hub: flag for the Users (preview) organisation tab (0.173.0) (#225)

Adds kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled
(default "false"), setting FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED on the
frontend and the demo frontend.

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.170.1
+version: 0.173.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -792,6 +792,7 @@ kerberospipeline:
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
+| `kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled` | Show the "Users (preview)" tab in organisation settings to organisation owners: a mockup of project, role and resource assignments with mocked users and data, nothing saved. Sets `FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED`. | `"false"` |
 | `kerberoshub.frontend.features.projects.enabled` | Fallback project group switch used when the organisations umbrella is unset. | `""` |
 | `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
 | `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
@@ -901,7 +902,7 @@ kerberospipeline:
 | `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
 | `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
 | `kerberoshub.audit.terminationGracePeriodSeconds` | Pod termination grace period. Keep this longer than `leaseDuration` so an in-flight cycle can finish. | `150` |
-| `kerberoshub.audit.destinations` | Audit destinations. Every entry supports `id`, `type` (`webhook` by default, or `s3`), `enabled`, delivery limits and filters. Webhooks add `url`, public `headers`, `bearerTokenSecret` and arbitrary `secretHeaders`. S3 destinations add `s3.bucket`, `s3.region`, optional `s3.prefix`, `s3.endpoint` and `s3.forcePathStyle` for S3-compatible stores, and an optional `credentialsSecret` (`name`, `accessKeyIdKey`, `secretAccessKeyKey`); without it the pod's AWS identity is used. The bucket must have Object Lock with a `COMPLIANCE` default retention unless `s3.allowUnlockedBucket` is `true` (stores without Object Lock such as Garage; the archive is then deletable). Every field, the delivery semantics and per-provider S3 settings are documented at https://learn.uug.ai/docs/hub/audit-events/#export-audit-events. Destination IDs retain independent checkpoints. | `[]` |
+| `kerberoshub.audit.destinations` | Audit destinations. Every entry supports `id`, `type` (`webhook` by default, or `s3`), `enabled`, delivery limits and filters. Webhooks add `url`, public `headers`, and credentials: `bearerToken` and `secretHeaders.<name>.value`. S3 destinations add `s3.bucket`, `s3.region`, optional `s3.prefix`, `s3.endpoint` and `s3.forcePathStyle` for S3-compatible stores, and credentials `s3.accessKey` / `s3.secretKey`; without credentials the pod's AWS identity is used (AWS S3 only). Credentials are set inline: the chart stores them in a Secret named `hub-audit-<id>-credentials` and mounts it into hub-audit, and changed values are picked up within a minute without a restart. To keep credentials out of the values, reference an existing Secret instead: `bearerTokenSecret` (`name`, `key`), `secretHeaders.<name>` (`secretName`, `secretKey`) or `credentialsSecret` (`name`, `accessKeyIdKey`, `secretAccessKeyKey`; the key fields name keys inside the Secret, not credentials). `credentialsSecret.create: true` with `accessKeyId` / `secretAccessKey` (chart 0.171.0) still works and is equivalent to `s3.accessKey` / `s3.secretKey`. Helm does not adopt resources it did not create, so delete a hand-made Secret before letting the chart create one with the same name. The bucket must have Object Lock with a `COMPLIANCE` default retention unless `s3.allowUnlockedBucket` is `true` (stores without Object Lock such as Garage; the archive is then deletable). Every field, the delivery semantics and per-provider S3 settings are documented at https://learn.uug.ai/docs/hub/audit-events/#export-audit-events. Destination IDs retain independent checkpoints. | `[]` |
 | `kerberoshub.audit.serviceAccount.create` | Create a ServiceAccount used only by hub-audit, for example for S3 access through IRSA. | `false` |
 | `kerberoshub.audit.serviceAccount.name` | Name of the hub-audit ServiceAccount; with `create: false`, an existing ServiceAccount to use. Defaults to `hub-audit` when created; when empty and not created, `kerberoshub.serviceAccount` applies. | `""` |
 | `kerberoshub.audit.serviceAccount.annotations` | Annotations for the hub-audit ServiceAccount, such as `eks.amazonaws.com/role-arn`. | `{}` |

charts/hub/templates/_helpers.tpl

@@ -106,3 +106,67 @@ Usage: {{- include "hub.opentelemetry.samplerEnv" $ | trim | nindent 8 }}
 {{- end }}
 {{- end }}
 {{- end -}}
+
+{{/*
+hub.audit.destinations resolves the audit destinations into JSON. Inline
+credentials (s3.accessKey / s3.secretKey on S3 destinations, bearerToken and
+secretHeaders.<name>.value on webhooks) are turned into a chart-created Secret named
+hub-audit-<id>-credentials, so every template below reads one shape:
+credentialsSecret / bearerTokenSecret / secretHeaders with create: true and the
+values to store.
+Use: fromJsonArray (include "hub.audit.destinations" .)
+*/}}
+{{- define "hub.audit.destinations" -}}
+{{- $resolved := list -}}
+{{- range $index, $original := .Values.kerberoshub.audit.destinations -}}
+  {{- $destination := deepCopy $original -}}
+  {{- $s3 := default dict $destination.s3 -}}
+  {{- if or $s3.accessKey $s3.secretKey -}}
+    {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+    {{- if not (and $s3.accessKey $s3.secretKey) -}}
+      {{- fail (printf "audit destination %s must set both s3.accessKey and s3.secretKey" $id) -}}
+    {{- end -}}
+    {{- if $destination.credentialsSecret -}}
+      {{- fail (printf "audit destination %s sets s3.accessKey/secretKey and credentialsSecret; use one of them" $id) -}}
+    {{- end -}}
+    {{- $_ := set $destination "credentialsSecret" (dict
+        "name" (printf "hub-audit-%s-credentials" $id)
+        "create" true
+        "accessKeyId" $s3.accessKey
+        "secretAccessKey" $s3.secretKey) -}}
+    {{- $_ := unset $s3 "accessKey" -}}
+    {{- $_ := unset $s3 "secretKey" -}}
+  {{- end -}}
+  {{- if hasKey $destination "bearerToken" -}}
+    {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+    {{- if not $destination.bearerToken -}}
+      {{- fail (printf "audit destination %s sets an empty bearerToken" $id) -}}
+    {{- end -}}
+    {{- if $destination.bearerTokenSecret -}}
+      {{- fail (printf "audit destination %s sets bearerToken and bearerTokenSecret; use one of them" $id) -}}
+    {{- end -}}
+    {{- $_ := set $destination "bearerTokenSecret" (dict
+        "name" (printf "hub-audit-%s-credentials" $id)
+        "key" "bearer-token"
+        "create" true
+        "value" $destination.bearerToken) -}}
+    {{- $_ := unset $destination "bearerToken" -}}
+  {{- end -}}
+  {{- range $header, $secret := (default dict $destination.secretHeaders) -}}
+    {{- if and (kindIs "map" $secret) (hasKey $secret "value") -}}
+      {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
+      {{- if not $secret.value -}}
+        {{- fail (printf "audit destination %s header %s sets an empty value" $id $header) -}}
+      {{- end -}}
+      {{- if or $secret.secretName $secret.secretKey -}}
+        {{- fail (printf "audit destination %s header %s sets value and secretName/secretKey; use one of them" $id $header) -}}
+      {{- end -}}
+      {{- $_ := set $secret "secretName" (printf "hub-audit-%s-credentials" $id) -}}
+      {{- $_ := set $secret "secretKey" (printf "header-%s" (sha256sum $header | trunc 12)) -}}
+      {{- $_ := set $secret "create" true -}}
+    {{- end -}}
+  {{- end -}}
+  {{- $resolved = append $resolved $destination -}}
+{{- end -}}
+{{- toJson $resolved -}}
+{{- end -}}

charts/hub/templates/configMaps/configmap-hub-audit.yaml

@@ -1,7 +1,7 @@
 {{- if .Values.audit.enabled -}}
 {{- $destinations := list -}}
 {{- $destinationIDs := dict -}}
-{{- range $index, $destination := .Values.kerberoshub.audit.destinations -}}
+{{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" .) -}}
   {{- $id := required (printf "id is required for audit destination %d" $index) $destination.id -}}
   {{- if not (regexMatch "^[a-z][a-z0-9-]{0,62}$" $id) -}}
     {{- fail (printf "audit destination id %q must match ^[a-z][a-z0-9-]{0,62}$" $id) -}}
@@ -44,7 +44,7 @@
     {{- end -}}
   {{- else if eq $type "s3" -}}
     {{- if or $destination.url $destination.headers $destination.bearerTokenSecret $destination.secretHeaders -}}
-      {{- fail (printf "audit destination %s is s3 and cannot set url, headers, bearerTokenSecret or secretHeaders" $id) -}}
+      {{- fail (printf "audit destination %s is s3 and cannot set url, headers, bearerToken, bearerTokenSecret or secretHeaders" $id) -}}
     {{- end -}}
     {{- $s3 := required (printf "s3 is required for audit destination %s" $id) $destination.s3 -}}
     {{- $settings := dict
@@ -58,6 +58,9 @@
     {{- $credentials := default dict $destination.credentialsSecret -}}
     {{- if gt (len $credentials) 0 -}}
       {{- $secretName := required (printf "credentialsSecret.name is required for destination %s" $id) $credentials.name -}}
+      {{- if and (not $credentials.create) (or $credentials.accessKeyId $credentials.secretAccessKey) -}}
+        {{- fail (printf "audit destination %s sets credentialsSecret.accessKeyId/secretAccessKey without create: true; set create: true to let the chart create Secret %s from them, or remove them and create the Secret yourself" $id $secretName) -}}
+      {{- end -}}
       {{- $_ := set $settings "accessKeyIdFile" (printf "%s/access-key-id-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "access-key-id" $credentials.accessKeyIdKey)) | trunc 12)) -}}
       {{- $_ := set $settings "secretAccessKeyFile" (printf "%s/secret-access-key-%s" $secretRoot (sha256sum (printf "%s:%s" $secretName (default "secret-access-key" $credentials.secretAccessKeyKey)) | trunc 12)) -}}
     {{- end -}}

charts/hub/templates/kerberos-hub/hub-audit-credentials-secret.yaml

@@ -0,0 +1,54 @@
+{{- if .Values.audit.enabled }}
+{{- /*
+Secrets the chart creates for audit destinations: inline credentials
+(s3.accessKey / s3.secretKey, bearerToken, secretHeaders.<name>.value) and credentialsSecret.create: true.
+Destinations that reference an existing Secret are not rendered here.
+*/}}
+{{- $created := dict }}
+{{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" .) }}
+{{- $data := dict }}
+{{- $name := "" }}
+{{- $credentials := default dict $destination.credentialsSecret }}
+{{- if $credentials.create }}
+{{- $name = required (printf "credentialsSecret.name is required for destination %s" $destination.id) $credentials.name }}
+{{- $accessKeyIdKey := default "access-key-id" $credentials.accessKeyIdKey }}
+{{- $secretAccessKeyKey := default "secret-access-key" $credentials.secretAccessKeyKey }}
+{{- if eq $accessKeyIdKey $secretAccessKeyKey }}
+{{- fail (printf "credentialsSecret.accessKeyIdKey and secretAccessKeyKey must differ for destination %s" $destination.id) }}
+{{- end }}
+{{- $_ := set $data $accessKeyIdKey (required (printf "credentialsSecret.accessKeyId is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.accessKeyId) }}
+{{- $_ := set $data $secretAccessKeyKey (required (printf "credentialsSecret.secretAccessKey is required for destination %s when credentialsSecret.create is true" $destination.id) $credentials.secretAccessKey) }}
+{{- end }}
+{{- $bearer := default dict $destination.bearerTokenSecret }}
+{{- if $bearer.create }}
+{{- $name = $bearer.name }}
+{{- $_ := set $data $bearer.key $bearer.value }}
+{{- end }}
+{{- range $header, $secret := (default dict $destination.secretHeaders) }}
+{{- if $secret.create }}
+{{- $name = $secret.secretName }}
+{{- $_ := set $data $secret.secretKey $secret.value }}
+{{- end }}
+{{- end }}
+{{- if $name }}
+{{- if hasKey $created $name }}
+{{- fail (printf "audit destinations %s and %s both create Secret %q; give each its own credentialsSecret.name, or set create: false on one and reuse the Secret" (get $created $name) $destination.id $name) }}
+{{- end }}
+{{- $_ := set $created $name $destination.id }}
+---
+apiVersion: v1
+kind: Secret
+metadata:
+  name: {{ $name }}
+  namespace: {{ $.Release.Namespace }}
+  labels:
+    app: hub-audit
+    audit-destination: {{ $destination.id }}
+type: Opaque
+stringData:
+  {{- range $key, $value := $data }}
+  {{ $key | quote }}: {{ toString $value | quote }}
+  {{- end }}
+{{- end }}
+{{- end }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-audit.yaml

@@ -43,7 +43,7 @@ spec:
         - name: destinations
           configMap:
             name: hub-audit
-          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" $) }}
       {{- $bearer := default dict $destination.bearerTokenSecret }}
       {{- $secretHeaders := default dict $destination.secretHeaders }}
       {{- $credentials := default dict $destination.credentialsSecret }}
@@ -112,7 +112,7 @@ spec:
             - name: destinations
               mountPath: /etc/hub-audit
               readOnly: true
-          {{- range $index, $destination := .Values.kerberoshub.audit.destinations }}
+          {{- range $index, $destination := fromJsonArray (include "hub.audit.destinations" $) }}
           {{- $bearer := default dict $destination.bearerTokenSecret }}
           {{- $secretHeaders := default dict $destination.secretHeaders }}
           {{- $credentials := default dict $destination.credentialsSecret }}

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -259,6 +259,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
         - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled }}"
         - name: FEATURE_PROJECTS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
         - name: FEATURE_PROJECT_SWITCHER_ENABLED

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -338,6 +338,8 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
         - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_MEMBERS_ACCESS_PREVIEW_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.membersAccessPreviewEnabled }}"
         - name: FEATURE_PROJECTS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
         - name: FEATURE_PROJECT_SWITCHER_ENABLED

charts/hub/values.yaml

@@ -655,6 +655,7 @@ kerberoshub:
         switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
         creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
         settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
+        membersAccessPreviewEnabled: "false" # Show the mocked "Users (preview)" tab in organisation settings to owners 'true' or 'false'
       projects:
         enabled: "" # Fallback project group switch used only when organisations.enabled is empty
         switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
@@ -897,13 +898,20 @@ kerberoshub:
     #   startAt: latest # latest | beginning, applied only on first creation
     #   headers:
     #     X-Source: kerberos-hub
-    #   bearerTokenSecret:
-    #     name: audit-primary-siem
-    #     key: token
+    #   # Inline credentials. The chart stores them in Secret
+    #   # hub-audit-<id>-credentials and mounts them.
+    #   bearerToken: "xxx"
     #   secretHeaders:
     #     X-Api-Key:
-    #       secretName: audit-primary-siem
-    #       secretKey: api-key
+    #       value: "xxx"
+    #   # Or reference an existing Secret instead of the inline values:
+    #   # bearerTokenSecret:
+    #   #   name: audit-primary-siem
+    #   #   key: token
+    #   # secretHeaders:
+    #   #   X-Api-Key:
+    #   #     secretName: audit-primary-siem
+    #   #     secretKey: api-key
     #   filters:
     #     organisationIds: []
     #     projectIds: []
@@ -932,13 +940,18 @@ kerberoshub:
     #     # Only for stores without Object Lock (e.g. Garage): skips the lock
     #     # check, so archived batches are deletable. Needs hub-audit v1.0.10.
     #     allowUnlockedBucket: false
-    #   # Omit credentialsSecret to use the pod's AWS identity (IRSA via
-    #   # kerberoshub.audit.serviceAccount, or an instance profile). That only
-    #   # works for AWS S3; every other store needs credentialsSecret.
-    #   credentialsSecret:
-    #     name: audit-immutable-archive
-    #     accessKeyIdKey: access-key-id
-    #     secretAccessKeyKey: secret-access-key
+    #     # Inline credentials. The chart stores them in Secret
+    #     # hub-audit-<id>-credentials and mounts them.
+    #     accessKey: "xxx"
+    #     secretKey: "xxx"
+    #   # Or reference an existing Secret instead of s3.accessKey/secretKey.
+    #   # accessKeyIdKey/secretAccessKeyKey name keys inside that Secret.
+    #   # credentialsSecret:
+    #   #   name: audit-immutable-archive
+    #   #   accessKeyIdKey: access-key-id
+    #   #   secretAccessKeyKey: secret-access-key
+    #   # Without either, hub-audit uses the pod's AWS identity (IRSA via
+    #   # kerberoshub.audit.serviceAccount, or an instance profile): AWS S3 only.
     # resources:
     #   requests:
     #     memory: 32Mi