Bump chart version to 0.148.0 for release

feature/hub-vlm-worker

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.146.0
+version: 0.148.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -313,6 +313,9 @@ spec:
             # workflows (for example the one-stage case redaction modal flow).
             - name: WORKFLOW_STAGE_QUEUES
               value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+            # Stages tenants may place in the workflow editor (see workflows.editorStages).
+            - name: WORKFLOW_EDITOR_STAGES
+              value: {{ .Values.kerberoshub.workflows.editorStages | default list | toJson | quote }}
 
             # Stripe for billing
             - name: STRIPE_KEY

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -59,9 +59,11 @@ use this only to embed the same queue on a synthetic stage.
 {{- define "kerberoshub.workflows.stageQueues" -}}
 {{- $queues := dict -}}
 {{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- if ne $operation "workflows" -}}
 {{- with $service.queue -}}
 {{- $_ := set $queues $operation . -}}
 {{- end -}}
 {{- end -}}
+{{- end -}}
 {{- $queues | toJson -}}
 {{- end -}}

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -18,6 +18,9 @@
   redaction) declares its destination provider with the named field
   services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
   read-only stage omits it and gets no provider env.
+
+  Worker-specific settings go in services.<name>.env (plain values) and
+  services.<name>.secretEnv (references to keys in an existing Secret).
 */ -}}
 {{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
 {{- $root := . -}}
@@ -122,6 +125,19 @@ spec:
         {{- range $key, $value := $svc.env }}
         - name: {{ $key }}
           value: {{ $value | quote }}
+        {{- end }}        {{- with $svc.secretEnv }}
+
+        # Per-stage secret env. Each key under services.<name>.secretEnv maps a
+        # container env var to a key in an existing Kubernetes Secret
+        # ({name, key}), so credentials such as a model API key stay out of
+        # values. The Secret must exist in the release namespace.
+        {{- range $key, $ref := . }}
+        - name: {{ $key }}
+          valueFrom:
+            secretKeyRef:
+              name: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.name is required" $name $key) $ref.name | quote }}
+              key: {{ required (printf "kerberoshub.services.%s.secretEnv.%s.key is required" $name $key) $ref.key | quote }}
+        {{- end }}
         {{- end }}
 ---
 apiVersion: v1

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -75,12 +75,15 @@ spec:
         # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
         # Definitions are the engine's boot-loaded config source and deployment
         # stage catalog. Organisation-scoped database workflows are read per
-        # recording; an in-cluster engine still requires at least one config
-        # definition so an empty catalog cannot silently drop traffic.
+        # recording; an in-cluster engine refuses to start only when both the
+        # config definitions and the stage-queue catalog below are empty.
         - name: WORKFLOWS_QUEUE
           value: "{{ .Values.kerberoshub.services.workflows.queue }}"
         - name: WORKFLOW_DEFINITIONS
           value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+        # Operation→queue catalog so DB workflows reach workers no config workflow references.
+        - name: WORKFLOW_STAGE_QUEUES
+          value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
 
         # RabbitMQ settings
         - name: RABBITMQ_HOST

charts/hub/values.yaml

@@ -828,6 +828,24 @@ kerberoshub:
     #      # (no condition ⇒ gate on the upstream's presence, not a value).
     #      needs:
     #        - operation: objecttracking
+    #vlm-workflow:
+    #  # Describe every recording with the hub-vlm worker (services.vlm below).
+    #  enabled: true
+    #  triggers:
+    #    - type: automatic
+    #  stages:
+    #    - operation: vlm
+    #      dispatch: always
+    # Stages tenants may place on the workflow editor canvas next to the device
+    # node. Each entry needs a deployed worker (services.<operation>.queue);
+    # entries without one are hidden. Empty means the editor offers no stages.
+    editorStages: []
+    #  - operation: vlm
+    #    name: Describe recording
+    #    description: Summarise the recording with a vision language model.
+    #  - operation: forwarder
+    #    name: Forward to my system
+    #    description: Send the result to the external destination configured for the forwarder.
   # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
   # replicas/resources/queue lives here in a single, uniform shape:
   #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -838,6 +856,8 @@ kerberoshub:
   #     Deploying a worker (services.<name>.enabled) is independent from routing
   #     to it (a workflows.definitions stage of the same operation) — it runs only
   #     when its own `enabled` is true AND the workflows engine is enabled.
+  #     Worker-specific settings go in `env` (plain key/values) and `secretEnv`
+  #     (ENV_NAME: {name, key} of an existing Secret, for credentials).
   services:
     # hub-workflows — the workflows engine (orchestrator). Consumes the engine
     # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
@@ -916,6 +936,43 @@ kerberoshub:
           #    requests:
           #      memory: 10Mi
           #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) — hub-vlm (operation "vlm").
+          #
+          # Samples frames from the recording, describes them with an Azure OpenAI
+          # vision model and emits timeline markers plus a recording description.
+          # Route to it with a workflows.definitions stage `- operation: vlm`.
+          # See https://github.com/uug-ai/hub-vlm for every VLM_* / AZURE_OPENAI_*
+          # setting. Create the API key Secret first, e.g.
+          #   kubectl create secret generic hub-vlm-azure-openai \
+          #     --from-literal=apiKey=<azure-openai-api-key>
+          #vlm:
+          #  # Deploy the hub-vlm worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-vlm
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (VLM_QUEUE).
+          #  queue: "hub-vlm-queue"
+          #  env:
+          #    AZURE_OPENAI_ENDPOINT: "https://<resource>.openai.azure.com"
+          #    AZURE_OPENAI_DEPLOYMENT: "gpt-5.4-mini" # Name of the model deployment.
+          #    AZURE_OPENAI_REASONING_EFFORT: "low" # none | minimal | low | medium | high
+          #    VLM_MAX_FRAMES: "8" # Frames sampled per recording (max 32).
+          #    VLM_FRAME_WIDTH: "1024" # Maximum frame width in pixels.
+          #    VLM_SET_DESCRIPTION: "true" # Write the summary to the recording description.
+          #  # The API key is read from an existing Secret, never from values.
+          #  secretEnv:
+          #    AZURE_OPENAI_API_KEY:
+          #      name: hub-vlm-azure-openai
+          #      key: apiKey
+          #  resources:
+          #    requests:
+          #      memory: 128Mi
+          #      cpu: 100m
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent