Values.mqtt.username }}"
-            - name: MQTT_PASSWORD
-              value: "{{ .Values.mqtt.password }}"
-
-            # TURN credentials (served via /runtime/config to authenticated
-            # frontend clients; no longer exposed in the public env.js).
-            - name: TURN_USERNAME
-              value: "{{ .Values.turn.username }}"
-            - name: TURN_PASSWORD
-              value: "{{ .Values.turn.password }}"
-            {{- if .Values.kerberoshub.api.serverTLS.enabled }}
-            - name: TLS_CERT_FILE
-              value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"
-            - name: TLS_KEY_FILE
-              value: "{{ .Values.kerberoshub.api.serverTLS.keyFile }}"
-            {{- end }}
-
            # Kerberos Hub
            - name: LICENSE_KEY
              value: "{{ .Values.license }}"
@@ -356,51 +165,20 @@ spec:
              value: "{{ .Values.licenseServer.url }}"
            - name: LICENSE_PUBLIC_API_TOKEN
              value: "{{ .Values.licenseServer.token }}"
-
+              
            # Authorization - Authentication secret
            - name: KERBEROS_JWT_SECRET
              value: "{{ .Values.kerberoshub.api.jwtSecret }}"
-
-            # Temporarily stop serving the polled GET /devices list (204, no DB reads).
-            - name: DISABLE_AGENT_HEARTBEAT
-              value: {{ .Values.kerberoshub.api.disableAgentHeartbeat | default false | quote }}
-
-            # Media proxy: hide Vault/storage endpoints behind hub-api URLs.
-            {{- $mediaProxy := .Values.kerberoshub.api.mediaProxy | default dict }}
-            - name: MEDIA_PROXY_ENABLED
-              value: {{ $mediaProxy.enabled | default false | quote }}
-            {{- if $mediaProxy.publicUrl }}
-            - name: MEDIA_PROXY_PUBLIC_URL
-              value: {{ $mediaProxy.publicUrl | quote }}
-            {{- end }}
-            {{- if $mediaProxy.key }}
-            - name: MEDIA_PROXY_KEY
-              value: {{ $mediaProxy.key | quote }}
-            {{- end }}
-            {{- if $mediaProxy.ttl }}
-            - name: MEDIA_PROXY_TTL
-              value: {{ $mediaProxy.ttl | quote }}
-            {{- end }}
-
+              
            # SSO (OIDC) setup
-            - name: SSO_DOMAINS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-            - name: SSO_REDIRECTURLS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .redirectUrl }};{{- end }}"
-            - name: SSO_CLAIMIDS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .claimId }};{{- end }}"
-            - name: SSO_ISSUERS
-              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .issuer }};{{- end }}"
-            - name: SSO_CLIENTIDS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientId }};{{- end }}"
-            - name: SSO_CLIENTSECRETS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientSecret }};{{- end }}"
-            - name: SSO_CLIENTVERIFICATIONIDS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientVerificationId }};{{- end }}"
-            - name: SSO_FORCE_SSO
-              value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
-            - name: SSO_EXTRA_HEADERS
-              value: "{{- range .Values.kerberoshub.api.sso }}{{- if .extraHeaders }}{{- range .extraHeaders }}{{ .name }}:{{ .value }};{{- end }}{{- else }}{{- end }}*{{- end }}"
+            - name: SSO_ISSUER
+              value: "{{ .Values.kerberoshub.api.sso.issuer }}"
+            - name: SSO_CLIENTID
+              value: "{{ .Values.kerberoshub.api.sso.clientId }}"
+            - name: SSO_CLIENTSECRET
+              value: "{{ .Values.kerberoshub.api.sso.clientSecret }}"
+            - name: SSO_REDIRECTURL
+              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}{{ .Values.kerberoshub.api.sso.redirectUrl }}"

            # Kerberos pipeline
            - name: QUEUE_SYSTEM
@@ -408,34 +186,10 @@ spec:
            - name: QUEUE_NAME
              value: "{{ .Values.queueName }}"

-            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
-            # SAME set the workflows engine consumes, assembled from the enabled
-            # definitions under kerberoshub.workflows.definitions (see
-            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
-            # read-only to surface config workflows alongside the user workflows
-            # it stores in the database; the config workflows are never persisted.
-            - name: WORKFLOW_DEFINITIONS
-              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
-            # Deployment service routing catalog used by API-owned embedded
-            # workflows (for example the one-stage case redaction modal flow).
-            - name: WORKFLOW_STAGE_QUEUES
-              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
-            # Stages tenants may place in the workflow editor (see workflows.editorStages).
-            - name: WORKFLOW_EDITOR_STAGES
-              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
-
            # Stripe for billing
            - name: STRIPE_KEY
              value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"

-            # OpenAI
-            - name: OPENAI_API_KEY
-              value: "{{ .Values.openai.apikey }}"
-
-            # MFA Issuer name (Will be shown when scanning in)
-            - name: MFA_ISSUER
-              value: "{{ .Values.kerberoshub.api.mfaIssuer }}"
-
            # AWS (Legacy, use Kerberos Vault instead)
            - name: AWS_REGION
              value: "{{ .Values.kerberoshub.api.aws.region }}"
@@ -475,23 +229,17 @@ spec:
            - name: KAFKA_SECURITY
              value: "{{ .Values.kafka.security }}"

-            # RabbitMQ settings
-            - name: RABBITMQ_HOST
-              value: "{{ .Values.rabbitmq.host }}"
-            - name: RABBITMQ_EXCHANGE
-              value: "{{ .Values.rabbitmq.exchange }}"
-            - name: RABBITMQ_USERNAME
-              value: "{{ .Values.rabbitmq.username }}"
-            - name: RABBITMQ_PASSWORD
-              value: "{{ .Values.rabbitmq.password }}"
-            - name: AUDIT_ENABLED
-              value: {{ and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled | quote }}
-            {{- if and .Values.audit.enabled .Values.kerberoshub.api.audit.enabled }}
-            - name: AUDIT_QUEUE
-              value: {{ .Values.audit.intake.queue | quote }}
-            - name: AUDIT_DEADLETTER_QUEUE
-              value: {{ .Values.audit.intake.deadletterQueue | quote }}
-            {{- end }}
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"

            # Slack notifications (this will send events/logs to a specific channel).
            - name: SLACK_ENABLED
@@ -501,6 +249,22 @@ spec:
            - name: SLACK_USERNAME
              value: "{{ .Values.kerberoshub.api.slack.username }}"

+            # Elastic search - Kibana
+            - name: LOGGING_ELASTICSEARCH
+              value: "{{ .Values.kerberoshub.api.elasticsearch.enabled }}"
+            - name: LOGGING_ELASTICSEARCH_PROTOCOL
+              value: "{{ .Values.kerberoshub.api.elasticsearch.protocol }}"
+            - name: LOGGING_ELASTICSEARCH_HOST
+              value: "{{ .Values.kerberoshub.api.elasticsearch.host }}"
+            - name: LOGGING_ELASTICSEARCH_PORT
+              value: "{{ .Values.kerberoshub.api.elasticsearch.port }}"
+            - name: LOGGING_ELASTICSEARCH_INDEX
+              value: "{{ .Values.kerberoshub.api.elasticsearch.index }}"
+            - name: LOGGING_ELASTICSEARCH_USERNAME
+              value: "{{ .Values.kerberoshub.api.elasticsearch.username }}"
+            - name: LOGGING_ELASTICSEARCH_PASSWORD
+              value: "{{ .Values.kerberoshub.api.elasticsearch.password }}"
+
            # Mail settings
            - name: MAIL_PROVIDER
              value: "{{ .Values.email.provider }}"
@@ -508,7 +272,7 @@ spec:
              value: "{{ .Values.email.from }}"
            - name: EMAIL_FROM_DISPLAYNAME
              value: "{{ .Values.email.displayName }}"
-
+              
            # Mail templates
            - name: WELCOME_TEMPLATE
              value: "{{ .Values.email.templates.welcome }}"
@@ -526,22 +290,6 @@ spec:
              value: "{{ .Values.email.templates.share }}"
            - name: SHARE_TITLE
              value: "{{ .Values.email.templates.shareTitle }}"
-            - name: CASE_SHARE_TEMPLATE
-              value: "{{ .Values.email.templates.caseShare }}"
-            - name: CASE_SHARE_TITLE
-              value: "{{ .Values.email.templates.caseShareTitle }}"
-            - name: CASE_SHARE_OTP_TEMPLATE
-              value: "{{ .Values.email.templates.caseShareOtp }}"
-            - name: CASE_SHARE_OTP_TITLE
-              value: "{{ .Values.email.templates.caseShareOtpTitle }}"
-            - name: ASSIGN_TASK_TEMPLATE
-              value: "{{ .Values.email.templates.assignTask }}"
-            - name: ASSIGN_TASK_TITLE
-              value: "{{ .Values.email.templates.assignTaskTitle }}"
-            - name: DEFAULT_TASK_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.api.defaultTaskRetentionDays }}"
-            - name: CASES_MAX_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.api.casesMaxRetentionDays }}"

            # SMTP
            - name: SMTP_SERVER
@@ -552,51 +300,9 @@ spec:
              value: "{{ .Values.email.smtp.username }}"
            - name: SMTP_PASSWORD
              value: "{{ .Values.email.smtp.password }}"
-
+              
            # Mailgun
            - name: MAILGUN_DOMAIN
              value: "{{ .Values.email.mailgun.domain }}"
            - name: MAILGUN_API_KEY
              value: "{{ .Values.email.mailgun.apikey }}"
-
-            # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-            # This will lower storage in mongodb.
-            - name: THUMBNAIL_VAULT_ENABLED
-              value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-            - name: VAULT_THUMBNAIL_PROVIDER
-              value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-            - name: VAULT_THUMBNAIL_ACCESS_KEY
-              value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-            - name: VAULT_THUMBNAIL_SECRET_KEY
-              value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-
-            # There is an option to store the sprites in a storage provider in Kerberos Vault.
-            - name: VAULT_SPRITE_ENABLED
-              value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-            - name: VAULT_SPRITE_PROVIDER
-              value: "{{ .Values.kerberosvault.sprite.provider }}"
-            - name: VAULT_SPRITE_ACCESS_KEY
-              value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-            - name: VAULT_SPRITE_SECRET_KEY
-              value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-            - name: VAULT_SPRITE_INTERVAL
-              value: "{{ .Values.kerberospipeline.sprite.interval }}"
-            - name: VAULT_SPRITE_WIDTH
-              value: "{{ .Values.kerberospipeline.sprite.width }}"
-            - name: VAULT_SPRITE_HEIGHT
-              value: "{{ .Values.kerberospipeline.sprite.height }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-
-            {{- if .Values.opentelemetry.enabled }}
-            # Open Telemetry tracing
-            - name: OTEL_EXPORTED_OTLP_ENABLED
-              value: "{{ .Values.opentelemetry.enabled }}"
-            - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-              value: "{{ .Values.opentelemetry.routingEnabled }}"
-            - name: OTEL_EXPORTER_OTLP_ENDPOINT
-              value: "{{ .Values.opentelemetry.collector.endpoint }}"
-            {{- include "hub.opentelemetry.apiSamplerEnv" $ | trim | nindent 12 }}
-            {{- end }}
-{{- end }}
@@ -1,18 +0,0 @@
-{{- if and .Values.audit.enabled .Values.kerberoshub.audit.serviceMonitor.enabled -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-audit-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: hub-audit
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: hub-audit
-  endpoints:
-    - port: metrics
-      interval: {{ .Values.kerberoshub.audit.serviceMonitor.interval }}
-      path: /metrics
-{{- end }}
@@ -1,167 +0,0 @@
-{{- if .Values.audit.enabled -}}
-{{- if ne (upper .Values.queueProvider) "RABBITMQ" -}}
-{{- fail "kerberoshub.audit currently requires queueProvider=RABBITMQ" -}}
-{{- end -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.audit.replicas }}
-  selector:
-    matchLabels:
-      app: hub-audit
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: hub-audit
-    spec:
-      terminationGracePeriodSeconds: {{ .Values.kerberoshub.audit.terminationGracePeriodSeconds }}
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      volumes:
-        - name: destinations
-          configMap:
-            name: hub-audit
-          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
-      {{- $bearer := default dict $destination.bearerTokenSecret }}
-      {{- $secretHeaders := default dict $destination.secretHeaders }}
-      {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
-        - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
-          projected:
-            sources:
-            {{- if gt (len $bearer) 0 }}
-              - secret:
-                  name: {{ required (printf "bearerTokenSecret.name is required for destination %s" $destination.id) $bearer.name | quote }}
-                  items:
-                    - key: {{ default "token" $bearer.key | quote }}
-                      path: bearer-{{ sha256sum (printf "%s:%s" $bearer.name (default "token" $bearer.key)) | trunc 12 }}
-            {{- end }}
-            {{- range $headerName, $secret := $secretHeaders }}
-              - secret:
-                  name: {{ required (printf "secretName is required for destination %s header %s" $destination.id $headerName) $secret.secretName | quote }}
-                  items:
-                    - key: {{ required (printf "secretKey is required for destination %s header %s" $destination.id $headerName) $secret.secretKey | quote }}
-                      path: header-{{ sha256sum (printf "%s:%s:%s" $headerName $secret.secretName $secret.secretKey) | trunc 12 }}
-            {{- end }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.audit.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.audit.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: hub-audit
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.audit.repository }}:{{ .Values.kerberoshub.audit.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.audit.pullPolicy }}
-          {{- with .Values.kerberoshub.audit.resources }}
-          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - name: metrics
-              containerPort: 2112
-              protocol: TCP
-          readinessProbe:
-            httpGet:
-              path: /healthz
-              port: metrics
-          livenessProbe:
-            httpGet:
-              path: /healthz
-              port: metrics
-          volumeMounts:
-            - name: destinations
-              mountPath: /etc/hub-audit
-              readOnly: true
-          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
-          {{- $bearer := default dict $destination.bearerTokenSecret }}
-          {{- $secretHeaders := default dict $destination.secretHeaders }}
-          {{- if or (gt (len $bearer) 0) (gt (len $secretHeaders) 0) }}
-            - name: audit-dest-{{ sha256sum $destination.id | trunc 12 }}
-              mountPath: /var/run/secrets/audit-destinations/{{ $destination.id }}
-              readOnly: true
-          {{- end }}
-          {{- end }}
-          {{- with .Values.kerberoshub.audit.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
-          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-audit") | nindent 12 }}
-            - name: RABBITMQ_HOST
-              value: {{ .Values.rabbitmq.host | quote }}
-            - name: RABBITMQ_EXCHANGE
-              value: {{ .Values.rabbitmq.exchange | quote }}
-            - name: RABBITMQ_USERNAME
-              value: {{ .Values.rabbitmq.username | quote }}
-            - name: RABBITMQ_PASSWORD
-              value: {{ .Values.rabbitmq.password | quote }}
-            - name: AUDIT_QUEUE
-              value: {{ .Values.audit.intake.queue | quote }}
-            - name: AUDIT_DEADLETTER_QUEUE
-              value: {{ .Values.audit.intake.deadletterQueue | quote }}
-            - name: AUDIT_MAX_RETRIES
-              value: {{ .Values.audit.intake.maxRetries | quote }}
-            - name: AUDIT_PREFETCH_COUNT
-              value: {{ .Values.audit.intake.prefetchCount | quote }}
-            - name: AUDIT_PERSIST_TIMEOUT
-              value: {{ .Values.audit.intake.persistTimeout | quote }}
-            - name: DISPATCH_INTERVAL
-              value: {{ .Values.kerberoshub.audit.dispatchInterval | quote }}
-            - name: LEASE_DURATION
-              value: {{ .Values.kerberoshub.audit.leaseDuration | quote }}
-            - name: POD_NAME
-              valueFrom:
-                fieldRef:
-                  fieldPath: metadata.name
-          {{- with .Values.kerberoshub.audit.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- with .Values.kerberoshub.extraEnv }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-audit
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-audit
-    service: hub-audit
-spec:
-  ports:
-    - name: metrics
-      port: 2112
-      targetPort: metrics
-      protocol: TCP
-  selector:
-    app: hub-audit
-{{- end }}
@@ -1,18 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-cleanup-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: hub-cleanup
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: hub-cleanup
-  endpoints:
-    - port: hub-metrics
-      interval: 15s
-      path: /metrics
-{{- end }}
@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-cleanup
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.cleanup.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: hub-cleanup
@@ -17,120 +15,32 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: hub-cleanup
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.cleanup.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
        - name: hub-cleanup
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
+          image: "{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.cleanup.pullPolicy }}
-          {{- with .Values.kerberoshub.cleanup.resources }}
          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
-          ports:
-            - containerPort: 8080
+            requests:
+              memory: 10Mi
+              cpu: 10m
          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-cleanup") | nindent 12 }}
-            - name: MODE
-              value: "{{ .Values.kerberoshub.cleanup.mode }}"
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.cleanup.logLevel }}"
-            - name: RUN_INTERVAL_MINUTES
-              value: "{{ .Values.kerberoshub.cleanup.runIntervalMinutes }}"
-            - name: CLEANUP_USERNAMES
-              value: "{{ .Values.kerberoshub.cleanup.cleanupUsernames }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readOnly }}"
            - name: MAX_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.maxDays }}"
-            - name: BATCH_SIZE
-              value: "{{ .Values.kerberoshub.cleanup.batchSize }}"
-            - name: USER_BATCH_SIZE
-              value: "{{ .Values.kerberoshub.cleanup.userBatchSize }}"
-            - name: MAX_USERS_PER_RUN
-              value: "{{ .Values.kerberoshub.cleanup.maxUsersPerRun }}"
-            - name: PROGRESS_EVERY
-              value: "{{ .Values.kerberoshub.cleanup.progressEvery }}"
-            - name: ACTIVE_USER_RESCAN_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.activeUserRescanHours }}"
-            - name: INACTIVE_USER_RESCAN_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.inactiveUserRescanHours }}"
-            - name: READ_TIMEOUT_SECONDS
-              value: "{{ .Values.kerberoshub.cleanup.readTimeoutSeconds }}"
-            - name: DELETE_TIMEOUT_SECONDS
-              value: "{{ .Values.kerberoshub.cleanup.deleteTimeoutSeconds }}"
-            - name: REPORT_INCLUDE_STATS
-              value: "{{ .Values.kerberoshub.cleanup.reportIncludeStats }}"
-            - name: DRY_RUN
-              value: "{{ .Values.kerberoshub.cleanup.dryRun }}"
-            - name: DEBUG
-              value: "{{ .Values.kerberoshub.cleanup.debug }}"
-            - name: GLOBAL_PASS_ENABLED
-              value: "{{ .Values.kerberoshub.cleanup.globalPassEnabled }}"
-            - name: GLOBAL_PASS_INTERVAL_HOURS
-              value: "{{ .Values.kerberoshub.cleanup.globalPassIntervalHours }}"
-            - name: GLOBAL_PASS_DELETE_BUDGET
-              value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
-            - name: DEFAULT_TASK_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
-            - name: AUDIT_EVENT_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.auditEventRetentionDays }}"
-            - name: WORKFLOW_RUN_RETENTION_DAYS
-              value: "{{ .Values.kerberoshub.cleanup.workflowRunRetentionDays | default "0" }}"
-          {{- if .Values.kerberoshub.extraEnv }}
-          {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-          {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-cleanup
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-cleanup
-    service: hub-cleanup
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-cleanup
-{{- end }}
+              value: "30"
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+
@@ -1,9 +1,7 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.frontend.demoEnabled -}}
 apiVersion: v1
 kind: Service
 metadata:
  name: hub-frontend-demo-svc
-  namespace: {{ .Release.Namespace }}
  labels:
    app: hub-frontend-demo-svc
 spec:
@@ -14,30 +12,39 @@ spec:
    name: http
  selector:
    app: hub-frontend-demo
-{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
+{{ else }}
+apiVersion: networking.k8s.io/v1
 {{ end }}
 kind: Ingress
 metadata:
  name: hub-frontend-demo-ingress
-  namespace: {{ .Release.Namespace }}
  annotations:
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
    {{- if eq .Values.ingress "nginx" }}
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
+
  {{- with .Values.kerberoshub.frontend.demoTls }}
  tls:
    {{- toYaml . | nindent 8 }}
  {{- end }}
-  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
+  rules:
+    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-frontend-demo-svc
+              servicePort: 80
+  {{- else }}
  rules:
    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
      http:
@@ -49,23 +56,12 @@ spec:
              name: hub-frontend-demo-svc
              port:
                number: 80
-  {{ else }}
-  rules:
-    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-demo-svc
-              servicePort: 80
-  {{ end }}
-{{ end }}
+  {{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-frontend-demo
-  namespace: {{ .Release.Namespace }}
 spec:
  replicas: {{ .Values.kerberoshub.frontend.replicas }}
  selector:
@@ -82,9 +78,6 @@ spec:
      labels:
        app: hub-frontend-demo
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
@@ -93,18 +86,14 @@ spec:
      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: hub-frontend-demo
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
        imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
-        {{- with .Values.kerberoshub.frontend.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
        ports:
        - containerPort: 80
          name: http
@@ -113,18 +102,12 @@ spec:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        env:
-        - name: SSO_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-        - name: SSO_FORCE_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
+        - name: SSO_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
        - name: TITLE
          value: "{{ .Values.kerberoshub.frontend.title }}"
        - name: LOGO_NAME
          value: "{{ .Values.kerberoshub.frontend.logo }}"
-        - name: ENVIRONMENT
-          value: "demo"
        - name: API_URL
          value: "" # legacy
        - name: NEW_API_URL
@@ -140,10 +123,6 @@ spec:
          value: "true"
        - name: DEMO
          value: "true"
-        - name: MULTI_TENANT
-          value: "{{ .Values.kerberoshub.frontend.multiTenant }}"
-        - name: TENANT_BASE_DOMAIN
-          value: "{{ .Values.kerberoshub.frontend.tenantBaseDomain }}"

        # Mqtt (VERNEMQ)
        - name: MQTT_PROTOCOL
@@ -152,24 +131,18 @@ spec:
          value: "{{ .Values.mqtt.host }}"
        - name: MQTT_PORT
          value: "{{ .Values.mqtt.port }}"
-        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
-        - name: MQTT_LEGACY_SERVER
-          value: "{{ .Values.mqtt.legacy.host }}"
-        - name: MQTT_LEGACY_PORT
-          value: "{{ .Values.mqtt.legacy.port }}"
-
-        # OpenAI
-        - name: OPENAI_ENABLED
-          value: "{{ .Values.openai.enabled }}"
+        - name: MQTT_USERNAME
+          value: "{{ .Values.mqtt.username }}"
+        - name: MQTT_PASSWORD
+          value: "{{ .Values.mqtt.password }}"

        # Turn (Pion)
        - name: TURN_SERVER
          value: "{{ .Values.turn.host }}"
-        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: TURN_USERNAME
+          value: "{{ .Values.turn.username }}"
+        - name: TURN_PASSWORD
+          value: "{{ .Values.turn.password }}"

        # Mixpanel for monitoring
        - name: MIXPANEL_KEY
@@ -192,209 +165,37 @@ spec:
        # Google maps for using and displaying cameras, sites on a map
        - name: GOOGLEMAPS_KEY
          value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
-        - name: GOOGLEMAPS_PLACES_API
-          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"
-
-        # features > chart
-        - name: CHART_COLORS
-          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}

        # Zendesk for support
        - name: ZENDESK_URL
          value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"

-        - name: HIDE_ADD_AGENT
-          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
-
-        # Navigation links
-        - name: NAVIGATION_LINK_TITLE_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
-        - name: NAVIGATION_LINK_URL_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
-        - name: NAVIGATION_LINK_TITLE_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
-        - name: NAVIGATION_LINK_URL_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
-        - name: NAVIGATION_LINK_TITLE_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
-        - name: NAVIGATION_LINK_URL_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
-        - name: NAVIGATION_LINK_TITLE_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
-        - name: NAVIGATION_LINK_URL_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
-        - name: NAVIGATION_LINK_TITLE_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
-        - name: NAVIGATION_LINK_URL_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
-        - name: CASE_FILTER_ASSIGNEES_DEFAULT
-          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
-
-        # features > general
-        - name: FEATURE_CASE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
-        - name: FEATURE_WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_AUDIT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
-        - name: FEATURE_DAY_OVERVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
-        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
-        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
-        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
-        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
-        - name: FEATURE_ORGANISATION_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
-        - name: FEATURE_DARK_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
-        - name: FEATURE_SPLASH_SCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
-        - name: FEATURE_LANDING_PAGE
-          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
-
-        # features > internationalization (i18n)
-        - name: FEATURE_I18N_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
-        - name: DEFAULT_LANGUAGE
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
-
-        # features > liveview
-        - name: FEATURE_LIVE_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
-        - name: FEATURE_HLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
-        - name: FEATURE_MOQ_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
-        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
-        - name: MOQ_RELAY_URL
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
-        - name: MOQ_BROADCAST_PREFIX
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
-        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
-        - name: FEATURE_LIVEVIEW_PAGE_SIZE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
-        - name: FEATURE_LIVEVIEW_MAX_STREAMS
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
-
-        # features > devices
-        - name: FEATURE_DEVICES_HIDE_AGENT
-          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
-
-        # features > floorplan
-        - name: FEATURE_FLOORPLAN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
-        # features > map
-        - name: MAP_TILE_URL_LIGHT
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
-        - name: MAP_TILE_URL_DARK
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
-        - name: MAP_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
-
-        - name: COLOR_TRACK_BOX
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
-        - name: COLOR_TRACK_BOX_HOVER
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
-        - name: COLOR_TRACK_BOX_DRAWING
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
-        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
-        - name: COLOR_DEVICE_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
-        - name: COLOR_DEVICE_INACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
-        - name: COLOR_DEVICE_IDLE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
-        - name: COLOR_DEVICE_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
-        - name: COLOR_DEVICE_MARKER_BORDER
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
-
-        # features > video edits
-        - name: FEATURE_VIDEO_EDITS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
-
-        # features > face redaction 
-        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
-        
-        # features > media
-        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
-          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
-        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
-        
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
-        {{- end }}
-      {{- end }}
+        # Titles and descriptions on pages
+        - name: LOGIN_DESCRIPTION
+          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
+        - name: LOGIN_COPYRIGHT
+          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
+        - name: PAGE_DASHBOARD_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
+        - name: PAGE_DASHBOARD_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
+        - name: PAGE_LATESTEVENTS_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
+        - name: PAGE_LATESTEVENTS_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
+        - name: PAGE_LIVESTREAM_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
+        - name: PAGE_LIVESTREAM_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
+        - name: PAGE_MEDIA_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
+        - name: PAGE_MEDIA_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
+        - name: PAGE_DASHBOARD_CPU_USAGE
+          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
+        - name: PAGE_DASHBOARD_FPS
+          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
+        - name: PAGE_DASHBOARD_MLA
+          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
+        - name: PAGE_DASHBOARD_OBJECTS
+          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
@@ -1,10 +1,7 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
-{{- if .Values.kerberoshub.frontend.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
  name: hub-frontend-svc
-  namespace: {{ .Release.Namespace }}
  labels:
    app: hub-frontend-svc
 spec:
@@ -15,138 +12,77 @@ spec:
    name: http
  selector:
    app: hub-frontend
-{{- end }}
-{{ if ne .Values.ingress "" }}
 ---
-{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
-apiVersion: networking.k8s.io/v1
-{{- else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
 apiVersion: networking.k8s.io/v1beta1
-{{- end }}
+{{ else }}
+apiVersion: networking.k8s.io/v1
+{{ end }}
 kind: Ingress
 metadata:
  name: hub-frontend-ingress
-  namespace: {{ .Release.Namespace }}
  annotations:
-    {{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
-    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
-    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
-    {{- end }}
+    kubernetes.io/ingress.class: {{ .Values.ingress }}
    {{- if eq .Values.ingress "nginx" }}
    kubernetes.io/tls-acme: "true"
    nginx.ingress.kubernetes.io/ssl-redirect: "true"
    cert-manager.io/cluster-issuer: "letsencrypt-prod"
    {{- end }}
 spec:
-  ingressClassName: {{ .Values.ingress }}
+
  {{- with .Values.kerberoshub.frontend.tls }}
  tls:
    {{- toYaml . | nindent 8 }}
  {{- end }}
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
  rules:
    - host: "{{ .Values.kerberoshub.frontend.url }}"
      http:
        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
    {{- if .Values.kerberoshub.frontend.legacyUrl }}
    - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
      http:
        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
    {{- end }}
-    {{- range .Values.kerberoshub.frontend.domains }}
-    - host: "{{ . }}"
-      http:
-        paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
-    {{- end }}
-
  {{- else }}
  rules:
    - host: "{{ .Values.kerberoshub.frontend.url }}"
      http:
        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
    {{- if .Values.kerberoshub.frontend.legacyUrl }}
    - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
      http:
        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
-    {{- end }}
-    {{- range .Values.kerberoshub.frontend.domains }}
-    - host: "{{ . }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
    {{- end }}
  {{- end }}
-{{- end }}
-{{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
---
-apiVersion: networking.k8s.io/v1
-kind: Ingress
-metadata:
-  name: oauth2-proxy-frontend
-  namespace: kube-system
-  annotations:
-    {{- if eq .Values.ingress "nginx" }}
-    cert-manager.io/cluster-issuer: letsencrypt-prod
-    kubernetes.io/tls-acme: "true"
-    nginx.ingress.kubernetes.io/ssl-redirect: "true"
-    nginx.ingress.kubernetes.io/enable-cors: "true"
-    {{- end }}
-spec:
-  ingressClassName: {{ .Values.ingress }}
-  rules:
-    - host: "{{ .Values.kerberoshub.frontend.url }}"
-      http:
-        paths:
-          - path: /oauth2
-            pathType: Prefix
-            backend:
-              service:
-                name: oauth2-proxy
-                port:
-                  number: 4180
-  tls:
-    - hosts:
-        - "{{ .Values.kerberoshub.frontend.url }}"
-      secretName:
-{{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-frontend
-  namespace: {{ .Release.Namespace }}
 spec:
  replicas: {{ .Values.kerberoshub.frontend.replicas }}
  selector:
@@ -163,9 +99,6 @@ spec:
      labels:
        app: hub-frontend
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
@@ -174,18 +107,14 @@ spec:
      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: hub-frontend
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
        imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
-        {{- with .Values.kerberoshub.frontend.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
        ports:
        - containerPort: 80
          name: http
@@ -194,20 +123,12 @@ spec:
          {{- toYaml . | nindent 8 }}
        {{- end }}
        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberoshub.frontend.logLevel }}"
-        - name: SSO_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
-        - name: SSO_FORCE_DOMAINS
-          # get the domain attribute from the list of sso domains
-          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
+        - name: SSO_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
        - name: TITLE
          value: "{{ .Values.kerberoshub.frontend.title }}"
        - name: LOGO_NAME
          value: "{{ .Values.kerberoshub.frontend.logo }}"
-        - name: ENVIRONMENT
-          value: "{{ .Values.environment }}"
        - name: API_URL
          value: "" # legacy
        - name: NEW_API_URL
@@ -235,24 +156,22 @@ spec:
          value: "{{ .Values.mqtt.host }}"
        - name: MQTT_PORT
          value: "{{ .Values.mqtt.port }}"
-        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: MQTT_USERNAME
+          value: "{{ .Values.mqtt.username }}"
+        - name: MQTT_PASSWORD
+          value: "{{ .Values.mqtt.password }}"
        - name: MQTT_LEGACY_SERVER
          value: "{{ .Values.mqtt.legacy.host }}"
        - name: MQTT_LEGACY_PORT
          value: "{{ .Values.mqtt.legacy.port }}"

-        # OpenAI
-        - name: OPENAI_ENABLED
-          value: "{{ .Values.openai.enabled }}"
-
        # Turn (Pion)
        - name: TURN_SERVER
          value: "{{ .Values.turn.host }}"
-        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
-        # frontend. They are fetched from the authenticated hub-api endpoint
-        # /runtime/config after login. See hub-api deployment.
+        - name: TURN_USERNAME
+          value: "{{ .Values.turn.username }}"
+        - name: TURN_PASSWORD
+          value: "{{ .Values.turn.password }}"

        # Mixpanel for monitoring
        - name: MIXPANEL_KEY
@@ -275,221 +194,37 @@ spec:
        # Google maps for using and displaying cameras, sites on a map
        - name: GOOGLEMAPS_KEY
          value: "{{ .Values.kerberoshub.frontend.googlemaps.apikey }}"
-        - name: GOOGLEMAPS_PLACES_API
-          value: "{{ .Values.kerberoshub.frontend.googlemaps.placesApi }}"

        # Zendesk for support
        - name: ZENDESK_URL
          value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"

-        - name: HIDE_ADD_AGENT
-          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
-
-        # Navigation links
-        - name: NAVIGATION_LINK_TITLE_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
-        - name: NAVIGATION_LINK_URL_1
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
-        - name: NAVIGATION_LINK_TITLE_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
-        - name: NAVIGATION_LINK_URL_2
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
-        - name: NAVIGATION_LINK_TITLE_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
-        - name: NAVIGATION_LINK_URL_3
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
-        - name: NAVIGATION_LINK_TITLE_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
-        - name: NAVIGATION_LINK_URL_4
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
-        - name: NAVIGATION_LINK_TITLE_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
-        - name: NAVIGATION_LINK_URL_5
-          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
-        - name: CASE_FILTER_ASSIGNEES_DEFAULT
-          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
-
-        # features > general
-        - name: FEATURE_CASE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
-        - name: FEATURE_WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
-        - name: FEATURE_AUDIT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.audit.enabled }}"
-        - name: FEATURE_DAY_OVERVIEW_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dayOverview.enabled }}"
-        - name: FEATURE_DEVICE_ANALYTICS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.analyticsEnabled }}"
-        - name: FEATURE_DASHBOARD_SITES_FULLSCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.dashboard.sitesFullscreenEnabled }}"
-        - name: FEATURE_DEVICE_DEVELOPER_TOOLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.devices.developerToolsEnabled }}"
-        - name: FEATURE_ORGANISATIONS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
-        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
-        - name: FEATURE_ORGANISATION_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
-        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
-        - name: FEATURE_PROJECTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
-        - name: FEATURE_PROJECT_SWITCHER_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
-        - name: FEATURE_PROJECT_CREATION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
-        - name: FEATURE_PROJECT_SETTINGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
-        - name: FEATURE_DARK_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
-        - name: FEATURE_SPLASH_SCREEN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
-        - name: FEATURE_LANDING_PAGE
-          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
-
-        # features > internationalization (i18n)
-        - name: FEATURE_I18N_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
-        - name: DEFAULT_LANGUAGE
-          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
-
-        # features > liveview
-        - name: FEATURE_DEFAULT_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
-        - name: FEATURE_LIVE_STREAM_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
-        - name: FEATURE_HLS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
-        - name: FEATURE_MOQ_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
-        - name: FEATURE_REMOTE_RECORDING_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
-        - name: FEATURE_LIVE_VIEW_DEVICE_STATUS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.deviceStatusEnabled }}"
-        - name: MOQ_RELAY_URL
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
-        - name: MOQ_BROADCAST_PREFIX
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
-        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
-        - name: FEATURE_LIVEVIEW_PAGE_SIZE
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
-        - name: FEATURE_LIVEVIEW_MAX_STREAMS
-          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
-
-        # features > devices
-        - name: FEATURE_DEVICES_HIDE_AGENT
-          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
-
-        # features > floorplan
-        - name: FEATURE_FLOORPLAN_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
-
-        # features > map
-        - name: MAP_TILE_URL_LIGHT
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
-        - name: MAP_TILE_URL_DARK
-          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
-        - name: MAP_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
-        - name: MAP_OVERLAY_TILE_URL
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
-        - name: MAP_OVERLAY_API_KEY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
-        - name: MAP_OVERLAY_ATTRIBUTION
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
-        - name: MAP_OVERLAY_MIN_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
-        - name: MAP_OVERLAY_MAX_ZOOM
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
-        - name: MAP_OVERLAY_OPACITY
-          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
-
-        - name: COLOR_TRACK_BOX
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
-        - name: COLOR_TRACK_BOX_HOVER
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
-        - name: COLOR_TRACK_BOX_DRAWING
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
-        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
-          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
-        - name: COLOR_DEVICE_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
-        - name: COLOR_DEVICE_INACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
-        - name: COLOR_DEVICE_IDLE
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
-        - name: COLOR_DEVICE_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
-        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
-          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
-        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
-          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
-        - name: COLOR_DEVICE_MARKER_BORDER
-          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
-
-        # features > chart
-        - name: CHART_COLORS
-          value: {{ .Values.kerberoshub.frontend.features.chart.colors | toJson | quote }}
-        - name: COLOR_CHART_SELECTION_FILL
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
-        - name: COLOR_CHART_SELECTION_STROKE
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionStroke }}"
-        - name: COLOR_CHART_GRID_STROKE
-          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartGridStroke }}"
-
-        # features > video edits
-        - name: FEATURE_VIDEO_EDITS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
-
-        # features > face redaction 
-        - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
-        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
-        
-        # features > media
-        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_ANALYSIS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.analysis.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_OPTIONS_BY_DATE_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerOptionsByDate.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_MARKER_CATEGORY_PRIORITY_CATEGORIES
-          value: {{ .Values.kerberoshub.frontend.features.media.filter.markerCategoryPriority.categories | toJson | replace "\\" "\\\\" | replace "'" "\\u0027" | quote }}
-        - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
-        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
-        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
-        
-
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
-        {{- end }}
-      {{- end }}
+        # Titles and descriptions on pages
+        - name: LOGIN_DESCRIPTION
+          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
+        - name: LOGIN_COPYRIGHT
+          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
+        - name: PAGE_DASHBOARD_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
+        - name: PAGE_DASHBOARD_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
+        - name: PAGE_LATESTEVENTS_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
+        - name: PAGE_LATESTEVENTS_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
+        - name: PAGE_LIVESTREAM_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
+        - name: PAGE_LIVESTREAM_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
+        - name: PAGE_MEDIA_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
+        - name: PAGE_MEDIA_SUB_TITLE
+          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
+        - name: PAGE_DASHBOARD_CPU_USAGE
+          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
+        - name: PAGE_DASHBOARD_FPS
+          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
+        - name: PAGE_DASHBOARD_MLA
+          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
+        - name: PAGE_DASHBOARD_OBJECTS
+          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-monitor-device
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.monitordevice.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: hub-monitor-device
@@ -17,58 +15,34 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: hub-monitor-device
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
        - name: hub-monitor-device
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
+          image: "{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.monitordevice.pullPolicy }}
-          {{- with .Values.kerberoshub.monitordevice.resources }}
          resources:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
+            requests:
+              memory: 10Mi
+              cpu: 10m
          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-monitor-device") | nindent 12 }}
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+
            # Mail settings
            - name: MAIL_PROVIDER
              value: "{{ .Values.email.provider }}"
@@ -76,13 +50,11 @@ spec:
              value: "{{ .Values.email.from }}"
            - name: EMAIL_FROM_DISPLAYNAME
              value: "{{ .Values.email.displayName }}"
-
+              
            # Mail templates
            - name: DEVICE_TEMPLATE
              value: "{{ .Values.email.templates.device }}"
-            - name: DEVICE_TITLE
-              value: "{{ .Values.email.templates.deviceTitle }}"
-
+              
            # - Plain SMTP
            - name: SMTP_SERVER
              value: "{{ .Values.email.smtp.server }}"
@@ -92,13 +64,3 @@ spec:
              value: "{{ .Values.email.smtp.username }}"
            - name: SMTP_PASSWORD
              value: "{{ .Values.email.smtp.password }}"
-
-            # Mailgun
-            - name: MAILGUN_DOMAIN
-              value: "{{ .Values.email.mailgun.domain }}"
-            - name: MAILGUN_API_KEY
-              value: "{{ .Values.email.mailgun.apikey }}"
-        {{- if .Values.kerberoshub.extraEnv }}
-        {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-        {{- end }}
-      {{- end }}
@@ -1,81 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.oauth2Proxy.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: oauth2-proxy
-  namespace: kube-system
-  labels:
-    k8s-app: oauth2-proxy
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      k8s-app: oauth2-proxy
-  template:
-    metadata:
-      labels:
-        k8s-app: oauth2-proxy
-    spec:
-      {{- with .Values.kerberoshub.oauth2Proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.oauth2Proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - args:
-            - --provider=github
-            - --email-domain=*
-            - --upstream=file:///dev/null
-            - --http-address=0.0.0.0:4180
-            - --skip-auth-preflight=true
-          {{- with .Values.kerberoshub.oauth2Proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          env:
-            - name: OAUTH2_PROXY_CLIENT_ID
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientId }}"
-            - name: OAUTH2_PROXY_CLIENT_SECRET
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientSecret }}"
-            - name: OAUTH2_PROXY_COOKIE_SECRET
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.cookieSecret }}"
-            - name: OAUTH2_PROXY_GITHUB_ORG
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.organization }}"
-            - name: OAUTH2_PROXY_GITHUB_TEAM
-              value: "{{ .Values.kerberoshub.oauth2Proxy.github.team }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-          image: quay.io/oauth2-proxy/oauth2-proxy:latest
-          imagePullPolicy: Always
-          name: oauth2-proxy
-          ports:
-            - containerPort: 4180
-              protocol: TCP
-          resources:
-            limits:
-              cpu: 100m
-              memory: 50Mi
-            requests:
-              cpu: 100m
-              memory: 50Mi
---
-apiVersion: v1
-kind: Service
-metadata:
-  labels:
-    k8s-app: oauth2-proxy
-  name: oauth2-proxy
-  namespace: kube-system
-spec:
-  ports:
-    - name: http
-      port: 4180
-      protocol: TCP
-      targetPort: 4180
-  selector:
-    k8s-app: oauth2-proxy
-{{- end -}}
@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: hub-reactivate-subscription
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.reactivate.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: hub-reactivate-subscription
@@ -17,56 +15,25 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: hub-reactivate-subscription
    spec:
-      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.reactivate.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        - name: regcred
      containers:
        - name: hub-reactivate-subscription
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
+          image: "{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-            - configMapRef:
-                name: mongodb-config
          env:
-            {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-reactivatesubscriptions") | nindent 12 }}
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
-            - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
            - name: AWS_ACCESS_KEY_ID
              value: "{{ .Values.kerberoshub.api.aws.accessKey }}"
            - name: AWS_SECRET_ACCESS_KEY
              value: "{{ .Values.kerberoshub.api.aws.secretKey }}"
-            {{- if .Values.kerberoshub.extraEnv }}
-            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
-            {{- end }}
-{{- end }}
@@ -1,13 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui") (eq .Values.mode "pipeline")) .Values.kerberoshub.serviceAccount.create }}
-apiVersion: v1
-kind: ServiceAccount
-metadata:
-  name: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-  namespace: {{ .Release.Namespace }}
-  annotations:
-    {{- toYaml .Values.kerberoshub.serviceAccount.annotations | nindent 4 }}
-  {{- with .Values.kerberoshub.serviceAccount.labels }}
-  labels:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-{{- end }}
@@ -1,154 +0,0 @@
-{{/*
-Reserve every effective identity, including disabled definitions, so enabling a
-workflow later cannot silently alias another workflow's runs or references.
-*/}}
-{{- define "kerberoshub.workflows.validateDefinitions" -}}
-{{- $identities := dict -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- $id := sha256sum $name | trunc 24 -}}
-{{- if hasKey $wf "id" -}}
-{{- $invalid := printf "kerberoshub.workflows.definitions[%q].id must be a non-zero 24-character hexadecimal string (Mongo ObjectID); omit id for name-derived compatibility" $name -}}
-{{- if not (kindIs "string" $wf.id) -}}
-{{- fail $invalid -}}
-{{- end -}}
-{{- if or (not (regexMatch "^[0-9a-fA-F]{24}$" $wf.id)) (eq $wf.id "000000000000000000000000") -}}
-{{- fail $invalid -}}
-{{- end -}}
-{{- $id = lower $wf.id -}}
-{{- end -}}
-{{- if hasKey $identities $id -}}
-{{- fail (printf "kerberoshub.workflows.definitions: duplicate effective workflow id %q for %q and %q (including disabled definitions)" $id (index $identities $id) $name) -}}
-{{- end -}}
-{{- $_ := set $identities $id $name -}}
-{{- end -}}
-{{- include "kerberoshub.workflows.validateSystemTags" . -}}
-{{- end -}}
-
-{{/*
-Guard the definitions that can select devices by system tag. The engine reads
-JSON keys case-insensitively and ignores unknown ones, so a misspelled or
-re-cased key silently changes what a definition selects (a dropped
-systemTags scope makes a global workflow run on every device). Therefore:
-  - definitions and triggers may only use the keys the engine knows, spelled
-    exactly (definition: id, enabled, triggers, stages; trigger: the
-    models.WorkflowTrigger fields);
-  - while deviceTags.system.enabled is false, no definition may mention system
-    tags anywhere (trigger systemTags, or a device.systemTags condition at any
-    depth, in triggers, shared conditions or stage needs), matched
-    case-insensitively on the whole definition;
-  - every system tag a trigger selects must be in deviceTags.system.catalog,
-    so a typo fails rendering instead of never matching a device.
-Disabled definitions are checked too, so enabling one cannot fail later.
-*/}}
-{{- define "kerberoshub.workflows.validateSystemTags" -}}
-{{- include "kerberoshub.deviceTags.system.validate" . -}}
-{{- $catalog := dict -}}
-{{- range $tag := (include "kerberoshub.deviceTags.system.catalog" . | fromJsonArray) -}}
-{{- $_ := set $catalog (toString $tag.key) true -}}
-{{- end -}}
-{{- $enabled := include "kerberoshub.deviceTags.system.enabled" . -}}
-{{- $definitionKeys := list "id" "enabled" "triggers" "stages" -}}
-{{- $triggerKeys := list "type" "edgeId" "sharedConditions" "devices" "siteIds" "groupIds" "systemTags" "classifications" "conditionMode" "conditions" "weeklySchedule" "surfaces" -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- if $wf -}}
-{{- if not (kindIs "map" $wf) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q] must be an object" $name) -}}
-{{- end -}}
-{{- if and (not $enabled) (contains "systemtags" (lower (toJson $wf))) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q] selects devices by system tag (systemTags or a device.systemTags condition), but deviceTags.system.enabled is false" $name) -}}
-{{- end -}}
-{{- range $key, $_ := $wf -}}
-{{- if not (has $key $definitionKeys) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored" $name $key (join ", " $definitionKeys)) -}}
-{{- end -}}
-{{- end -}}
-{{- range $i, $trigger := ($wf.triggers | default list) -}}
-{{- if not (kindIs "map" $trigger) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d] must be an object" $name $i) -}}
-{{- end -}}
-{{- range $key, $_ := $trigger -}}
-{{- if not (has $key $triggerKeys) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d]: unknown key %q (allowed: %s). Keys are case-sensitive; a misspelled key would be ignored and widen the trigger" $name $i $key (join ", " $triggerKeys)) -}}
-{{- end -}}
-{{- end -}}
-{{- range $tag := ($trigger.systemTags | default list) -}}
-{{- if not (hasKey $catalog (toString $tag)) -}}
-{{- fail (printf "kerberoshub.workflows.definitions[%q].triggers[%d].systemTags: %q is not in deviceTags.system.catalog; add it to the system tag catalog" $name $i (toString $tag)) -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-
-{{/*
-Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
-JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
-This is the engine's boot-loaded configuration source and deployment stage
-catalog: several distinct config workflows can run over one recording — each
-opens its own run and dispatches only its own stages. Organisation-scoped
-database workflows are discovered separately at runtime.
-
-Each enabled definition contributes one workflow object:
-  id        optional explicit stable identity, normalized to lowercase. Omitted
-            for legacy definitions; their effective id is SHA256(name)[:24].
-  name      the map key (mutable display name when an explicit id is supplied).
-  enabled   always true here (a disabled definition is skipped entirely).
-  source    "config" — provenance marking a Helm-defined, deployment-global,
-            ops-managed workflow (read-only in the API, no owning organisation).
-  triggers  how a run OPENS. Defaults to a single bare automatic trigger
-            (opens for every recording); narrow with device/schedule triggers.
-            Per-stage `needs` (below) decide which stages then FIRE.
-  stages    the executable stage set, each contributing the same routing
-            descriptor the stageRegistry emits:
-              operation  the stage's operation (unique within the workflow).
-              dispatch   "always" (default) | "conditional".
-              queue      from the matching services.<operation>.queue
-                         (authoritative; omitted when unset so the engine
-                         derives "kcloud-<operation>-queue.fifo").
-              needs      conditional stages only: upstream dependencies, each
-                         {operation?, condition?}, carried through verbatim.
-              needsMode  conditional stages: "any" (default) | "all".
-*/}}
-{{- define "kerberoshub.workflows.workflowDefinitions" -}}
-{{- include "kerberoshub.workflows.validateDefinitions" . -}}
-{{- $defs := list -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
-{{- if $wf.enabled -}}
-{{- $stages := list -}}
-{{- range $stage := $wf.stages -}}
-{{- $op := $stage.operation -}}
-{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
-{{- $service := index $services $op -}}
-{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
-{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
-{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
-{{- $stages = append $stages $entry -}}
-{{- end -}}
-{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
-{{- if hasKey $wf "id" }}{{- $_ := set $def "id" (lower $wf.id) -}}{{- end }}
-{{- $defs = append $defs $def -}}
-{{- end -}}
-{{- end -}}
-{{- $defs | toJson -}}
-{{- end -}}
-
-{{/*
-Expose the deployment's operation→queue catalog to API producers that seed
-embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
-are enabled for internal flows but are absent from user-visible workflow
-definitions. The workflows engine remains authoritative for dispatch; producers
-use this only to embed the same queue on a synthetic stage.
-*/}}
-{{- define "kerberoshub.workflows.stageQueues" -}}
-{{- $queues := dict -}}
-{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
-{{- if ne $operation "workflows" -}}
-{{- with $service.queue -}}
-{{- $_ := set $queues $operation . -}}
-{{- end -}}
-{{- end -}}
-{{- end -}}
-{{- $queues | toJson -}}
-{{- end -}}
@@ -1,169 +0,0 @@
-{{- /*
-  Generic workflow-stage worker.
-
-  Renders a Deployment + Service for every enabled worker under
-  kerberoshub.services.<name> other than the `workflows` engine itself. A custom
-  stage joins the pipeline by values alone — declare its worker here and route to
-  it from a kerberoshub.workflows.definitions stage of the same operation; no
-  per-stage template is needed.
-
-  Every stage worker receives the same connection contract; the only value that
-  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
-  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
-  a worker outside the chart instead, leave services.<name>.enabled unset (or
-  false) and point its workflow stage at the queue you publish.
-
-  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
-  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
-  redaction) declares its destination provider with the named field
-  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
-  read-only stage omits it and gets no provider env.
-
-  Worker-specific settings go in services.<name>.env (plain values) and
-  services.<name>.secretEnv (references to keys in an existing Secret).
-*/ -}}
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-{{- $root := . -}}
-{{- $services := .Values.kerberoshub.services | default dict -}}
-{{- range $name, $svc := $services -}}
-{{- if and (ne $name "workflows") $svc $svc.enabled -}}
-{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
---
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-spec:
-  replicas: {{ $svc.replicas | default 1 }}
-  selector:
-    matchLabels:
-      app: hub-{{ $name }}
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: hub-{{ $name }}
-    spec:
-      {{- if $root.Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with $root.Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with $svc.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-{{ $name }}
-        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
-        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
-        {{- with $svc.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with $svc.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ $svc.logLevel | default "info" }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ $root.Values.queueProvider }}"
-
-        # The queue this stage worker consumes dispatched "{{ $name }}" stages
-        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
-        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
-        # any stage that needs "{{ $name }}" can fire).
-        - name: {{ $queueEnv }}
-          value: "{{ $svc.queue }}"
-        - name: WORKFLOWS_QUEUE
-          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ $root.Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ $root.Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ $root.Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ $root.Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials this stage uses to fetch
-        # the media it operates on.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ $root.Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ $root.Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ $root.Values.kerberosvault.secretkey }}"
-        {{- with $svc.storageProvider }}
-        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
-        # that write an artefact back (e.g. redaction) set services.<name>.
-        # storageProvider; read-only stages omit it and get no provider env.
-        - name: KERBEROS_STORAGE_PROVIDER
-          value: {{ . | quote }}
-        {{- end }}
-        {{- if $root.Values.opentelemetry.enabled }}
-
-        # OpenTelemetry tracing: the stage continues the engine's dispatch span
-        # (the run's traceparent) and follows its sampling decision.
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ $root.Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $root | trim | nindent 8 }}
-        {{- end }}
-
-        # Per-stage tuning knobs. Any key/value under services.<name>.env is
-        # rendered verbatim as container env, so a worker can be tuned from
-        # values without a per-stage template. These override the image's own
-        # ENV defaults; the fixed contract env above is not overridable here.
-        {{- range $key, $value := $svc.env }}
-        - name: {{ $key }}
-          value: {{ $value | quote }}
-        {{- end }}        {{- with $svc.secretEnv }}
-
-        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
-        # container env var to a key in an existing Kubernetes Secret
-        # ({name, key}), so credentials such as a model API key stay out of
-        # values. The Secret must exist in the release namespace.
-        {{- range $key, $ref := . }}
-        - name: {{ $key }}
-          valueFrom:
-            secretKeyRef:
-              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
-              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
-        {{- end }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-{{ $name }}
-  namespace: {{ $root.Release.Namespace }}
-  labels:
-    app: hub-{{ $name }}
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-{{ $name }}
-{{ end -}}
-{{- end }}
-{{- end }}
@@ -1,137 +0,0 @@
-{{- include "kerberoshub.workflows.validateDefinitions" . -}}
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
-  selector:
-    matchLabels:
-      app: hub-workflows
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: hub-workflows
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.services.workflows.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: hub-workflows
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
-        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
-        {{- with .Values.kerberoshub.services.workflows.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
-        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-workflows") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
-        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
-        # trigger and executable stages, assembled from the enabled definitions
-        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
-        # Definitions are the engine's boot-loaded config source and deployment
-        # stage catalog. Organisation-scoped database workflows are read per
-        # recording; an in-cluster engine refuses to start only when both the
-        # config definitions and the stage-queue catalog below are empty.
-        - name: WORKFLOWS_QUEUE
-          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
-        - name: WORKFLOW_DEFINITIONS
-          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
-        # Operation→queue catalog so DB workflows reach workers no config workflow references.
-        - name: WORKFLOW_STAGE_QUEUES
-          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # Kerberos Vault — global storage credentials a dispatched stage worker
-        # uses to fetch the media. Per-recording vault overrides (site/account)
-        # are resolved at dispatch time from the database.
-        - name: KERBEROS_STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: KERBEROS_STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: hub-workflows
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: hub-workflows
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: hub-workflows
-{{- end }}
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-analysis
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.analysis.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.analysis.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-analysis
@@ -21,61 +15,37 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-analysis
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.analysis.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-analysis
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
+        image: "{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.analysis.pullPolicy }}
-        {{- with .Values.kerberospipeline.analysis.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-analysis") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"

+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
        # Kafka settings
        - name: KAFKA_BROKER
          value: "{{ .Values.kafka.broker }}"
@@ -88,79 +58,10 @@ spec:
        - name: KAFKA_SECURITY
          value: "{{ .Values.kafka.security }}"

-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
-        # When true, analysis tees the classify result to the hub-workflows
-        # service in parallel with the throttler/notification tail (which still
-        # runs unchanged). Kept in sync with whether the workflows service runs.
-        - name: WORKFLOWS_ENABLED
-          value: "{{ .Values.kerberoshub.workflows.enabled }}"
-
-        # Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
-        # taken from the workflows service's queue so analysis and the engine
-        # always agree on the queue name (no drift).
-        - name: WORKFLOWS_QUEUE
-          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
-          
        # Kerberos Vault
        - name: KERBEROS_STORAGE_URI
          value: "{{ .Values.kerberosvault.uri }}"
        - name: KERBEROS_STORAGE_ACCESS_KEY
          value: "{{ .Values.kerberosvault.accesskey }}"
        - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Sprites
-        - name: SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-
-        # Dominant colors
-        - name: DOMINANTCOLOR_ENABLED
-          value: "{{ .Values.kerberospipeline.dominantColor.enabled }}"
-
-        # Thumbnail regeneration from classified frames (opt-in)
-        - name: THUMBNAIL_REGENERATION_ENABLED
-          value: {{ .Values.kerberospipeline.analysis.thumbnailRegeneration.enabled | default false | quote }}
-
-        # In-memory cache for hot-path MongoDB lookups
-        - name: DB_CACHE_ENABLED
-          value: {{ .Values.kerberospipeline.analysis.dbCache.enabled | default false | quote }}
-        - name: DB_CACHE_TTL
-          value: {{ .Values.kerberospipeline.analysis.dbCache.ttl | default "5m" | quote }}
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-analysis
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-analysis
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-analysis
-{{- end }}
+          value: "{{ .Values.kerberosvault.secretkey }}"
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-counting
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.counting.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.counting.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-counting
@@ -24,36 +18,19 @@ spec:
      labels:
        app: pipe-counting
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.counting.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.counting.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-counting
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
+        image: "{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.counting.pullPolicy }}
-        {{- with .Values.kerberospipeline.counting.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.counting.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.counting.logLevel }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
@@ -69,43 +46,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-counting
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-counting
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-counting
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,15 +1,9 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.dominantColor.enabled true) -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-dominantcolor
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.dominantColor.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-dominantcolor
@@ -24,36 +18,19 @@ spec:
      labels:
        app: pipe-dominantcolor
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.dominantColor.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.dominantColor.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-dominantcolor
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
+        image: "{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.dominantColor.pullPolicy }}
-        {{- with .Values.kerberospipeline.dominantColor.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.dominantColor.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.dominantColor.logLevel }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
@@ -69,43 +46,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-dominantcolor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-dominantcolor
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-dominantcolor
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-event
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.event.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.event.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-event
@@ -21,65 +15,37 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-event
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.event.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-event
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
+        image: "{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.event.pullPolicy }}
-        {{- with .Values.kerberospipeline.event.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.event.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        ports:
-          - containerPort: 8080
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-event") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.event.logLevel }}"
-        - name: READ_ONLY
-          value: "{{ .Values.readonly }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"

+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
        # Kafka settings
        - name: KAFKA_BROKER
          value: "{{ .Values.kafka.broker }}"
@@ -90,43 +56,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-event
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-event
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-event
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,164 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-export
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberospipeline.export.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-export
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: pipe-export
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.export.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-export
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.export.repository }}:{{ .Values.kerberospipeline.export.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.export.pullPolicy }}
-        {{- with .Values.kerberospipeline.export.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.export.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
-        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-export") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.export.logLevel }}"
-        {{- if .Values.kerberospipeline.export.playerAssetsPath }}
-        - name: PLAYER_ASSETS_PATH
-          value: "{{ .Values.kerberospipeline.export.playerAssetsPath }}"
-        {{- end }}
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-          
-        # Kerberos Vault (Main instance, within Kerberos Hub you can assign additional Vaults to sites).
-        - name: STORAGE_URI
-          value: "{{ .Values.kerberosvault.uri }}"
-        - name: STORAGE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.accesskey }}"
-        - name: STORAGE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.secretkey }}"
-
-        # Kerberos Vault: archiving credentials. When creating a task, the underlying recording will be
-        # copied to this storage provider, using the specific account credentials, for deletion/retention.
-        - name: STORAGE_ARCHIVE_PROVIDER
-          value: "{{ .Values.kerberosvault.archive.provider }}"
-        - name: STORAGE_ARCHIVE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.archive.accesskey }}"
-        - name: STORAGE_ARCHIVE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.archive.secretkey }}"
-
-        # Sprites
-        - name: SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        # Thumbnails
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-export
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-export
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-export
-{{- end }}
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-monitor
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.monitor.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.monitor.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-monitor
@@ -21,58 +15,32 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-monitor
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.monitor.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-monitor
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
+        image: "{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.monitor.pullPolicy }}
-        {{- with .Values.kerberospipeline.monitor.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-monitor") | nindent 8 }}
-        # Application
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
-
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+  
        # Queue      
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"
@@ -89,16 +57,6 @@ spec:
        - name: KAFKA_SECURITY
          value: "{{ .Values.kafka.security }}"

-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
        # Mail settings
        - name: MAIL_PROVIDER
          value: "{{ .Values.email.provider }}"
@@ -122,32 +80,3 @@ spec:
          value: "{{ .Values.email.smtp.username }}"
        - name: SMTP_PASSWORD
          value: "{{ .Values.email.smtp.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-monitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-monitor
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-monitor
-{{- end }}
@@ -1,11 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-notify-test
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberospipeline.notifyTest.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-notify-test
@@ -17,57 +15,43 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-notify-test
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
      {{- with .Values.kerberospipeline.notifyTest.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: pipe-notify-test
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
+        image: "{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.notifyTest.pullPolicy }}
-        {{- with .Values.kerberospipeline.notifyTest.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
+          requests:
+            memory: 10Mi
+            cpu: 10m
        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        volumeMounts:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification-test") | nindent 8 }}
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"

+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
        # Kerberos Vault
        - name: STORAGE_URI
          value: "{{ .Values.kerberosvault.uri }}"
@@ -88,16 +72,6 @@ spec:
        - name: KAFKA_SECURITY
          value: "{{ .Values.kafka.security }}"

-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-
        # Mail settings
        - name: MAIL_PROVIDER
          value: "{{ .Values.email.provider }}"
@@ -105,8 +79,6 @@ spec:
          value: "{{ .Values.email.from }}"
        - name: EMAIL_FROM_DISPLAYNAME
          value: "{{ .Values.email.displayName }}"
-        - name: PUBLIC_URL
-          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
          
        # Mail templates
        - name: DETECT_TEMPLATE
@@ -121,32 +93,3 @@ spec:
          value: "{{ .Values.email.smtp.username }}"
        - name: SMTP_PASSWORD
          value: "{{ .Values.email.smtp.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-notify-test
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-notify-test
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-notify-test
-{{- end }}
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-notify
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.notify.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.notify.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-notify
@@ -21,61 +15,44 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-notify
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
      {{- with .Values.kerberospipeline.notify.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
-      topologySpreadConstraints:
+      volumes:
        {{- toYaml . | nindent 8 }}
      {{- end }}
      containers:
      - name: pipe-notify
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
+        image: "{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.notify.pullPolicy }}
-        {{- with .Values.kerberospipeline.notify.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
+          requests:
+            memory: 10Mi
+            cpu: 10m
        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        volumeMounts:
          {{- toYaml . | nindent 12 }}
        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-notification") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.notify.logLevel }}"
-        - name: NOTIFICATION_EXPIRY_MINUTES
-          value: "{{ .Values.kerberospipeline.notify.notificationExpiryMinutes }}"
-        # Queue
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"
+        - name: MAIL_PROVIDER
+          value: "{{ .Values.email.provider }}"
+
+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"

        # Kafka settings
        - name: KAFKA_BROKER
@@ -89,24 +66,6 @@ spec:
        - name: KAFKA_SECURITY
          value: "{{ .Values.kafka.security }}"

-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        - name: AUDIT_ENABLED
-          value: {{ and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled | quote }}
-        {{- if and .Values.audit.enabled .Values.kerberospipeline.notify.audit.enabled }}
-        - name: AUDIT_QUEUE
-          value: {{ .Values.audit.intake.queue | quote }}
-        - name: AUDIT_DEADLETTER_QUEUE
-          value: {{ .Values.audit.intake.deadletterQueue | quote }}
-        {{- end }}
-
        # Kerberos Vault
        - name: STORAGE_URI
          value: "{{ .Values.kerberosvault.uri }}"
@@ -122,14 +81,10 @@ spec:
          value: "{{ .Values.email.from }}"
        - name: EMAIL_FROM_DISPLAYNAME
          value: "{{ .Values.email.displayName }}"
-        - name: PUBLIC_URL
-          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
          
        # Mail templates 
        - name: DETECT_TEMPLATE
          value: "{{ .Values.email.templates.detection }}"
-        - name: ALERT_TITLE
-          value: "{{ .Values.email.templates.alertTitle }}"

        # SMTP
        - name: SMTP_SERVER
@@ -146,53 +101,3 @@ spec:
          value: "{{ .Values.email.mailgun.domain }}"
        - name: MAILGUN_API_KEY
          value: "{{ .Values.email.mailgun.apikey }}"
-
-        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-        # This will lower storage in mongodb.
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-      
-        # There is an option to store the sprites in a storage provider in Kerberos Vault.
-        - name: VAULT_SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-notify
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-notify
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-notify
-{{- end }}
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-sequence
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.sequence.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.sequence.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-sequence
@@ -21,59 +15,37 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-sequence
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.sequence.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-sequence
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
+        image: "{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.sequence.pullPolicy }}
-        {{- with .Values.kerberospipeline.sequence.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-sequence") | nindent 8 }}
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"

+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
        # Kafka settings
        - name: KAFKA_BROKER
          value: "{{ .Values.kafka.broker }}"
@@ -84,43 +56,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-sequence
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-sequence
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-sequence
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,138 +0,0 @@
-{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.sprite.enabled true) }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: pipe-sprite
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.sprite.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
-spec:
-  replicas: {{ .Values.kerberospipeline.sprite.replicas }}
-  selector:
-    matchLabels:
-      app: pipe-sprite
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: pipe-sprite
-    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sprite.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.sprite.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-      - name: pipe-sprite
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sprite.repository }}:{{ .Values.kerberospipeline.sprite.tag }}"
-        imagePullPolicy: {{ .Values.kerberospipeline.sprite.pullPolicy }}        
-        {{- with .Values.kerberospipeline.sprite.resources }}
-        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.sprite.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.sprite.logLevel }}"
-        {{ if .Values.isPrivate }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "true"
-        {{ else }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "false"
-        {{ end }}
-        - name: CLOUD_PROVIDER
-          value: "{{ .Values.cloudProvider }}"
-        - name: QUEUE_SYSTEM
-          value: "{{ .Values.queueProvider }}"
-
-        # Kafka settings
-        - name: KAFKA_BROKER
-          value: "{{ .Values.kafka.broker }}"
-        - name: KAFKA_USERNAME
-          value: "{{ .Values.kafka.username }}"
-        - name: KAFKA_PASSWORD
-          value: "{{ .Values.kafka.password }}"
-        - name: KAFKA_MECHANISM
-          value: "{{ .Values.kafka.mechanism }}"
-        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        {{- with .Values.kerberospipeline.sprite.prefetchCount }}
-        - name: RABBITMQ_PREFETCH_COUNT
-          value: {{ . | quote }}
-        {{- end }}
-
-        # There is an option to store the sprites in a storage provider in Kerberos Vault.
-        - name: VAULT_SPRITE_ENABLED
-          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
-        - name: VAULT_SPRITE_PROVIDER
-          value: "{{ .Values.kerberosvault.sprite.provider }}"
-        - name: VAULT_SPRITE_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
-        - name: VAULT_SPRITE_SECRET_KEY
-          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
-        - name: VAULT_SPRITE_INTERVAL
-          value: "{{ .Values.kerberospipeline.sprite.interval }}"
-        - name: VAULT_SPRITE_WIDTH
-          value: "{{ .Values.kerberospipeline.sprite.width }}"
-        - name: VAULT_SPRITE_HEIGHT
-          value: "{{ .Values.kerberospipeline.sprite.height }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-sprite
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-sprite
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-sprite
-{{ end }}
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-throttler
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.throttler.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.throttler.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-throttler
@@ -21,61 +15,37 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: pipe-throttler
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberospipeline.throttler.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-throttler
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
+        image: "{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.throttler.pullPolicy }}
-        {{- with .Values.kerberospipeline.throttler.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-        volumeMounts:
-        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-        {{- end }}
-        {{- end }}
-        envFrom:
-        - configMapRef:
-            name: mongodb-config
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "hub-pipeline-throttler") | nindent 8 }}
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
          value: "{{ .Values.queueProvider }}"

+        # Database
+        - name: MONGODB_HOST
+          value: "{{ .Values.mongodb.host }}"
+        - name: MONGODB_DATABASE_CREDENTIALS
+          value: "{{ .Values.mongodb.adminDatabase }}"
+        - name: MONGODB_USERNAME
+          value: "{{ .Values.mongodb.username }}"
+        - name: MONGODB_PASSWORD
+          value: "{{ .Values.mongodb.password }}"
+
        # Kafka settings
        - name: KAFKA_BROKER
          value: "{{ .Values.kafka.broker }}"
@@ -86,43 +56,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-throttler
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-throttler
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-throttler
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,15 +1,9 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: pipe-thumbnail
-  namespace: {{ .Release.Namespace }}
-  {{- with .Values.kerberospipeline.thumbnail.deploymentAnnotations }}
-  annotations:
-    {{- toYaml . | nindent 4 }}
-  {{- end }}
 spec:
-  replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
+  replicas: 1
  selector:
    matchLabels:
      app: pipe-thumbnail
@@ -24,43 +18,19 @@ spec:
      labels:
        app: pipe-thumbnail
    spec:
-      {{- if .Values.kerberoshub.serviceAccount.create }}
-      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
-      {{- end }}
      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- with .Values.kerberospipeline.thumbnail.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberospipeline.thumbnail.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
      - name: pipe-thumbnail
-        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
+        image: "{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
        imagePullPolicy: {{ .Values.kerberospipeline.thumbnail.pullPolicy }}
-        {{- with .Values.kerberospipeline.thumbnail.resources }}
        resources:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
-        {{- with .Values.kerberospipeline.thumbnail.volumeMounts }}
-        volumeMounts:
-          {{- toYaml . | nindent 12 }}
-        {{- end }}
+          requests:
+            memory: 10Mi
+            cpu: 10m
        env:
-        - name: LOG_LEVEL
-          value: "{{ .Values.kerberospipeline.thumbnail.logLevel }}"
-        {{ if .Values.isPrivate }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "true"
-        {{ else }}
-        - name: KERBEROS_PRIVATE_CLOUD
-          value: "false"
-        {{ end }}
        - name: CLOUD_PROVIDER
          value: "{{ .Values.cloudProvider }}"
        - name: QUEUE_SYSTEM
@@ -76,67 +46,4 @@ spec:
        - name: KAFKA_MECHANISM
          value: "{{ .Values.kafka.mechanism }}"
        - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
-
-        # RabbitMQ settings
-        - name: RABBITMQ_HOST
-          value: "{{ .Values.rabbitmq.host }}"
-        - name: RABBITMQ_EXCHANGE
-          value: "{{ .Values.rabbitmq.exchange }}"
-        - name: RABBITMQ_USERNAME
-          value: "{{ .Values.rabbitmq.username }}"
-        - name: RABBITMQ_PASSWORD
-          value: "{{ .Values.rabbitmq.password }}"
-        {{- with .Values.kerberospipeline.thumbnail.prefetchCount }}
-        - name: RABBITMQ_PREFETCH_COUNT
-          value: {{ . | quote }}
-        {{- end }}
-
-        # Thumbnail generation
-        - name: THUMBNAIL_QUALITY
-          value: "{{ .Values.kerberospipeline.thumbnail.quality }}"
-        - name: THUMBNAIL_WIDTH
-          value: "{{ .Values.kerberospipeline.thumbnail.width }}"
-        - name: THUMBNAIL_HEIGHT
-          value: "{{ .Values.kerberospipeline.thumbnail.height }}"
-
-        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
-        # This will lower storage in mongodb.
-        - name: THUMBNAIL_VAULT_ENABLED
-          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
-        - name: VAULT_THUMBNAIL_PROVIDER
-          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
-        - name: VAULT_THUMBNAIL_ACCESS_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
-        - name: VAULT_THUMBNAIL_SECRET_KEY
-          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
-        
-        {{- if .Values.opentelemetry.enabled }}
-        # Open Telemetry tracing
-        - name: OTEL_EXPORTED_OTLP_ENABLED
-          value: "{{ .Values.opentelemetry.enabled }}"
-        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
-          value: "{{ .Values.opentelemetry.routingEnabled }}"
-        - name: OTEL_EXPORTER_OTLP_ENDPOINT
-          value: "{{ .Values.opentelemetry.collector.endpoint }}"
-        {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
-        {{- end }}
-
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: pipe-thumbnail
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: pipe-thumbnail
-    service: pipe
-spec:
-  ports:
-    - name: hub-metrics
-      port: 8080
-      targetPort: 8080
-      protocol: TCP
-  selector:
-    app: pipe-thumbnail
-{{- end }}
+          value: "{{ .Values.kafka.security }}"
@@ -1,18 +0,0 @@
-{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
-apiVersion: monitoring.coreos.com/v1
-kind: ServiceMonitor
-metadata:
-  name: hub-metrics-servicemonitor
-  namespace: {{ .Release.Namespace }}
-  labels:
-    service: pipe
-    release: prometheus
-spec:
-  selector:
-    matchLabels:
-      service: pipe
-  endpoints:
-    - port: hub-metrics
-      interval: 15s
-      path: /metrics
-{{- end }}
@@ -1,10 +1,7 @@
-# If .Values.kerberoshub.forwarder.enabled is set to true 
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: vault-forwarder
-  namespace: {{ .Release.Namespace }}
 spec:
  replicas: 1
  selector:
@@ -18,8 +15,6 @@ spec:
      maxSurge: 1
  template:
    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
      labels:
        app: vault-forwarder
    spec:
@@ -27,50 +22,35 @@ spec:
      imagePullSecrets:
        {{- toYaml . | nindent 8 }}
      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.forwarder.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
      containers:
        - name: vault-forwarder
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
+          image: "{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
          resources:
            requests:
              memory: 10Mi
              cpu: 10m
-          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-          - configMapRef:
-              name: mongodb-config
          env:
-          {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
-          - name: ITERATION_SPEED
-            value: "5"
-          - name: BUFFER_TIME
-            value: "3"
-          - name: MQTT_URI
-            value: "{{ .Values.mqtt.host }}"
-          - name: MQTT_USERNAME
-            value: "{{ .Values.mqtt.username }}"
-          - name: MQTT_PASSWORD
-            value: "{{ .Values.mqtt.password }}"
-{{- end }}
+            - name: ITERATION_SPEED
+              value: "5"
+            - name: BUFFER_TIME
+              value: "3"
+            # Mongodb
+            - name: MONGODB_DATABASE_CLOUD
+              value: "Kerberos"
+            - name: MONGODB_HOST
+              value: "{{ .Values.mongodb.host }}"
+            - name: MONGODB_DATABASE_CREDENTIALS
+              value: "{{ .Values.mongodb.adminDatabase }}"
+            - name: MONGODB_USERNAME
+              value: "{{ .Values.mongodb.username }}"
+            - name: MONGODB_PASSWORD
+              value: "{{ .Values.mongodb.password }}"
+
+            # Mqtt (VERNEMQ)
+            - name: MQTT_URI
+              value: "{{ .Values.mqtt.host }}"
+            - name: MQTT_USERNAME
+              value: "{{ .Values.mqtt.username }}"
+            - name: MQTT_PASSWORD
+              value: "{{ .Values.mqtt.password }}"
@@ -1,11 +1,9 @@
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
  name: vault-proxy
-  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: {{ .Values.kerberoshub.proxy.replicas }}
+  replicas: 3
  selector:
    matchLabels:
      app: vault-proxy
@@ -20,32 +18,16 @@ spec:
      labels:
        app: vault-proxy
    spec:
-      {{- with .Values.imagePullSecrets }}
      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
+        - name: regcred
      containers:
        - name: vault-proxy
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
+          image: "{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
          imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
-          {{- with .Values.kerberoshub.proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
          ports:
            - containerPort: 8080
              name: http
          env:
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.proxy.logLevel }}"
            # Kerberos Hub API
            - name: KERBEROS_API_CHECK_SUBSCRIPTION
              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
@@ -63,7 +45,6 @@ apiVersion: v1
 kind: Service
 metadata:
  name: vault-proxy-svc
-  namespace: {{ .Release.Namespace }}
  labels:
    app: vault-proxy-svc
 spec:
@@ -75,4 +56,3 @@ spec:
      name: http
  selector:
    app: vault-proxy
-{{- end }}
@@ -0,0 +1,24 @@
+dashboard:
+  enabled: true
+  domain: yourdomain.com
+  serviceType: NodePort
+rbac:
+    enabled: true
+ssl:
+  enabled: true
+  enforced: true
+  permanentRedirect: true
+acme:
+  enabled: true
+  challengeType: "dns-01"
+  email: ...
+  caServer: https://acme-v02.api.letsencrypt.org/directory
+  domains:
+    enabled: true
+    domainsList:
+      - main: "*.yourdomain.com"
+  dnsProvider:
+    name: cloudflare
+    cloudflare:
+      CLOUDFLARE_EMAIL: youremail
+      CLOUDFLARE_API_KEY: yourpassword
@@ -1,146 +0,0 @@
-{
-  "$schema": "http://json-schema.org/draft-07/schema#",
-  "type": "object",
-  "properties": {
-    "classificationCatalogExistingConfigMap": {
-      "type": "string",
-      "maxLength": 253,
-      "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
-    },
-    "classificationCatalog": {
-      "type": ["array", "null"],
-      "minItems": 1,
-      "description": "Optional inline classification catalog in the Hub shared choice catalog format; replaces the bundled defaults in the chart's classification-catalog ConfigMap. Omit (or null) for the bundled defaults. Keys must be unique (checked when rendering).",
-      "items": {
-        "type": "object",
-        "additionalProperties": false,
-        "required": ["key", "label"],
-        "properties": {
-          "key": {"type": "string", "minLength": 1},
-          "label": {"type": "string", "minLength": 1},
-          "icon": {"type": "string", "minLength": 1}
-        }
-      }
-    },
-    "deviceTags": {
-      "type": "object",
-      "additionalProperties": false,
-      "properties": {
-        "system": {
-          "type": "object",
-          "additionalProperties": false,
-          "properties": {
-            "enabled": {
-              "type": "boolean",
-              "description": "Owners may assign system tags and global workflows may select devices by them. Only for deployments whose owners are trusted (self-hosted)."
-            },
-            "catalog": {
-              "type": "array",
-              "description": "The system tags owners can assign, in the Hub shared choice catalog format (key, label) plus an optional description. Keys must be unique (checked when rendering).",
-              "items": {
-                "type": "object",
-                "additionalProperties": false,
-                "required": ["key", "label"],
-                "properties": {
-                  "key": {
-                    "type": "string",
-                    "maxLength": 64,
-                    "pattern": "^[a-z0-9]([a-z0-9._:-]*[a-z0-9])?$"
-                  },
-                  "label": {"type": "string", "minLength": 1},
-                  "description": {"type": "string"}
-                }
-              }
-            }
-          }
-        }
-      }
-    },
-    "kerberoshub": {
-      "type": "object",
-      "properties": {
-        "api": {
-          "type": "object",
-          "properties": {
-            "corsAllowedOrigins": {
-              "type": "array",
-              "items": {
-                "type": "string",
-                "pattern": "^https?://[^/?#]+$"
-              }
-            }
-          }
-        }
-      }
-    },
-    "workflowConfiguration": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["enabled"],
-      "not": {
-        "allOf": [
-          {"anyOf": [{"required": ["includeDefaults"]}, {"required": ["configMaps"]}]},
-          {"anyOf": [{"required": ["existingConfigMap"]}, {"required": ["items"]}, {"required": ["extraConfigMaps"]}]}
-        ]
-      },
-      "properties": {
-        "enabled": {"type": "boolean"},
-        "includeDefaults": {
-          "type": "boolean",
-          "description": "Include bundled files not explicitly replaced by configMaps items; true when omitted."
-        },
-        "configMaps": {
-          "type": "array",
-          "items": {"$ref": "#/definitions/configMapSource"},
-          "description": "Add files or explicitly replace a bundled file using replace: true on an item."
-        },
-        "extraConfigMaps": {
-          "type": "array",
-          "description": "Legacy additive sources; use configMaps for new deployments.",
-          "items": {"$ref": "#/definitions/configMapSource"}
-        },
-        "existingConfigMap": {
-          "type": "string",
-          "maxLength": 253,
-          "pattern": "^$|^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
-        },
-        "items": {
-          "type": "array",
-          "items": {"$ref": "#/definitions/configMapItem"}
-        }
-      }
-    }
-  },
-  "definitions": {
-    "configMapSource": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["name", "items"],
-      "properties": {
-        "name": {
-          "type": "string",
-          "maxLength": 253,
-          "pattern": "^[a-z0-9]([-a-z0-9]*[a-z0-9])?(\\.[a-z0-9]([-a-z0-9]*[a-z0-9])?)*$"
-        },
-        "items": {
-          "type": "array",
-          "minItems": 1,
-          "items": {"$ref": "#/definitions/configMapItem"}
-        }
-      }
-    },
-    "configMapItem": {
-      "type": "object",
-      "additionalProperties": false,
-      "required": ["key", "path"],
-      "properties": {
-        "key": {"type": "string", "pattern": "^[A-Za-z0-9._-]+$"},
-        "path": {"type": "string", "pattern": "^(workflow-contracts|catalogs)/[A-Za-z0-9_-][A-Za-z0-9._-]*\\.(yaml|json)$"},
-        "replace": {
-          "type": "boolean",
-          "description": "Replace this whole bundled file, not individual fields/entries. Requires configMaps and includeDefaults: true; the path must identify a bundled file."
-        }
-      }
-    }
-  }
-}
@@ -0,0 +1,243 @@
+# Default values for vernemq.
+# This is a YAML-formatted file.
+# Declare variables to be passed into your templates.
+
+replicaCount: 1
+
+image:
+  repository: vernemq/vernemq
+  tag: 1.12.3-alpine
+
+  pullPolicy: IfNotPresent
+
+nameOverride: ""
+fullnameOverride: ""
+
+serviceMonitor:
+  create: false
+  labels: {}
+
+service:
+  # Can be disabled if more advanced use cases require more complex setups, e.g., combining LoadBalancer and ClusterIP for internal and external access. See also issue #274.
+  enabled: true
+  # NodePort - Listen to a port on nodes and forward to the service.
+  # ClusterIP - Listen on the service internal to the cluster only.
+  # LoadBalancer - Create a LoadBalancer in the cloud provider and forward to the service.
+  type: LoadBalancer
+#  clusterIP: 10.1.2.4
+#  externalIPs: []
+#  loadBalancerIP: 10.1.2.4
+#  loadBalancerSourceRanges: []
+#  externalTrafficPolicy: Local
+#  sessionAffinity: None
+#  sessionAffinityConfig: {}
+  mqtt:
+    enabled: true
+    port: 1883
+    # This is the port used by nodes to expose the service
+    nodePort: 1883
+  mqtts:
+    enabled: true
+    port: 8883
+    # This is the port used by nodes to expose the service
+    nodePort: 8883
+  ws:
+    enabled: true
+    port: 8080
+    # This is the port used by nodes to expose the service
+    nodePort: 8080
+  wss:
+    enabled: true
+    port: 8443
+    # This is the port used by nodes to expose the service
+    nodePort: 8443
+  annotations: {}
+  labels: {}
+
+## Ingress can optionally be applied when enabling the MQTT websocket service
+## This allows for an ingress controller to route web ports and arbitrary hostnames
+## and paths to the websocket service as well as allow the controller to handle TLS
+## termination for the websocket traffic. Ingress is only possible for traffic exchanged
+## over HTTP, so ONLY the websocket service take advantage of ingress.
+ingress:
+  className: ""
+  enabled: false
+
+  labels: {}
+
+  annotations: {}
+
+  ## Hosts must be provided if ingress is enabled.
+  ##
+  hosts: []
+    # - vernemq.domain.com
+
+  ## Paths to use for ingress rules.
+  ##
+  paths:
+    - path: /
+      pathType: ImplementationSpecific
+      
+
+  ## TLS configuration for ingress
+  ## Secret must be manually created in the namespace
+  ##
+  tls: []
+  # - secretName: vernemq-tls
+  #   hosts:
+  #   - vernemq.domain.com
+
+## VerneMQ resources requests and limits
+## Ref: http://kubernetes.io/docs/user-guide/compute-resources
+resources: {}
+  ## We usually recommend not to specify default resources and to leave this as a conscious
+  ## choice for the user. This also increases chances charts run on environments with little
+  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
+  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
+#  limits:
+#    cpu: 1
+#    memory: 256Mi
+#  requests:
+#    cpu: 1
+#    memory: 256Mi
+
+## Node labels for pod assignment
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
+nodeSelector: {}
+
+## Node tolerations for pod assignment
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
+tolerations: []
+
+## Pod affinity
+## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
+podAntiAffinity: soft
+
+securityContext:
+  runAsUser: 10000
+  runAsGroup: 10000
+  fsGroup: 10000
+
+## If RBAC is enabled on the cluster,VerneMQ needs a service account
+## with permissisions sufficient to list pods
+rbac:
+  create: true
+  serviceAccount:
+    create: true
+    ## Service account name to be used.
+    ## If not set and serviceAccount.create is true a name is generated using the fullname template.
+#    name:
+
+persistentVolume:
+  ## If true, VerneMQ will create/use a Persistent Volume Claim
+  ## If false, use local directory
+  enabled: false
+
+  ## VerneMQ data Persistent Volume access modes
+  ## Must match those of existing PV or dynamic provisioner
+  ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
+  accessModes:
+    - ReadWriteOnce
+
+  ## VerneMQ data Persistent Volume size
+  size: 5Gi
+
+  ## VerneMQ data Persistent Volume Storage Class
+  ## If defined, storageClassName: <storageClass>
+  ## If set to "-", storageClassName: "", which disables dynamic provisioning
+  ## If undefined (the default) or set to null, no storageClassName spec is
+  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
+  ##   GKE, AWS & OpenStack)
+#  storageClass: ""
+
+  ## Annotations for Persistent Volume Claim
+  annotations: {}
+
+extraVolumeMounts: []
+## Additional volumeMounts to the pod.
+#  - name: additional-volume-mount
+#    mountPath: /var/additional-volume-path
+
+extraVolumes: []
+## Additional volumes to the pod.
+#  - name: additional-volume
+#    emptyDir: {}
+
+# A list of secrets and their paths to mount inside the pod
+# This is useful for mounting certificates for security (tls)
+secretMounts:
+  - name: vernemq-certificates
+    secretName: vernemq-certificates-secret
+    path: /etc/ssl/vernemq
+
+statefulset:
+  ## Start and stop pods in Parallel or OrderedReady (one-by-one.)  Note - Can not change after first release.
+  ## Ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
+  podManagementPolicy: OrderedReady
+  ## Statefulsets rolling update update strategy
+  ## Ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#rolling-update
+  updateStrategy: RollingUpdate
+  ## Configure how much time VerneMQ takes to move offline queues to other nodes
+  ## Ref: https://vernemq.com/docs/clustering/#detailed-cluster-leave-case-a-make-a-live-node-leave
+  terminationGracePeriodSeconds: 60
+  ## Liveness and Readiness probe values
+  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes
+  livenessProbe:
+    initialDelaySeconds: 90
+    periodSeconds: 10
+    timeoutSeconds: 5
+    successThreshold: 1
+    failureThreshold: 3
+  readinessProbe:
+    initialDelaySeconds: 90
+    periodSeconds: 10
+    timeoutSeconds: 5
+    successThreshold: 1
+    failureThreshold: 3
+  podAnnotations: {}
+#    prometheus.io/scrape: "true"
+#    prometheus.io/port: "8888"
+  annotations: {}
+  labels: {}
+  lifecycle: {}
+
+pdb:
+  enabled: false
+  minAvailable: 1
+  # maxUnavailable: 1
+
+## VerneMQ settings
+
+additionalEnv:
+  - name: DOCKER_VERNEMQ_ALLOW_REGISTER_DURING_NETSPLIT
+    value: "on"
+  - name: DOCKER_VERNEMQ_ALLOW_PUBLISH_DURING_NETSPLIT
+    value: "on"
+  - name: DOCKER_VERNEMQ_ALLOW_SUBSCRIBE_DURING_NETSPLIT
+    value: "on"
+  - name: DOCKER_VERNEMQ_ALLOW_UNSUBSCRIBE_DURING_NETSPLIT
+    value: "on"
+  - name: DOCKER_VERNEMQ_ACCEPT_EULA
+    value: "yes"
+  - name: DOCKER_VERNEMQ_ALLOW_ANONYMOUS
+    value: "off"
+  - name: DOCKER_VERNEMQ_USER_YOURUSERNAME
+    value: "yourpassword"
+  - name: DOCKER_VERNEMQ_LISTENER__SSL__CAFILE
+    value: "/etc/ssl/vernemq/tls.crt"
+  - name: DOCKER_VERNEMQ_LISTENER__SSL__CERTFILE
+    value: "/etc/ssl/vernemq/tls.crt"
+  - name: DOCKER_VERNEMQ_LISTENER__SSL__KEYFILE
+    value: "/etc/ssl/vernemq/tls.key"
+  - name: DOCKER_VERNEMQ_LISTENER__WSS__CAFILE
+    value: "/etc/ssl/vernemq/tls.crt"
+  - name: DOCKER_VERNEMQ_LISTENER__WSS__CERTFILE
+    value: "/etc/ssl/vernemq/tls.crt"
+  - name: DOCKER_VERNEMQ_LISTENER__WSS__KEYFILE
+    value: "/etc/ssl/vernemq/tls.key"
+
+envFrom: []
+# add additional environment variables e.g. from a configmap or secret
+# can be usefull if you wanna use authentication via files
+#  - secretRef:
+#      name: vernemq-users
@@ -0,0 +1,11 @@
+apiVersion: cert-manager.io/v1
+kind: Certificate
+metadata:
+  name: vernemq-certificates
+spec:
+  dnsNames:
+   - "mqtt.yourdomain.com"
+  issuerRef:
+    kind: ClusterIssuer
+    name: vernemq-letsencrypt-iss
+  secretName: vernemq-certificates-secret
@@ -0,0 +1,18 @@
+apiVersion: cert-manager.io/v1
+kind: ClusterIssuer
+metadata:
+  name: vernemq-letsencrypt-iss
+spec:
+  acme:
+    email: xxx@xxx.io
+    server: https://acme-v02.api.letsencrypt.org/directory
+    privateKeySecretRef:
+      name: vernemq-letsencrypt-iss-key
+    solvers:
+      - selector: {}
+        dns01:
+          cloudflare:
+            email: xxx@xxx.io
+            apiKeySecretRef:
+              name: cloudflare-api-key-secret
+              key: api-key
@@ -0,0 +1,7 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: cloudflare-api-key-secret
+type: Opaque
+stringData:
+  api-key: xxxx
@@ -1,81 +0,0 @@
-#!/usr/bin/env bash
-set -euo pipefail
-
-CHART_DIR="${1:-charts/hub}"
-
-# Supply per-service test overrides without requiring a separate values file.
-WAVE_FLAGS=()
-for setting in event:10 notify:20 throttler:30 analysis:40 thumbnail:50 sprite:50 dominantColor:50 counting:50 sequence:60 monitor:70; do
-  service="${setting%%:*}"
-  wave="${setting#*:}"
-  WAVE_FLAGS+=(--set-string "kerberospipeline.${service}.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=${wave}")
-done
-
-# Only read Deployment metadata, never pod-template or Service annotations.
-extract_waves() {
-  awk '
-    /^---/ { deployment=0; metadata=0; name="" }
-    /^kind: Deployment$/ { deployment=1 }
-    /^metadata:$/ { metadata=1; next }
-    /^[^ #]/ { metadata=0 }
-    deployment && metadata && /^  name:/ { name=$2 }
-    deployment && metadata && /^    argocd.argoproj.io\/sync-wave:/ {
-      value=$2
-      gsub(/"/, "", value)
-      print name, value
-    }
-  ' | sort
-}
-
-assert_waves() {
-  local rendered="$1"
-  local expected="$2"
-  local actual
-  actual="$(printf '%s\n' "$rendered" | extract_waves)"
-  if [[ "$actual" != "$expected" ]]; then
-    printf 'Unexpected Deployment waves:\n%s\nExpected:\n%s\n' "$actual" "$expected" >&2
-    return 1
-  fi
-  local all_count expected_count
-  all_count="$(printf '%s\n' "$rendered" | grep -c 'argocd.argoproj.io/sync-wave:' || true)"
-  expected_count="$(printf '%s\n' "$expected" | awk 'NF { count++ } END { print count+0 }')"
-  if [[ "$all_count" != "$expected_count" ]]; then
-    echo "Sync-wave annotation leaked outside expected Deployment metadata" >&2
-    return 1
-  fi
-}
-
-expected="$(printf '%s\n' \
-  'pipe-event 10' 'pipe-notify 20' 'pipe-throttler 30' 'pipe-analysis 40' \
-  'pipe-thumbnail 50' 'pipe-sprite 50' 'pipe-dominantcolor 50' \
-  'pipe-counting 50' 'pipe-sequence 60' 'pipe-monitor 70' | sort)"
-
-for mode in all pipeline; do
-  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
-  assert_waves "$default_render" ""
-  if printf '%s\n' "$default_render" | grep -q '^  annotations: null'; then
-    echo "Empty annotations must be omitted" >&2
-    exit 1
-  fi
-  configured_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set "mode=$mode" --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
-  assert_waves "$configured_render" "$expected"
-  echo "OK ($mode): defaults opt out; per-service values assign all ten Deployment waves"
-done
-
-disabled_optional="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=pipeline)"
-assert_waves "$disabled_optional" "$(printf '%s\n' "$expected" | grep -v -e '^pipe-sprite ' -e '^pipe-dominantcolor ')"
-
-ui_render="$(helm template hub "$CHART_DIR" "${WAVE_FLAGS[@]}" --set mode=ui --set kerberospipeline.sprite.enabled=true --set kerberospipeline.dominantColor.enabled=true)"
-assert_waves "$ui_render" ""
-
-# Exercise zero/negative strings and an unrelated annotation on the same map.
-for wave in 0 -10; do
-  override="$(helm template hub "$CHART_DIR" --set mode=pipeline \
-    --set-string "kerberospipeline.event.deploymentAnnotations.argocd\\.argoproj\\.io/sync-wave=$wave" \
-    --set-string 'kerberospipeline.event.deploymentAnnotations.example\.com/owner=queue-team')"
-  assert_waves "$override" "pipe-event $wave"
-  printf '%s\n' "$override" | grep -q "^    argocd.argoproj.io/sync-wave: \"$wave\"$"
-  printf '%s\n' "$override" | grep -q '^    example.com/owner: queue-team$'
-done
-
-echo "All pipeline Deployment annotation checks passed."
Author	SHA1	Message	Date
KilianBoute	7b6316c626	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-19 16:22:46 +00:00
KilianBoute	d6e7c82696	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-19 13:24:16 +00:00
KilianBoute	d70b29727a	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-19 13:14:38 +00:00
KilianBoute	2d3b2e0ddc	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-16 11:57:54 +00:00
KilianBoute	7548d38583	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-14 12:52:39 +00:00
KilianBoute	046f8f7ae9	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-14 12:35:50 +00:00
KilianBoute	f259f1ea30	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-13 11:17:59 +00:00
KilianBoute	5ba937d45e	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-13 10:23:40 +00:00
cedricve	064dbb25d9	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-10-10 11:24:32 +00:00
KilianBoute	669c2d14db	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-08 14:51:52 +00:00
KilianBoute	b0fe25f96f	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-08 06:46:21 +00:00
KilianBoute	d5424c0f8d	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-06 09:39:34 +00:00
KilianBoute	d7de61c369	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-06 07:19:13 +00:00
cedricve	6391d8cf19	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-10-05 19:48:47 +00:00
cedricve	eb5a06af84	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-10-05 15:17:15 +00:00
KilianBoute	c002d69e0b	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-10-05 14:41:00 +00:00
KilianBoute	ffde7cce09	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-29 14:15:17 +00:00
cedricve	4ad6389587	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-09-28 15:18:00 +00:00
cedricve	8a02a4984f	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-09-25 14:26:28 +00:00
cedricve	a7a4fa9dd7	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-09-21 19:40:35 +00:00
KilianBoute	e492051936	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-21 15:44:20 +00:00
KilianBoute	5378e29466	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-21 14:18:45 +00:00
KilianBoute	468a54daac	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-21 10:08:50 +00:00
KilianBoute	ef3d12fc6d	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-16 06:53:33 +00:00
KilianBoute	05f0a8f9a9	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-15 15:08:04 +00:00
KilianBoute	f5f9fb6144	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-15 09:54:21 +00:00
KilianBoute	ab352180bb	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-14 14:24:54 +00:00
KilianBoute	e6ecc06796	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-11 14:16:00 +00:00
KilianBoute	3e37aac800	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-11 08:53:44 +00:00
KilianBoute	512e727c1d	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-09 09:58:14 +00:00
KilianBoute	8a6f94c95a	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-07 14:20:16 +00:00
KilianBoute	6c43e36b3b	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-09-04 14:45:48 +00:00
cedricve	8ae80b9309	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-09-01 14:19:07 +00:00
KilianBoute	25e5cd6529	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-28 15:18:51 +00:00
KilianBoute	71df96b6f7	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-28 14:13:08 +00:00
KilianBoute	79411e36ee	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-24 11:02:32 +00:00
KilianBoute	a5c8e8fc89	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-24 09:28:45 +00:00
cedricve	31568ae802	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-08-20 20:11:03 +00:00
cedricve	5034d90e7d	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-08-20 19:44:46 +00:00
cedricve	639d2c1833	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-08-11 20:01:53 +00:00
cedricve	c13574d9b4	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-08-11 12:14:47 +00:00
KilianBoute	994da19ab7	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-10 10:36:43 +00:00
cedricve	be90f14f48	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-08-05 20:43:00 +00:00
KilianBoute	11d97f2b19	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-05 16:07:33 +00:00
KilianBoute	ec9fccce4c	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-08-05 11:03:59 +00:00
cedricve	1ad2e8bd9c	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-07-31 13:35:15 +00:00
cedricve	f06b24ecf6	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-07-16 09:29:33 +00:00
KilianBoute	33ea73df30	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-07-10 17:22:38 +00:00
KilianBoute	4ed4b8bb59	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-07-08 13:06:09 +00:00
KilianBoute	c3e814f7a0	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-07-07 13:10:12 +00:00
KilianBoute	b09649a0e5	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-06-25 16:43:30 +00:00
cedricve	1e89b57299	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-06-17 09:56:49 +00:00
cedricve	31da9180f3	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-06-16 07:39:52 +00:00
cedricve	29703cc938	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-06-02 18:40:53 +00:00
cedricve	b2907247f4	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-06-01 07:50:19 +00:00
KilianBoute	fbbe663070	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-05-29 15:03:12 +00:00
cedricve	0883f7cbe1	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-05-26 13:21:16 +00:00
cedricve	0dca2dbc39	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-05-26 13:13:29 +00:00
cedricve	39e18e5130	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-05-25 19:26:15 +00:00
cedricve	4e830a83dc	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-05-22 14:36:04 +00:00
KilianBoute	ac5c4663bc	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2026-05-13 10:04:34 +00:00
cedricve	82f46f753a	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-05-06 18:49:36 +00:00
cedricve	809e6000c7	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-04-03 08:06:37 +00:00
cedricve	3970c096d3	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-04-03 07:55:20 +00:00
cedricve	e4ff457518	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-28 11:34:17 +00:00
cedricve	3fc697c1bb	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-28 11:12:01 +00:00
cedricve	d5b3f0fd7d	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-28 10:56:17 +00:00
cedricve	a89b20ea28	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-23 08:40:17 +00:00
cedricve	ab9b26b8c8	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-07 21:07:48 +00:00
cedricve	f32968dfb6	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2026-03-02 10:58:46 +00:00
cedricve	68c8f2098b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-12-12 15:42:54 +00:00
cedricve	2e65f5f525	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-12-09 16:08:01 +00:00
cedricve	b1403e6f55	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-11-26 12:53:52 +00:00
cedricve	f74a2d9e32	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-10-03 05:37:48 +00:00
cedricve	00aad660cd	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-08-29 12:43:54 +00:00
KilianBoute	a48a42b1b9	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2025-08-12 11:35:54 +00:00
cedricve	fb3fa1cd6e	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-08-04 12:46:56 +00:00
KilianBoute	a1b9f3aaa3	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2025-07-08 07:41:42 +00:00
KilianBoute	3f7c2c9ac7	Update index.yaml Signed-off-by: KilianBoute <KilianBoute@users.noreply.github.com>	2025-07-04 11:13:42 +00:00
cedricve	b7d7ef11c3	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-06-24 05:59:41 +00:00
cedricve	6b731cfd82	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-04-29 12:13:07 +00:00
cedricve	a0fd4b2dfd	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-25 11:29:17 +00:00
cedricve	75f6a67ab6	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-07 16:29:26 +00:00
cedricve	81c85cd055	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-07 16:14:20 +00:00
cedricve	3cc4f656f8	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-07 13:19:08 +00:00
cedricve	9e5585ae4b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-07 12:43:13 +00:00
cedricve	c0034c1c0b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2025-03-06 12:13:29 +00:00
cedricve	69e98bbf78	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-12-02 11:57:10 +00:00
cedricve	80307ec014	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-12-02 10:42:26 +00:00
cedricve	7076529fc0	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-12-02 10:23:10 +00:00
cedricve	4806b8b70f	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-11-27 13:24:51 +00:00
cedricve	6251179997	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-11-26 15:54:36 +00:00
cedricve	e27b70ac48	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-11-20 14:15:35 +00:00
cedricve	13c276f822	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-31 15:42:49 +00:00
cedricve	f3f6c16c09	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-31 15:01:28 +00:00
cedricve	a191c1c17d	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-31 11:57:03 +00:00
cedricve	0f7eef7a24	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 21:31:41 +00:00
cedricve	5fff034d94	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 21:23:05 +00:00
cedricve	de6ea7bab5	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 21:17:05 +00:00
cedricve	0952831fd9	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 21:05:49 +00:00
cedricve	780a082633	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 20:47:30 +00:00
cedricve	c49688b488	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 20:43:38 +00:00
cedricve	ead090d25b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-30 20:26:43 +00:00
cedricve	3e38c4ba16	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-04 20:37:20 +00:00
cedricve	66693cdd83	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-04 19:12:39 +00:00
cedricve	949132bbc6	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-04 17:54:28 +00:00
cedricve	5aac27eefb	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-04 12:26:18 +00:00
cedricve	1853a025f4	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-10-03 07:40:20 +00:00
cedricve	b47b02704a	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-09-14 20:36:00 +00:00
cedricve	887745be40	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-07-23 10:50:34 +00:00
cedricve	cdce4589ec	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-07-02 14:55:16 +00:00
cedricve	d18eca00ce	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-06-11 08:28:37 +00:00
cedricve	45ae8aa720	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-05-15 14:14:10 +00:00
cedricve	fcb2f276c7	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-04-24 14:03:08 +00:00
cedricve	646c377ba1	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-03-19 20:39:44 +00:00
cedricve	93b00ba861	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-02-28 18:31:33 +00:00
cedricve	7b75c10c2c	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-02-12 00:24:20 +00:00
cedricve	ae52d08a9b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2024-01-26 19:52:58 +00:00
cedricve	6263c4fb51	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-11-10 14:23:21 +00:00
cedricve	0d6a14c288	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-06-02 14:47:04 +00:00
cedricve	4a5a1cf952	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-04-12 17:31:56 +00:00
cedricve	db8ce43416	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-03-26 18:33:59 +00:00
cedricve	dab6953561	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-03-25 21:20:28 +00:00
cedricve	64e273d56d	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-03-24 11:57:12 +00:00
cedricve	a1aa29e20a	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-03-07 13:34:27 +00:00
cedricve	a09e754de5	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-02-20 10:20:45 +00:00
cedricve	f4f3adc38e	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2023-01-16 07:37:21 +00:00
cedricve	10d00281d0	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-12-10 20:59:50 +00:00
cedricve	c6159ca14a	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-11-17 19:16:02 +00:00
cedricve	daed3b3a9b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-10-21 10:13:44 +00:00
cedricve	d27b9b5407	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-09-29 11:05:50 +00:00
thomasqp	a2eec76b61	Update index.yaml Signed-off-by: thomasqp <thomasqp@users.noreply.github.com>	2022-08-05 09:20:00 +00:00
thomasqp	bb99af95d7	Update index.yaml Signed-off-by: thomasqp <thomasqp@users.noreply.github.com>	2022-07-18 13:34:58 +00:00
thomasqp	7c8a7a4859	Update index.yaml Signed-off-by: thomasqp <thomasqp@users.noreply.github.com>	2022-07-01 06:11:28 +00:00
cedricve	c914a29a5b	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-06-17 18:14:15 +00:00
cedricve	497c3da194	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-06-17 17:58:22 +00:00
Cédric Verstraeten	4ff9375751	Create CNAME	2022-06-13 17:44:27 +02:00
Cédric Verstraeten	f599f4bb08	Delete CNAME	2022-06-13 16:09:01 +02:00
Cédric Verstraeten	3a47a8c7ed	Create CNAME	2022-06-13 15:33:13 +02:00
cedricve	c031b16b32	Update index.yaml Signed-off-by: cedricve <cedricve@users.noreply.github.com>	2022-06-13 13:30:33 +00:00