docs(hub): refresh i18n examples

fix(frontend): enable remote recording by default

.devcontainer/Dockerfile

@@ -0,0 +1,28 @@
+FROM mcr.microsoft.com/devcontainers/go:1.25-bookworm
+
+# Remove expired Yarn GPG key from base image
+RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
+
+# Remove expired Yarn repository key (inherited from base image)
+RUN sudo rm -f /etc/apt/sources.list.d/yarn.list
+
+# Install AZURE CLI
+RUN curl -sL https://aka.ms/InstallAzureCLIDeb | sudo bash
+
+# Install helm and kubectl
+RUN curl https://raw.githubusercontent.com/helm/helm/master/scripts/get-helm-3 | bash
+RUN curl -LO "https://dl.k8s.io/release/$(curl -L -s https://dl.k8s.io/release/stable.txt)/bin/linux/amd64/kubectl" \
+    && chmod +x ./kubectl \
+    && sudo mv ./kubectl /usr/local/bin/kubectl
+
+# Install Argocd CLI
+RUN VERSION=$(curl -L -s https://raw.githubusercontent.com/argoproj/argo-cd/stable/VERSION)
+RUN curl -sSL -o argocd-linux-amd64 https://github.com/argoproj/argo-cd/releases/download/v$VERSION/argocd-linux-amd64
+RUN sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd
+RUN rm argocd-linux-amd64
+
+# Install google-cloud-sdk
+RUN echo "deb [signed-by=/usr/share/keyrings/cloud.google.gpg] http://packages.cloud.google.com/apt cloud-sdk main" | sudo tee -a /etc/apt/sources.list.d/google-cloud-sdk.list
+RUN curl https://packages.cloud.google.com/apt/doc/apt-key.gpg | sudo gpg --dearmor -o /usr/share/keyrings/cloud.google.gpg
+RUN sudo apt-get update && sudo apt-get install -y google-cloud-cli
+RUN sudo apt-get install google-cloud-cli-gke-gcloud-auth-plugin

.devcontainer/devcontainer.json

@@ -0,0 +1,23 @@
+{
+	"name": "go:1.25-bookworm",
+	"dockerFile": "Dockerfile",
+	"runArgs": [
+		"--name=helm-charts",
+		"--network=host",
+		 "--privileged"
+	],
+	"customizations": {
+		"vscode": {
+			"extensions": [
+				"ms-kubernetes-tools.vscode-kubernetes-tools",
+				"redhat.vscode-yaml",
+				"Tim-Koehler.helm-intellisense",
+				"ms-vscode.azurecli",
+				"ms-vscode-remote.remote-containers",
+				"GitHub.copilot",
+				"ms-kubernetes-tools.vscode-aks-tools",
+				"fabiospampinato.vscode-diff"
+			]
+		}
+	}
+}

.github/workflows/k3d.yaml

@@ -0,0 +1,56 @@
+name: Deploy on k3d
+on:
+  workflow_dispatch:
+  pull_request:
+jobs:
+  deploy:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+        k3d: [v5.7.5]
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+      - name: "Create single cluster"
+        uses: AbsaOSS/k3d-action@v2
+        with:
+          k3d-version: ${{ matrix.k3d }}  
+          cluster-name: "k3d-cluster"
+      - name: Print Kubernetes Version
+        run: |
+          kubectl version
+      - name: Test k3d
+        run: |
+          echo "Sleeping for 120 seconds, give time for the cluster to be ready" && sleep 120
+          kubectl get no
+          kubectl get pods -A -o wide
+          kubectl get sc
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Prometheus operator
+        id: install-prometheus-operator
+        run: |
+          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
+          kubectl get crd
+          kubectl get po -A -o wide
+      - name: Install Hub Helm chart
+        id: install-hub
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          kubectl create namespace kerberos-hub
+          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
+          kubectl get pods -A -o wide
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ K3d deployment successful on ${{ matrix.os }} (${{ matrix.k3d }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ K3d deployment failed on ${{ matrix.os }} (${{ matrix.k3d }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/kind.yaml

@@ -0,0 +1,52 @@
+name: Deploy on kind
+on:
+  workflow_dispatch:
+  pull_request:
+jobs:
+  deploy:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+        kind: [v0.25.0]
+    steps:
+      - name: Create kind
+        uses: helm/kind-action@v1
+        with:
+          version: ${{ matrix.kind }}
+      - name: Print Kubernetes Version
+        run: |
+          kubectl version
+      - name: Test kind
+        run: |
+          kubectl get no
+          kubectl get pods -A -o wide
+          kubectl get sc
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Prometheus operator
+        id: install-prometheus-operator
+        run: |
+          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
+          kubectl get crd
+          kubectl get po -A -o wide
+      - name: Install Hub Helm chart
+        id: install-hub
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          kubectl create namespace kerberos-hub
+          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
+          kubectl get pods -A -o wide
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ Kind deployment successful on ${{ matrix.os }} (${{ matrix.kind }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ Kind deployment failed on ${{ matrix.os }} (${{ matrix.kind }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL

.github/workflows/microk8s.yaml

@@ -0,0 +1,53 @@
+name: Deploy on microk8s
+on:
+  workflow_dispatch:
+  pull_request:
+jobs:
+  deploy:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      matrix:
+        os: [ubuntu-22.04, ubuntu-24.04]
+        microk8s: [1.32/stable]
+    steps:
+      - uses: balchua/microk8s-actions@v0.4.3
+        with:
+          channel: ${{ matrix.microk8s }}
+          addons: '["dns", "dashboard", "hostpath-storage", "nvidia"]'
+      - name: Set permissions
+        run: |
+          sudo chown -f -R $USER $HOME/.kube $HOME/.config
+      - name: Test microk8s
+        id: list-pods
+        run: |
+          kubectl get no
+          kubectl get pods -A -o wide
+      - name: Checkout repository
+        uses: actions/checkout@v2
+      - name: Install Prometheus operator
+        id: install-prometheus-operator
+        run: |
+          kubectl apply -f https://raw.githubusercontent.com/prometheus-operator/prometheus-operator/v0.48.1/bundle.yaml
+          kubectl wait --for=condition=available deployment/prometheus-operator -n default --timeout=300s
+          kubectl get crd
+          kubectl get po -A -o wide
+      - name: Install Hub Helm chart
+        id: install-hub
+        run: |
+          helm repo add kerberos https://charts.kerberos.io
+          kubectl create namespace kerberos-hub
+          helm install hub ./charts/hub --values charts/hub/values.yaml -n kerberos-hub --create-namespace
+          kubectl get pods -A -o wide
+      - name: Send Slack Notification on Success
+        if: success()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"✅ MicroK8s deployment successful on ${{ matrix.os }} (${{ matrix.microk8s }}) - triggered by ${{ github.actor }}\"}" $SLACK_WEBHOOK_URL
+      - name: Send Slack Notification on Failure
+        if: failure()
+        env:
+          SLACK_WEBHOOK_URL: ${{ secrets.SLACK_WEBHOOK_URL }}
+        run: |
+          curl -X POST -H 'Content-type: application/json' --data "{\"text\": \"❌ MicroK8s deployment failed on ${{ matrix.os }} (${{ matrix.microk8s }}) - <${{ github.server_url }}/${{ github.repository }}/actions/runs/${{ github.run_id }}|View logs>\"}" $SLACK_WEBHOOK_URL
+          

.github/workflows/release-create.yaml

@@ -1,9 +1,11 @@
-name: Release Charts
+name: Create a new release
 
 on:
   push:
     branches:
       - main
+    paths:
+      - 'charts/**/Chart.yaml'
 
 jobs:
   release:

.github/workflows/workflows-queue-consistency.yaml

@@ -0,0 +1,31 @@
+name: Workflows queue consistency
+
+# Fails the build if the analysis producer, the workflows engine and the stage
+# workers would render onto different WORKFLOWS_QUEUE names — the silent
+# producer/consumer queue-name drift that leaves runs piling up with no
+# consumer. Pure `helm template` render check, no cluster required.
+on:
+  workflow_dispatch:
+  pull_request:
+    paths:
+      - 'charts/hub/**'
+      - 'scripts/check-workflows-queue-consistency.sh'
+      - '.github/workflows/workflows-queue-consistency.yaml'
+
+permissions:
+  contents: read
+
+jobs:
+  check:
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+
+      - name: Set up Helm
+        uses: azure/setup-helm@v4
+        with:
+          version: v3.16.2
+
+      - name: Check WORKFLOWS_QUEUE consistency
+        run: ./scripts/check-workflows-queue-consistency.sh charts/hub

README.md

@@ -1,19 +1,24 @@
-## Usage
+## Helm charts
 
-[Helm](https://helm.sh) must be installed to use the charts. Please refer to
-Helm's [documentation](https://helm.sh/docs) to get started.
+Kerberos.io ecosystem can be deployed through Helm charts. Use one of the following charts to boost the installation:
+
+- [Hub](https://github.com/kerberos-io/helm-charts/tree/main/charts/hub)
+
+## Prerequisite
+
+[Helm](https://helm.sh) must be installed to use the charts. Please refer to Helm's [documentation](https://helm.sh/docs) to get started.
 
 Once Helm has been set up correctly, add the repo as follows:
 
-helm repo add <alias> https://<orgname>.github.io/helm-charts
+    helm repo add kerberos https://charts.kerberos.io
 
 If you had already added this repo earlier, run `helm repo update` to retrieve
-the latest versions of the packages. You can then run `helm search repo <alias>` to see the charts.
+the latest versions of the packages. You can then run `helm search repo kerberos` to see the charts.
 
-To install the <chart-name> chart:
+To install the `kerberos` chart:
 
-    helm install my-<chart-name> <alias>/<chart-name>
+    helm install my-hub kerberos/hub
 
 To uninstall the chart:
 
-    helm delete my-<chart-name>
+    helm delete my-hub

charts/hub/Chart.yaml

@@ -1,6 +1,6 @@
 apiVersion: v2
 name: hub
-description: A Helm chart for install Kerberos Hub in Kubernetes
+description: A Helm chart to install Kerberos Hub in Kubernetes
 icon: https://doc.kerberos.io/images/kerberos-logo.svg
 
 # A chart can be either an 'application' or a 'library' chart.
@@ -16,10 +16,10 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.29.0
+version: 0.134.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
 # follow Semantic Versioning. They should reflect the version the application is using.
 # It is recommended to use it with quotes.
-appVersion: "3.0.0"
+appVersion: "3.3.0"

charts/hub/README.md

@@ -2,169 +2,30 @@
 
 Kerberos Hub is the single pane of glass for your Kerberos agents. It comes with a best of breed open source technology stack, modular and scale first mindset, and allows you to build and maintain an everless growing video surveillance and video analytics landscape.
 
+![Kerberos Hub Interface](assets/images/hub-dashboard.png)
+
 ## License
 
 To use Kerberos Hub a license is required. This license will grant access the Kerberos Hub API, and allow to connect a number of cameras and Kerberos Vaults.
 
-## What's in the repo?
-
-This repo describes how to install Kerberos Hub inside your own Kubernetes cluster (or [K3S cluster](https://k3s.io/)) using a Helm chart.
-A couple of dependencies need to be installed first:
-- A Kafka message queue,
-- a Mongodb database,
-- a MQTT message broker ([Vernemq](https://vernemq.com/))
-- and a TURN server ([Pion](https://github.com/pion/turn))
-
-Next to that one can use an Nginx ingress controller or Traefik for orchestrating the ingresses. Once all dependencies are installed, the appropriate values should be updated in the **values.yaml** file.
-
-We do manage certificates through cert-manager and letsencrypt, and rely on HTTP01 and DNS01 resolvers. So you might need to change that for your custom scenarion (e.g. on premise deployment).
-
-![hubdashboard](hub-dashboard.png)
-
-# What are we building?
-
-As shown below you will find the architecture of what we are going to install (the green rectangle).
-
-![hubarechitecture](architecture.png)
-
-# Let's give it a try.
-
 ## Add helm repos
 
-The Kerberos Hub installation makes use a couple of other charts which are shipped within their on Helm repos. Therefore, we will add those repos to our Kubernetes cluster.
+The Kerberos Hub installation makes use of this Helm chart. Therefore, we will add those repos to our Kubernetes cluster.
 
-    helm repo add bitnami https://charts.bitnami.com/bitnami
-    helm repo add jetstack https://charts.jetstack.io
-    helm repo add traefik https://helm.traefik.io/traefik
-    helm repo add vernemq https://vernemq.github.io/docker-vernemq
-    helm repo add kerberos https://kerberos-io.github.io/hub
+    helm repo add kerberos https://charts.kerberos.io
     helm repo update
 
-## Cert manager
+## Prerequisites
 
-We rely on cert-manager and letsencrypt for generating all the certificates we'll need for the Kerberos Hub web interface, Kerberos Hub api and the Vernemq broker (WSS/TLS).
+Go and follow the Kerberos Hub installation at the [hub repository](https://github.com/kerberos-io/hub). Once you have [installed all prerequisites](https://github.com/kerberos-io/helm-charts/tree/main/charts/hub#lets-give-it-a-try) come back here.
 
-As a best practice we will install all the dependencies in their own namespace. Let's start by creating a separate namespace for cert-manager.
+## Kerberos Hub
 
-    kubectl create namespace cert-manager
+So once you hit this step, you should have installed all required dependencies. Hopefully you didn't had too much pain with the certificates. Before starting, it's important to have a look at the `values.yaml` file. This includes the different parameters to configure the different deployments. Reach out to us if you would need any help with this.
 
-Install the cert-manager helm chart into that namespace.
+Install the Kerberos Hub chart in a specific namespace and take into the values.yaml file.
 
-    helm install cert-manager jetstack/cert-manager --namespace cert-manager --set installCRDs=true
-
-If you already have the CRDs install you could get rid of `--set installCRDs=true`.
-
-Next we will install a cluster issuer that will make the HTTP01 challenges, this is needed for resolving the certificates of both Kerberos Hub web interface and api.
-    
-    kubectl apply -f cert-manager/cluster-issuer.yaml
-
-## Optional - Rancher
-
-A great way to manage your cluster through a UI is Rancher. This is totally up to you, but we love to use it a Kerberos.io
-
-    helm repo add rancher-latest https://releases.rancher.com/server-charts/latest
-    helm repo update
-    kubectl create namespace cattle-system
-    helm install rancher rancher-latest/rancher \
-    --namespace cattle-system \
-    --set hostname=rancher.kerberos.xxx \
-    --set ingress.tls.source=letsEncrypt \
-    --set letsEncrypt.email=xxx@email.com \
-    --set 'extraEnv[0].name=CATTLE_TLS_MIN_VERSION' \
-    --set 'extraEnv[0].value=1.2'
-
-## Kafka
-
-Kafka is used for the Kerberos Pipeline, this is the place where microservices are executed in parallel and/or sequentially. These microservices will receive events from a Kafka topic and then process the recording, and it's metadata. Results are injected back into Kafka and passed on to the following microservices. Microservices are independently horizontal scalable through replicas, this means that you can distribute your workload across your nodes if a specific microservice requires that.
-
-As a best practice let's create another namespace.
-
-    kubectl create namespace kafka
-
-Before installing the Kafka helm chart, go and have a look in the kafka/values.yaml file. You should update the clientUsers and clientPasswords. Have a look at the zookeeper credentials as well and update accordingly.
-    
-    helm install kafka bitnami/kafka -f ./kafka/values.yaml -n kafka
-
-## MongoDB
-
-A MongoDB instance is used for data persistence. Data might come from the Kerberos Pipeline or user interaction on the Kerberos Hub frontend.
-
-We will create a namespace for our Mongodb deployment as well.
-
-    kubectl create namespace mongodb
-
-Create a persistent volume, this is where the data will be stored on disk.
-
-    kubectl apply -f ./mongodb/fast.yaml
-
-Before installing the mongodb helm chart, go and have a look in the `mongodb/values.yaml` file. You should update the root password to a custom secure value.
-
-    helm install mongodb bitnami/mongodb --values ./mongodb/values.yaml -n mongodb
-
-## Vernemq
-
-Next to Kafka, we are using MQTT for bidirectional communication in the Kerberos ecosystem. This Vernemq broker, which is horizontal scalable, allows communicating with Kerberos agents at the edge (or wherever they live) and Kerberos Vault to forward recordings from the edge into the cloud.
-
-We'll create a namespace for our message broker Vernemq.
-
-    kubectl create namespace vernemq
-
-Create a certificate, so we can handle TLS/WSS. (this needs a DNS challenge)
-
-    kubectl apply -f vernemq/vernemq-secret.yaml --namespace vernemq
-    kubectl apply -f vernemq/vernemq-issuer.yaml --namespace vernemq
-    kubectl apply -f vernemq/vernemq-certificate.yaml --namespace vernemq
-
-By default, a username and password is set for the Vernemq broker. You can find these in the `vernemq/values.yaml` file [as shown below](https://github.com/kerberos-io/hub/blob/master/vernemq/values.yaml#L216-L217).
-
-    ...
-    - name: DOCKER_VERNEMQ_USER_YOURUSERNAME
-    value: "yourpassword"
-    ...
-
-Please note that the username is defined in capitals `YOURUSERNAME`, but will result as `yourusername`. So anything written in capitals, will be lowercase. 
-
-Go a head and install the Vernemq chart with the relevant configuration options.
-
-    helm install vernemq vernemq/vernemq -f vernemq/values.yaml  --namespace vernemq
-
-## TURN/STUN
-
-Within Kerberos Hub we allow streaming live from the edge to the cloud without port-forwarding. To make this work we are using a technology called WebRTC that leverages a TURN/STUN server. 
-
-![hubarechitecture](images/turn-stun.svg)
-
-To run a TURN/STUN server please [have a look at following repository](https://github.com/kerberos-io/turn-and-stun), this will deploy a Docker container on a specific host that will act as a proxy for network traversal. The TURN/STUN server will make sure a connection from a Kerberos Agent to a Kerberos Hub viewer is established.
-
-## Install Nginx ingress
-
-Ingresses are needed to expose the Kerberos hub front-end and api to the internet or intranet. We prefer nginx ingress but if you would prefer Traefik, that is perfectly fine as well.
-
-    helm upgrade --install ingress-nginx ingress-nginx \
-    --repo https://kubernetes.github.io/ingress-nginx \
-    --namespace ingress-nginx --create-namespace
-
-### or (option) Install traefik
-
-     helm install traefik traefik/traefik -f ./traefik/values-ssl.yaml
-
-## Kerberos Hub 
-
-So once you hit this step, you should have installed a previous defined dependencies. Hopefully you didn't have too much pain with the certificates :).
-Before starting, it's important to have a look at the `values.yaml` file. This includes the different parameters to configure the different deployments.
-Reach out to us if you would need any help with this.
-
-As previously mentioned a couple of times, we should also create a kerberos namespace.
-
-    kubectl create namespace kerberos-hub
-
-Install the `registry credentials` to download the Kerberos Hub and Kerberos Pipeline. You'll need to request the `regcred.yaml` from the Kerberos team, to be able to download the Kerberos Hub images.
-
-    kubectl apply -f regcred.yaml -n kerberos-hub
-
-Install the Kerberos Hub chart and take into the values.yaml file.
-
-    helm install hub kerberos/hub --values values.yaml -n kerberos-hub
+    helm install hub kerberos/hub --values values.yaml -n kerberos-hub --create-namespace
 
 Uninstall the Kerberos Hub chart
 
@@ -174,141 +35,422 @@ Uninstall the Kerberos Hub chart
 
 Below all configuration options and parameters are listed.
 
-| Name                                          | Description                                                                                                               | Value |
-| --------------------------------------------- | ------------------------------------------------------------------------------------------------------------------------- | ----- |
-| `license`                                     | The license key you received from support@kerberos.io. If not available request one.                                      | `""`  |
-| `licenseServer.url`                           | The license server for validating the license of your Kerberos Hub, by default `'"https://license.kerberos.io/verify"'`.  | `""`  |
-| `licenseServer.token`                         | The license server API token to sign the license validation by default `'214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM'`.     | `""`  |
-| `imagePullSecrets.name`                       | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images.       | `""`  |
-| `isPrivate`                                   | Global StorageClass for Persistent Volume(s)                                                                              | `""`  |
-| `readOnly`                                    | This will stop any write process to mongodb or any processing done in the Kerberos Hub pipeline.                          | `""`  |
-| `ingress`                                     | The ingress being used for `kerberoshub.api.url` and `kerberoshub.frontend.url`.                                          | `""`  |
-| `mongodb.host`                                | MongoDB hostname (`'mongodb:27017'`) or mongodb replicas (`'mongodb-0:27017,mongodb-1:27017'`).                           | `""`  |
-| `mongodb.adminDatabase`                       | MongoDB admin database, this is named `admin` by default.                                                                 | `""`  |
-| `mongodb.username`                            | MongoDB user account, we are using in the hub installation `'root'`.                                                      | `""`  |
-| `mongodb.password`                            | MongoDB user password, by default `'yourmongodbpassword'`                                                                 | `""`  |
-| `mqtt.host`                                   | MQTT (Vernemq) hostname.                                                                                                  | `""`  |
-| `mqtt.port`                                   | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`.                                                        | `""`  |
-| `mqtt.protocol`                               | MQTT (Vernemq) protocol, by default `'wss'`.                                                                              | `""`  |
-| `mqtt.username`                               | MQTT (Vernemq) username, by default `'yourusername'`.                                                                     | `""`  |
-| `mqtt.password`                               | MQTT (Vernemq) password, by default `'yourpassword'`.                                                                     | `""`  |
-| `queueProvider`                               | The queue we are using for the [Kerberos Hub pipeline](https://doc.kerberos.io/hub/pipeline/), can be 'SQS' or 'KAFKA'.   | `""`  |
-| `queueName`                                   | The event queue which is propagating messages in the [Kerberos Hub pipeline](https://doc.kerberos.io/hub/pipeline/).      | `""`  |
-| `kafka.broker`                                | Kafka brokers, by default `'kafka1.yourdomain.com:9094,kafka2.yourdomain.com:9094'`                                       | `""`  |
-| `kafka.username`                              | Kafka username, by default `'yourusername'`                                                                               | `""`  |
-| `kafka.password`                              | Kafka password, by default `'yourpassword'`                                                                               | `""`  |
-| `kafka.mechanism`                             | Kafka mechanism, by default `'PLAIN'`                                                                                     | `""`  |
-| `kafka.security`                              | Kafka security, by default `'SASL_PLAINTEXT'`                                                                             | `""`  |
-| `turn.host`                                   | TURN/STUN hostname, by default `'turn:turn.yourdomain.com:8443'`                                                          | `""`  |
-| `turn.username`                               | TURN/STUN username, by default `'username1'`                                                                              | `""`  |
-| `turn.password`                               | TURN/STUN password, by default `'password1'`                                                                              | `""`  |
-| `kerberosvault.uri`                           | The default Kerberos Vault uri (you can add multiple within the app), by default `'https://api.storage.yourdomain.com'`   | `""`  |
-| `kerberosvault.accesskey`                     | The default Kerberos Vault access key, by default `'xxx'`                                                                 | `""`  |
-| `kerberosvault.secretkey`                     | The default Kerberos Vault secret key, by default `'xxx'`                                                                 | `""`  |
-| `kerberosvault.provider`                      | The default Kerberos Vault provider`'a-provider'`                                                                                | `""`  |
-| `kerberosvault.archive.accesskey`             | When a task is created, the relevant recording is moved to another provider, using this access key `'xxx'`                                                                                | `""`  |
-| `kerberosvault.archive.secretkey`             | When a task is created, the relevant recording is moved to another provider, using this secret key`'xxx'`                                                                                | `""`  |
-| `kerberosvault.archive.provider`              | When a task is created, the relevant recording is moved to this provider `'an-archive-provider'`                                                                                | `""`  |
-| `email.provider`                              | The email service provider for sending out messages over email , use `'mailgun'` or `'smtp'`.                             | `""`  |
-| `email.from`                                  | The email address that is sending messages in name of, by default `'support@yourdomain.com'`.                             | `""`  |
-| `email.displayName`                           | The display name that is sending messages in name of, by default `'yourdomain.com'`                                       | `""`  |
-| `email.mailgun.domain`                        | While using `mailgun` as email service provider, you will need to provide your Mailgun domain.                            | `""`  |
-| `email.mailgun.apiKey`                        | The Mailgun API key linked to your Mailgun domain.                                                                        | `""`  |
-| `email.smtp.server`                           | While using `smtp` as email service provider, use the SMTP server.                                                        | `""`  |
-| `email.smtp.port`                             | SMTP port specified by your SMTP server, by default `'456'`.                                                              | `""`  |
-| `email.smtp.username`                         | SMTP username.                                                                                                            | `""`  |
-| `email.smtp.password`                         | SMTP password.                                                                                                            | `""`  |
-| `email.templates.detection`                   | We use templates to send notifications, this allow you to bring your own `Mailgun` templates, by default `'detection'`.   | `""`  |
-| `email.templates.disabled`                    | The template which is send when an account is disabled due to reaching its upload limit, by default `'disabled'`.         | `""`  |
-| `email.templates.highupload`                  | The template which is send when an account is reaching a specific upload threshold, by default `'threshold'`.             | `""`  |
-| `email.templates.device`                      | The template which is send when a camera goes online or offline, by default `'device'`.                                   | `""`  |
-| `email.templates.welcome`                     | The template which is send when a new user registered on the platform (`IS_PRIVATE='false'`), by default `'disabled'`.    | `""`  |
-| `email.templates.welcomeTitle`                | The welcome title use in the subject of the email.                                                                        | `""`  |
-| `email.templates.activate`                    | The template which is send when a user is required to activate his account , by default `'activate'`.                     | `""`  |
-| `email.templates.activateTitle`               | The activation title use in the subject of the email.                                                                     | `""`  |
-| `email.templates.forgot`                      | The template which is send when an account is requesting a forgot password, by default `'forgot'`.                        | `""`  |
-| `email.templates.forgotTitle`                 | The forgot title use in the subject of the email.                                                                         | `""`  |
-| `kerberoshub.api.repository`                  | The Docker registry where the Kerberos Hub API container is hosted.                                                       | `""`  |
-| `kerberoshub.api.pullPolicy`                  | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberoshub.api.tag`                         | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberoshub.api.replicas`                    | The number of pods/replicas running for the Kerberos Hub API deployment.                                                  | `""`  |
-| `kerberoshub.api.jwtSecret`                   | A secret that is for generating JWT tokens.                                                                               | `""`  |
-| `kerberoshub.api.schema`                      | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`.                                                        | `""`  |
-| `kerberoshub.api.url`                         | The Kerberos Hub API ingress to access the API.                                                                           | `""`  |
-| `kerberoshub.api.tls`                         | Bring your own TLS certificates for Kerberos Hub API ingress.                                                             | `""`  |
-| `kerberoshub.api.language`                    | The language of Kerberos Hub API responses, error messages will be communicated in the specified language.                | `""`  |
-| `kerberoshub.api.fallbackLanguage`            | The fallback language, if a specific translation is not available.                                                        | `""`  |
-| `kerberoshub.api.slack.enabled`               | Slack integration for sending events and notifications coming from the Kerberos Hub API, `'true'` or `'false'`.           | `""`  |
-| `kerberoshub.api.slack.hook`                  | Slack integration hook url.                                                                                               | `""`  |
-| `kerberoshub.api.slack.username`              | Slack integration username.                                                                                               | `""`  |
-| `kerberoshub.api.elasticsearch.enabled`       | Elasticsearch for storing events coming from the Kerberos Hub API, `'true'` or `'false'`                                  | `""`  |
-| `kerberoshub.api.elasticsearch.protocol`      | Elasticsearch protocol, `'http'` or `'https'`.                                                                            | `""`  |
-| `kerberoshub.api.elasticsearch.host`          | Elasticsearch host.                                                                                                       | `""`  |
-| `kerberoshub.api.elasticsearch.port`          | Elasticsearch port.                                                                                                       | `""`  |
-| `kerberoshub.api.elasticsearch.index`         | Elasticsearch index which is used to store the events.                                                                    | `""`  |
-| `kerberoshub.api.elasticsearch.username`      | Elasticsearch username.                                                                                                   | `""`  |
-| `kerberoshub.api.elasticsearch.password`      | Elasticsearch password.                                                                                                   | `""`  |
-| `kerberoshub.api.sso.issuer`                  | Kerberos Hub can be linked to OpenID Connect for SSO. Specify the OIC issuer.                                             | `""`  |
-| `kerberoshub.api.sso.clientId`                | The OIC client id.                                                                                                        | `""`  |
-| `kerberoshub.api.sso.clientSecret`            | The OIC client secret.                                                                                                    | `""`  |
-| `kerberoshub.api.sso.redirectUrl`             | The OIC redirectUrl, once the authentication is validated.                                                                | `""`  |
-| `kerberoshub.frontend.repository`             | The Docker registry where the Kerberos Hub frontend is hosted.                                                            | `""`  |
-| `kerberoshub.frontend.pullPolicy`             | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberoshub.frontend.tag`                    | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberoshub.frontend.replicas`               | The number of pods/replicas running for the Kerberos Hub frontend deployment.                                             | `""`  |
-| `kerberoshub.frontend.schema`                 | The protocol to serve the Kerberos Hub frontend, `'http'` or `'https'`.                                                   | `""`  |
-| `kerberoshub.frontend.url`                    | The Kerberos Hub frontend ingress to access the frontend.                                                                 | `""`  |
-| `kerberoshub.frontend.tls`                    | Bring your own TLS certificates for Kerberos Hub frontend ingress.                                                        | `""`  |
-| `kerberoshub.frontend.ssoDomain`              | The domain that's being used to activate SSO from the login page.                                                         | `""`  |
-| `kerberoshub.frontend.logo`                   | The logo being used in the Kerberos Hub frontend, set to 'custom' if you want to mount your own stylesheet.               | `""`  |
-| `kerberoshub.frontend.mixpanel.apikey`        | No longer used.                                                                                                           | `""`  |
-| `kerberoshub.frontend.sentry.url`             | No longer used.                                                                                                           | `""`  |
-| `kerberoshub.frontend.posthog.key`            | The API key retrieved from the Posthog instance.                                                                          | `""`  |
-| `kerberoshub.frontend.posthog.url`            | Posthog's endpoint (http/https).                                                                                          | `""`  |
-| `kerberoshub.frontend.stripe.apikey`          | If using the public version, `stripe` can be used for automated billing and subscriptions.                                | `""`  |
-| `kerberoshub.frontend.googlemaps.apikey`      | Within Kerberos Hub frontend a couple of maps are being used, the google maps is leveraged for that.                      | `""`  |
-| `kerberoshub.frontend.zendesk.url`            | No longer used.                                                                                                           | `""`  |
+| Name                                        | Description                                                                                                                | Value |
+| ------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------- | ----- |
+| `license` | The license key you received from support@kerberos.io. If not available request one. | `"L/+DAwEBB2xpY2Vuc2UB/4QAAQIBB1BheWxvYWQBCgABCVNpZ25hdHVyZQEKAAAA/gMk/4QB/gEZ/8sQACxnaXRodWIuY29tL3V1Zy1haS9odWItbGljZW5zZS9tb2RlbHMuTGljZW5zZX8DAQEHTGljZW5zZQH/gAABDAECSWQB/4IAAQNLZXkBDAABB0NvbXBhbnkBDAABB0V4cFRpbWUBBAABBERheXMBBAABB0NhbWVyYXMBBAABBVNpdGVzAQQAAQZWYXVsdHMBBAABCk1lZGlhTGltaXQBBAABCVBlcnBldHVhbAECAAEGQWN0aXZlAQIAAQlJcEFkZHJlc3MBDAAAABj/gQEBAQhPYmplY3RJRAH/ggABBgEYAAAy/4AvAQwAAAAAAAAAAAAAAAACDGZyZWUtbGljZW5zZQH81iZi6gH+AtoBEAEUARQDAQAB/gIAfeXxQb6kaPfAgOWeSAE6qEiQviFD6sciNmNfMel1mEL53FeV0GQe4cYBip9wyJag35az8A1yppxSymZD5V4my2FckyN2zmEW4E2sO/v+8eKepiAGYEzrKtfNCLxdWLmrHd0zjYQ3qk+PNfoPyzCOefeulw3aFsqBlzg9wDkF8cRx6tUW0qNTzki6sFGOuLoxS49cWqsftAvZmt+CRWa8u0VArIAjOpywN0RIZCkEYzp5RYF3LSVyWYEyvVhjE19DDnevzpJyCHRsIHTRcpTQkhboeapOdlEz8cx+PaOvxktN8hBWceTAH+nw96FARG7y6Cpjw3xo+NV1xb0tvRXGaGoK77JnErKLhd/haXji98rGvMakDt18WSbQfTVS84+Fw+/gKGsW3uS3fROAaZw1kZj4PgsEPZDvbVkCVyuS0O87UoYqpxH8S4by8cTF3wDP7FwyIRZbEbYjN2wzHSmlADYOBtdsdb1VGm7wvtB85vML9n7ZSlIpJdqfci06mGks102mDyG2LRMhUEvpUW3D/weErIvj2WiAwf6r0EUj+LO8VmAsYkME9da7FXEN6Vg/5f1u485LOpYki332RaDOhDn2eMG9DVb/HnmQSFagX+XXc/QwfsWiehCgKYGk4jQpyklTqoGu8BAt6Sm8CaoH8ngZ3cHLQT5DcZElV36/N/wA"` |
+| `licenseServer.url` | The license server for validating the license of your Kerberos Hub, by default `'"https://license.kerberos.io/verify"'`. | `""` |
+| `licenseServer.token` | The license server API token to sign the license validation by default `'214%ˆ#ddfsf@#3rfdsgl_)23sffeqasSwefDSFNBM'`. | `""` |
+| `environment` | A colored banner will be shown on top of the application to illustrate a non-production environment: `staging`, `demo`, .. | `"production"` |
+| `isPrivate` | Global StorageClass for Persistent Volume(s) | `true` |
+| `readOnly` | This will stop any write process to mongodb or any processing done in the Kerberos Hub pipeline. | `false` |
+| `mode` | Deployment mode: `all`, `pipeline`, or `ui`. `all` renders everything, `pipeline` only pipeline services, `ui` only hub services. | `"all"` |
+| `global.imageRegistry` | Global container registry override used for all images. | `""` |
+| `ingress` | The ingress being used for `kerberoshub.api.url` and `kerberoshub.frontend.url`. | `"nginx"` |
+| `mongodb.host` | MongoDB hostname (`'mongodb:27017'`) or mongodb replicas (`'mongodb-0:27017,mongodb-1:27017'`). | `"mongodb.mongodb"` |
+| `mongodb.adminDatabase` | MongoDB admin database, this is named `admin` by default. | `"admin"` |
+| `mongodb.authenticationMechanism` | MongoDB authentication mechanism (for example `SCRAM-SHA-256`). | `"SCRAM-SHA-256"` |
+| `mongodb.username` | MongoDB user account, we are using in the hub installation `'root'`. | `"yourusername"` |
+| `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
+| `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
+| `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
+| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
+| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
+| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
+| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
+| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
+| `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
+| `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
+| `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
+| `mqtt.username` | MQTT (Vernemq) username, by default `'yourusername'`. | `"yourusername"` |
+| `mqtt.password` | MQTT (Vernemq) password, by default `'yourpassword'`. | `"yourpassword"` |
+| `mqtt.legacy.host` | Legacy MQTT broker host used for backward-compatible clients. | `""` |
+| `mqtt.legacy.port` | Legacy MQTT broker port used for backward-compatible clients. | `""` |
+| `queueProvider` | The queue we are using for the [pipeline](https://doc.kerberos.io/hub/pipeline/): 'SQS', 'KAFKA' or `RABBITMQ`. | `"RABBITMQ"` |
+| `queueName` | The event queue which is propagating messages in the [Kerberos Hub pipeline](https://doc.kerberos.io/hub/pipeline/). | `"kcloud-event-queue"` |
+| `rabbitmq.host` | RabbitMQ host, by default `'rabbitmq.yourdomain.com:5671'` | `"rabbitmq.rabbitmq:5672"` |
+| `rabbitmq.username` | RabbitMQ username, by default `'yourusername'` | `"yourusername"` |
+| `rabbitmq.password` | RabbitMQ password, by default `'yourpassword'` | `"yourpassword"` |
+| `rabbitmq.exchange` | RabbitMQ exchange, by default `''` | `""` |
+| `kafka.broker` | Kafka brokers, by default `'kafka1.yourdomain.com:9094,kafka2.yourdomain.com:9094'` | `"kafka1.yourdomain.com:9094"` |
+| `kafka.username` | Kafka username, by default `'yourusername'` | `"yourusername"` |
+| `kafka.password` | Kafka password, by default `'yourpassword'` | `"yourpassword"` |
+| `kafka.mechanism` | Kafka mechanism, by default `'PLAIN'` | `"PLAIN"` |
+| `kafka.security` | Kafka security, by default `'SASL_PLAINTEXT'` | `"SASL_PLAINTEXT"` |
+| `turn.host` | TURN/STUN hostname, by default `'turn:turn.yourdomain.com:8443'` | `"turn:turn.yourdomain.com:8443"` |
+| `turn.username` | TURN/STUN username, by default `'username1'` | `"username1"` |
+| `turn.password` | TURN/STUN password, by default `'password1'` | `"password1"` |
+| `opentelemetry.enabled` | Enable or disable OpenTelemetry instrumentation. | `false` |
+| `opentelemetry.routingEnabled` | Enable or disable OpenTelemetry routing/export behavior. | `false` |
+| `opentelemetry.collector.endpoint` | OpenTelemetry collector endpoint used for trace export. | `"http://otel-collector:4317"` |
+| `openai.enabled` | Enable or disable OpenAI-backed semantic features. | `false` |
+| `openai.apikey` | OpenAI API key used when OpenAI integration is enabled. | `"xxx"` |
+| `kerberosvault.uri` | The default Kerberos Vault uri (you can add multiple within the app), by default `'https://api.storage.yourdomain.com'` | `"https://api.vault.yourdomain.com"` |
+| `kerberosvault.provider` | The default Kerberos Vault provider`'a-provider'` | `"a-provider"` |
+| `kerberosvault.accesskey` | The default Kerberos Vault access key, by default `'xxx'` | `"xxx"` |
+| `kerberosvault.secretkey` | The default Kerberos Vault secret key, by default `'xxx'` | `"xxx"` |
+| `kerberosvault.archive.provider` | When a task is created, the relevant recording is moved to this provider `'an-archive-provider'` | `"an-archive-provider"` |
+| `kerberosvault.archive.accesskey` | When a task is created, the relevant recording is moved to another provider, using this access key `'xxx'` | `"xxx"` |
+| `kerberosvault.archive.secretkey` | When a task is created, the relevant recording is moved to another provider, using this secret key`'xxx'` | `"xxx"` |
+| `kerberosvault.thumbnail.provider` | Configuration value for `kerberosvault.thumbnail.provider`. | `"a-thumbnail-provider"` |
+| `kerberosvault.thumbnail.accessKey` | Access key for `kerberosvault.thumbnail`. | `"xxx"` |
+| `kerberosvault.thumbnail.secretKey` | Secret key for `kerberosvault.thumbnail`. | `"xxx"` |
+| `kerberosvault.sprite.provider` | Configuration value for `kerberosvault.sprite.provider`. | `"a-sprite-provider"` |
+| `kerberosvault.sprite.accessKey` | Access key for `kerberosvault.sprite`. | `"xxx"` |
+| `kerberosvault.sprite.secretKey` | Secret key for `kerberosvault.sprite`. | `"xxx"` |
+| `admin.repository` | Container image repository for `admin`. | `"uugai/admin"` |
+| `admin.pullPolicy` | Image pull policy for `admin`. | `"IfNotPresent"` |
+| `admin.tag` | Container image tag/version for `admin`. | `"v1.3.0"` |
+| `admin.replicas` | Number of replicas for `admin`. | `2` |
+| `admin.logLevel` | Log verbosity level for `admin`. | `"info"` |
+| `admin.resources.requests.memory` | Memory request for `admin`. | `"100Mi"` |
+| `admin.resources.requests.cpu` | CPU request for `admin`. | `"250m"` |
+| `admin.url` | URL for `admin`. | `"admin.yourdomain.com"` |
+| `admin.tls.secretName` | Kubernetes Secret name used by `admin.tls`. | `""` |
+| `admin.oauth2Proxy.enabled` | Enable or disable `admin.oauth2Proxy`. | `false` |
+| `admin.oauth2Proxy.github.clientId` | Client ID used by `admin.oauth2Proxy.github`. | `"github-client-id"` |
+| `admin.oauth2Proxy.github.clientSecret` | Client secret used by `admin.oauth2Proxy.github`. | `"github-client-secret"` |
+| `admin.oauth2Proxy.github.cookieSecret` | Cookie secret used by `admin.oauth2Proxy.github`. | `"generate-a-random-cookie-secret"` |
+| `admin.oauth2Proxy.github.organization` | Organization value used by `admin.oauth2Proxy.github`. | `"github-organization"` |
+| `admin.oauth2Proxy.github.team` | Team value used by `admin.oauth2Proxy.github`. | `"github-team"` |
+| `kerberoshub.extraEnv` | Additional environment variables injected into Kerberos Hub pods. | `[]` |
+| `kerberoshub.serviceAccount.create` | Create or manage `kerberoshub.serviceAccount` resources. | `false` |
+| `kerberoshub.serviceAccount.name` | Name value for `kerberoshub.serviceAccount`. | `""` |
+| `kerberoshub.serviceAccount.annotations` | Annotations applied to `kerberoshub.serviceAccount` resources. | `""` |
+| `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
+| `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
+| `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
+| `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
+| `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
+| `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
+| `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
+| `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
+| `kerberoshub.api.resources.requests.memory` | Memory request for `kerberoshub.api`. | `"100Mi"` |
+| `kerberoshub.api.resources.requests.cpu` | CPU request for `kerberoshub.api`. | `"250m"` |
+| `kerberoshub.api.resources.limits.memory` | Memory limit for `kerberoshub.api`. | `"100Mi"` |
+| `kerberoshub.api.resources.limits.cpu` | CPU limit for `kerberoshub.api`. | `"250m"` |
+| `kerberoshub.api.serverTLS.enabled` | Enable or disable `kerberoshub.api.serverTLS`. | `false` |
+| `kerberoshub.api.serverTLS.secretName` | Kubernetes Secret name used by `kerberoshub.api.serverTLS`. | `""` |
+| `kerberoshub.api.serverTLS.mountPath` | Filesystem path where the Hub API TLS secret is mounted. | `"/etc/hub-api/tls"` |
+| `kerberoshub.api.serverTLS.certFile` | Path to the TLS certificate file used by Hub API server-side TLS. | `"/etc/hub-api/tls/tls.crt"` |
+| `kerberoshub.api.serverTLS.keyFile` | Path to the TLS private key file used by Hub API server-side TLS. | `"/etc/hub-api/tls/tls.key"` |
+| `kerberoshub.api.mfaIssuer` | When enabling the MFA access, this is the name that will be shown in the MFA app. | `"yourdomain.com"` |
+| `kerberoshub.api.apiKey` | API key for `kerberoshub.api`. | `"a-random-admin-api-key"` |
+| `kerberoshub.api.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. New tasks are stamped with this value. Set to `"0"` or a negative value to keep tasks indefinitely. Must match `kerberoshub.cleanup.defaultTaskRetentionDays`. | `"0"` |
+| `kerberoshub.api.tls` | Bring your own TLS certificates for Kerberos Hub API ingress. | `<list>` |
+| `kerberoshub.api.tls.secretName` | Kubernetes Secret name used by `kerberoshub.api.tls`. | `""` |
+| `kerberoshub.api.language` | The language of Kerberos Hub API responses, error messages will be communicated in the specified language. | `"english"` |
+| `kerberoshub.api.fallbackLanguage` | The fallback language, if a specific translation is not available. | `"english"` |
+| `kerberoshub.api.aws.region` | AWS region used by the Hub API legacy S3 integration. | `"xxx"` |
+| `kerberoshub.api.aws.bucket` | AWS S3 bucket used by the Hub API legacy S3 integration. | `"xxx"` |
+| `kerberoshub.api.aws.accessKey` | Access key for `kerberoshub.api.aws`. | `"xxx"` |
+| `kerberoshub.api.aws.secretKey` | Secret key for `kerberoshub.api.aws`. | `"xxx"` |
+| `kerberoshub.api.stripe.privateKey` | Private key for `kerberoshub.api.stripe`. | `"xxx"` |
+| `kerberoshub.api.slack.enabled` | Slack integration for sending events and notifications coming from the Kerberos Hub API, `'true'` or `'false'`. | `"true"` |
+| `kerberoshub.api.slack.hook` | Slack integration hook url. | `"yourslackhook"` |
+| `kerberoshub.api.slack.username` | Slack integration username. | `"Kerberos Hub"` |
+| `kerberoshub.api.elasticsearch.enabled` | Elasticsearch for storing events coming from the Kerberos Hub API, `'true'` or `'false'` | `"false"` |
+| `kerberoshub.api.elasticsearch.protocol` | Elasticsearch protocol, `'http'` or `'https'`. | `"http"` |
+| `kerberoshub.api.elasticsearch.host` | Elasticsearch host. | `"yourelasticsearchinstance.com"` |
+| `kerberoshub.api.elasticsearch.port` | Elasticsearch port. | `"9200"` |
+| `kerberoshub.api.elasticsearch.index` | Elasticsearch index which is used to store the events. | `"kerberos-cloud"` |
+| `kerberoshub.api.elasticsearch.username` | Elasticsearch username. | `""` |
+| `kerberoshub.api.elasticsearch.password` | Elasticsearch password. | `""` |
+| `kerberoshub.api.sso.redirectUrl` | The OIC redirectUrl, once the authentication is validated. | `""` |
+| `kerberoshub.api.sso.forceSSO` | Force SSO login for users of the configured domain. | `""` |
+| `kerberoshub.api.sso.issuer` | Kerberos Hub can be linked to OpenID Connect for SSO. Specify the OIC issuer. | `""` |
+| `kerberoshub.api.sso.claimId` | OIDC claim used to uniquely identify the authenticated user. | `""` |
+| `kerberoshub.api.sso.clientId` | The OIC client id. | `""` |
+| `kerberoshub.api.sso.clientSecret` | The OIC client secret. | `""` |
+| `kerberoshub.api.sso.clientVerificationId` | Optional client verification ID used for SSO chaining scenarios. | `""` |
+| `kerberoshub.api.sso.extraHeaders` | Additional headers appended to outbound SSO provider requests. | `""` |
+| `kerberoshub.api.sso.extraHeaders.value` | Header value for each configured SSO extra header entry. | `""` |
+| `kerberoshub.frontend.repository` | The Docker registry where the Kerberos Hub frontend is hosted. | `"ghcr.io/uug-ai/hub-frontend"` |
+| `kerberoshub.frontend.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.9.11"` |
+| `kerberoshub.frontend.replicas` | The number of pods/replicas running for the Kerberos Hub frontend deployment. | `2` |
+| `kerberoshub.frontend.logLevel` | Log verbosity level for `kerberoshub.frontend`. | `"info"` |
+| `kerberoshub.frontend.schema` | The protocol to serve the Kerberos Hub frontend, `'http'` or `'https'`. | `"https"` |
+| `kerberoshub.frontend.url` | The Kerberos Hub frontend ingress to access the frontend. | `"yourdomain.com"` |
+| `kerberoshub.frontend.resources.requests.memory` | Memory request for `kerberoshub.frontend`. | `"50Mi"` |
+| `kerberoshub.frontend.resources.requests.cpu` | CPU request for `kerberoshub.frontend`. | `"50m"` |
+| `kerberoshub.frontend.resources.limits.memory` | Memory limit for `kerberoshub.frontend`. | `"50Mi"` |
+| `kerberoshub.frontend.resources.limits.cpu` | CPU limit for `kerberoshub.frontend`. | `"50m"` |
+| `kerberoshub.frontend.tls` | Bring your own TLS certificates for Kerberos Hub frontend ingress. | `<list>` |
+| `kerberoshub.frontend.tls.secretName` | Kubernetes Secret name used by `kerberoshub.frontend.tls`. | `""` |
+| `kerberoshub.frontend.mixpanel.apikey` | No longer used. | `"xxx"` |
+| `kerberoshub.frontend.sentry.url` | No longer used. | `"https://xxx@sentry.io/xxx"` |
+| `kerberoshub.frontend.stripe.publicKey` | Public key for `kerberoshub.frontend.stripe`. | `""` |
+| `kerberoshub.frontend.googlemaps.apikey` | Within Kerberos Hub frontend a couple of maps are being used, the google maps is leveraged for that. | `"xxxx"` |
+| `kerberoshub.frontend.zendesk.url` | No longer used. | `"yourdomain.zendesk.com"` |
+| `kerberoshub.frontend.posthog.key` | The API key retrieved from the Posthog instance. | `"xxx"` |
+| `kerberoshub.frontend.posthog.url` | Posthog's endpoint (http/https). | `"https://posthog.domain.com"` |
+| `kerberoshub.frontend.hideAddAgent` | Configuration value for `kerberoshub.frontend.hideAddAgent`. | `"false"` |
+| `kerberoshub.frontend.multiTenant` | Configuration value for `kerberoshub.frontend.multiTenant`. | `false` |
+| `kerberoshub.frontend.title` | Title text used for `kerberoshub.frontend`. | `"Kerberos Hub - Video surveillance as it should be"` |
+| `kerberoshub.frontend.logo` | The logo being used in the Kerberos Hub frontend, set to 'custom' if you want to mount your own stylesheet. | `"custom"` |
+| `kerberoshub.frontend.navigationLinkTitle1` | Custom navigation item (title 1) | `""` |
+| `kerberoshub.frontend.navigationLinkUrl1` | Custom navigation item (url 1) | `""` |
+| `kerberoshub.frontend.navigationLinkTitle2` | Custom navigation item (title 2) | `""` |
+| `kerberoshub.frontend.navigationLinkUrl2` | Custom navigation item (url 2) | `""` |
+| `kerberoshub.frontend.navigationLinkTitle3` | Custom navigation item (title 3) | `""` |
+| `kerberoshub.frontend.navigationLinkUrl3` | Custom navigation item (url 3) | `""` |
+| `kerberoshub.frontend.navigationLinkTitle4` | Custom navigation item (title 4) | `""` |
+| `kerberoshub.frontend.navigationLinkUrl4` | Custom navigation item (url 4) | `""` |
+| `kerberoshub.frontend.navigationLinkTitle5` | Custom navigation item (title 5) | `""` |
+| `kerberoshub.frontend.navigationLinkUrl5` | Custom navigation item (url 5) | `""` |
+| `kerberoshub.frontend.caseFilterAssigneesDefault` | Default assignee filter behavior for cases in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
+| `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
+| `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
+| `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
+| `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
+| `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (`en`, `nl`, `pl`, `pt`, `it`, `tr`, `fr`, `sv`, `de`). | `"en"` |
+| `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable the organisation feature family, including projects. When empty, child groups apply independently. | `""` |
+| `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
+| `kerberoshub.frontend.features.projects.enabled` | Fallback project group switch used when the organisations umbrella is unset. | `""` |
+| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
+| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
+| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
+| `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
+| `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
+| `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
+| `kerberoshub.frontend.features.map.overlayTileUrl` | Optional XYZ overlay URL supporting `{z}`, `{x}`, `{y}`, and `{apiKey}`. Empty disables the overlay. | `""` |
+| `kerberoshub.frontend.features.map.overlayApiKey` | Optional browser-visible API key substituted for `{apiKey}` in the overlay URL. | `""` |
+| `kerberoshub.frontend.features.map.overlayAttribution` | Attribution text displayed when the overlay is enabled. | `""` |
+| `kerberoshub.frontend.features.map.overlayMinZoom` | Minimum zoom level for overlay tiles. | `"0"` |
+| `kerberoshub.frontend.features.map.overlayMaxZoom` | Maximum zoom level for overlay tiles. | `"19"` |
+| `kerberoshub.frontend.features.map.overlayOpacity` | Overlay opacity from `0` to `1`. | `"1"` |
+| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Liveview behavior setting: `defaultStreamMode`. | `"SD"` |
+| `kerberoshub.frontend.features.liveview.liveStreamMode` | Transport backing LIVE mode: `webrtc`, `hls`, or `moq`. | `"webrtc"` |
+| `kerberoshub.frontend.features.liveview.hlsEnabled` | Offer HLS as a selectable LIVE transport. | `"true"` |
+| `kerberoshub.frontend.features.liveview.moqEnabled` | Offer MoQ as a selectable LIVE transport. | `"false"` |
+| `kerberoshub.frontend.features.liveview.remoteRecordingEnabled` | Show the manual REC control in live views. | `"true"` |
+| `kerberoshub.frontend.features.liveview.moqRelayUrl` | WebTransport URL of the MoQ relay. | `"https://relay.uug.ai/anon"` |
+| `kerberoshub.frontend.features.liveview.moqBroadcastPrefix` | Prefix used to build MoQ broadcast names. | `"devices"` |
+| `kerberoshub.frontend.features.liveview.paginationMode` | Liveview behavior setting: `paginationMode` (`scroll`, `numbered` or `maxStreams`). | `"scroll"` |
+| `kerberoshub.frontend.features.liveview.pageSize` | Liveview behavior setting: `pageSize` (max streams shown per page in `numbered` mode). | `"6"` |
+| `kerberoshub.frontend.features.liveview.maxStreams` | Liveview behavior setting: `maxStreams`. | `"-1"` |
+| `kerberoshub.frontend.features.chart.colorChartSelectionFill` | Fill color for chart selection regions. | `"rgba(132, 86, 159, 0.07)"` |
+| `kerberoshub.frontend.features.chart.colorChartSelectionStroke` | Stroke color for chart selection regions. | `"rgba(132, 86, 159, 0.4)"` |
+| `kerberoshub.frontend.features.chart.colorChartGridStroke` | Stroke color for chart grid lines. | `"rgba(0, 106, 255, 0.18)"` |
+| `kerberoshub.frontend.features.devices.hideAgent` | Hide agent controls in the devices section of the frontend. | `"false"` |
+| `kerberoshub.frontend.features.media.filter.date.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.date`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.sites.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sites`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.groups.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.groups`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.devices.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.devices`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.objectDetection.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.objectDetection`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.star.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.star`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.region.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.region`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.sort.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.sort`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.category.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.category`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.markers.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.markers`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.events.enabled` | Enable or disable `kerberoshub.frontend.features.media.filter.events`. | `"true"` |
+| `kerberoshub.frontend.features.liveview.defaultStreamMode` | Default live stream mode: `SD` or `HD`. | `"SD"` |lter.tags`. | `"true"` |
+| `kerberoshub.frontend.features.media.filter.defaultView` | Default view for the media page: `timeline` or `grid`. | `"timeline"` |
+| `kerberoshub.frontend.features.floorplan.enabled` | Enable or disable `kerberoshub.frontend.features.floorplan`. | `"true"` |
+| `kerberoshub.frontend.features.floorplan.colorDeviceActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorDeviceInactive` | Color customization for `floorplan` in the frontend. | `"hsla(0, 3%, 41%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorDeviceIdle` | Color customization for `floorplan` in the frontend. | `"hsla(47, 86%, 47%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorDeviceMotion` | Color customization for `floorplan` in the frontend. | `"hsla(2, 58%, 48%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorLiveViewControlActive` | Color customization for `floorplan` in the frontend. | `"hsla(131, 31%, 52%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorLiveViewControlMotion` | Color customization for `floorplan` in the frontend. | `"hsla(2, 58%, 48%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorFloorPlanLabelText` | Color customization for `floorplan` in the frontend. | `"hsla(0, 0%, 100%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorFloorPlanLabelBackground` | Color customization for `floorplan` in the frontend. | `"hsla(0, 0%, 0%, 0.8)"` |
+| `kerberoshub.frontend.features.floorplan.colorDeviceMarkerBorder` | Color customization for `floorplan` in the frontend. | `"hsla(0, 0%, 100%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorTrackBox` | Color customization for `floorplan` in the frontend. | `"hsla(278, 30%, 48%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorTrackBoxHover` | Color customization for `floorplan` in the frontend. | `"hsla(47, 86%, 47%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
+| `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
+| `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
+| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
+| `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
+| `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
+| `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
+| `kerberoshub.oauth2Proxy.github.clientSecret` | Client secret used by `kerberoshub.oauth2Proxy.github`. | `"github-client-secret"` |
+| `kerberoshub.oauth2Proxy.github.cookieSecret` | Cookie secret used by `kerberoshub.oauth2Proxy.github`. | `"generate-a-random-cookie-secret"` |
+| `kerberoshub.oauth2Proxy.github.organization` | Organization value used by `kerberoshub.oauth2Proxy.github`. | `"github-organization"` |
+| `kerberoshub.oauth2Proxy.github.team` | Team value used by `kerberoshub.oauth2Proxy.github`. | `"github-team"` |
+| `kerberoshub.cleanup.repository` | The Docker container that is responsible for cleaning up the Kerberos Hub API content and related MongoDB collections. | `"ghcr.io/uug-ai/hub-cleanup"` |
+| `kerberoshub.cleanup.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberoshub.cleanup.tag` | The Docker image tag/version. | `"v1.4.13"` |
+| `kerberoshub.cleanup.replicas` | Number of replicas for `kerberoshub.cleanup`. | `1` |
+| `kerberoshub.cleanup.mode` | Cleanup service mode: `serve`, `dry-run`, or `version`. | `"serve"` |
+| `kerberoshub.cleanup.logLevel` | Log verbosity level for `kerberoshub.cleanup`. | `"info"` |
+| `kerberoshub.cleanup.maxDays` | Hard maximum age (in days) used by the optional global cleanup pass. | `"365"` |
+| `kerberoshub.cleanup.runIntervalMinutes` | Minutes between cleanup cycles. | `"10"` |
+| `kerberoshub.cleanup.cleanupUsernames` | Optional comma-separated usernames to target. | `""` |
+| `kerberoshub.cleanup.batchSize` | Delete batch size per collection operation. | `"250"` |
+| `kerberoshub.cleanup.userBatchSize` | Number of users processed per inner batch. | `"100"` |
+| `kerberoshub.cleanup.maxUsersPerRun` | Maximum users processed per run. | `"100"` |
+| `kerberoshub.cleanup.progressEvery` | Print progress every N processed users. | `"100"` |
+| `kerberoshub.cleanup.activeUserRescanHours` | Rescan interval for active users. | `"6"` |
+| `kerberoshub.cleanup.inactiveUserRescanHours` | Rescan interval for inactive users. | `"24"` |
+| `kerberoshub.cleanup.readTimeoutSeconds` | Timeout for MongoDB read operations. | `"30"` |
+| `kerberoshub.cleanup.deleteTimeoutSeconds` | Timeout for delete operations. | `"120"` |
+| `kerberoshub.cleanup.reportIncludeStats` | Include richer per-user dry-run summary stats. | `"false"` |
+| `kerberoshub.cleanup.dryRun` | Force dry-run behavior through env var. | `"false"` |
+| `kerberoshub.cleanup.debug` | Enable extra cleanup debug logging. | `"false"` |
+| `kerberoshub.cleanup.globalPassEnabled` | Enable optional global orphan cleanup pass. | `"false"` |
+| `kerberoshub.cleanup.globalPassIntervalHours` | Minimum hours between global cleanup passes. | `"0"` |
+| `kerberoshub.cleanup.globalPassDeleteBudget` | Max documents deleted during a global pass. | `"0"` |
+| `kerberoshub.cleanup.defaultTaskRetentionDays` | Default retention (in days) applied to tasks without an explicit `retention_days`. Tasks older than this (anchored on `creation_date`) are deleted with their `case_media` rows. Set to `"0"` or a negative value to keep tasks forever. Must match `kerberoshub.api.defaultTaskRetentionDays`. | `"0"` |
+| `kerberoshub.cleanup.resources.requests.memory` | Memory request for `kerberoshub.cleanup`. | `"10Mi"` |
+| `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
+| `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
+| `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
+| `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
+| `kerberoshub.monitordevice.logLevel` | Log verbosity level for `kerberoshub.monitordevice`. | `"info"` |
+| `kerberoshub.monitordevice.resources.requests.memory` | Memory request for `kerberoshub.monitordevice`. | `"10Mi"` |
+| `kerberoshub.monitordevice.resources.requests.cpu` | CPU request for `kerberoshub.monitordevice`. | `"10m"` |
+| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
+| `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
+| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
+| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
+| `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
+| `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
+| `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
+| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
+| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
+| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
+| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
+| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
+| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
+| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
+| `kerberospipeline.event.repository` | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice. | `"ghcr.io/uug-ai/hub-pipeline-event"` |
+| `kerberospipeline.event.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.0"` |
+| `kerberospipeline.event.replicas` | Number of replicas for `kerberospipeline.event`. | `1` |
+| `kerberospipeline.event.logLevel` | Log verbosity level for `kerberospipeline.event`. | `"info"` |
+| `kerberospipeline.event.resources.requests.memory` | Memory request for `kerberospipeline.event`. | `"10Mi"` |
+| `kerberospipeline.event.resources.requests.cpu` | CPU request for `kerberospipeline.event`. | `"10m"` |
+| `kerberospipeline.monitor.repository` | The [monitoring microservice](https://doc.kerberos.io/hub/pipeline/#monitoring), calculating metrics of incoming messages. | `"ghcr.io/uug-ai/hub-pipeline-monitor"` |
+| `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
+| `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
+| `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
+| `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
+| `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
+| `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
+| `kerberospipeline.sequence.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.sequence.tag` | The Docker image tag/version. | `"v1.6.18"` |
+| `kerberospipeline.sequence.replicas` | Number of replicas for `kerberospipeline.sequence`. | `1` |
+| `kerberospipeline.sequence.resources.requests.memory` | Memory request for `kerberospipeline.sequence`. | `"10Mi"` |
+| `kerberospipeline.sequence.resources.requests.cpu` | CPU request for `kerberospipeline.sequence`. | `"10m"` |
+| `kerberospipeline.throttler.repository` | The [throttler microservice](https://doc.kerberos.io/hub/pipeline/#throttler), throttling events. | `"uugai/hub-pipeline-throttler"` |
+| `kerberospipeline.throttler.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.throttler.tag` | The Docker image tag/version. | `"v1.2.0"` |
+| `kerberospipeline.throttler.replicas` | Number of replicas for `kerberospipeline.throttler`. | `1` |
+| `kerberospipeline.throttler.logLevel` | Log verbosity level for `kerberospipeline.throttler`. | `"info"` |
+| `kerberospipeline.throttler.resources.requests.memory` | Memory request for `kerberospipeline.throttler`. | `"10Mi"` |
+| `kerberospipeline.throttler.resources.requests.cpu` | CPU request for `kerberospipeline.throttler`. | `"10m"` |
+| `kerberospipeline.notify.repository` | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events. | `"ghcr.io/uug-ai/hub-pipeline-notification"` |
+| `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
+| `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
+| `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
+| `kerberospipeline.notify.resources.requests.memory` | Memory request for `kerberospipeline.notify`. | `"10Mi"` |
+| `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
+| `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
+| `kerberospipeline.notifyTest.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.1"` |
+| `kerberospipeline.notifyTest.replicas` | Number of replicas for `kerberospipeline.notifyTest`. | `1` |
+| `kerberospipeline.notifyTest.resources.requests.memory` | Memory request for `kerberospipeline.notifyTest`. | `"10Mi"` |
+| `kerberospipeline.notifyTest.resources.requests.cpu` | CPU request for `kerberospipeline.notifyTest`. | `"10m"` |
+| `kerberospipeline.analysis.repository` | The [analysis microservices](https://doc.kerberos.io/hub/pipeline/#analyser) which executed specific analysis in parallel. | `"ghcr.io/uug-ai/hub-pipeline-analysis"` |
+| `kerberospipeline.analysis.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
+| `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
+| `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
+| `kerberospipeline.analysis.resources.requests.memory` | Memory request for `kerberospipeline.analysis`. | `"10Mi"` |
+| `kerberospipeline.analysis.resources.requests.cpu` | CPU request for `kerberospipeline.analysis`. | `"10m"` |
+| `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
+| `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.2"` |
+| `kerberospipeline.dominantColor.replicas` | Number of replicas for `kerberospipeline.dominantColor`. | `3` |
+| `kerberospipeline.dominantColor.logLevel` | Log verbosity level for `kerberospipeline.dominantColor`. | `"info"` |
+| `kerberospipeline.dominantColor.resources.requests.memory` | Memory request for `kerberospipeline.dominantColor`. | `"512Mi"` |
+| `kerberospipeline.dominantColor.resources.requests.cpu` | CPU request for `kerberospipeline.dominantColor`. | `"500m"` |
+| `kerberospipeline.dominantColor.resources.limits.memory` | Memory limit for `kerberospipeline.dominantColor`. | `"2Gi"` |
+| `kerberospipeline.dominantColor.resources.limits.cpu` | CPU limit for `kerberospipeline.dominantColor`. | `"1000m"` |
+| `kerberospipeline.thumbnail.repository` | The thumbnail microservices generated a thumbnail for a recordings. | `"ghcr.io/uug-ai/hub-pipeline-thumbnail"` |
+| `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.4"` |
+| `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
+| `kerberospipeline.thumbnail.logLevel` | Log verbosity level for `kerberospipeline.thumbnail`. | `"info"` |
+| `kerberospipeline.thumbnail.quality` | Configuration value for `kerberospipeline.thumbnail.quality`. | `"1"` |
+| `kerberospipeline.thumbnail.width` | Configuration value for `kerberospipeline.thumbnail.width`. | `"600"` |
+| `kerberospipeline.thumbnail.height` | Configuration value for `kerberospipeline.thumbnail.height`. | `"-1"` |
+| `kerberospipeline.thumbnail.kerberosvault.enabled` | Enable or disable `kerberospipeline.thumbnail.kerberosvault`. | `true` |
+| `kerberospipeline.thumbnail.resources.requests.memory` | Memory request for `kerberospipeline.thumbnail`. | `"512Mi"` |
+| `kerberospipeline.thumbnail.resources.requests.cpu` | CPU request for `kerberospipeline.thumbnail`. | `"500m"` |
+| `kerberospipeline.thumbnail.resources.limits.memory` | Memory limit for `kerberospipeline.thumbnail`. | `"2Gi"` |
+| `kerberospipeline.thumbnail.resources.limits.cpu` | CPU limit for `kerberospipeline.thumbnail`. | `"1000m"` |
+| `kerberospipeline.counting.repository` | The counting microservices computes objects passing different line segments. | `"uugai/hub-pipeline-counting"` |
+| `kerberospipeline.counting.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
+| `kerberospipeline.counting.tag` | The Docker image tag/version. | `"v1.6.3"` |
+| `kerberospipeline.counting.replicas` | Number of replicas for `kerberospipeline.counting`. | `1` |
+| `kerberospipeline.counting.logLevel` | Log verbosity level for `kerberospipeline.counting`. | `"info"` |
+| `kerberospipeline.counting.resources.requests.memory` | Memory request for `kerberospipeline.counting`. | `"10Mi"` |
+| `kerberospipeline.counting.resources.requests.cpu` | CPU request for `kerberospipeline.counting`. | `"10m"` |
+| `kerberospipeline.sprite.enabled` | Enable or disable `kerberospipeline.sprite`. | `false` |
+| `kerberospipeline.sprite.repository` | Container image repository for `kerberospipeline.sprite`. | `"ghcr.io/uug-ai/hub-pipeline-sprite"` |
+| `kerberospipeline.sprite.pullPolicy` | Image pull policy for `kerberospipeline.sprite`. | `"IfNotPresent"` |
+| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.12"` |
+| `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
+| `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
+| `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
+| `kerberospipeline.sprite.width` | Configuration value for `kerberospipeline.sprite.width`. | `"240"` |
+| `kerberospipeline.sprite.height` | Configuration value for `kerberospipeline.sprite.height`. | `"135"` |
+| `kerberospipeline.sprite.resources.requests.memory` | Memory request for `kerberospipeline.sprite`. | `"512Mi"` |
+| `kerberospipeline.sprite.resources.requests.cpu` | CPU request for `kerberospipeline.sprite`. | `"500m"` |
+| `kerberospipeline.sprite.resources.limits.memory` | Memory limit for `kerberospipeline.sprite`. | `"2Gi"` |
+| `kerberospipeline.sprite.resources.limits.cpu` | CPU limit for `kerberospipeline.sprite`. | `"1000m"` |
+| `kerberospipeline.export.repository` | Container image repository for `kerberospipeline.export`. | `"ghcr.io/uug-ai/hub-pipeline-export"` |
+| `kerberospipeline.export.pullPolicy` | Image pull policy for `kerberospipeline.export`. | `"IfNotPresent"` |
+| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.4"` |
+| `kerberospipeline.export.replicas` | Number of replicas for `kerberospipeline.export`. | `2` |
+| `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
+| `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
+| `kerberospipeline.export.resources.requests.cpu` | CPU request for `kerberospipeline.export`. | `"10m"` |
+| `email.provider` | The email service provider for sending out messages over email , use `'mailgun'` or `'smtp'`. | `"mailgun"` |
+| `email.from` | The email address that is sending messages in name of, by default `'support@yourdomain.com'`. | `"support@yourdomain.com"` |
+| `email.displayName` | The display name that is sending messages in name of, by default `'yourdomain.com'` | `"yourdomain.com"` |
+| `email.mailgun.domain` | While using `mailgun` as email service provider, you will need to provide your Mailgun domain. | `"mg.yourdomain.com"` |
+| `email.mailgun.apikey` | Mailgun API key (lowercase variant) used when provider is `mailgun`. | `"xxxx"` |
+| `email.smtp.server` | While using `smtp` as email service provider, use the SMTP server. | `"smtp.yourdomain.com"` |
+| `email.smtp.port` | SMTP port specified by your SMTP server, by default `'456'`. | `"465"` |
+| `email.smtp.username` | SMTP username. | `"yourusername"` |
+| `email.smtp.password` | SMTP password. | `"yourpassword"` |
+| `email.templates.welcome` | The template which is send when a new user registered on the platform (`IS_PRIVATE='false'`), by default `'disabled'`. | `"welcome"` |
+| `email.templates.welcomeTitle` | The welcome title use in the subject of the email. | `"Welcome to Kerberos Hub"` |
+| `email.templates.activate` | The template which is send when a user is required to activate his account , by default `'activate'`. | `"activate"` |
+| `email.templates.activateTitle` | The activation title use in the subject of the email. | `"Wonderful! Your Kerberos Hub is now active"` |
+| `email.templates.forgot` | The template which is send when an account is requesting a forgot password, by default `'forgot'`. | `"forgot"` |
+| `email.templates.forgotTitle` | The forgot title use in the subject of the email. | `"Password reset Kerberos Hub. You forgot your password"` |
+| `email.templates.share` | Email template name/key for `share` notifications. | `"share"` |
+| `email.templates.shareTitle` | Email subject title for the `share` template. | `"[Action] You received a recording from Kerberos Hub"` |
+| `email.templates.assignTask` | Email template name/key for `assign task` notifications. | `"assign_task"` |
+| `email.templates.assignTaskTitle` | Email subject title for the `assign task` template. | `"[Action] You've been assigned to a task"` |
+| `email.templates.detection` | We use templates to send notifications, this allow you to bring your own `Mailgun` templates, by default `'detection'`. | `"detection"` |
+| `email.templates.disabled` | The template which is send when an account is disabled due to reaching its upload limit, by default `'disabled'`. | `"disabled"` |
+| `email.templates.highupload` | The template which is send when an account is reaching a specific upload threshold, by default `'threshold'`. | `"highupload"` |
+| `email.templates.device` | The template which is send when a camera goes online or offline, by default `'device'`. | `"device"` |
+| `email.templates.alertTitle` | Email subject title for the `alert` template. | `"[Alert] Kerberos Hub detected something an event"` |
+| `email.templates.deviceTitle` | Email subject title for the `device` template. | `"[Device] A Kerberos Agent's status has been changed"` |
+| `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
+| `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
+| `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
+| `kerberoshub.forwarder.repository` | The Docker container which orchestrates forwarding coming from different Kerberos Vaults. | `""` |
+| `kerberoshub.forwarder.tag` | The Docker image tag/version. | `""` |
+| `kerberoshub.frontend.ssoDomain` | The domain that's being used to activate SSO from the login page. | `""` |
+| `kerberoshub.frontend.stripe.apikey` | If using the public version, `stripe` can be used for automated billing and subscriptions. | `""` |
 
-| `kerberoshub.frontend.zendesk.url`            | No longer used.                                                                                                           | `""`  |
-| `kerberoshub.cleanup.repository`              | The Docker container that is responsible for cleaning up the Kerberos Hub API content and related MongoDB collections.    | `""`  |
-| `kerberoshub.cleanup.pullPolicy`              | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberoshub.cleanup.tag`                     | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberoshub.forwarder.repository`            | The Docker container which orchestrates forwarding coming from different Kerberos Vaults.                                 | `""`  |
-| `kerberoshub.forwarder.pullPolicy`            | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberoshub.forwarder.tag`                   | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberoshub.monitordevice.repository`        | The monitoring microservice, following up the status of your cameras and Kerberos Agents.                                 | `""`  |
-| `kerberoshub.monitordevice.pullPolicy`        | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberoshub.monitordevice.tag`               | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.event.repository`           | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice.                               | `""`  |
-| `kerberospipeline.event.pullPolicy`           | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.event.tag`                  | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.monitor.repository`         | The [monitoring microservice](https://doc.kerberos.io/hub/pipeline/#monitoring), calculating metrics of incoming messages.| `""`  |
-| `kerberospipeline.monitor.pullPolicy`         | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.monitor.tag`                | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.sequence.repository`        | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups.      | `""`  |
-| `kerberospipeline.sequence.pullPolicy`        | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.sequence.tag`               | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.throttler.repository`       | The [throttler microservice](https://doc.kerberos.io/hub/pipeline/#throttler), throttling events.                         | `""`  |
-| `kerberospipeline.throttler.pullPolicy`       | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.throttler.tag`              | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.notify.repository`          | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events.     | `""`  |
-| `kerberospipeline.notify.pullPolicy`          | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.notify.tag`                 | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.notifyTest.repository`      | The notification service for testing, the different channels.                                                             | `""`  |
-| `kerberospipeline.notifyTest.pullPolicy`      | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.notifyTest.tag`             | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.analysis.repository`        | The [analysis microservices](https://doc.kerberos.io/hub/pipeline/#analyser) which executed specific analysis in parallel.| `""`  |
-| `kerberospipeline.analysis.pullPolicy`        | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.analysis.tag`               | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.dominantColor.repository`   | The dominant color microservices is computing a top 3 color histogram.                                                    | `""`  |
-| `kerberospipeline.dominantColor.pullPolicy`   | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.dominantColor.tag`          | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.thumbnail.repository`       | The thumbnail microservices generated a thumbnail for a recordings.                                                       | `""`  |
-| `kerberospipeline.thumbnail.pullPolicy`       | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.thumbnail.tag`              | The Docker image tag/version.                                                                                             | `""`  |
-| `kerberospipeline.counting.repository`        | The counting microservices computes objects passing different line segments.                                              | `""`  |
-| `kerberospipeline.counting.pullPolicy`        | The Docker registry pull policy.                                                                                          | `""`  |
-| `kerberospipeline.counting.tag`               | The Docker image tag/version.                                                                                             | `""`  |
 ### Post installation
 
 After the installation you'll need to initialise the Mongodb with some objects. Have a look at the `mongodb/` folder, you'll find three files available:
@@ -319,7 +461,7 @@ After the installation you'll need to initialise the Mongodb with some objects.
 
 Open your favourite Mongodb client (or cli) and connect to your Mongodb database as previously created (or have already installed). Import the previous mentioned `.nosql` files into a new database called `Kerberos`.
 
-<img width="1037" alt="Screenshot 2021-05-24 at 16 01 24" src="https://user-images.githubusercontent.com/1546779/119358865-4fd84300-bca9-11eb-8ea1-82998f88d3d8.png">
+![Open the Mongodb client](assets/images/mongodb-client.png)
 
 Once done you should be able to sign in with following credentials:
 
@@ -330,25 +472,48 @@ Please note that the default username and password can be changed [by the changi
 
 ### Subscription settings
 
-Once the collections are loaded in the Mongodb instance, you should see the `user`, `subscriptons` and `settings` collections. Those three collections will allow a user to login into the Kerberos Hub web interface, using the previously mentioned username and password. 
+Once the collections are loaded in the Mongodb instance, you should see the `user`, `subscriptons` and `settings` collections. Those three collections will allow a user to login into the Kerberos Hub web interface, using the previously mentioned username and password.
 
-Next to that, in the `subscriptions` collection you will find a subscription for that specific user. The subscription specifies which kind of access the user has in terms of features and upload quota. 
+Next to that, in the `subscriptions` collection you will find a subscription for that specific user. The subscription specifies which kind of access the user has in terms of features and upload quota.
 
 Building further on those `subscriptions`, you will find a `settings` collection that contains the quota for each `subscription`.
 
+### Settings collection
+
+As mentioned during the Post installation step, you'll import some `.nosql` files. The `settings.nosql` file includes all the relevant configurations and parameters that allow you to tweak the Kerberos Hub deployment (dynamically).
+
+#### Classifications
+
+Within the Kerberos Hub front-end you'll see the option to filter through classifications. This filtered is stored in the `settings` collection. By changing the entries of the `classifications` object, you can add, edit or remove items from the filters.
+
 ### Indexing
 
-Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance.
+Following indexes should be executed on the MongoDB database (Kerberos) to improve future performance. Within Kerberos Hub several queries are executed, following indexes will improve the loading times. If not applied you might experience application timeouts or reduced performance when storing lots of data.
 
-    db.getCollection('sequences').createIndex({user_id:1, end:1, start: -1, devices: 1})
+#### Sequences collection
 
-    db.getCollection('sequences').createIndex({user_id:1, end:1, start: 1, "images.instanceName": 1})
-    
+    db.getCollection('sequences').createIndex({start:1})
     db.getCollection('sequences').createIndex({user_id:1, "images.key":1})
+    db.getCollection('sequences').createIndex({user_id:1, end:1, start: -1, devices: 1})
+    db.getCollection('sequences').createIndex({user_id:1, end:1, start: 1, "images.instanceName": 1})
 
-    db.getCollection("notifications").createIndex({"user":1})
+#### Notifications collection
 
-    db.getCollection("analysis").createIndex({"key":1})
+    db.getCollection("notifications").createIndex({userid:1})
+    db.getCollection("notifications").createIndex({userid:1, timestamp:1})
+    db.getCollection("notifications").createIndex({alert_master_user:1, media_key: 1})
+
+#### Analysis collection
+
+    db.getCollection("analysis").createIndex({start:1})
+    db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
+    db.getCollection("analysis").createIndex({userid:1, key:1})
+    db.getCollection("analysis").createIndex({userid:1, start:1})
+
+#### Heatmap collection
+
+    db.getCollection("heatmap").createIndex({timestamp:1})
+    db.getCollection("heatmap").createIndex({user_id:1, timestamp: 1})
 
 # Upgrade
 
@@ -360,16 +525,15 @@ The first argument is the helm project name, you could find this out by running
 
 # Building
 
-To build a new release the following steps needs to be executed.
+To build a new release the following steps needs to be executed. Please note that this repository has a Github action which automatically releases new a Helm chart version.
 
     cd hub
-    helm lint 
+    helm lint
 
     cd ..
     helm package hub
     mv hub-*.tgz hub
 
-    helm repo index hub --url https://kerberos-io.github.io/hub
+    helm repo index hub --url https://charts.kerberos.io/hub
     cd hub
     cat index.yaml
-    

charts/hub/cert-manager/cluster-issuer.yaml

@@ -1,18 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: letsencrypt-prod
-spec:
-  acme:
-    # The ACME server URL
-    server: https://acme-v02.api.letsencrypt.org/directory
-    # Email address used for ACME registration
-    email: cedric@verstraeten.io
-    # Name of a secret used to store the ACME account private key
-    privateKeySecretRef:
-      name: letsencrypt-prod
-    # Enable the HTTP-01 challenge provider
-    solvers:
-      - http01:
-          ingress:
-            class: nginx

charts/hub/custom-layout/i18n-custom/custom-i18n-claim.yaml

@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: custom-i18n-claim
+spec:
+  accessModes:
+    - ReadWriteMany
+  storageClassName: azurefile-premium
+  resources:
+    requests:
+      storage: 25Mi

charts/hub/custom-layout/i18n-custom/en.json

@@ -0,0 +1,17 @@
+{
+  "nav": {
+    "cases": "Investigations",
+    "dashboard": "Home",
+    "context": {
+      "label": "Tenant",
+      "title": "Switch tenant",
+      "open": "Choose tenant and project"
+    }
+  },
+  "projects": {
+    "current": "Active project"
+  },
+  "login": {
+    "signInTo": "Sign in to {{domain}} \u2014 Acme Security"
+  }
+}

charts/hub/custom-layout/templates/assign_task.html

@@ -0,0 +1,409 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">Hey, {{assignee}}</h4>
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        padding-bottom: 24px;
+                                        padding-left: 0;
+                                        padding-right: 0;">You have been assigned to a task</h2>
+						<p style="font-family: Inter;
+                                        font-size: 18px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;
+						">Task Details:</p>
+						<ul style="font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 0;
+                                        padding-bottom: 12px;
+                                        padding-left: 0;
+                                        padding-right: 0;
+                                        margin-left: 12px">
+							<li>Task Name: {{task_name}}</li>
+							<li>Assigned By: {{user}}</li>
+						</ul>
+ 						<a style="text-decoration: none;color: none;" href="{{link}}">
+                            <p style="font-family: Inter;
+                                                font-size: 14px;
+                                                font-style: normal;
+                                                line-height: 20px;
+                                                mso-line-height-rule:exactly;
+                                                letter-spacing: 0em;
+                                                text-align: left;
+                                                color:#FFFFFF;
+                                                background-color: #84559F;
+                                                padding-top: 6px;
+                                                padding-bottom: 6px;
+                                                padding-right: 16px;
+                                                padding-left: 16px;
+                                                width: 166px;
+                                                border-radius: 4px;
+                                                cursor: pointer;">View task on kerberos hub</p>
+                        </a>
+						
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@verstraeten.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/assign_task.txt

@@ -0,0 +1,19 @@
+Kerberos.io
+------------
+
+Hey, {{assignee}}
+You have been assigned to a new task on Kerberos Hub.
+Task Details:
+- Task Name: {{task_name}}
+- Assigned By: {{user}}
+- Link: {{link}}
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/detection.html

@@ -1,3 +1,31 @@
+package templates
+
+var TEMPLATE_DETECTION_TEXT = `
+Kerberos.io
+------------
+
+Hey, {{user}}
+Welcome to Kerberos Hub
+Activate your account ->
+{{link}}
+
+Kerberos Hub in a nutshell
+With Kerberos Hub you can access your surveillance media remotely. By subscribing to a plan, you get access to a set of features, from advanced filtering, notifications to machine learning.
+
+However before you get started this amazing applications, please activate your account.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.
+`
+
+var TEMPLATE_DETECTION = `
 <!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
 <html xmlns="http://www.w3.org/1999/xhtml">
 <head>
@@ -275,10 +303,25 @@
                                         letter-spacing: 0em;
                                         text-align: left;
                                         color: #6D6666;
-                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered. Please watch the recording, by clicking on below button. 
+                                        margin-top: 12px;">An alert was send to your e-mail as one of the conditions was triggered for your device <b>{{devicename}}</b>. Please watch the recording, by clicking on below button. 
 If you believe this event is a false positive, go to your Kerberos Hub account and change the alert settings accordingly.</p>
 
 
+                        <p style=" font-family: Inter;
+                        font-size: 14px;
+                        font-style: normal;
+                        font-weight: 400;
+                        line-height: 24px;
+                        mso-line-height-rule:exactly;
+                        letter-spacing: 0em;
+                        text-align: left;
+                        color: #6D6666;
+                        margin-top: 12px;">Following event was detected at {{datetime}}.</p>
+
+						<a style="text-decoration: none;color: none;" href="{{link}}">
+                            {{thumbnail}}
+                        </a>
+
 						<a style="text-decoration: none;color: none;" href="{{link}}">
                             <p style="font-family: Inter;
                                                 font-size: 14px;
@@ -429,4 +472,4 @@ If you believe this event is a false positive, go to your Kerberos Hub account a
     </tr>
 </table>
 </body>
-</html>
+</html>`

charts/hub/custom-layout/templates/share_case.html

@@ -0,0 +1,418 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">A case has been shared with you</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">{{user}} shared a case with you</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Open the shared case</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">{{user}} has shared a case with you. Click the button below to open it. You'll be asked to request a one-time verification code from the share page itself.<br/><br/>This link will expire in {{expiry}}.</p>
+
+
+						<a style="text-decoration: none;color: none;" href="{{url}}">
+                            <p style="font-family: Inter;
+                                                font-size: 14px;
+                                                font-style: normal;
+                                                line-height: 24px;
+                                                mso-line-height-rule:exactly;
+                                                letter-spacing: 0em;
+                                                text-align: left;
+                                                color:#FFFFFF;
+                                                background-color: #84559F;
+                                                padding-top: 6px;
+                                                padding-bottom: 6px;
+                                                padding-right: 16px;
+                                                padding-left: 16px;
+                                                width: 130px;
+                                                border-radius: 4px;
+												text-align: center;
+                                                cursor: pointer;">Open case -></p>
+                        </a>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+A case has been shared with you
+{{user}} shared a case with you
+
+Open the shared case
+{{user}} has shared a case with you. Open the link below to access it — you'll be asked to request a one-time verification code from the share page.
+{{url}}
+
+This link will expire in {{expiry}}.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/custom-layout/templates/share_case_otp.html

@@ -0,0 +1,425 @@
+<!DOCTYPE html PUBLIC "-//W3C//DTD XHTML 1.0 Transitional//EN" "http://www.w3.org/TR/xhtml1/DTD/xhtml1-transitional.dtd">
+<html xmlns="http://www.w3.org/1999/xhtml">
+<head>
+    
+    <meta http-equiv="X-UA-Compatible" content="IE=edge" />
+    <meta http-equiv="Content-Type" content="text/html; charset=utf-8" />
+    <meta
+            name="viewport"
+            content="width=device-width, initial-scale=1, minimum-scale=1, maximum-scale=1"
+    />
+    <meta name="description" content="Kerberos.io Mailing">
+    <style type="text/css">
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 400;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Regular.woff?v=/dist/fonts/Inter-Regular.woff2?v=3.183.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 500;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-Medium.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-Medium.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter';
+            font-style:  normal;
+            font-weight: 600;
+            font-display: swap;
+            src: url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff2?v=3.18") format("woff2"),
+            url("https://kerberos.io/dist/fonts/Inter-SemiBold.woff?v=3.18") format("woff");
+        }
+
+        @font-face {
+            font-family: 'Inter var';
+            font-weight: 100 900;
+            font-display: swap;
+            font-style: normal;
+            font-named-instance: 'Regular';
+            src: url("https://kerberos.io/dist/fonts/Inter-roman.var.woff2?v=3.18") format("woff2");
+        }
+
+        body{
+            background: #E5E5E5;
+            margin-top:0;
+            margin-bottom: 0;
+            margin-right: 0;
+            margin-left: 0;
+            padding-top: 0;
+            padding-left: 0;
+            padding-right: 0;
+            padding-bottom: 0;
+            font-family: 'Inter';
+        }
+        a, a:hover, a:active {
+            color: #262424;
+            text-decoration: none;
+        }
+
+        .corner-td{
+            width: 60px;
+        }
+
+        table {border-collapse:separate;max-width: 850px; margin: 0 auto; width: 100%;}
+        .ExternalClass p, .ExternalClass span, .ExternalClass font, .ExternalClass td {line-height: 100%;}
+        .ExternalClass {width: 100%;}
+        @media screen and (max-width:500px){
+            .tab-td{
+                padding-left: 10px!important;
+            }
+            .tab-td a h4{
+                font-size: 14px!important;
+            }
+            .corner-td{
+                width: 20px!important;
+            }
+            .company-name-td h3{
+                font-size: 16px!important;
+            }
+            table.header-table{
+                padding-top: 8px!important;
+                padding-right: 0px!important;
+                padding-bottom: 24px!important;
+                padding-left: 0px!important;
+            }
+            .colored-card-td  h4{
+                font-size: 14px!important;
+            }
+            .colored-card-td  h2{
+                font-size: 20px!important;
+            }
+            .colored-card-td  a p{
+                font-size: 12px!important;
+                width: 143px!important;
+            }
+            .colored-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td{
+                padding-top: 24px!important;
+                padding-right: 24px!important;
+                padding-bottom: 24px!important;
+                padding-left: 24px!important;
+            }
+            .colorless-card-td h3{
+                font-size: 18px!important;
+            }
+            .colorless-card-td p{
+                font-size: 14px!important;
+            }
+            .colorless-card-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 24px!important;
+                margin-bottom: 24px!important;
+            }
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:600px) {
+            .footer-td{
+                display: table-row!important;
+            }
+        }
+        @media screen and (max-width:650px) {
+            .footer-table{
+                margin-left: 0px!important;
+                margin-right: 0px!important;
+                margin-top: 0px!important;
+                margin-bottom: 36px!important;
+            }
+        }
+    </style>
+</head>
+<body height="100%" width="100%">
+<table border="0" cellpadding="0" cellspacing="0" width="100%" bgcolor="E5E5E5" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" height="36" class="header-table" style="padding-top: 36px ;padding-right: 0;padding-bottom: 36px;padding-left: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td width="48" height="36" align="left"><img alt="Kerberos.io" width="36" height="36"  src="https://kerberos.io/images/email/kerberos.png"/></td>
+                    <td height="36" align="left" class="company-name-td">
+                        <h3  width="36" height="36" style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;">Kerberos.io</h3>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td" align="right">
+                        <a style="text-decoration: none;color: none;" href={{tab1_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab1_title}}</h4>
+                        </a>
+                    </td>
+                    <td  height="36" width="36" style="padding-left: 36px;" class="tab-td"  align="right" >
+                        <a style="text-decoration: none;color: none;" href={{tab2_href}}>
+                            <h4 style="font-family: Inter;
+                                            font-size: 16px;
+                                            font-style: normal;
+                                            font-weight: 500;
+                                            line-height: 36px;
+                                            mso-line-height-rule:exactly;
+                                            letter-spacing: 0em;
+                                            text-align: right;
+                                            color: #6D6666;">{{tab2_title}}</h4>
+                        </a>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;" >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td class="colored-card-td" bgcolor="#57356B"  style="padding-left: 48px;padding-right: 48px;padding-top: 48px;padding-bottom: 48px;border-radius: 4px;background-color:#57356B;">
+                        <h2 style=" font-family: Inter;
+                                        font-size: 24px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#FFFFFF;
+                                        padding-top: 12px;
+                                        margin-bottom: 0;
+                                        padding-bottom: 0;
+                                        padding-left: 0;
+                                        padding-right: 0;">Verify your access</h2>
+                        <h4 style="font-family: Inter;
+                                        font-size: 16px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color:#b09fb9;">Use the code below to open the shared case</h4>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="colorless-card-table" style="margin-top: 36px;margin-bottom: 36px;margin-left: 0;margin-right: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <td  class="colorless-card-td" bgcolor="#FFFFFF" style="background-color:#FFFFFF;padding-top: 36px;padding-right: 43px;padding-bottom: 25px;padding-left: 43px;border-radius: 4px;">
+                        <h3 style=" font-family: Inter;
+                                        font-size: 20px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 36px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #262424;
+                                        width: 280px">Your verification code</h3>
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;
+                                        margin-top: 12px;">Enter the code below on the share page to access the case.</p>
+
+                        <p style="font-family: 'Courier New', Courier, monospace;
+                                        font-size: 32px;
+                                        font-style: normal;
+                                        font-weight: 600;
+                                        line-height: 40px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 8px;
+                                        text-align: center;
+                                        color:#262424;
+                                        background-color: #F2F0F4;
+                                        padding-top: 16px;
+                                        padding-bottom: 16px;
+                                        padding-right: 16px;
+                                        padding-left: 16px;
+                                        margin-top: 16px;
+                                        margin-bottom: 16px;
+                                        border-radius: 4px;">{{code}}</p>
+
+                        <p style=" font-family: Inter;
+                                        font-size: 14px;
+                                        font-style: normal;
+                                        font-weight: 400;
+                                        line-height: 24px;
+                                        mso-line-height-rule:exactly;
+                                        letter-spacing: 0em;
+                                        text-align: left;
+                                        color: #6D6666;">This code expires in {{expiry}}. If you didn't request this, you can safely ignore this email.</p>
+					</td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+<table border="0" cellpadding="0" cellspacing="0" width="100%"  bgcolor="E5E5E5"  style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+    <tr>
+        <td bgcolor="E5E5E5">
+            <table border="0" cellpadding="0" cellspacing="0" width="100%" class="footer-table" style="margin-top: 0;border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;"  >
+                <tbody>
+                <tr>
+                    <td class="corner-td" align="left"></td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td height="146" width="190" class="footer-td" style="margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">Get in touch</h4>
+                                    <a style="text-decoration: none;color: none;" href="mailto:support@kerberos.io">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 16px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">support@kerberos.io</p>
+                                    </a>
+                                    <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                    line-height: 16px;
+                                    mso-line-height-rule:exactly;
+                                    letter-spacing: 0em;
+                                    text-align: left;
+                                    color: #A69D9D;">9000 Ghent, BE</p>
+
+                                    <a style="text-decoration: none;color: none;" href="https://kerberos.io/">
+                                        <p style=" font-family: Inter;
+                                                            font-size: 14px;
+                                                            font-style: normal;
+                                                            font-weight: 400;
+                                                            line-height: 24px;
+                                                            mso-line-height-rule:exactly;
+                                                            letter-spacing: 0em;
+                                                            text-align: left;
+                                                            color: #A69D9D;">https://kerberos.io</p>
+                                    </a>
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <!--[if mso | IE]>
+                    <table role="presentation" border="0" cellpadding="0" cellspacing="0"><tr><td style="vertical-align:top;display:table-row !important">
+                    <![endif]-->
+                    <td class="footer-td" style="border-radius: 4px;padding-left: 0;padding-right: 0;padding-top: 0;padding-bottom: 0; margin-bottom: 12px;"  valign="top" align="left">
+                        <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                            <tbody>
+                            <tr>
+                                <td>
+                                    <h4 style=" font-family: Inter;
+                                                        font-size: 16px;
+                                                        font-style: normal;
+                                                        font-weight: 600;
+                                                        line-height: 36px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color:#6D6666;">About Kerberos</h4>
+                                    <p style=" font-family: Inter;
+                                                        font-size: 14px;
+                                                        font-style: normal;
+                                                        font-weight: 400;
+                                                        line-height: 24px;
+                                                        mso-line-height-rule:exactly;
+                                                        letter-spacing: 0em;
+                                                        text-align: left;
+                                                        color: #A69D9D;">Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.</p>
+                                                        
+                                    
+                                    <p style="margin-top: 12px;">
+                                        <a href="https://twitter.com/kerberosio" style="text-decoration: none;color: none;">
+                                            <img width="24" height="24" alt="Twitter" src="https://kerberos.io/images/email/twitter.png"/>
+                                        </a>
+                                        <a href="https://reddit.com/r/kerberos_io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Reddit" src="https://kerberos.io/images/email/reddit.png"/>
+                                        </a>
+                                        <a href="https://www.youtube.com/channel/UCnd9q7iRNNw4W95eQwQuECA" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Youtube" src="https://kerberos.io/images/email/youtube.png"/>
+                                        </a>
+                                        <a href="https://github.com/kerberos-io" style="text-decoration: none;color: none;">
+                                            <img g width="24" height="24" alt="Github" src="https://kerberos.io/images/email/github.png"/>
+                                        </a>
+                                    </p>                
+                                </td>
+                            </tr>
+                            </tbody>
+                        </table>
+                    </td>
+                    <td class="corner-td" align="right"></td>
+                </tr>
+                </tbody>
+            </table>
+            <table style="border-collaps:collaps; mso-table-lspace:0pt; mso-table-rspace:0pt;">
+                <tbody>
+                    <tr style="height: 50px">
+                        <td></td>
+                    </tr>
+                </tbody>
+            </table>
+        </td>
+    </tr>
+</table>
+</body>
+</html>

charts/hub/custom-layout/templates/share_case_otp.txt

@@ -0,0 +1,21 @@
+Kerberos.io
+------------
+
+Verify your access
+Use the code below to open the shared case
+
+Your verification code
+{{code}}
+
+Enter this code on the share page to access the case. This code expires in {{expiry}}.
+If you didn't request this, you can safely ignore this email.
+
+Get in touch
+------------
+support@kerberos.io
+9000 Ghent, BE
+https://kerberos.io
+
+About Kerberos
+------------
+Welcome to the revolutionary video analytics and video management platform. Open, modular, and extensible for everyone, anywhere.

charts/hub/examples/hub-api-server-tls-secret.yaml

@@ -0,0 +1,17 @@
+apiVersion: v1
+kind: Secret
+metadata:
+  name: hub-api-server-tls
+  namespace: kerberos-hub
+type: kubernetes.io/tls
+stringData:
+  # Paste your PEM certificate chain here (e.g., fullchain.pem)
+  tls.crt: |
+    -----BEGIN CERTIFICATE-----
+    REPLACE_WITH_YOUR_CERTIFICATE
+    -----END CERTIFICATE-----
+  # Paste your PEM private key here (e.g., privkey.pem)
+  tls.key: |
+    -----BEGIN PRIVATE KEY-----
+    REPLACE_WITH_YOUR_PRIVATE_KEY
+    -----END PRIVATE KEY-----

charts/hub/mongodb/fast.yaml

@@ -1,7 +0,0 @@
-apiVersion: storage.k8s.io/v1
-kind: StorageClass
-metadata:
-  name: fast
-provisioner: kubernetes.io/gce-pd
-parameters:
-  type: pd-ssd

charts/hub/mongodb/settings.nosql

@@ -65,4 +65,22 @@ db.settings.insertMany([
             "dayLimit" : NumberInt(30)
         }
     }
+},
+{ 
+    "_id" : ObjectId("63f346ec64011a574161cf99"), 
+    "key" : "classifications", 
+    "map" : {
+        "objects" : [
+            {
+                "text" : "Car", 
+                "value" : "car", 
+                "icon" : "car"
+            }, 
+            {
+                "text" : "Person", 
+                "value" : "pedestrian", 
+                "icon" : "pedestrian"
+            }
+        ]
+    }
 }])

charts/hub/mongodb/values.yaml

@@ -1,932 +0,0 @@
-## Global Docker image parameters
-## Please, note that this will override the image parameters, including dependencies, configured to use the global value
-## Current available global Docker image parameters: imageRegistry and imagePullSecrets
-##
-# global:
-#   imageRegistry: myRegistryName
-#   imagePullSecrets:
-#     - myRegistryKeySecretName
-#   storageClass: myStorageClass
-## Override the namespace for resource deployed by the chart, but can itself be overridden by the local namespaceOverride
-#   namespaceOverride: my-global-namespace
-
-image:
-  ## Bitnami MongoDB registry
-  ##
-  registry: docker.io
-  ## Bitnami MongoDB image name
-  ##
-  repository: bitnami/mongodb
-  ## Bitnami MongoDB image tag
-  ## ref: https://hub.docker.com/r/bitnami/mongodb/tags/
-  ##
-  tag: 4.4.2-debian-10-r0
-  ## Specify a imagePullPolicy
-  ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-  ##
-  pullPolicy: IfNotPresent
-  ## Optionally specify an array of imagePullSecrets.
-  ## Secrets must be manually created in the namespace.
-  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-  ##
-  # pullSecrets:
-  #   - myRegistryKeySecretName
-
-  ## Set to true if you would like to see extra information on logs
-  ## It turns on Bitnami debugging in minideb-extras-base
-  ## ref:  https://github.com/bitnami/minideb-extras-base
-  debug: false
-
-## String to partially override mongodb.fullname template (will maintain the release name)
-##
-# nameOverride:
-
-## String to fully override mongodb.fullname template
-##
-# fullnameOverride:
-
-## Kubernetes Cluster Domain
-##
-clusterDomain: cluster.local
-
-## Use an alternate scheduler, e.g. "stork".
-## ref: https://kubernetes.io/docs/tasks/administer-cluster/configure-multiple-schedulers/
-##
-# schedulerName:
-
-## MongoDB architecture. Allowed values: standalone or replicaset
-##
-architecture: standalone
-
-## Use StatefulSet instead of Deployment when deploying standalone
-##
-useStatefulSet: false
-
-## MongoDB Authentication parameters
-##
-auth:
-  ## Enable authentication
-  ## ref: https://docs.mongodb.com/manual/tutorial/enable-authentication/
-  ##
-  enabled: true
-  ## MongoDB root password
-  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#setting-the-root-password-on-first-run
-  ##
-  rootPassword: "yourmongodbpassword"
-  ## MongoDB custom user and database
-  ## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#creating-a-user-and-database-on-first-run
-  ##
-  # username: username
-  # password: password
-  # database: database
-  ## Key used for replica set authentication
-  ## Ignored when mongodb.architecture=standalone
-  ##
-  replicaSetKey: ""
-
-  ## Existing secret with MongoDB credentials
-  ## NOTE: When it's set the previous parameters are ignored.
-  ##
-  # existingSecret: name-of-existing-secret
-
-tls:
-  ## Enable or disable MongoDB TLS Support
-  enabled: false
-  ##
-  ## Bitnami Nginx image
-  ##
-  image:
-    registry: docker.io
-    repository: bitnami/cert-manager
-    tag: 1.19.4-debian-10-r19
-    pullPolicy: IfNotPresent
-
-## Name of the replica set
-## Ignored when mongodb.architecture=standalone
-##
-replicaSetName: rs0
-
-## Enable DNS hostnames in the replica set config
-## Ignored when mongodb.architecture=standalone
-## Ignored when externalAccess.enabled=true
-##
-replicaSetHostnames: true
-
-## Whether enable/disable IPv6 on MongoDB
-## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-ipv6
-##
-enableIPv6: false
-
-## Whether enable/disable DirectoryPerDB on MongoDB
-## ref: https://github.com/bitnami/bitnami-docker-mongodb/blob/master/README.md#enabling/disabling-directoryperdb
-##
-directoryPerDB: false
-
-## MongoDB System Log configuration
-## ref: https://github.com/bitnami/bitnami-docker-mongodb#configuring-system-log-verbosity-level
-##
-systemLogVerbosity: 0
-disableSystemLog: false
-
-## MongoDB configuration file for Primary and Secondary nodes. For documentation of all options, see:
-##   http://docs.mongodb.org/manual/reference/configuration-options/
-## Example:
-## configuration: |-
-##   # where and how to store data.
-##   storage:
-##     dbPath: /bitnami/mongodb/data/db
-##     journal:
-##       enabled: true
-##     directoryPerDB: false
-##   # where to write logging data
-##   systemLog:
-##     destination: file
-##     quiet: false
-##     logAppend: true
-##     logRotate: reopen
-##     path: /opt/bitnami/mongodb/logs/mongodb.log
-##     verbosity: 0
-##   # network interfaces
-##   net:
-##     port: 27017
-##     unixDomainSocket:
-##       enabled: true
-##       pathPrefix: /opt/bitnami/mongodb/tmp
-##     ipv6: false
-##     bindIpAll: true
-##   # replica set options
-##   #replication:
-##     #replSetName: replicaset
-##     #enableMajorityReadConcern: true
-##   # process management options
-##   processManagement:
-##      fork: false
-##      pidFilePath: /opt/bitnami/mongodb/tmp/mongodb.pid
-##   # set parameter options
-##   setParameter:
-##      enableLocalhostAuthBypass: true
-##   # security options
-##   security:
-##     authorization: disabled
-##     #keyFile: /opt/bitnami/mongodb/conf/keyfile
-##
-configuration: ""
-
-## ConfigMap with MongoDB configuration for Primary and Secondary nodes
-## NOTE: When it's set the arbiter.configuration parameter is ignored
-##
-# existingConfigmap:
-
-## initdb scripts
-## Specify dictionary of scripts to be run at first boot
-## Example:
-## initdbScripts:
-##   my_init_script.sh: |
-##      #!/bin/bash
-##      echo "Do something."
-initdbScripts: {}
-
-## Existing ConfigMap with custom init scripts
-##
-# initdbScriptsConfigMap:
-
-## Command and args for running the container (set to default if not set). Use array form
-##
-# command:
-# args:
-
-## Additional command line flags
-## Example:
-## extraFlags:
-##  - "--wiredTigerCacheSizeGB=2"
-##
-extraFlags: []
-
-## Additional environment variables to set
-## E.g:
-## extraEnvVars:
-##   - name: FOO
-##     value: BAR
-##
-extraEnvVars: []
-
-## ConfigMap with extra environment variables
-##
-# extraEnvVarsCM:
-
-## Secret with extra environment variables
-##
-# extraEnvVarsSecret:
-
-## Annotations to be added to the MongoDB statefulset. Evaluated as a template.
-##
-annotations: {}
-
-## Additional labels to be added to the MongoDB statefulset. Evaluated as a template.
-##
-labels: {}
-
-## Number of MongoDB replicas to deploy.
-## Ignored when mongodb.architecture=standalone
-##
-replicaCount: 2
-
-## StrategyType for MongoDB statefulset
-## It can be set to RollingUpdate or Recreate by default.
-##
-strategyType: RollingUpdate
-
-## MongoDB should be initialized one by one when building the replicaset for the first time.
-##
-podManagementPolicy: OrderedReady
-
-## Affinity for pod assignment. Evaluated as a template.
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-##
-affinity: {}
-
-## Node labels for pod assignment. Evaluated as a template.
-## ref: https://kubernetes.io/docs/user-guide/node-selection/
-##
-nodeSelector: {}
-
-## Tolerations for pod assignment. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-##
-tolerations: []
-
-## Lables for MongoDB pods. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-##
-podLabels: {}
-
-## Annotations for MongoDB pods. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-##
-podAnnotations: {}
-
-## MongoDB pods' priority.
-## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
-##
-# priorityClassName: ""
-
-## MongoDB pods' Security Context.
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
-##
-podSecurityContext:
-  enabled: true
-  fsGroup: 1001
-  ## sysctl settings
-  ## Example:
-  ## sysctls:
-  ## - name: net.core.somaxconn
-  ##   value: "10000"
-  ##
-  sysctls: []
-
-## MongoDB containers' Security Context (main and metrics container).
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
-##
-containerSecurityContext:
-  enabled: true
-  runAsUser: 1001
-  runAsNonRoot: true
-
-## MongoDB containers' resource requests and limits.
-## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-##
-resources:
-  # We usually recommend not to specify default resources and to leave this as a conscious
-  # choice for the user. This also increases chances charts run on environments with little
-  # resources, such as Minikube. If you do want to specify resources, uncomment the following
-  # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-  limits:
-    cpu: 2048m
-    memory: 4096Mi
-  requests:
-    cpu: 512m
-    memory: 1024Mi
-
-## MongoDB pods' liveness and readiness probes. Evaluated as a template.
-## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
-##
-livenessProbe:
-  enabled: true
-  initialDelaySeconds: 30
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 6
-  successThreshold: 1
-readinessProbe:
-  enabled: true
-  initialDelaySeconds: 5
-  periodSeconds: 10
-  timeoutSeconds: 5
-  failureThreshold: 6
-  successThreshold: 1
-
-## Custom Liveness probes for MongoDB pods
-##
-customLivenessProbe: {}
-
-## Custom Rediness probes MongoDB pods
-##
-customReadinessProbe: {}
-
-## Add init containers to the MongoDB pods.
-## Example:
-## initContainers:
-##   - name: your-image-name
-##     image: your-image
-##     imagePullPolicy: Always
-##     ports:
-##       - name: portname
-##         containerPort: 1234
-##
-initContainers: {}
-
-## Add sidecars to the MongoDB pods.
-## Example:
-## sidecars:
-##   - name: your-image-name
-##     image: your-image
-##     imagePullPolicy: Always
-##     ports:
-##       - name: portname
-##         containerPort: 1234
-##
-sidecars: {}
-
-## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB pods
-## Examples:
-## extraVolumeMounts:
-##   - name: extras
-##     mountPath: /usr/share/extras
-##     readOnly: true
-## extraVolumes:
-##   - name: extras
-##     emptyDir: {}
-extraVolumeMounts: []
-extraVolumes: []
-
-## MongoDB Pod Disruption Budget configuration
-## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-##
-pdb:
-  create: false
-  ## Min number of pods that must still be available after the eviction
-  ##
-  minAvailable: 1
-  ## Max number of pods that can be unavailable after the eviction
-  ##
-  # maxUnavailable: 1
-
-## Enable persistence using Persistent Volume Claims
-## ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-##
-persistence:
-  enabled: true
-  ## A manually managed Persistent Volume and Claim
-  ## Requires persistence.enabled: true
-  ## If defined, PVC must be created manually before volume will be bound
-  ## Ignored when mongodb.architecture=replicaset
-  ##
-  # existingClaim:
-  ## PV Storage Class
-  ## If defined, storageClassName: <storageClass>
-  ## If set to "-", storageClassName: "", which disables dynamic provisioning
-  ## If undefined (the default) or set to null, no storageClassName spec is
-  ## set, choosing the default provisioner.
-  ##
-  # storageClass: "-"
-  ## PV Access Mode
-  ##
-  accessModes:
-    - ReadWriteOnce
-  ## PVC size
-  ##
-  size: 8Gi
-  ## PVC annotations
-  ##
-  annotations: {}
-  ## The path the volume will be mounted at, useful when using different
-  ## MongoDB images.
-  ##
-  mountPath: /bitnami/mongodb
-  ## The subdirectory of the volume to mount to, useful in dev environments
-  ## and one PV for multiple services.
-  ##
-  subPath: ""
-
-## Service parameters
-##
-service:
-  ## Service type
-  ##
-  type: ClusterIP
-  ## MongoDB service port
-  ##
-  port: 27017
-  ## MongoDB service port name
-  ##
-  portName: mongodb
-  ## Specify the nodePort value for the LoadBalancer and NodePort service types.
-  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#type-nodeport
-  ##
-  nodePort: ""
-  ## MongoDB service clusterIP IP
-  ##
-  # clusterIP: None
-  ## Specify the externalIP value ClusterIP service type.
-  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#external-ips
-  ##
-  externalIPs: []
-  ## Specify the loadBalancerIP value for LoadBalancer service types.
-  ## ref: https://kubernetes.io/docs/concepts/services-networking/service/#loadbalancer
-  ##
-  # loadBalancerIP:
-  ## Specify the loadBalancerSourceRanges value for LoadBalancer service types.
-  ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
-  ##
-  loadBalancerSourceRanges: []
-  ## Provide any additional annotations which may be required. Evaluated as a template
-  ##
-  annotations: {}
-
-## External Access to MongoDB nodes configuration
-##
-externalAccess:
-  ## Enable Kubernetes external cluster access to MongoDB nodes
-  ##
-  enabled: false
-  ## External IPs auto-discovery configuration
-  ## An init container is used to auto-detect LB IPs or node ports by querying the K8s API
-  ## Note: RBAC might be required
-  ##
-  autoDiscovery:
-    ## Enable external IP/ports auto-discovery
-    ##
-    enabled: false
-    ## Bitnami Kubectl image
-    ## ref: https://hub.docker.com/r/bitnami/kubectl/tags/
-    ##
-    image:
-      registry: docker.io
-      repository: bitnami/kubectl
-      tag: 1.18.12-debian-10-r2
-      ## Specify a imagePullPolicy
-      ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-      ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-      ##
-      pullPolicy: IfNotPresent
-      ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
-      ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-      ## Example:
-      ## pullSecrets:
-      ##   - myRegistryKeySecretName
-      ##
-      pullSecrets: []
-    ## Init Container resource requests and limits
-    ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-    ##
-    resources:
-      # We usually recommend not to specify default resources and to leave this as a conscious
-      # choice for the user. This also increases chances charts run on environments with little
-      # resources, such as Minikube. If you do want to specify resources, uncomment the following
-      # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-      limits: {}
-      #   cpu: 100m
-      #   memory: 128Mi
-      requests: {}
-      #   cpu: 100m
-      #   memory: 128Mi
-  ## Parameters to configure K8s service(s) used to externally access MongoDB
-  ## A new service per broker will be created
-  ##
-  service:
-    ## Service type. Allowed values: LoadBalancer or NodePort
-    ##
-    type: LoadBalancer
-    ## Port used when service type is LoadBalancer
-    ##
-    port: 27017
-    ## Array of load balancer IPs for each MongoDB node. Length must be the same as replicaCount
-    ## Example:
-    ## loadBalancerIPs:
-    ##   - X.X.X.X
-    ##   - Y.Y.Y.Y
-    ##
-    loadBalancerIPs: []
-    ## Load Balancer sources
-    ## ref: https://kubernetes.io/docs/tasks/access-application-cluster/configure-cloud-provider-firewall/#restrict-access-for-loadbalancer-service
-    ## Example:
-    ## loadBalancerSourceRanges:
-    ## - 10.10.10.0/24
-    ##
-    loadBalancerSourceRanges: []
-    ## Array of node ports used for each MongoDB nodes. Length must be the same as replicaCount
-    ## Example:
-    ## nodePorts:
-    ##   - 30001
-    ##   - 30002
-    ##
-    nodePorts: []
-    ## When service type is NodePort, you can specify the domain used for MongoDB advertised hostnames.
-    ## If not specified, the container will try to get the kubernetes node external IP
-    ##
-    # domain: mydomain.com
-    ## Provide any additional annotations which may be required. Evaluated as a template
-    ##
-    annotations: {}
-
-##
-## MongoDB Arbiter parameters.
-##
-arbiter:
-  ## Enable deploying the MongoDB Arbiter
-  ##   https://docs.mongodb.com/manual/tutorial/add-replica-set-arbiter/
-  enabled: true
-
-  ## MongoDB configuration file for the Arbiter. For documentation of all options, see:
-  ##   http://docs.mongodb.org/manual/reference/configuration-options/
-  ##
-  configuration: ""
-
-  ## ConfigMap with MongoDB configuration for the Arbiter
-  ## NOTE: When it's set the arbiter.configuration parameter is ignored
-  ##
-  # existingConfigmap:
-
-  ## Command and args for running the container (set to default if not set). Use array form
-  ##
-  # command:
-  # args:
-
-  ## Additional command line flags
-  ## Example:
-  ## extraFlags:
-  ##  - "--wiredTigerCacheSizeGB=2"
-  ##
-  extraFlags: []
-
-  ## Additional environment variables to set
-  ## E.g:
-  ## extraEnvVars:
-  ##   - name: FOO
-  ##     value: BAR
-  ##
-  extraEnvVars: []
-
-  ## ConfigMap with extra environment variables
-  ##
-  # extraEnvVarsCM:
-
-  ## Secret with extra environment variables
-  ##
-  # extraEnvVarsSecret:
-
-  ## Annotations to be added to the Arbiter statefulset. Evaluated as a template.
-  ##
-  annotations: {}
-
-  ## Additional to be added to the Arbiter statefulset. Evaluated as a template.
-  ##
-  labels: {}
-
-  ## Affinity for pod assignment. Evaluated as a template.
-  ## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-  ##
-  affinity: {}
-
-  ## Node labels for pod assignment. Evaluated as a template.
-  ## ref: https://kubernetes.io/docs/user-guide/node-selection/
-  ##
-  nodeSelector: {}
-
-  ## Tolerations for pod assignment. Evaluated as a template.
-  ## ref: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/
-  ##
-  tolerations: []
-
-  ## Lables for MongoDB Arbiter pods. Evaluated as a template.
-  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/
-  ##
-  podLabels: {}
-
-  ## Annotations for MongoDB Arbiter pods. Evaluated as a template.
-  ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-  ##
-  podAnnotations: {}
-
-  ## MongoDB Arbiter pods' priority.
-  ## ref: https://kubernetes.io/docs/concepts/configuration/pod-priority-preemption/
-  ##
-  # priorityClassName: ""
-
-  ## MongoDB Arbiter pods' Security Context.
-  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod
-  ##
-  podSecurityContext:
-    enabled: true
-    fsGroup: 1001
-    ## sysctl settings
-    ## Example:
-    ## sysctls:
-    ## - name: net.core.somaxconn
-    ##   value: "10000"
-    ##
-    sysctls: []
-
-  ## MongoDB Arbiter containers' Security Context (only main container).
-  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-container
-  ##
-  containerSecurityContext:
-    enabled: true
-    runAsUser: 1001
-
-  ## MongoDB Arbiter containers' resource requests and limits.
-  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ##
-  resources:
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    limits: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-    requests: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-
-  ## MongoDB Arbiter pods' liveness and readiness probes. Evaluated as a template.
-  ## ref: https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#container-probes
-  ##
-  livenessProbe:
-    enabled: true
-    initialDelaySeconds: 30
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 6
-    successThreshold: 1
-  readinessProbe:
-    enabled: true
-    initialDelaySeconds: 5
-    periodSeconds: 10
-    timeoutSeconds: 5
-    failureThreshold: 6
-    successThreshold: 1
-
-  ## Custom Liveness probes for MongoDB Arbiter pods
-  ##
-  customLivenessProbe: {}
-
-  ## Custom Rediness probes MongoDB Arbiter pods
-  ##
-  customReadinessProbe: {}
-
-  ## Add init containers to the MongoDB Arbiter pods.
-  ## Example:
-  ## initContainers:
-  ##   - name: your-image-name
-  ##     image: your-image
-  ##     imagePullPolicy: Always
-  ##     ports:
-  ##       - name: portname
-  ##         containerPort: 1234
-  ##
-  initContainers: {}
-
-  ## Add sidecars to the MongoDB Arbiter pods.
-  ## Example:
-  ## sidecars:
-  ##   - name: your-image-name
-  ##     image: your-image
-  ##     imagePullPolicy: Always
-  ##     ports:
-  ##       - name: portname
-  ##         containerPort: 1234
-  ##
-  sidecars: {}
-
-  ## extraVolumes and extraVolumeMounts allows you to mount other volumes on MongoDB Arbiter pods
-  ## Examples:
-  ## extraVolumeMounts:
-  ##   - name: extras
-  ##     mountPath: /usr/share/extras
-  ##     readOnly: true
-  ## extraVolumes:
-  ##   - name: extras
-  ##     emptyDir: {}
-  extraVolumeMounts: []
-  extraVolumes: []
-
-  ## MongoDB Arbiter Pod Disruption Budget configuration
-  ## ref: https://kubernetes.io/docs/tasks/run-application/configure-pdb/
-  ##
-  pdb:
-    create: false
-    ## Min number of pods that must still be available after the eviction
-    ##
-    minAvailable: 1
-    ## Max number of pods that can be unavailable after the eviction
-    ##
-    # maxUnavailable: 1
-
-## ServiceAccount
-## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-service-account/
-##
-serviceAccount:
-  ## Specifies whether a ServiceAccount should be created
-  ##
-  create: true
-  ## The name of the ServiceAccount to use.
-  ## If not set and create is true, a name is generated using the rabbitmq.fullname template
-  ##
-  # name:
-
-## Role Based Access
-## ref: https://kubernetes.io/docs/admin/authorization/rbac/
-##
-rbac:
-  ## Specifies whether RBAC rules should be created
-  ## binding MongoDB ServiceAccount to a role
-  ## that allows MongoDB pods querying the K8s API
-  ##
-  create: false
-
-## Init Container paramaters
-## Change the owner and group of the persistent volume(s) mountpoint(s) to 'runAsUser:fsGroup' on each component
-## values from the securityContext section of the component
-##
-volumePermissions:
-  enabled: false
-  ## Bitnami Minideb image
-  ## ref: https://hub.docker.com/r/bitnami/minideb/tags/
-  ##
-  image:
-    registry: docker.io
-    repository: bitnami/minideb
-    tag: buster
-    ## Specify a imagePullPolicy
-    ## Defaults to 'Always' if image tag is 'latest', else set to 'IfNotPresent'
-    ## ref: http://kubernetes.io/docs/user-guide/images/#pre-pulling-images
-    ##
-    pullPolicy: Always
-    ## Optionally specify an array of imagePullSecrets (secrets must be manually created in the namespace)
-    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-    ## Example:
-    ## pullSecrets:
-    ##   - myRegistryKeySecretName
-    ##
-    pullSecrets: []
-  ## Init Container resource requests and limits
-  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ##
-  resources:
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    limits: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-    requests: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-  ## Init container Security Context
-  ## Note: the chown of the data folder is done to containerSecurityContext.runAsUser
-  ## and not the below volumePermissions.securityContext.runAsUser
-  ## When runAsUser is set to special value "auto", init container will try to chwon the
-  ## data folder to autodetermined user&group, using commands: `id -u`:`id -G | cut -d" " -f2`
-  ## "auto" is especially useful for OpenShift which has scc with dynamic userids (and 0 is not allowed).
-  ## You may want to use this volumePermissions.securityContext.runAsUser="auto" in combination with
-  ## podSecurityContext.enabled=false,containerSecurityContext.enabled=false and shmVolume.chmod.enabled=false
-  ##
-  securityContext:
-    runAsUser: 0
-
-## Prometheus Exporter / Metrics
-##
-metrics:
-  enabled: false
-  ## Bitnami MongoDB Promtheus Exporter image
-  ## ref: https://hub.docker.com/r/bitnami/mongodb-exporter/tags/
-  ##
-  image:
-    registry: docker.io
-    repository: bitnami/mongodb-exporter
-    tag: 0.11.2-debian-10-r44
-    pullPolicy: IfNotPresent
-    ## Optionally specify an array of imagePullSecrets.
-    ## Secrets must be manually created in the namespace.
-    ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/pull-image-private-registry/
-    ##
-    # pullSecrets:
-    #   - myRegistryKeySecretName
-
-  ## String with extra flags to the metrics exporter
-  ## ref: https://github.com/percona/mongodb_exporter/blob/master/mongodb_exporter.go
-  ##
-  extraFlags: ""
-
-  ## String with additional URI options to the metrics exporter
-  ## ref: https://docs.mongodb.com/manual/reference/connection-string
-  ##
-  extraUri: ""
-
-  ## Metrics exporter container resource requests and limits
-  ## ref: http://kubernetes.io/docs/user-guide/compute-resources/
-  ##
-  resources:
-    # We usually recommend not to specify default resources and to leave this as a conscious
-    # choice for the user. This also increases chances charts run on environments with little
-    # resources, such as Minikube. If you do want to specify resources, uncomment the following
-    # lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-    limits: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-    requests: {}
-    #   cpu: 100m
-    #   memory: 128Mi
-
-  ## Prometheus Exporter service configuration
-  ##
-  service:
-    ## Annotations for Prometheus Exporter pods. Evaluated as a template.
-    ## ref: https://kubernetes.io/docs/concepts/overview/working-with-objects/annotations/
-    ##
-    annotations:
-      prometheus.io/scrape: "true"
-      prometheus.io/port: "{{ .Values.metrics.service.port }}"
-      prometheus.io/path: "/metrics"
-    type: ClusterIP
-    port: 9216
-
-  ## Metrics exporter liveness and readiness probes
-  ## ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes/#configure-probes)
-  ##
-  livenessProbe:
-    enabled: true
-    initialDelaySeconds: 15
-    periodSeconds: 5
-    timeoutSeconds: 5
-    failureThreshold: 3
-    successThreshold: 1
-  readinessProbe:
-    enabled: true
-    initialDelaySeconds: 5
-    periodSeconds: 5
-    timeoutSeconds: 1
-    failureThreshold: 3
-    successThreshold: 1
-
-  ## Prometheus Service Monitor
-  ## ref: https://github.com/coreos/prometheus-operator
-  ##      https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md
-  ##
-  serviceMonitor:
-    ## If the operator is installed in your cluster, set to true to create a Service Monitor Entry
-    enabled: false
-
-    ## Specify the namespace where Prometheus Operator is running
-    ##
-    # namespace: monitoring
-
-    ## Specify the interval at which metrics should be scraped
-    ##
-    interval: 30s
-    ## Specify the timeout after which the scrape is ended
-    ##
-    # scrapeTimeout: 30s
-    ## Used to pass Labels that are used by the Prometheus installed in your cluster to select Service Monitors to work with
-    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#prometheusspec
-    ##
-    additionalLabels: {}
-
-  ## Custom PrometheusRule to be defined
-  ## ref: https://github.com/coreos/prometheus-operator#customresourcedefinitions
-  ##
-  prometheusRule:
-    enabled: false
-    additionalLabels: {}
-    ## Specify the namespace where Prometheus Operator is running
-    ##
-    # namespace: monitoring
-
-    ## Define individual alerting rules as required
-    ## ref: https://github.com/coreos/prometheus-operator/blob/master/Documentation/api.md#rulegroup
-    ##      https://prometheus.io/docs/prometheus/latest/configuration/alerting_rules/
-    ##
-    ## This is an example of a rule, you should add the below code block under the "rules" param, removing the brackets
-    ## - name: example
-    ##   rules:
-    ##   - alert: HighRequestLatency
-    ##     expr: job:request_latency_seconds:mean5m{job="myjob"} > 0.5
-    ##     for: 10m
-    ##     labels:
-    ##       severity: page
-    ##     annotations:
-    ##       summary: High request latency
-    ##
-    rules: {}

charts/hub/regcred.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: regcred
-type: kubernetes.io/dockerconfigjson
-data:
-  .dockerconfigjson: xxxxkeytoberequestedxxx

charts/hub/templates/_helpers.tpl

@@ -0,0 +1,48 @@
+{{/* Build the path to the configured MongoDB CA bundle. */}}
+{{- define "hub.mongodb.tlsCAFile" -}}
+{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
+{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
+{{- define "hub.mongodb.uri" -}}
+{{- $uri := .Values.mongodb.uri | default "" -}}
+{{- if and .Values.mongodb.tls.enabled $uri -}}
+  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
+    {{- $separator := "?" -}}
+    {{- if contains "?" $uri -}}
+      {{- $separator = "&" -}}
+    {{- end -}}
+    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stls=true" $uri $separator -}}
+  {{- end -}}
+  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
+  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
+  {{- end -}}
+{{- end -}}
+{{- $uri -}}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA Secret volume. */}}
+{{- define "hub.mongodb.tlsVolume" -}}
+- name: mongodb-tls
+  secret:
+    secretName: {{ .Values.mongodb.tls.existingSecret }}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA volume mount. */}}
+{{- define "hub.mongodb.tlsVolumeMount" -}}
+- name: mongodb-tls
+  mountPath: {{ .Values.mongodb.tls.mountPath }}
+  readOnly: true
+{{- end -}}

charts/hub/templates/admin/deployment.yaml

@@ -0,0 +1,57 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: admin
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.admin.replicas }}
+  selector:
+    matchLabels:
+      app: admin
+  template:
+    metadata:
+      labels:
+        app: admin
+    spec:
+      {{- with .Values.admin.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.admin.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - name: admin
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.admin.repository }}:{{ .Values.admin.tag }}"
+          imagePullPolicy: {{ .Values.admin.pullPolicy }}
+          {{- with .Values.admin.resources }}
+          resources:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- with .Values.admin.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          ports:
+            - name: http
+              containerPort: 80
+              protocol: TCP
+          env:
+            - name: LOG_LEVEL
+              value: "{{ .Values.admin.logLevel }}"
+            - name: API_URL
+              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
+            - name: TITLE
+              value: Hub Admin | Scale for everyone, anywhere
+            - name: LOGO_NAME
+            - name: ENVIRONMENT
+              value: staging
+            - name: PRIVATE_EDITION
+              value: "false"
+            - name: PRODUCTION
+              value: "true"
+            - name: DEMO
+              value: "false"
+{{- end }}

charts/hub/templates/admin/ingress.yaml

@@ -0,0 +1,52 @@
+
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{ if ne .Values.ingress "" }}
+{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+apiVersion: networking.k8s.io/v1
+{{- else }}
+apiVersion: networking.k8s.io/v1beta1
+{{- end }}
+kind: Ingress
+metadata:
+  name: admin-ingress
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- if eq .Values.admin.oauth2Proxy.enabled true  }}
+    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
+    {{- end }}
+    {{- if eq .Values.ingress "nginx" }}
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    cert-manager.io/cluster-issuer: "letsencrypt-prod"
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress }}
+  {{- with .Values.admin.tls }}
+  tls:
+    {{- toYaml . | nindent 8 }}
+  {{- end }}
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
+  rules:
+    - host: "{{ .Values.admin.url }}"
+      http:
+        paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: admin-svc
+              port:
+                number: 80
+  {{- else }}
+  rules:
+    - host: "{{ .Values.admin.url }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: admin-svc
+              servicePort: 80
+  {{- end }}
+{{- end }}
+{{- end }}

charts/hub/templates/admin/oauth2-proxy.yaml

@@ -0,0 +1,108 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) (eq .Values.admin.oauth2Proxy.enabled true) }}
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oauth2-proxy-admin
+  namespace: kube-system
+  annotations:
+    {{- if eq .Values.ingress "nginx" }}
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress }}
+  rules:
+    - host: "{{ .Values.admin.url }}"
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy-admin
+                port:
+                  number: 4180
+  tls:
+    - hosts:
+        - "{{ .Values.admin.url }}"
+      secretName: 
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy-admin
+  namespace: kube-system
+  labels:
+    k8s-app: oauth2-proxy-admin
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: oauth2-proxy-admin
+  template:
+    metadata:
+      labels:
+        k8s-app: oauth2-proxy-admin
+    spec:
+      {{- with .Values.admin.oauth2Proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.admin.oauth2Proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - args:
+            - --provider=github
+            - --email-domain=*
+            - --upstream=file:///dev/null
+            - --http-address=0.0.0.0:4180
+            - --skip-auth-preflight=true
+          {{- with .Values.admin.oauth2Proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              value: "{{ .Values.admin.oauth2Proxy.github.clientId }}"
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              value: "{{ .Values.admin.oauth2Proxy.github.clientSecret }}"
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              value: "{{ .Values.admin.oauth2Proxy.github.cookieSecret }}"
+            - name: OAUTH2_PROXY_GITHUB_ORG
+              value: "{{ .Values.admin.oauth2Proxy.github.organization }}"
+            - name: OAUTH2_PROXY_GITHUB_TEAM
+              value: "{{ .Values.admin.oauth2Proxy.github.team }}"
+          image: quay.io/oauth2-proxy/oauth2-proxy:latest
+          imagePullPolicy: Always
+          name: oauth2-proxy
+          ports:
+            - containerPort: 4180
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 100m
+              memory: 50Mi
+            requests:
+              cpu: 100m
+              memory: 50Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: oauth2-proxy-admin
+  name: oauth2-proxy-admin
+  namespace: kube-system
+spec:
+  ports:
+    - name: http
+      port: 4180
+      protocol: TCP
+      targetPort: 4180
+  selector:
+    k8s-app: oauth2-proxy-admin
+{{- end -}}

charts/hub/templates/admin/service.yaml

@@ -0,0 +1,17 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+apiVersion: v1
+kind: Service
+metadata:
+  name: admin-svc
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: admin-svc
+spec:
+  ports:
+    - protocol: TCP
+      port: 80
+      targetPort: 80
+      name: http
+  selector:
+    app: admin
+{{- end }}

charts/hub/templates/configmap-mongodb.yaml

@@ -0,0 +1,18 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: mongodb-config
+  namespace: {{ .Release.Namespace }}
+data:
+  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
+  MONGODB_HOST: "{{ .Values.mongodb.host }}"
+  MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
+  MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
+  MONGODB_USERNAME: "{{ .Values.mongodb.username }}"
+  MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
+  MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
+  MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
+  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
+  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
+  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
+  MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -1,7 +1,10 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- if .Values.kerberoshub.api.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-api-svc
+  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-api-svc
 spec:
@@ -16,47 +19,33 @@ spec:
       protocol: TCP
   selector:
     app: hub-api
+{{- end }}
+{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
-apiVersion: networking.k8s.io/v1beta1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
 apiVersion: networking.k8s.io/v1
+{{ else }}
+apiVersion: networking.k8s.io/v1beta1
 {{ end }}
 kind: Ingress
 metadata:
   name: hub-api-ingress
+  namespace: {{ .Release.Namespace }}
   annotations:
-    kubernetes.io/ingress.class: {{ .Values.ingress }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/proxy-body-size: 200m # This might throw a 413 Entity Too Large when uploading large recordings.
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
+  ingressClassName: {{ .Values.ingress }}
   {{- with .Values.kerberoshub.api.tls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
 
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
-  rules:
-    - host: "{{ .Values.kerberoshub.api.url }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- if .Values.kerberoshub.api.legacyUrl }}
-    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-api-svc
-              servicePort: 8081
-    {{- end }}
-  {{- else }}
+  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
   rules:
     - host: "{{ .Values.kerberoshub.api.url }}"
       http:
@@ -90,12 +79,32 @@ spec:
                 name: hub-api-svc
                 port:
                   number: 80
-  {{- end }}
+  {{ else }}
+    rules:
+    - host: "{{ .Values.kerberoshub.api.url }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- if .Values.kerberoshub.api.legacyUrl }}
+    - host: "{{ .Values.kerberoshub.api.legacyUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-api-svc
+              servicePort: 8081
+    {{- end }}
+  {{ end }}
+{{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-api
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.api.replicas }}
   selector:
@@ -109,41 +118,99 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config-mongodb: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-api
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.api.volumes }}
+      {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.api.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $serverTLS.enabled $serverTLS.secretName }}
+        - name: hub-api-server-tls
+          secret:
+            secretName: {{ $serverTLS.secretName }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
         - name: hub-api
-          image: "{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.api.repository }}:{{ .Values.kerberoshub.api.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.api.pullPolicy }}
+          {{- with .Values.kerberoshub.api.resources }}
           resources:
-            requests:
-              memory: 100Mi
-              cpu: 50m
-          ports:
-            - containerPort: 80
-              name: http  
-          {{- with .Values.kerberoshub.api.volumeMounts}}
-          volumeMounts:
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          ports:
+            - containerPort: 80
+              name: http
+          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.api.volumeMounts}}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $serverTLS.enabled $serverTLS.secretName }}
+            - name: hub-api-server-tls
+              mountPath: {{ $serverTLS.mountPath }}
+              readOnly: true
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          # Mongodb - loaded from ConfigMap
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
+            - name: ENVIRONMENT
+              value: "{{ .Values.environment }}"
             - name: READ_ONLY
-              value: "{{ .Values.readonly }}"
+              value: "{{ .Values.readOnly }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.api.logLevel }}"
+            - name: SUPPORT_ENABLED
+              value: "{{ .Values.kerberoshub.support.enabled }}"
             - name: CLOUD_API_URL
               value: "{{ .Values.kerberoshub.api.url }}"
             - name: API_URL
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"
@@ -158,6 +225,26 @@ spec:
             - name: API_KEY
               value: "{{ .Values.kerberoshub.api.apiKey }}"
 
+            # MQTT credentials (served via /runtime/config to authenticated
+            # frontend clients; no longer exposed in the public env.js).
+            - name: MQTT_USERNAME
+              value: "{{ .Values.mqtt.username }}"
+            - name: MQTT_PASSWORD
+              value: "{{ .Values.mqtt.password }}"
+
+            # TURN credentials (served via /runtime/config to authenticated
+            # frontend clients; no longer exposed in the public env.js).
+            - name: TURN_USERNAME
+              value: "{{ .Values.turn.username }}"
+            - name: TURN_PASSWORD
+              value: "{{ .Values.turn.password }}"
+            {{- if .Values.kerberoshub.api.serverTLS.enabled }}
+            - name: TLS_CERT_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.certFile }}"
+            - name: TLS_KEY_FILE
+              value: "{{ .Values.kerberoshub.api.serverTLS.keyFile }}"
+            {{- end }}
+
             # Kerberos Hub
             - name: LICENSE_KEY
               value: "{{ .Values.license }}"
@@ -165,20 +252,30 @@ spec:
               value: "{{ .Values.licenseServer.url }}"
             - name: LICENSE_PUBLIC_API_TOKEN
               value: "{{ .Values.licenseServer.token }}"
-              
+
             # Authorization - Authentication secret
             - name: KERBEROS_JWT_SECRET
               value: "{{ .Values.kerberoshub.api.jwtSecret }}"
-              
+
             # SSO (OIDC) setup
-            - name: SSO_ISSUER
-              value: "{{ .Values.kerberoshub.api.sso.issuer }}"
-            - name: SSO_CLIENTID
-              value: "{{ .Values.kerberoshub.api.sso.clientId }}"
-            - name: SSO_CLIENTSECRET
-              value: "{{ .Values.kerberoshub.api.sso.clientSecret }}"
-            - name: SSO_REDIRECTURL
-              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}{{ .Values.kerberoshub.api.sso.redirectUrl }}"
+            - name: SSO_DOMAINS
+              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
+            - name: SSO_REDIRECTURLS
+              value: "{{- range .Values.kerberoshub.api.sso }}{{ .redirectUrl }};{{- end }}"
+            - name: SSO_CLAIMIDS
+              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .claimId }};{{- end }}"
+            - name: SSO_ISSUERS
+              value:  "{{- range .Values.kerberoshub.api.sso }}{{ .issuer }};{{- end }}"
+            - name: SSO_CLIENTIDS
+              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientId }};{{- end }}"
+            - name: SSO_CLIENTSECRETS
+              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientSecret }};{{- end }}"
+            - name: SSO_CLIENTVERIFICATIONIDS
+              value: "{{- range .Values.kerberoshub.api.sso }}{{ .clientVerificationId }};{{- end }}"
+            - name: SSO_FORCE_SSO
+              value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
+            - name: SSO_EXTRA_HEADERS
+              value: "{{- range .Values.kerberoshub.api.sso }}{{- if .extraHeaders }}{{- range .extraHeaders }}{{ .name }}:{{ .value }};{{- end }}{{- else }}{{- end }}*{{- end }}"
 
             # Kerberos pipeline
             - name: QUEUE_SYSTEM
@@ -186,10 +283,31 @@ spec:
             - name: QUEUE_NAME
               value: "{{ .Values.queueName }}"
 
+            # Deployment-global workflow definitions (WORKFLOW_DEFINITIONS): the
+            # SAME set the workflows engine consumes, assembled from the enabled
+            # definitions under kerberoshub.workflows.definitions (see
+            # kerberos-pipeline/_workflows-helpers.tpl). hub-api reads these
+            # read-only to surface config workflows alongside the user workflows
+            # it stores in the database; the config workflows are never persisted.
+            - name: WORKFLOW_DEFINITIONS
+              value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+            # Deployment service routing catalog used by API-owned embedded
+            # workflows (for example the one-stage case redaction modal flow).
+            - name: WORKFLOW_STAGE_QUEUES
+              value: {{ include "kerberoshub.workflows.stageQueues" . | quote }}
+
             # Stripe for billing
             - name: STRIPE_KEY
               value: "{{ .Values.kerberoshub.api.stripe.privateKey }}"
 
+            # OpenAI
+            - name: OPENAI_API_KEY
+              value: "{{ .Values.openai.apikey }}"
+
+            # MFA Issuer name (Will be shown when scanning in)
+            - name: MFA_ISSUER
+              value: "{{ .Values.kerberoshub.api.mfaIssuer }}"
+
             # AWS (Legacy, use Kerberos Vault instead)
             - name: AWS_REGION
               value: "{{ .Values.kerberoshub.api.aws.region }}"
@@ -229,17 +347,15 @@ spec:
             - name: KAFKA_SECURITY
               value: "{{ .Values.kafka.security }}"
 
-            # Mongodb
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
+            # RabbitMQ settings
+            - name: RABBITMQ_HOST
+              value: "{{ .Values.rabbitmq.host }}"
+            - name: RABBITMQ_EXCHANGE
+              value: "{{ .Values.rabbitmq.exchange }}"
+            - name: RABBITMQ_USERNAME
+              value: "{{ .Values.rabbitmq.username }}"
+            - name: RABBITMQ_PASSWORD
+              value: "{{ .Values.rabbitmq.password }}"
 
             # Slack notifications (this will send events/logs to a specific channel).
             - name: SLACK_ENABLED
@@ -249,22 +365,6 @@ spec:
             - name: SLACK_USERNAME
               value: "{{ .Values.kerberoshub.api.slack.username }}"
 
-            # Elastic search - Kibana
-            - name: LOGGING_ELASTICSEARCH
-              value: "{{ .Values.kerberoshub.api.elasticsearch.enabled }}"
-            - name: LOGGING_ELASTICSEARCH_PROTOCOL
-              value: "{{ .Values.kerberoshub.api.elasticsearch.protocol }}"
-            - name: LOGGING_ELASTICSEARCH_HOST
-              value: "{{ .Values.kerberoshub.api.elasticsearch.host }}"
-            - name: LOGGING_ELASTICSEARCH_PORT
-              value: "{{ .Values.kerberoshub.api.elasticsearch.port }}"
-            - name: LOGGING_ELASTICSEARCH_INDEX
-              value: "{{ .Values.kerberoshub.api.elasticsearch.index }}"
-            - name: LOGGING_ELASTICSEARCH_USERNAME
-              value: "{{ .Values.kerberoshub.api.elasticsearch.username }}"
-            - name: LOGGING_ELASTICSEARCH_PASSWORD
-              value: "{{ .Values.kerberoshub.api.elasticsearch.password }}"
-
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -272,7 +372,7 @@ spec:
               value: "{{ .Values.email.from }}"
             - name: EMAIL_FROM_DISPLAYNAME
               value: "{{ .Values.email.displayName }}"
-              
+
             # Mail templates
             - name: WELCOME_TEMPLATE
               value: "{{ .Values.email.templates.welcome }}"
@@ -290,6 +390,22 @@ spec:
               value: "{{ .Values.email.templates.share }}"
             - name: SHARE_TITLE
               value: "{{ .Values.email.templates.shareTitle }}"
+            - name: CASE_SHARE_TEMPLATE
+              value: "{{ .Values.email.templates.caseShare }}"
+            - name: CASE_SHARE_TITLE
+              value: "{{ .Values.email.templates.caseShareTitle }}"
+            - name: CASE_SHARE_OTP_TEMPLATE
+              value: "{{ .Values.email.templates.caseShareOtp }}"
+            - name: CASE_SHARE_OTP_TITLE
+              value: "{{ .Values.email.templates.caseShareOtpTitle }}"
+            - name: ASSIGN_TASK_TEMPLATE
+              value: "{{ .Values.email.templates.assignTask }}"
+            - name: ASSIGN_TASK_TITLE
+              value: "{{ .Values.email.templates.assignTaskTitle }}"
+            - name: DEFAULT_TASK_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.api.defaultTaskRetentionDays }}"
+            - name: CASES_MAX_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.api.casesMaxRetentionDays }}"
 
             # SMTP
             - name: SMTP_SERVER
@@ -300,9 +416,50 @@ spec:
               value: "{{ .Values.email.smtp.username }}"
             - name: SMTP_PASSWORD
               value: "{{ .Values.email.smtp.password }}"
-              
+
             # Mailgun
             - name: MAILGUN_DOMAIN
               value: "{{ .Values.email.mailgun.domain }}"
             - name: MAILGUN_API_KEY
               value: "{{ .Values.email.mailgun.apikey }}"
+
+            # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
+            # This will lower storage in mongodb.
+            - name: THUMBNAIL_VAULT_ENABLED
+              value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
+            - name: VAULT_THUMBNAIL_PROVIDER
+              value: "{{ .Values.kerberosvault.thumbnail.provider }}"
+            - name: VAULT_THUMBNAIL_ACCESS_KEY
+              value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
+            - name: VAULT_THUMBNAIL_SECRET_KEY
+              value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+
+            # There is an option to store the sprites in a storage provider in Kerberos Vault.
+            - name: VAULT_SPRITE_ENABLED
+              value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+            - name: VAULT_SPRITE_PROVIDER
+              value: "{{ .Values.kerberosvault.sprite.provider }}"
+            - name: VAULT_SPRITE_ACCESS_KEY
+              value: "{{ .Values.kerberosvault.sprite.accessKey }}"
+            - name: VAULT_SPRITE_SECRET_KEY
+              value: "{{ .Values.kerberosvault.sprite.secretKey }}"
+            - name: VAULT_SPRITE_INTERVAL
+              value: "{{ .Values.kerberosvault.sprite.interval }}"
+            - name: VAULT_SPRITE_WIDTH
+              value: "{{ .Values.kerberosvault.sprite.width }}"
+            - name: VAULT_SPRITE_HEIGHT
+              value: "{{ .Values.kerberosvault.sprite.height }}"
+            {{- if .Values.kerberoshub.extraEnv }}
+            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
+            {{- end }}
+
+            {{- if .Values.opentelemetry.enabled }}
+            # Open Telemetry tracing
+            - name: OTEL_EXPORTED_OTLP_ENABLED
+              value: "{{ .Values.opentelemetry.enabled }}"
+            - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+              value: "{{ .Values.opentelemetry.routingEnabled }}"
+            - name: OTEL_EXPORTER_OTLP_ENDPOINT
+              value: "{{ .Values.opentelemetry.collector.endpoint }}"
+            {{- end }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup-servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-cleanup-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: hub-cleanup
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: hub-cleanup
+  endpoints:
+    - port: hub-metrics
+      interval: 15s
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-cleanup
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.cleanup.replicas }}
   selector:
     matchLabels:
       app: hub-cleanup
@@ -15,32 +17,115 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-cleanup
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.cleanup.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: hub-cleanup
-          image: "{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.cleanup.repository }}:{{ .Values.kerberoshub.cleanup.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.cleanup.pullPolicy }}
+          {{- with .Values.kerberoshub.cleanup.resources }}
           resources:
-            requests:
-              memory: 10Mi
-              cpu: 10m
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
+          ports:
+            - containerPort: 8080
           env:
+            - name: MODE
+              value: "{{ .Values.kerberoshub.cleanup.mode }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.cleanup.logLevel }}"
+            - name: RUN_INTERVAL_MINUTES
+              value: "{{ .Values.kerberoshub.cleanup.runIntervalMinutes }}"
+            - name: CLEANUP_USERNAMES
+              value: "{{ .Values.kerberoshub.cleanup.cleanupUsernames }}"
+            - name: READ_ONLY
+              value: "{{ .Values.readOnly }}"
             - name: MAX_DAYS
-              value: "30"
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
-
+              value: "{{ .Values.kerberoshub.cleanup.maxDays }}"
+            - name: BATCH_SIZE
+              value: "{{ .Values.kerberoshub.cleanup.batchSize }}"
+            - name: USER_BATCH_SIZE
+              value: "{{ .Values.kerberoshub.cleanup.userBatchSize }}"
+            - name: MAX_USERS_PER_RUN
+              value: "{{ .Values.kerberoshub.cleanup.maxUsersPerRun }}"
+            - name: PROGRESS_EVERY
+              value: "{{ .Values.kerberoshub.cleanup.progressEvery }}"
+            - name: ACTIVE_USER_RESCAN_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.activeUserRescanHours }}"
+            - name: INACTIVE_USER_RESCAN_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.inactiveUserRescanHours }}"
+            - name: READ_TIMEOUT_SECONDS
+              value: "{{ .Values.kerberoshub.cleanup.readTimeoutSeconds }}"
+            - name: DELETE_TIMEOUT_SECONDS
+              value: "{{ .Values.kerberoshub.cleanup.deleteTimeoutSeconds }}"
+            - name: REPORT_INCLUDE_STATS
+              value: "{{ .Values.kerberoshub.cleanup.reportIncludeStats }}"
+            - name: DRY_RUN
+              value: "{{ .Values.kerberoshub.cleanup.dryRun }}"
+            - name: DEBUG
+              value: "{{ .Values.kerberoshub.cleanup.debug }}"
+            - name: GLOBAL_PASS_ENABLED
+              value: "{{ .Values.kerberoshub.cleanup.globalPassEnabled }}"
+            - name: GLOBAL_PASS_INTERVAL_HOURS
+              value: "{{ .Values.kerberoshub.cleanup.globalPassIntervalHours }}"
+            - name: GLOBAL_PASS_DELETE_BUDGET
+              value: "{{ .Values.kerberoshub.cleanup.globalPassDeleteBudget }}"
+            - name: DEFAULT_TASK_RETENTION_DAYS
+              value: "{{ .Values.kerberoshub.cleanup.defaultTaskRetentionDays }}"
+          {{- if .Values.kerberoshub.extraEnv }}
+          {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
+          {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-cleanup
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-cleanup
+    service: hub-cleanup
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-cleanup
+{{- end }}

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -1,7 +1,9 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.frontend.demoEnabled -}}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-frontend-demo-svc
+  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-frontend-demo-svc
 spec:
@@ -12,39 +14,30 @@ spec:
     name: http
   selector:
     app: hub-frontend-demo
+{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
-apiVersion: networking.k8s.io/v1beta1
-{{ else }}
+{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
 apiVersion: networking.k8s.io/v1
+{{ else }}
+apiVersion: networking.k8s.io/v1beta1
 {{ end }}
 kind: Ingress
 metadata:
   name: hub-frontend-demo-ingress
+  namespace: {{ .Release.Namespace }}
   annotations:
-    kubernetes.io/ingress.class: {{ .Values.ingress }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
-
+  ingressClassName: {{ .Values.ingress }}
   {{- with .Values.kerberoshub.frontend.demoTls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
-
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
-  rules:
-    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
-      http:
-        paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-demo-svc
-              servicePort: 80
-  {{- else }}
+  {{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
       http:
@@ -56,12 +49,23 @@ spec:
               name: hub-frontend-demo-svc
               port:
                 number: 80
-  {{- end }}
+  {{ else }}
+  rules:
+    - host: "{{ .Values.kerberoshub.frontend.demoUrl }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-frontend-demo-svc
+              servicePort: 80
+  {{ end }}
+{{ end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-frontend-demo
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.frontend.replicas }}
   selector:
@@ -78,6 +82,9 @@ spec:
       labels:
         app: hub-frontend-demo
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -86,14 +93,18 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: hub-frontend-demo
-        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
         imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
+        {{- with .Values.kerberoshub.frontend.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         ports:
         - containerPort: 80
           name: http
@@ -102,12 +113,18 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        - name: SSO_DOMAIN
-          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
+        - name: SSO_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
+        - name: SSO_FORCE_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
         - name: TITLE
           value: "{{ .Values.kerberoshub.frontend.title }}"
         - name: LOGO_NAME
           value: "{{ .Values.kerberoshub.frontend.logo }}"
+        - name: ENVIRONMENT
+          value: "demo"
         - name: API_URL
           value: "" # legacy
         - name: NEW_API_URL
@@ -123,6 +140,10 @@ spec:
           value: "true"
         - name: DEMO
           value: "true"
+        - name: MULTI_TENANT
+          value: "{{ .Values.kerberoshub.frontend.multiTenant }}"
+        - name: TENANT_BASE_DOMAIN
+          value: "{{ .Values.kerberoshub.frontend.tenantBaseDomain }}"
 
         # Mqtt (VERNEMQ)
         - name: MQTT_PROTOCOL
@@ -131,18 +152,24 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        - name: MQTT_USERNAME
-          value: "{{ .Values.mqtt.username }}"
-        - name: MQTT_PASSWORD
-          value: "{{ .Values.mqtt.password }}"
+        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
+        - name: MQTT_LEGACY_SERVER
+          value: "{{ .Values.mqtt.legacy.host }}"
+        - name: MQTT_LEGACY_PORT
+          value: "{{ .Values.mqtt.legacy.port }}"
+
+        # OpenAI
+        - name: OPENAI_ENABLED
+          value: "{{ .Values.openai.enabled }}"
 
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        - name: TURN_USERNAME
-          value: "{{ .Values.turn.username }}"
-        - name: TURN_PASSWORD
-          value: "{{ .Values.turn.password }}"
+        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -170,32 +197,178 @@ spec:
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        # Titles and descriptions on pages
-        - name: LOGIN_DESCRIPTION
-          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
-        - name: LOGIN_COPYRIGHT
-          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
-        - name: PAGE_DASHBOARD_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
-        - name: PAGE_DASHBOARD_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
-        - name: PAGE_LATESTEVENTS_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
-        - name: PAGE_LATESTEVENTS_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
-        - name: PAGE_LIVESTREAM_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
-        - name: PAGE_LIVESTREAM_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
-        - name: PAGE_MEDIA_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
-        - name: PAGE_MEDIA_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
-        - name: PAGE_DASHBOARD_CPU_USAGE
-          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
-        - name: PAGE_DASHBOARD_FPS
-          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
-        - name: PAGE_DASHBOARD_MLA
-          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
-        - name: PAGE_DASHBOARD_OBJECTS
-          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
+        - name: HIDE_ADD_AGENT
+          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
+
+        # Navigation links
+        - name: NAVIGATION_LINK_TITLE_1
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
+        - name: NAVIGATION_LINK_URL_1
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
+        - name: NAVIGATION_LINK_TITLE_2
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
+        - name: NAVIGATION_LINK_URL_2
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
+        - name: NAVIGATION_LINK_TITLE_3
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
+        - name: NAVIGATION_LINK_URL_3
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
+        - name: NAVIGATION_LINK_TITLE_4
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
+        - name: NAVIGATION_LINK_URL_4
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
+        - name: NAVIGATION_LINK_TITLE_5
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
+        - name: NAVIGATION_LINK_URL_5
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
+        - name: CASE_FILTER_ASSIGNEES_DEFAULT
+          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
+
+        # features > general
+        - name: FEATURE_CASE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
+        - name: FEATURE_WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
+        - name: FEATURE_DARK_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: FEATURE_LANDING_PAGE
+          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
+
+        # features > internationalization (i18n)
+        - name: FEATURE_I18N_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
+        - name: DEFAULT_LANGUAGE
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
+
+        # features > liveview
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
+        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
+        - name: FEATURE_LIVEVIEW_PAGE_SIZE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
+        - name: FEATURE_LIVEVIEW_MAX_STREAMS
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
+
+        # features > devices
+        - name: FEATURE_DEVICES_HIDE_AGENT
+          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
+
+        # features > floorplan
+        - name: FEATURE_FLOORPLAN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"      
+        # features > map
+        - name: MAP_TILE_URL_LIGHT
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
+        - name: MAP_TILE_URL_DARK
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
+        - name: MAP_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
+
+        - name: COLOR_TRACK_BOX
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
+        - name: COLOR_TRACK_BOX_HOVER
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
+        - name: COLOR_TRACK_BOX_DRAWING
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
+        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
+        - name: COLOR_DEVICE_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
+        - name: COLOR_DEVICE_INACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
+        - name: COLOR_DEVICE_IDLE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
+        - name: COLOR_DEVICE_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
+        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
+          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
+        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
+          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
+        - name: COLOR_DEVICE_MARKER_BORDER
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
+
+        # features > video edits
+        - name: FEATURE_VIDEO_EDITS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
+
+        # features > face redaction 
+        - name: FEATURE_FACE_REDACTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+        
+        # features > media
+        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
+        
+        {{- if .Values.kerberoshub.extraEnv }}
+        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
+        {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -1,7 +1,10 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
+{{- if .Values.kerberoshub.frontend.serviceEnabled }}
 apiVersion: v1
 kind: Service
 metadata:
   name: hub-frontend-svc
+  namespace: {{ .Release.Namespace }}
   labels:
     app: hub-frontend-svc
 spec:
@@ -12,77 +15,138 @@ spec:
     name: http
   selector:
     app: hub-frontend
+{{- end }}
+{{ if ne .Values.ingress "" }}
 ---
-{{ if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
-apiVersion: networking.k8s.io/v1beta1
-{{ else }}
+{{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
 apiVersion: networking.k8s.io/v1
-{{ end }}
+{{- else }}
+apiVersion: networking.k8s.io/v1beta1
+{{- end }}
 kind: Ingress
 metadata:
   name: hub-frontend-ingress
+  namespace: {{ .Release.Namespace }}
   annotations:
-    kubernetes.io/ingress.class: {{ .Values.ingress }}
+    {{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
+    nginx.ingress.kubernetes.io/auth-url: "https://$host/oauth2/auth"
+    nginx.ingress.kubernetes.io/auth-signin: "https://$host/oauth2/start?rd=$escaped_request_uri"
+    {{- end }}
     {{- if eq .Values.ingress "nginx" }}
     kubernetes.io/tls-acme: "true"
     nginx.ingress.kubernetes.io/ssl-redirect: "true"
     cert-manager.io/cluster-issuer: "letsencrypt-prod"
     {{- end }}
 spec:
-
+  ingressClassName: {{ .Values.ingress }}
   {{- with .Values.kerberoshub.frontend.tls }}
   tls:
     {{- toYaml . | nindent 8 }}
   {{- end }}
-
-  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1beta1" }}
+  {{- if .Capabilities.APIVersions.Has "networking.k8s.io/v1" }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.url }}"
       http:
         paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
     {{- if .Values.kerberoshub.frontend.legacyUrl }}
     - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
       http:
         paths:
-          - path: /
-            backend:
-              serviceName: hub-frontend-svc
-              servicePort: 80
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
     {{- end }}
+    {{- range .Values.kerberoshub.frontend.domains }}
+    - host: "{{ . }}"
+      http:
+        paths:
+        - path: /
+          pathType: Prefix
+          backend:
+            service:
+              name: hub-frontend-svc
+              port:
+                number: 80
+    {{- end }}
+
   {{- else }}
   rules:
     - host: "{{ .Values.kerberoshub.frontend.url }}"
       http:
         paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
     {{- if .Values.kerberoshub.frontend.legacyUrl }}
     - host: "{{ .Values.kerberoshub.frontend.legacyUrl }}"
       http:
         paths:
-        - path: /
-          pathType: Prefix
-          backend:
-            service:
-              name: hub-frontend-svc
-              port:
-                number: 80
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
+    {{- end }}
+    {{- range .Values.kerberoshub.frontend.domains }}
+    - host: "{{ . }}"
+      http:
+        paths:
+          - path: /
+            backend:
+              serviceName: hub-frontend-svc
+              servicePort: 80
     {{- end }}
   {{- end }}
+{{- end }}
+{{- if eq .Values.kerberoshub.oauth2Proxy.enabled true  }}
+---
+apiVersion: networking.k8s.io/v1
+kind: Ingress
+metadata:
+  name: oauth2-proxy-frontend
+  namespace: kube-system
+  annotations:
+    {{- if eq .Values.ingress "nginx" }}
+    cert-manager.io/cluster-issuer: letsencrypt-prod
+    kubernetes.io/tls-acme: "true"
+    nginx.ingress.kubernetes.io/ssl-redirect: "true"
+    nginx.ingress.kubernetes.io/enable-cors: "true"
+    {{- end }}
+spec:
+  ingressClassName: {{ .Values.ingress }}
+  rules:
+    - host: "{{ .Values.kerberoshub.frontend.url }}"
+      http:
+        paths:
+          - path: /oauth2
+            pathType: Prefix
+            backend:
+              service:
+                name: oauth2-proxy
+                port:
+                  number: 4180
+  tls:
+    - hosts:
+        - "{{ .Values.kerberoshub.frontend.url }}"
+      secretName:
+{{- end }}
 ---
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-frontend
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: {{ .Values.kerberoshub.frontend.replicas }}
   selector:
@@ -99,6 +163,9 @@ spec:
       labels:
         app: hub-frontend
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
@@ -107,14 +174,18 @@ spec:
       volumes:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberoshub.frontend.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: hub-frontend
-        image: "{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.frontend.repository }}:{{ .Values.kerberoshub.frontend.tag }}"
         imagePullPolicy: {{ .Values.kerberoshub.frontend.pullPolicy }}
+        {{- with .Values.kerberoshub.frontend.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         ports:
         - containerPort: 80
           name: http
@@ -123,12 +194,20 @@ spec:
           {{- toYaml . | nindent 8 }}
         {{- end }}
         env:
-        - name: SSO_DOMAIN
-          value: "{{ .Values.kerberoshub.frontend.ssoDomain }}"
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberoshub.frontend.logLevel }}"
+        - name: SSO_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .domain }};{{- end }}"
+        - name: SSO_FORCE_DOMAINS
+          # get the domain attribute from the list of sso domains
+          value: "{{- range .Values.kerberoshub.api.sso }}{{ .forceSSO }};{{- end }}"
         - name: TITLE
           value: "{{ .Values.kerberoshub.frontend.title }}"
         - name: LOGO_NAME
           value: "{{ .Values.kerberoshub.frontend.logo }}"
+        - name: ENVIRONMENT
+          value: "{{ .Values.environment }}"
         - name: API_URL
           value: "" # legacy
         - name: NEW_API_URL
@@ -156,22 +235,24 @@ spec:
           value: "{{ .Values.mqtt.host }}"
         - name: MQTT_PORT
           value: "{{ .Values.mqtt.port }}"
-        - name: MQTT_USERNAME
-          value: "{{ .Values.mqtt.username }}"
-        - name: MQTT_PASSWORD
-          value: "{{ .Values.mqtt.password }}"
+        # MQTT_USERNAME / MQTT_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
         - name: MQTT_LEGACY_SERVER
           value: "{{ .Values.mqtt.legacy.host }}"
         - name: MQTT_LEGACY_PORT
           value: "{{ .Values.mqtt.legacy.port }}"
 
+        # OpenAI
+        - name: OPENAI_ENABLED
+          value: "{{ .Values.openai.enabled }}"
+
         # Turn (Pion)
         - name: TURN_SERVER
           value: "{{ .Values.turn.host }}"
-        - name: TURN_USERNAME
-          value: "{{ .Values.turn.username }}"
-        - name: TURN_PASSWORD
-          value: "{{ .Values.turn.password }}"
+        # TURN_USERNAME / TURN_PASSWORD are intentionally not exposed to the
+        # frontend. They are fetched from the authenticated hub-api endpoint
+        # /runtime/config after login. See hub-api deployment.
 
         # Mixpanel for monitoring
         - name: MIXPANEL_KEY
@@ -199,32 +280,192 @@ spec:
         - name: ZENDESK_URL
           value: "{{ .Values.kerberoshub.frontend.zendesk.url }}"
 
-        # Titles and descriptions on pages
-        - name: LOGIN_DESCRIPTION
-          value: "{{ .Values.kerberoshub.frontend.loginDescription }}"
-        - name: LOGIN_COPYRIGHT
-          value: "{{ .Values.kerberoshub.frontend.loginCopyright }}"
-        - name: PAGE_DASHBOARD_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardTitle }}"
-        - name: PAGE_DASHBOARD_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.dashboardSubTitle }}"
-        - name: PAGE_LATESTEVENTS_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsTitle }}"
-        - name: PAGE_LATESTEVENTS_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.latestEventsSubTitle }}"
-        - name: PAGE_LIVESTREAM_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamTitle }}"
-        - name: PAGE_LIVESTREAM_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.livestreamSubTitle }}"
-        - name: PAGE_MEDIA_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaTitle }}"
-        - name: PAGE_MEDIA_SUB_TITLE
-          value: "{{ .Values.kerberoshub.frontend.mediaSubTitle }}"
-        - name: PAGE_DASHBOARD_CPU_USAGE
-          value: "{{ .Values.kerberoshub.frontend.cpuUsageDescription }}"
-        - name: PAGE_DASHBOARD_FPS
-          value: "{{ .Values.kerberoshub.frontend.framesPerSecondDescription }}"
-        - name: PAGE_DASHBOARD_MLA
-          value: "{{ .Values.kerberoshub.frontend.mlaUtilizationDescription }}"
-        - name: PAGE_DASHBOARD_OBJECTS
-          value: "{{ .Values.kerberoshub.frontend.objectsDetectedDescription }}"
+        - name: HIDE_ADD_AGENT
+          value: "{{ .Values.kerberoshub.frontend.hideAddAgent }}"
+
+        # Navigation links
+        - name: NAVIGATION_LINK_TITLE_1
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle1 }}"
+        - name: NAVIGATION_LINK_URL_1
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl1 }}"
+        - name: NAVIGATION_LINK_TITLE_2
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle2 }}"
+        - name: NAVIGATION_LINK_URL_2
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl2 }}"
+        - name: NAVIGATION_LINK_TITLE_3
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle3 }}"
+        - name: NAVIGATION_LINK_URL_3
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl3 }}"
+        - name: NAVIGATION_LINK_TITLE_4
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle4 }}"
+        - name: NAVIGATION_LINK_URL_4
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl4 }}"
+        - name: NAVIGATION_LINK_TITLE_5
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkTitle5 }}"
+        - name: NAVIGATION_LINK_URL_5
+          value: "{{ .Values.kerberoshub.frontend.navigationLinkUrl5 }}"
+        - name: CASE_FILTER_ASSIGNEES_DEFAULT
+          value: "{{ .Values.kerberoshub.frontend.caseFilterAssigneesDefault }}"
+
+        # features > general
+        - name: FEATURE_CASE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
+        - name: FEATURE_WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
+        - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
+        - name: FEATURE_ORGANISATION_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
+        - name: FEATURE_DARK_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
+        - name: FEATURE_SPLASH_SCREEN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: FEATURE_LANDING_PAGE
+          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"
+
+        # features > internationalization (i18n)
+        - name: FEATURE_I18N_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.enabled }}"
+        - name: DEFAULT_LANGUAGE
+          value: "{{ .Values.kerberoshub.frontend.features.i18n.defaultLanguage }}"
+
+        # features > liveview
+        - name: FEATURE_DEFAULT_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.defaultStreamMode }}"
+        - name: FEATURE_LIVE_STREAM_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.liveStreamMode }}"
+        - name: FEATURE_HLS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.hlsEnabled }}"
+        - name: FEATURE_MOQ_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqEnabled }}"
+        - name: FEATURE_REMOTE_RECORDING_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.remoteRecordingEnabled }}"
+        - name: MOQ_RELAY_URL
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqRelayUrl }}"
+        - name: MOQ_BROADCAST_PREFIX
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.moqBroadcastPrefix }}"
+        - name: FEATURE_LIVEVIEW_PAGINATION_MODE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.paginationMode }}"
+        - name: FEATURE_LIVEVIEW_PAGE_SIZE
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.pageSize }}"
+        - name: FEATURE_LIVEVIEW_MAX_STREAMS
+          value: "{{ .Values.kerberoshub.frontend.features.liveview.maxStreams }}"
+
+        # features > devices
+        - name: FEATURE_DEVICES_HIDE_AGENT
+          value: "{{ .Values.kerberoshub.frontend.features.devices.hideAgent }}"
+
+        # features > floorplan
+        - name: FEATURE_FLOORPLAN_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.enabled }}"
+
+        # features > map
+        - name: MAP_TILE_URL_LIGHT
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlLight }}"
+        - name: MAP_TILE_URL_DARK
+          value: "{{ .Values.kerberoshub.frontend.features.map.tileUrlDark }}"
+        - name: MAP_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.attribution }}"
+        - name: MAP_OVERLAY_TILE_URL
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayTileUrl }}"
+        - name: MAP_OVERLAY_API_KEY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayApiKey }}"
+        - name: MAP_OVERLAY_ATTRIBUTION
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayAttribution }}"
+        - name: MAP_OVERLAY_MIN_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMinZoom }}"
+        - name: MAP_OVERLAY_MAX_ZOOM
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayMaxZoom }}"
+        - name: MAP_OVERLAY_OPACITY
+          value: "{{ .Values.kerberoshub.frontend.features.map.overlayOpacity }}"
+
+        - name: COLOR_TRACK_BOX
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBox }}"
+        - name: COLOR_TRACK_BOX_HOVER
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxHover }}"
+        - name: COLOR_TRACK_BOX_DRAWING
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing }}"
+        - name: COLOR_TRACK_BOX_CONTROLS_DELETE
+          value: "{{ .Values.kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete }}"
+        - name: COLOR_DEVICE_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceActive }}"
+        - name: COLOR_DEVICE_INACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceInactive }}"
+        - name: COLOR_DEVICE_IDLE
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceIdle }}"
+        - name: COLOR_DEVICE_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceMotion }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_ACTIVE
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlActive }}"
+        - name: COLOR_LIVE_VIEW_CONTROL_MOTION
+          value: "{{ .Values.kerberoshub.frontend.colorLiveViewControlMotion }}"
+        - name: COLOR_FLOOR_PLAN_LABEL_TEXT
+          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelText }}"
+        - name: COLOR_FLOOR_PLAN_LABEL_BACKGROUND
+          value: "{{ .Values.kerberoshub.frontend.colorFloorPlanLabelBackground }}"
+        - name: COLOR_DEVICE_MARKER_BORDER
+          value: "{{ .Values.kerberoshub.frontend.colorDeviceMarkerBorder }}"
+
+        # features > chart
+        - name: COLOR_CHART_SELECTION_FILL
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionFill }}"
+        - name: COLOR_CHART_SELECTION_STROKE
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartSelectionStroke }}"
+        - name: COLOR_CHART_GRID_STROKE
+          value: "{{ .Values.kerberoshub.frontend.features.chart.colorChartGridStroke }}"
+
+        # features > video edits
+        - name: FEATURE_VIDEO_EDITS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.videoEdits.enabled }}"
+
+        # features > face redaction 
+        - name: FEATURE_FACE_REDACTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
+        
+        # features > media
+        - name: FEATURE_MEDIA_FILTER_DATE_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.date.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SITES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sites.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_GROUPS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.groups.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_DEVICES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.devices.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_OBJECT_DETECTION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.objectDetection.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_STAR_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.star.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_REGION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.region.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_SORT_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.sort.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_CATEGORIES_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.category.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_MARKERS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.markers.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_DEFAULT_VIEW
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.defaultView }}"
+        - name: FEATURE_MEDIA_FILTER_EVENTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.events.enabled }}"
+        - name: FEATURE_MEDIA_FILTER_TAGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.media.filter.tags.enabled }}"
+        
+
+        {{- if .Values.kerberoshub.extraEnv }}
+        {{- toYaml .Values.kerberoshub.extraEnv | nindent 8 }}
+        {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-monitor-device
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.monitordevice.replicas }}
   selector:
     matchLabels:
       app: hub-monitor-device
@@ -15,34 +17,57 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-monitor-device
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.monitordevice.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: hub-monitor-device
-          image: "{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.monitordevice.repository }}:{{ .Values.kerberoshub.monitordevice.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.monitordevice.pullPolicy }}
+          {{- with .Values.kerberoshub.monitordevice.resources }}
           resources:
-            requests:
-              memory: 10Mi
-              cpu: 10m
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
-            # Mongodb
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
-
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.monitordevice.logLevel }}"
+            - name: READ_ONLY
+              value: "{{ .Values.readonly }}"
             # Mail settings
             - name: MAIL_PROVIDER
               value: "{{ .Values.email.provider }}"
@@ -50,11 +75,13 @@ spec:
               value: "{{ .Values.email.from }}"
             - name: EMAIL_FROM_DISPLAYNAME
               value: "{{ .Values.email.displayName }}"
-              
+
             # Mail templates
             - name: DEVICE_TEMPLATE
               value: "{{ .Values.email.templates.device }}"
-              
+            - name: DEVICE_TITLE
+              value: "{{ .Values.email.templates.deviceTitle }}"
+
             # - Plain SMTP
             - name: SMTP_SERVER
               value: "{{ .Values.email.smtp.server }}"
@@ -64,3 +91,13 @@ spec:
               value: "{{ .Values.email.smtp.username }}"
             - name: SMTP_PASSWORD
               value: "{{ .Values.email.smtp.password }}"
+
+            # Mailgun
+            - name: MAILGUN_DOMAIN
+              value: "{{ .Values.email.mailgun.domain }}"
+            - name: MAILGUN_API_KEY
+              value: "{{ .Values.email.mailgun.apikey }}"
+        {{- if .Values.kerberoshub.extraEnv }}
+        {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
+        {{- end }}
+      {{- end }}

charts/hub/templates/kerberos-hub/hub-oauth2-proxy.yaml

@@ -0,0 +1,81 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui")) .Values.kerberoshub.oauth2Proxy.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: oauth2-proxy
+  namespace: kube-system
+  labels:
+    k8s-app: oauth2-proxy
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      k8s-app: oauth2-proxy
+  template:
+    metadata:
+      labels:
+        k8s-app: oauth2-proxy
+    spec:
+      {{- with .Values.kerberoshub.oauth2Proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.oauth2Proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+        - args:
+            - --provider=github
+            - --email-domain=*
+            - --upstream=file:///dev/null
+            - --http-address=0.0.0.0:4180
+            - --skip-auth-preflight=true
+          {{- with .Values.kerberoshub.oauth2Proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          env:
+            - name: OAUTH2_PROXY_CLIENT_ID
+              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientId }}"
+            - name: OAUTH2_PROXY_CLIENT_SECRET
+              value: "{{ .Values.kerberoshub.oauth2Proxy.github.clientSecret }}"
+            - name: OAUTH2_PROXY_COOKIE_SECRET
+              value: "{{ .Values.kerberoshub.oauth2Proxy.github.cookieSecret }}"
+            - name: OAUTH2_PROXY_GITHUB_ORG
+              value: "{{ .Values.kerberoshub.oauth2Proxy.github.organization }}"
+            - name: OAUTH2_PROXY_GITHUB_TEAM
+              value: "{{ .Values.kerberoshub.oauth2Proxy.github.team }}"
+            {{- if .Values.kerberoshub.extraEnv }}
+            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
+            {{- end }}
+          image: quay.io/oauth2-proxy/oauth2-proxy:latest
+          imagePullPolicy: Always
+          name: oauth2-proxy
+          ports:
+            - containerPort: 4180
+              protocol: TCP
+          resources:
+            limits:
+              cpu: 100m
+              memory: 50Mi
+            requests:
+              cpu: 100m
+              memory: 50Mi
+---
+apiVersion: v1
+kind: Service
+metadata:
+  labels:
+    k8s-app: oauth2-proxy
+  name: oauth2-proxy
+  namespace: kube-system
+spec:
+  ports:
+    - name: http
+      port: 4180
+      protocol: TCP
+      targetPort: 4180
+  selector:
+    k8s-app: oauth2-proxy
+{{- end -}}

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "ui") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: hub-reactivate-subscription
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberoshub.reactivate.replicas }}
   selector:
     matchLabels:
       app: hub-reactivate-subscription
@@ -15,25 +17,55 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: hub-reactivate-subscription
     spec:
+      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        - name: regcred
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.reactivate.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: hub-reactivate-subscription
-          image: "{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
+          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+            - configMapRef:
+                name: mongodb-config
           env:
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.reactivate.logLevel }}"
+            - name: READ_ONLY
+              value: "{{ .Values.readonly }}"
             - name: AWS_ACCESS_KEY_ID
               value: "{{ .Values.kerberoshub.api.aws.accessKey }}"
             - name: AWS_SECRET_ACCESS_KEY
               value: "{{ .Values.kerberoshub.api.aws.secretKey }}"
+            {{- if .Values.kerberoshub.extraEnv }}
+            {{- toYaml .Values.kerberoshub.extraEnv | nindent 12 }}
+            {{- end }}
+{{- end }}

charts/hub/templates/kerberos-hub/hub-serviceaccount.yaml

@@ -0,0 +1,13 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "ui") (eq .Values.mode "pipeline")) .Values.kerberoshub.serviceAccount.create }}
+apiVersion: v1
+kind: ServiceAccount
+metadata:
+  name: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+  namespace: {{ .Release.Namespace }}
+  annotations:
+    {{- toYaml .Values.kerberoshub.serviceAccount.annotations | nindent 4 }}
+  {{- with .Values.kerberoshub.serviceAccount.labels }}
+  labels:
+    {{- toYaml . | nindent 4 }}
+  {{- end }}
+{{- end }}

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -0,0 +1,67 @@
+{{/*
+Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
+JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
+This is the engine's boot-loaded configuration source and deployment stage
+catalog: several distinct config workflows can run over one recording — each
+opens its own run and dispatches only its own stages. Organisation-scoped
+database workflows are discovered separately at runtime.
+
+Each enabled definition contributes one workflow object:
+  name      the map key (the workflow's human-readable name; also its identity —
+            the engine derives a stable id from it when the definition carries
+            no explicit id).
+  enabled   always true here (a disabled definition is skipped entirely).
+  source    "config" — provenance marking a Helm-defined, deployment-global,
+            ops-managed workflow (read-only in the API, no owning organisation).
+  triggers  how a run OPENS. Defaults to a single bare automatic trigger
+            (opens for every recording); narrow with device/schedule triggers.
+            Per-stage `needs` (below) decide which stages then FIRE.
+  stages    the executable stage set, each contributing the same routing
+            descriptor the stageRegistry emits:
+              operation  the stage's operation (unique within the workflow).
+              dispatch   "always" (default) | "conditional".
+              queue      from the matching services.<operation>.queue
+                         (authoritative; omitted when unset so the engine
+                         derives "kcloud-<operation>-queue.fifo").
+              needs      conditional stages only: upstream dependencies, each
+                         {operation?, condition?}, carried through verbatim.
+              needsMode  conditional stages: "any" (default) | "all".
+*/}}
+{{- define "kerberoshub.workflows.workflowDefinitions" -}}
+{{- $defs := list -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $wf := .Values.kerberoshub.workflows.definitions -}}
+{{- if $wf.enabled -}}
+{{- $stages := list -}}
+{{- range $stage := $wf.stages -}}
+{{- $op := $stage.operation -}}
+{{- $entry := dict "operation" $op "dispatch" (default "always" $stage.dispatch) -}}
+{{- $service := index $services $op -}}
+{{- if $service }}{{- with $service.queue }}{{- $_ := set $entry "queue" . -}}{{- end }}{{- end }}
+{{- with $stage.needs }}{{- $_ := set $entry "needs" . -}}{{- end }}
+{{- with $stage.needsMode }}{{- $_ := set $entry "needsMode" . -}}{{- end }}
+{{- $stages = append $stages $entry -}}
+{{- end -}}
+{{- $def := dict "name" $name "enabled" true "source" "config" "triggers" (default (list (dict "type" "automatic")) $wf.triggers) "stages" $stages -}}
+{{- $defs = append $defs $def -}}
+{{- end -}}
+{{- end -}}
+{{- $defs | toJson -}}
+{{- end -}}
+
+{{/*
+Expose the deployment's operation→queue catalog to API producers that seed
+embedded WorkflowRuns. Unlike WORKFLOW_DEFINITIONS this includes services that
+are enabled for internal flows but are absent from user-visible workflow
+definitions. The workflows engine remains authoritative for dispatch; producers
+use this only to embed the same queue on a synthetic stage.
+*/}}
+{{- define "kerberoshub.workflows.stageQueues" -}}
+{{- $queues := dict -}}
+{{- range $operation, $service := (.Values.kerberoshub.services | default dict) -}}
+{{- with $service.queue -}}
+{{- $_ := set $queues $operation . -}}
+{{- end -}}
+{{- end -}}
+{{- $queues | toJson -}}
+{{- end -}}

charts/hub/templates/kerberos-pipeline/hub-stage.yaml

@@ -0,0 +1,145 @@
+{{- /*
+  Generic workflow-stage worker.
+
+  Renders a Deployment + Service for every enabled worker under
+  kerberoshub.services.<name> other than the `workflows` engine itself. A custom
+  stage joins the pipeline by values alone — declare its worker here and route to
+  it from a kerberoshub.workflows.definitions stage of the same operation; no
+  per-stage template is needed.
+
+  Every stage worker receives the same connection contract; the only value that
+  varies by stage is the consume-queue variable name, <NAME>_QUEUE (a worker
+  named "loitering" gets LOITERING_QUEUE, "my-stage" gets MY_STAGE_QUEUE). To run
+  a worker outside the chart instead, leave services.<name>.enabled unset (or
+  false) and point its workflow stage at the queue you publish.
+
+  All stages receive the Vault read credentials (KERBEROS_STORAGE_URI /
+  ACCESS_KEY / SECRET). A stage that also writes an artefact back to Vault (e.g.
+  redaction) declares its destination provider with the named field
+  services.<name>.storageProvider, rendered as KERBEROS_STORAGE_PROVIDER; a
+  read-only stage omits it and gets no provider env.
+*/ -}}
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+{{- $root := . -}}
+{{- $services := .Values.kerberoshub.services | default dict -}}
+{{- range $name, $svc := $services -}}
+{{- if and (ne $name "workflows") $svc $svc.enabled -}}
+{{- $queueEnv := printf "%s_QUEUE" ($name | upper | replace "-" "_") -}}
+---
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+spec:
+  replicas: {{ $svc.replicas | default 1 }}
+  selector:
+    matchLabels:
+      app: hub-{{ $name }}
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: hub-{{ $name }}
+    spec:
+      {{- if $root.Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" $root.Release.Name $root.Chart.Name | trunc 63 | trimSuffix "-") $root.Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with $root.Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with $svc.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-{{ $name }}
+        image: "{{ $root.Values.global.imageRegistry }}{{ $svc.repository }}:{{ $svc.tag }}"
+        imagePullPolicy: {{ $svc.pullPolicy | default "IfNotPresent" }}
+        {{- with $svc.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with $svc.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        env:
+        - name: LOG_LEVEL
+          value: "{{ $svc.logLevel | default "info" }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ $root.Values.queueProvider }}"
+
+        # The queue this stage worker consumes dispatched "{{ $name }}" stages
+        # from ({{ $queueEnv }}) and the workflows engine queue it routes its
+        # result back to (WORKFLOWS_QUEUE, so the run records the resolution and
+        # any stage that needs "{{ $name }}" can fire).
+        - name: {{ $queueEnv }}
+          value: "{{ $svc.queue }}"
+        - name: WORKFLOWS_QUEUE
+          value: "{{ $root.Values.kerberoshub.services.workflows.queue }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ $root.Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ $root.Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ $root.Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ $root.Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials this stage uses to fetch
+        # the media it operates on.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ $root.Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ $root.Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ $root.Values.kerberosvault.secretkey }}"
+        {{- with $svc.storageProvider }}
+        # Destination Vault provider (KERBEROS_STORAGE_PROVIDER) — only stages
+        # that write an artefact back (e.g. redaction) set services.<name>.
+        # storageProvider; read-only stages omit it and get no provider env.
+        - name: KERBEROS_STORAGE_PROVIDER
+          value: {{ . | quote }}
+        {{- end }}
+
+        # Per-stage tuning knobs. Any key/value under services.<name>.env is
+        # rendered verbatim as container env, so a worker can be tuned from
+        # values without a per-stage template. These override the image's own
+        # ENV defaults; the fixed contract env above is not overridable here.
+        {{- range $key, $value := $svc.env }}
+        - name: {{ $key }}
+          value: {{ $value | quote }}
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-{{ $name }}
+  namespace: {{ $root.Release.Namespace }}
+  labels:
+    app: hub-{{ $name }}
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-{{ $name }}
+{{ end -}}
+{{- end }}
+{{- end }}

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -0,0 +1,131 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) .Values.kerberoshub.workflows.enabled -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberoshub.services.workflows.replicas }}
+  selector:
+    matchLabels:
+      app: hub-workflows
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: hub-workflows
+    spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.services.workflows.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: hub-workflows
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.services.workflows.repository }}:{{ .Values.kerberoshub.services.workflows.tag }}"
+        imagePullPolicy: {{ .Values.kerberoshub.services.workflows.pullPolicy }}
+        {{- with .Values.kerberoshub.services.workflows.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
+        env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberoshub.services.workflows.logLevel }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ .Values.queueProvider }}"
+
+        # Queue this service consumes from (WORKFLOWS_QUEUE) and the set of
+        # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
+        # trigger and executable stages, assembled from the enabled definitions
+        # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
+        # Definitions are the engine's boot-loaded config source and deployment
+        # stage catalog. Organisation-scoped database workflows are read per
+        # recording; an in-cluster engine still requires at least one config
+        # definition so an empty catalog cannot silently drop traffic.
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
+        - name: WORKFLOW_DEFINITIONS
+          value: {{ include "kerberoshub.workflows.workflowDefinitions" . | quote }}
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # Kerberos Vault — global storage credentials a dispatched stage worker
+        # uses to fetch the media. Per-recording vault overrides (site/account)
+        # are resolved at dispatch time from the database.
+        - name: KERBEROS_STORAGE_URI
+          value: "{{ .Values.kerberosvault.uri }}"
+        - name: KERBEROS_STORAGE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.accesskey }}"
+        - name: KERBEROS_STORAGE_SECRET
+          value: "{{ .Values.kerberosvault.secretkey }}"
+
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: hub-workflows
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: hub-workflows
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: hub-workflows
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-analysis
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.analysis.replicas }}
   selector:
     matchLabels:
       app: pipe-analysis
@@ -15,37 +17,60 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-analysis
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.analysis.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-analysis
-        image: "{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.analysis.repository }}:{{ .Values.kerberospipeline.analysis.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.analysis.pullPolicy }}
+        {{- with .Values.kerberospipeline.analysis.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.analysis.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -58,10 +83,64 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # When true, analysis tees the classify result to the hub-workflows
+        # service in parallel with the throttler/notification tail (which still
+        # runs unchanged). Kept in sync with whether the workflows service runs.
+        - name: WORKFLOWS_ENABLED
+          value: "{{ .Values.kerberoshub.workflows.enabled }}"
+
+        # Queue analysis publishes opened workflow runs to (WORKFLOWS_QUEUE),
+        # taken from the workflows service's queue so analysis and the engine
+        # always agree on the queue name (no drift).
+        - name: WORKFLOWS_QUEUE
+          value: "{{ .Values.kerberoshub.services.workflows.queue }}"
+          
         # Kerberos Vault
         - name: KERBEROS_STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
         - name: KERBEROS_STORAGE_ACCESS_KEY
           value: "{{ .Values.kerberosvault.accesskey }}"
         - name: KERBEROS_STORAGE_SECRET
-          value: "{{ .Values.kerberosvault.secretkey }}"
+          value: "{{ .Values.kerberosvault.secretkey }}"
+
+        # Sprites
+        - name: SPRITE_ENABLED
+          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-analysis
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-analysis
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-analysis
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-counting.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-counting
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.counting.replicas }}
   selector:
     matchLabels:
       app: pipe-counting
@@ -18,19 +20,36 @@ spec:
       labels:
         app: pipe-counting
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.counting.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.counting.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-counting
-        image: "{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.counting.repository }}:{{ .Values.kerberospipeline.counting.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.counting.pullPolicy }}
+        {{- with .Values.kerberospipeline.counting.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with .Values.kerberospipeline.counting.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.counting.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -46,4 +65,42 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-counting
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-counting
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-counting
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-dominantcolor.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-dominantcolor
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.dominantColor.replicas }}
   selector:
     matchLabels:
       app: pipe-dominantcolor
@@ -18,19 +20,36 @@ spec:
       labels:
         app: pipe-dominantcolor
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.dominantColor.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.dominantColor.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-dominantcolor
-        image: "{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.dominantColor.repository }}:{{ .Values.kerberospipeline.dominantColor.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.dominantColor.pullPolicy }}
+        {{- with .Values.kerberospipeline.dominantColor.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with .Values.kerberospipeline.dominantColor.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.dominantColor.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -46,4 +65,42 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-dominantcolor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-dominantcolor
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-dominantcolor
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-event
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.event.replicas }}
   selector:
     matchLabels:
       app: pipe-event
@@ -15,37 +17,64 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-event
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.event.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-event
-        image: "{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.event.repository }}:{{ .Values.kerberospipeline.event.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.event.pullPolicy }}
+        {{- with .Values.kerberospipeline.event.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.event.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        ports:
+          - containerPort: 8080
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.event.logLevel }}"
+        - name: READ_ONLY
+          value: "{{ .Values.readonly }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -56,4 +85,42 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-event
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-event
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-event
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -0,0 +1,162 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pipe-export
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberospipeline.export.replicas }}
+  selector:
+    matchLabels:
+      app: pipe-export
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
+      labels:
+        app: pipe-export
+    spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.export.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: pipe-export
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.export.repository }}:{{ .Values.kerberospipeline.export.tag }}"
+        imagePullPolicy: {{ .Values.kerberospipeline.export.pullPolicy }}
+        {{- with .Values.kerberospipeline.export.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.export.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
+        env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.export.logLevel }}"
+        {{- if .Values.kerberospipeline.export.playerAssetsPath }}
+        - name: PLAYER_ASSETS_PATH
+          value: "{{ .Values.kerberospipeline.export.playerAssetsPath }}"
+        {{- end }}
+        - name: CLOUD_PROVIDER
+          value: "{{ .Values.cloudProvider }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ .Values.queueProvider }}"
+
+        # Kafka settings
+        - name: KAFKA_BROKER
+          value: "{{ .Values.kafka.broker }}"
+        - name: KAFKA_USERNAME
+          value: "{{ .Values.kafka.username }}"
+        - name: KAFKA_PASSWORD
+          value: "{{ .Values.kafka.password }}"
+        - name: KAFKA_MECHANISM
+          value: "{{ .Values.kafka.mechanism }}"
+        - name: KAFKA_SECURITY
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+          
+        # Kerberos Vault (Main instance, within Kerberos Hub you can assign additional Vaults to sites).
+        - name: STORAGE_URI
+          value: "{{ .Values.kerberosvault.uri }}"
+        - name: STORAGE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.accesskey }}"
+        - name: STORAGE_SECRET_KEY
+          value: "{{ .Values.kerberosvault.secretkey }}"
+
+        # Kerberos Vault: archiving credentials. When creating a task, the underlying recording will be
+        # copied to this storage provider, using the specific account credentials, for deletion/retention.
+        - name: STORAGE_ARCHIVE_PROVIDER
+          value: "{{ .Values.kerberosvault.archive.provider }}"
+        - name: STORAGE_ARCHIVE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.archive.accesskey }}"
+        - name: STORAGE_ARCHIVE_SECRET_KEY
+          value: "{{ .Values.kerberosvault.archive.secretkey }}"
+
+        # Sprites
+        - name: SPRITE_ENABLED
+          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+        - name: VAULT_SPRITE_PROVIDER
+          value: "{{ .Values.kerberosvault.sprite.provider }}"
+        - name: VAULT_SPRITE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
+        - name: VAULT_SPRITE_SECRET_KEY
+          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
+        # Thumbnails
+        - name: THUMBNAIL_VAULT_ENABLED
+          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
+        - name: VAULT_THUMBNAIL_PROVIDER
+          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
+        - name: VAULT_THUMBNAIL_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
+        - name: VAULT_THUMBNAIL_SECRET_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-export
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-export
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-export
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-monitor
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.monitor.replicas }}
   selector:
     matchLabels:
       app: pipe-monitor
@@ -15,32 +17,57 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-monitor
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.monitor.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-monitor
-        image: "{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.monitor.repository }}:{{ .Values.kerberospipeline.monitor.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.monitor.pullPolicy }}
+        {{- with .Values.kerberospipeline.monitor.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-  
+        # Application
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.monitor.logLevel }}"
+
         # Queue      
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
@@ -57,6 +84,16 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
         # Mail settings
         - name: MAIL_PROVIDER
           value: "{{ .Values.email.provider }}"
@@ -80,3 +117,31 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-monitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-monitor
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-monitor
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-notify-test
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.notifyTest.replicas }}
   selector:
     matchLabels:
       app: pipe-notify-test
@@ -15,43 +17,56 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify-test
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
       - name: pipe-notify-test
-        image: "{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notifyTest.repository }}:{{ .Values.kerberospipeline.notifyTest.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.notifyTest.pullPolicy }}
+        {{- with .Values.kerberospipeline.notifyTest.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
-        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
-        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kerberos Vault
         - name: STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
@@ -72,6 +87,16 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
         # Mail settings
         - name: MAIL_PROVIDER
           value: "{{ .Values.email.provider }}"
@@ -79,6 +104,8 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
+        - name: PUBLIC_URL
+          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates
         - name: DETECT_TEMPLATE
@@ -93,3 +120,31 @@ spec:
           value: "{{ .Values.email.smtp.username }}"
         - name: SMTP_PASSWORD
           value: "{{ .Values.email.smtp.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-notify-test
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-notify-test
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-notify-test
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-notify
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.notify.replicas }}
   selector:
     matchLabels:
       app: pipe-notify
@@ -15,44 +17,58 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-notify
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notify.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notify.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
+      topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       containers:
       - name: pipe-notify
-        image: "{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.notify.repository }}:{{ .Values.kerberospipeline.notify.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.notify.pullPolicy }}
+        {{- with .Values.kerberospipeline.notify.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
-        {{- with .Values.kerberospipeline.notify.volumeMounts}}
-        volumeMounts:
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.notify.logLevel }}"
+        # Queue
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
-        - name: MAIL_PROVIDER
-          value: "{{ .Values.email.provider }}"
-
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
 
         # Kafka settings
         - name: KAFKA_BROKER
@@ -66,6 +82,16 @@ spec:
         - name: KAFKA_SECURITY
           value: "{{ .Values.kafka.security }}"
 
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
         # Kerberos Vault
         - name: STORAGE_URI
           value: "{{ .Values.kerberosvault.uri }}"
@@ -81,10 +107,14 @@ spec:
           value: "{{ .Values.email.from }}"
         - name: EMAIL_FROM_DISPLAYNAME
           value: "{{ .Values.email.displayName }}"
+        - name: PUBLIC_URL
+          value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
           
         # Mail templates 
         - name: DETECT_TEMPLATE
           value: "{{ .Values.email.templates.detection }}"
+        - name: ALERT_TITLE
+          value: "{{ .Values.email.templates.alertTitle }}"
 
         # SMTP
         - name: SMTP_SERVER
@@ -101,3 +131,52 @@ spec:
           value: "{{ .Values.email.mailgun.domain }}"
         - name: MAILGUN_API_KEY
           value: "{{ .Values.email.mailgun.apikey }}"
+
+        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
+        # This will lower storage in mongodb.
+        - name: THUMBNAIL_VAULT_ENABLED
+          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
+        - name: VAULT_THUMBNAIL_PROVIDER
+          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
+        - name: VAULT_THUMBNAIL_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
+        - name: VAULT_THUMBNAIL_SECRET_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+      
+        # There is an option to store the sprites in a storage provider in Kerberos Vault.
+        - name: VAULT_SPRITE_ENABLED
+          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+        - name: VAULT_SPRITE_PROVIDER
+          value: "{{ .Values.kerberosvault.sprite.provider }}"
+        - name: VAULT_SPRITE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
+        - name: VAULT_SPRITE_SECRET_KEY
+          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-notify
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-notify
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-notify
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-sequence
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.sequence.replicas }}
   selector:
     matchLabels:
       app: pipe-sequence
@@ -15,37 +17,58 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-sequence
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.sequence.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-sequence
-        image: "{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sequence.repository }}:{{ .Values.kerberospipeline.sequence.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.sequence.pullPolicy }}
+        {{- with .Values.kerberospipeline.sequence.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -56,4 +79,42 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-sequence
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-sequence
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-sequence
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-sprite.yaml

@@ -0,0 +1,129 @@
+{{- if and (or (eq .Values.mode "all") (eq .Values.mode "pipeline")) (eq .Values.kerberospipeline.sprite.enabled true) }}
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: pipe-sprite
+  namespace: {{ .Release.Namespace }}
+spec:
+  replicas: {{ .Values.kerberospipeline.sprite.replicas }}
+  selector:
+    matchLabels:
+      app: pipe-sprite
+  minReadySeconds: 10
+  strategy:
+    type: RollingUpdate
+    rollingUpdate:
+      maxUnavailable: 1
+      maxSurge: 1
+  template:
+    metadata:
+      labels:
+        app: pipe-sprite
+    spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
+      {{- with .Values.imagePullSecrets }}
+      imagePullSecrets:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.sprite.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.sprite.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      containers:
+      - name: pipe-sprite
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.sprite.repository }}:{{ .Values.kerberospipeline.sprite.tag }}"
+        imagePullPolicy: {{ .Values.kerberospipeline.sprite.pullPolicy }}        
+        {{- with .Values.kerberospipeline.sprite.resources }}
+        resources:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with .Values.kerberospipeline.sprite.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.sprite.logLevel }}"
+        {{ if .Values.isPrivate }}
+        - name: KERBEROS_PRIVATE_CLOUD
+          value: "true"
+        {{ else }}
+        - name: KERBEROS_PRIVATE_CLOUD
+          value: "false"
+        {{ end }}
+        - name: CLOUD_PROVIDER
+          value: "{{ .Values.cloudProvider }}"
+        - name: QUEUE_SYSTEM
+          value: "{{ .Values.queueProvider }}"
+
+        # Kafka settings
+        - name: KAFKA_BROKER
+          value: "{{ .Values.kafka.broker }}"
+        - name: KAFKA_USERNAME
+          value: "{{ .Values.kafka.username }}"
+        - name: KAFKA_PASSWORD
+          value: "{{ .Values.kafka.password }}"
+        - name: KAFKA_MECHANISM
+          value: "{{ .Values.kafka.mechanism }}"
+        - name: KAFKA_SECURITY
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # There is an option to store the sprites in a storage provider in Kerberos Vault.
+        - name: VAULT_SPRITE_ENABLED
+          value: "{{ .Values.kerberospipeline.sprite.enabled }}"
+        - name: VAULT_SPRITE_PROVIDER
+          value: "{{ .Values.kerberosvault.sprite.provider }}"
+        - name: VAULT_SPRITE_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.sprite.accessKey }}"
+        - name: VAULT_SPRITE_SECRET_KEY
+          value: "{{ .Values.kerberosvault.sprite.secretKey }}"
+        - name: VAULT_SPRITE_INTERVAL
+          value: "{{ .Values.kerberospipeline.sprite.interval }}"
+        - name: VAULT_SPRITE_WIDTH
+          value: "{{ .Values.kerberospipeline.sprite.width }}"
+        - name: VAULT_SPRITE_HEIGHT
+          value: "{{ .Values.kerberospipeline.sprite.height }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-sprite
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-sprite
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-sprite
+{{ end }}

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-throttler
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.throttler.replicas }}
   selector:
     matchLabels:
       app: pipe-throttler
@@ -15,37 +17,60 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: pipe-throttler
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberospipeline.throttler.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-throttler
-        image: "{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.throttler.repository }}:{{ .Values.kerberospipeline.throttler.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.throttler.pullPolicy }}
+        {{- with .Values.kerberospipeline.throttler.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+        volumeMounts:
+        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
+        envFrom:
+        - configMapRef:
+            name: mongodb-config
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.throttler.logLevel }}"
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
           value: "{{ .Values.queueProvider }}"
 
-        # Database
-        - name: MONGODB_HOST
-          value: "{{ .Values.mongodb.host }}"
-        - name: MONGODB_DATABASE_CREDENTIALS
-          value: "{{ .Values.mongodb.adminDatabase }}"
-        - name: MONGODB_USERNAME
-          value: "{{ .Values.mongodb.username }}"
-        - name: MONGODB_PASSWORD
-          value: "{{ .Values.mongodb.password }}"
-
         # Kafka settings
         - name: KAFKA_BROKER
           value: "{{ .Values.kafka.broker }}"
@@ -56,4 +81,42 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-throttler
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-throttler
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-throttler
+{{- end }}

charts/hub/templates/kerberos-pipeline/pipe-thumbnail.yaml

@@ -1,9 +1,11 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: pipe-thumbnail
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 1
+  replicas: {{ .Values.kerberospipeline.thumbnail.replicas }}
   selector:
     matchLabels:
       app: pipe-thumbnail
@@ -18,19 +20,43 @@ spec:
       labels:
         app: pipe-thumbnail
     spec:
+      {{- if .Values.kerberoshub.serviceAccount.create }}
+      serviceAccountName: {{ default (printf "%s-%s-sa" .Release.Name .Chart.Name | trunc 63 | trimSuffix "-") .Values.kerberoshub.serviceAccount.name }}
+      {{- end }}
       {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- with .Values.kerberospipeline.thumbnail.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberospipeline.thumbnail.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
       - name: pipe-thumbnail
-        image: "{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
+        image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberospipeline.thumbnail.repository }}:{{ .Values.kerberospipeline.thumbnail.tag }}"
         imagePullPolicy: {{ .Values.kerberospipeline.thumbnail.pullPolicy }}
+        {{- with .Values.kerberospipeline.thumbnail.resources }}
         resources:
-          requests:
-            memory: 10Mi
-            cpu: 10m
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
+        {{- with .Values.kerberospipeline.thumbnail.volumeMounts }}
+        volumeMounts:
+          {{- toYaml . | nindent 12 }}
+        {{- end }}
         env:
+        - name: LOG_LEVEL
+          value: "{{ .Values.kerberospipeline.thumbnail.logLevel }}"
+        {{ if .Values.isPrivate }}
+        - name: KERBEROS_PRIVATE_CLOUD
+          value: "true"
+        {{ else }}
+        - name: KERBEROS_PRIVATE_CLOUD
+          value: "false"
+        {{ end }}
         - name: CLOUD_PROVIDER
           value: "{{ .Values.cloudProvider }}"
         - name: QUEUE_SYSTEM
@@ -46,4 +72,62 @@ spec:
         - name: KAFKA_MECHANISM
           value: "{{ .Values.kafka.mechanism }}"
         - name: KAFKA_SECURITY
-          value: "{{ .Values.kafka.security }}"
+          value: "{{ .Values.kafka.security }}"
+
+        # RabbitMQ settings
+        - name: RABBITMQ_HOST
+          value: "{{ .Values.rabbitmq.host }}"
+        - name: RABBITMQ_EXCHANGE
+          value: "{{ .Values.rabbitmq.exchange }}"
+        - name: RABBITMQ_USERNAME
+          value: "{{ .Values.rabbitmq.username }}"
+        - name: RABBITMQ_PASSWORD
+          value: "{{ .Values.rabbitmq.password }}"
+
+        # Thumbnail generation
+        - name: THUMBNAIL_QUALITY
+          value: "{{ .Values.kerberospipeline.thumbnail.quality }}"
+        - name: THUMBNAIL_WIDTH
+          value: "{{ .Values.kerberospipeline.thumbnail.width }}"
+        - name: THUMBNAIL_HEIGHT
+          value: "{{ .Values.kerberospipeline.thumbnail.height }}"
+
+        # There is an option to store the thumbnails in a storage provider in Kerberos Vault.
+        # This will lower storage in mongodb.
+        - name: THUMBNAIL_VAULT_ENABLED
+          value: "{{ .Values.kerberospipeline.thumbnail.kerberosvault.enabled }}"
+        - name: VAULT_THUMBNAIL_PROVIDER
+          value: "{{ .Values.kerberosvault.thumbnail.provider }}"
+        - name: VAULT_THUMBNAIL_ACCESS_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.accessKey }}"
+        - name: VAULT_THUMBNAIL_SECRET_KEY
+          value: "{{ .Values.kerberosvault.thumbnail.secretKey }}"
+        
+        {{- if .Values.opentelemetry.enabled }}
+        # Open Telemetry tracing
+        - name: OTEL_EXPORTED_OTLP_ENABLED
+          value: "{{ .Values.opentelemetry.enabled }}"
+        - name: OTEL_EXPORTED_OTLP_ROUTING_ENABLED
+          value: "{{ .Values.opentelemetry.routingEnabled }}"
+        - name: OTEL_EXPORTER_OTLP_ENDPOINT
+          value: "{{ .Values.opentelemetry.collector.endpoint }}"
+        {{- end }}
+
+---
+apiVersion: v1
+kind: Service
+metadata:
+  name: pipe-thumbnail
+  namespace: {{ .Release.Namespace }}
+  labels:
+    app: pipe-thumbnail
+    service: pipe
+spec:
+  ports:
+    - name: hub-metrics
+      port: 8080
+      targetPort: 8080
+      protocol: TCP
+  selector:
+    app: pipe-thumbnail
+{{- end }}

charts/hub/templates/kerberos-pipeline/servicemonitor.yaml

@@ -0,0 +1,18 @@
+{{- if or (eq .Values.mode "all") (eq .Values.mode "pipeline") -}}
+apiVersion: monitoring.coreos.com/v1
+kind: ServiceMonitor
+metadata:
+  name: hub-metrics-servicemonitor
+  namespace: {{ .Release.Namespace }}
+  labels:
+    service: pipe
+    release: prometheus
+spec:
+  selector:
+    matchLabels:
+      service: pipe
+  endpoints:
+    - port: hub-metrics
+      interval: 15s
+      path: /metrics
+{{- end }}

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -1,7 +1,10 @@
+# If .Values.kerberoshub.forwarder.enabled is set to true 
+{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: vault-forwarder
+  namespace: {{ .Release.Namespace }}
 spec:
   replicas: 1
   selector:
@@ -15,6 +18,8 @@ spec:
       maxSurge: 1
   template:
     metadata:
+      annotations:
+        checksum/config: {{ include (print $.Template.BasePath "/configmap-mongodb.yaml") . | sha256sum }}
       labels:
         app: vault-forwarder
     spec:
@@ -22,35 +27,49 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+      volumes:
+      {{- with .Values.kerberoshub.forwarder.volumes }}
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
+      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: vault-forwarder
-          image: "{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
           resources:
             requests:
               memory: 10Mi
               cpu: 10m
+          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
+          volumeMounts:
+          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
+          envFrom:
+          - configMapRef:
+              name: mongodb-config
           env:
-            - name: ITERATION_SPEED
-              value: "5"
-            - name: BUFFER_TIME
-              value: "3"
-            # Mongodb
-            - name: MONGODB_DATABASE_CLOUD
-              value: "Kerberos"
-            - name: MONGODB_HOST
-              value: "{{ .Values.mongodb.host }}"
-            - name: MONGODB_DATABASE_CREDENTIALS
-              value: "{{ .Values.mongodb.adminDatabase }}"
-            - name: MONGODB_USERNAME
-              value: "{{ .Values.mongodb.username }}"
-            - name: MONGODB_PASSWORD
-              value: "{{ .Values.mongodb.password }}"
-
-            # Mqtt (VERNEMQ)
-            - name: MQTT_URI
-              value: "{{ .Values.mqtt.host }}"
-            - name: MQTT_USERNAME
-              value: "{{ .Values.mqtt.username }}"
-            - name: MQTT_PASSWORD
-              value: "{{ .Values.mqtt.password }}"
+          - name: ITERATION_SPEED
+            value: "5"
+          - name: BUFFER_TIME
+            value: "3"
+          - name: MQTT_URI
+            value: "{{ .Values.mqtt.host }}"
+          - name: MQTT_USERNAME
+            value: "{{ .Values.mqtt.username }}"
+          - name: MQTT_PASSWORD
+            value: "{{ .Values.mqtt.password }}"
+{{- end }}

charts/hub/templates/kerberos-vault/vault-proxy.yaml

@@ -1,9 +1,11 @@
+{{- if eq .Values.mode "all" -}}
 apiVersion: apps/v1
 kind: Deployment
 metadata:
   name: vault-proxy
+  namespace: {{ .Release.Namespace }}
 spec:
-  replicas: 3
+  replicas: {{ .Values.kerberoshub.proxy.replicas }}
   selector:
     matchLabels:
       app: vault-proxy
@@ -18,16 +20,32 @@ spec:
       labels:
         app: vault-proxy
     spec:
+      {{- with .Values.imagePullSecrets }}
       imagePullSecrets:
-        - name: regcred
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.proxy.volumes }}
+      volumes:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
+      {{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
+      topologySpreadConstraints:
+        {{- toYaml . | nindent 8 }}
+      {{- end }}
       containers:
         - name: vault-proxy
-          image: "{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
+          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
+          {{- with .Values.kerberoshub.proxy.volumeMounts }}
+          volumeMounts:
+            {{- toYaml . | nindent 12 }}
+          {{- end }}
           ports:
             - containerPort: 8080
               name: http
           env:
+            - name: LOG_LEVEL
+              value: "{{ .Values.kerberoshub.proxy.logLevel }}"
             # Kerberos Hub API
             - name: KERBEROS_API_CHECK_SUBSCRIPTION
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
@@ -45,6 +63,7 @@ apiVersion: v1
 kind: Service
 metadata:
   name: vault-proxy-svc
+  namespace: {{ .Release.Namespace }}
   labels:
     app: vault-proxy-svc
 spec:
@@ -56,3 +75,4 @@ spec:
       name: http
   selector:
     app: vault-proxy
+{{- end }}

charts/hub/traefik/values-ssl.yaml

@@ -1,24 +0,0 @@
-dashboard:
-  enabled: true
-  domain: yourdomain.com
-  serviceType: NodePort
-rbac:
-    enabled: true
-ssl:
-  enabled: true
-  enforced: true
-  permanentRedirect: true
-acme:
-  enabled: true
-  challengeType: "dns-01"
-  email: ...
-  caServer: https://acme-v02.api.letsencrypt.org/directory
-  domains:
-    enabled: true
-    domainsList:
-      - main: "*.yourdomain.com"
-  dnsProvider:
-    name: cloudflare
-    cloudflare:
-      CLOUDFLARE_EMAIL: youremail
-      CLOUDFLARE_API_KEY: yourpassword

charts/hub/vernemq/values.yaml

@@ -1,243 +0,0 @@
-# Default values for vernemq.
-# This is a YAML-formatted file.
-# Declare variables to be passed into your templates.
-
-replicaCount: 1
-
-image:
-  repository: vernemq/vernemq
-  tag: 1.12.3-alpine
-
-  pullPolicy: IfNotPresent
-
-nameOverride: ""
-fullnameOverride: ""
-
-serviceMonitor:
-  create: false
-  labels: {}
-
-service:
-  # Can be disabled if more advanced use cases require more complex setups, e.g., combining LoadBalancer and ClusterIP for internal and external access. See also issue #274.
-  enabled: true
-  # NodePort - Listen to a port on nodes and forward to the service.
-  # ClusterIP - Listen on the service internal to the cluster only.
-  # LoadBalancer - Create a LoadBalancer in the cloud provider and forward to the service.
-  type: LoadBalancer
-#  clusterIP: 10.1.2.4
-#  externalIPs: []
-#  loadBalancerIP: 10.1.2.4
-#  loadBalancerSourceRanges: []
-#  externalTrafficPolicy: Local
-#  sessionAffinity: None
-#  sessionAffinityConfig: {}
-  mqtt:
-    enabled: true
-    port: 1883
-    # This is the port used by nodes to expose the service
-    nodePort: 1883
-  mqtts:
-    enabled: true
-    port: 8883
-    # This is the port used by nodes to expose the service
-    nodePort: 8883
-  ws:
-    enabled: true
-    port: 8080
-    # This is the port used by nodes to expose the service
-    nodePort: 8080
-  wss:
-    enabled: true
-    port: 8443
-    # This is the port used by nodes to expose the service
-    nodePort: 8443
-  annotations: {}
-  labels: {}
-
-## Ingress can optionally be applied when enabling the MQTT websocket service
-## This allows for an ingress controller to route web ports and arbitrary hostnames
-## and paths to the websocket service as well as allow the controller to handle TLS
-## termination for the websocket traffic. Ingress is only possible for traffic exchanged
-## over HTTP, so ONLY the websocket service take advantage of ingress.
-ingress:
-  className: ""
-  enabled: false
-
-  labels: {}
-
-  annotations: {}
-
-  ## Hosts must be provided if ingress is enabled.
-  ##
-  hosts: []
-    # - vernemq.domain.com
-
-  ## Paths to use for ingress rules.
-  ##
-  paths:
-    - path: /
-      pathType: ImplementationSpecific
-      
-
-  ## TLS configuration for ingress
-  ## Secret must be manually created in the namespace
-  ##
-  tls: []
-  # - secretName: vernemq-tls
-  #   hosts:
-  #   - vernemq.domain.com
-
-## VerneMQ resources requests and limits
-## Ref: http://kubernetes.io/docs/user-guide/compute-resources
-resources: {}
-  ## We usually recommend not to specify default resources and to leave this as a conscious
-  ## choice for the user. This also increases chances charts run on environments with little
-  ## resources, such as Minikube. If you do want to specify resources, uncomment the following
-  ## lines, adjust them as necessary, and remove the curly braces after 'resources:'.
-#  limits:
-#    cpu: 1
-#    memory: 256Mi
-#  requests:
-#    cpu: 1
-#    memory: 256Mi
-
-## Node labels for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#nodeselector
-nodeSelector: {}
-
-## Node tolerations for pod assignment
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#taints-and-tolerations-beta-feature
-tolerations: []
-
-## Pod affinity
-## Ref: https://kubernetes.io/docs/concepts/configuration/assign-pod-node/#affinity-and-anti-affinity
-podAntiAffinity: soft
-
-securityContext:
-  runAsUser: 10000
-  runAsGroup: 10000
-  fsGroup: 10000
-
-## If RBAC is enabled on the cluster,VerneMQ needs a service account
-## with permissisions sufficient to list pods
-rbac:
-  create: true
-  serviceAccount:
-    create: true
-    ## Service account name to be used.
-    ## If not set and serviceAccount.create is true a name is generated using the fullname template.
-#    name:
-
-persistentVolume:
-  ## If true, VerneMQ will create/use a Persistent Volume Claim
-  ## If false, use local directory
-  enabled: false
-
-  ## VerneMQ data Persistent Volume access modes
-  ## Must match those of existing PV or dynamic provisioner
-  ## Ref: http://kubernetes.io/docs/user-guide/persistent-volumes/
-  accessModes:
-    - ReadWriteOnce
-
-  ## VerneMQ data Persistent Volume size
-  size: 5Gi
-
-  ## VerneMQ data Persistent Volume Storage Class
-  ## If defined, storageClassName: <storageClass>
-  ## If set to "-", storageClassName: "", which disables dynamic provisioning
-  ## If undefined (the default) or set to null, no storageClassName spec is
-  ##   set, choosing the default provisioner.  (gp2 on AWS, standard on
-  ##   GKE, AWS & OpenStack)
-#  storageClass: ""
-
-  ## Annotations for Persistent Volume Claim
-  annotations: {}
-
-extraVolumeMounts: []
-## Additional volumeMounts to the pod.
-#  - name: additional-volume-mount
-#    mountPath: /var/additional-volume-path
-
-extraVolumes: []
-## Additional volumes to the pod.
-#  - name: additional-volume
-#    emptyDir: {}
-
-# A list of secrets and their paths to mount inside the pod
-# This is useful for mounting certificates for security (tls)
-secretMounts:
-  - name: vernemq-certificates
-    secretName: vernemq-certificates-secret
-    path: /etc/ssl/vernemq
-
-statefulset:
-  ## Start and stop pods in Parallel or OrderedReady (one-by-one.)  Note - Can not change after first release.
-  ## Ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#pod-management-policy
-  podManagementPolicy: OrderedReady
-  ## Statefulsets rolling update update strategy
-  ## Ref: https://kubernetes.io/docs/tutorials/stateful-application/basic-stateful-set/#rolling-update
-  updateStrategy: RollingUpdate
-  ## Configure how much time VerneMQ takes to move offline queues to other nodes
-  ## Ref: https://vernemq.com/docs/clustering/#detailed-cluster-leave-case-a-make-a-live-node-leave
-  terminationGracePeriodSeconds: 60
-  ## Liveness and Readiness probe values
-  ## Ref: https://kubernetes.io/docs/tasks/configure-pod-container/configure-liveness-readiness-probes
-  livenessProbe:
-    initialDelaySeconds: 90
-    periodSeconds: 10
-    timeoutSeconds: 5
-    successThreshold: 1
-    failureThreshold: 3
-  readinessProbe:
-    initialDelaySeconds: 90
-    periodSeconds: 10
-    timeoutSeconds: 5
-    successThreshold: 1
-    failureThreshold: 3
-  podAnnotations: {}
-#    prometheus.io/scrape: "true"
-#    prometheus.io/port: "8888"
-  annotations: {}
-  labels: {}
-  lifecycle: {}
-
-pdb:
-  enabled: false
-  minAvailable: 1
-  # maxUnavailable: 1
-
-## VerneMQ settings
-
-additionalEnv:
-  - name: DOCKER_VERNEMQ_ALLOW_REGISTER_DURING_NETSPLIT
-    value: "on"
-  - name: DOCKER_VERNEMQ_ALLOW_PUBLISH_DURING_NETSPLIT
-    value: "on"
-  - name: DOCKER_VERNEMQ_ALLOW_SUBSCRIBE_DURING_NETSPLIT
-    value: "on"
-  - name: DOCKER_VERNEMQ_ALLOW_UNSUBSCRIBE_DURING_NETSPLIT
-    value: "on"
-  - name: DOCKER_VERNEMQ_ACCEPT_EULA
-    value: "yes"
-  - name: DOCKER_VERNEMQ_ALLOW_ANONYMOUS
-    value: "off"
-  - name: DOCKER_VERNEMQ_USER_YOURUSERNAME
-    value: "yourpassword"
-  - name: DOCKER_VERNEMQ_LISTENER__SSL__CAFILE
-    value: "/etc/ssl/vernemq/tls.crt"
-  - name: DOCKER_VERNEMQ_LISTENER__SSL__CERTFILE
-    value: "/etc/ssl/vernemq/tls.crt"
-  - name: DOCKER_VERNEMQ_LISTENER__SSL__KEYFILE
-    value: "/etc/ssl/vernemq/tls.key"
-  - name: DOCKER_VERNEMQ_LISTENER__WSS__CAFILE
-    value: "/etc/ssl/vernemq/tls.crt"
-  - name: DOCKER_VERNEMQ_LISTENER__WSS__CERTFILE
-    value: "/etc/ssl/vernemq/tls.crt"
-  - name: DOCKER_VERNEMQ_LISTENER__WSS__KEYFILE
-    value: "/etc/ssl/vernemq/tls.key"
-
-envFrom: []
-# add additional environment variables e.g. from a configmap or secret
-# can be usefull if you wanna use authentication via files
-#  - secretRef:
-#      name: vernemq-users

charts/hub/vernemq/vernemq-certificate.yaml

@@ -1,11 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: Certificate
-metadata:
-  name: vernemq-certificates
-spec:
-  dnsNames:
-   - "mqtt.yourdomain.com"
-  issuerRef:
-    kind: ClusterIssuer
-    name: vernemq-letsencrypt-iss
-  secretName: vernemq-certificates-secret

charts/hub/vernemq/vernemq-issuer.yaml

@@ -1,18 +0,0 @@
-apiVersion: cert-manager.io/v1
-kind: ClusterIssuer
-metadata:
-  name: vernemq-letsencrypt-iss
-spec:
-  acme:
-    email: xxx@xxx.io
-    server: https://acme-v02.api.letsencrypt.org/directory
-    privateKeySecretRef:
-      name: vernemq-letsencrypt-iss-key
-    solvers:
-      - selector: {}
-        dns01:
-          cloudflare:
-            email: xxx@xxx.io
-            apiKeySecretRef:
-              name: cloudflare-api-key-secret
-              key: api-key

charts/hub/vernemq/vernemq-secret.yaml

@@ -1,7 +0,0 @@
-apiVersion: v1
-kind: Secret
-metadata:
-  name: cloudflare-api-key-secret
-type: Opaque
-stringData:
-  api-key: xxxx

scripts/check-workflows-queue-consistency.sh

@@ -0,0 +1,97 @@
+#!/usr/bin/env bash
+#
+# Render the hub chart and assert that every deployment which carries the
+# workflows hand-off queue (the WORKFLOWS_QUEUE env var) resolves to the SAME,
+# non-empty value.
+#
+# Why: the analysis pipeline (pipe-analysis) publishes opened workflow runs to
+# WORKFLOWS_QUEUE, the workflows engine (hub-workflows) consumes it, and every
+# stage worker (hub-stage) routes its result back to it. All three templates
+# read the single key `kerberoshub.services.workflows.queue`. If a future edit
+# hardcodes a value, reads the wrong key, or drops the env on one of them, the
+# producer and consumer silently drift onto different queue names and messages
+# pile up with no consumer. This check fails the build before that can ship.
+#
+# Usage: scripts/check-workflows-queue-consistency.sh [chart-dir]
+#        (chart-dir defaults to charts/hub, relative to the repo root)
+
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+PROBE="drift-probe-queue-name"
+
+# Flags that force all three deployment kinds (analysis, engine and one stage
+# worker) to render, so the check actually has something to compare. The chart
+# ships NO enabled stage worker by default (custom stages are values-only and
+# opt-in), so we synthesise a throwaway stage purely to exercise the generic
+# hub-stage path. The name is a neutral fixture ("queuecheck") on purpose: any
+# arbitrary stage key must render the same way, so the check must not depend on
+# a specific bundled worker.
+STAGE="queuecheck"
+RENDER_FLAGS=(
+  --set mode=all
+  --set kerberoshub.workflows.enabled=true
+  --set "kerberoshub.workflows.stages.${STAGE}.enabled=true"
+  --set "kerberoshub.services.${STAGE}.enabled=true"
+  --set "kerberoshub.services.${STAGE}.repository=example.invalid/queuecheck"
+  --set "kerberoshub.services.${STAGE}.tag=test"
+  --set "kerberoshub.services.${STAGE}.queue=queuecheck-fixture-queue"
+)
+
+# Read `helm template` output on stdin and print one WORKFLOWS_QUEUE value per
+# line. Matches the `- name: WORKFLOWS_QUEUE` env entry and captures the value
+# from the following `value:` line, skipping blank/comment lines in between.
+extract_workflows_queue() {
+  awk '
+    /^[[:space:]]*-[[:space:]]*name:[[:space:]]*WORKFLOWS_QUEUE[[:space:]]*$/ { want=1; next }
+    want==1 {
+      if ($0 ~ /^[[:space:]]*#/ || $0 ~ /^[[:space:]]*$/) next
+      v=$0
+      sub(/^[[:space:]]*value:[[:space:]]*/, "", v)
+      sub(/^"/, "", v); sub(/"[[:space:]]*$/, "", v)
+      sub(/[[:space:]]+$/, "", v)
+      print v
+      want=0
+    }
+  '
+}
+
+assert_all_equal() {
+  local expected="$1"; shift
+  local label="$1"; shift
+  local -a vals=("$@")
+
+  if [ "${#vals[@]}" -lt 2 ]; then
+    echo "FAIL (${label}): expected at least 2 WORKFLOWS_QUEUE values (analysis + engine), found ${#vals[@]}" >&2
+    return 1
+  fi
+
+  local v
+  for v in "${vals[@]}"; do
+    if [ -z "${v}" ]; then
+      echo "FAIL (${label}): a deployment rendered an empty WORKFLOWS_QUEUE value" >&2
+      return 1
+    fi
+    if [ "${v}" != "${expected}" ]; then
+      echo "FAIL (${label}): WORKFLOWS_QUEUE drift detected — expected '${expected}' but a deployment rendered '${v}'" >&2
+      printf '  rendered values: %s\n' "${vals[*]}" >&2
+      return 1
+    fi
+  done
+
+  echo "OK (${label}): ${#vals[@]} deployments all use WORKFLOWS_QUEUE='${expected}'"
+}
+
+echo "== Rendering ${CHART_DIR} with the chart's default workflows queue =="
+default_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}")"
+mapfile -t default_vals < <(printf '%s\n' "${default_out}" | extract_workflows_queue)
+default_queue="${default_vals[0]:-}"
+assert_all_equal "${default_queue}" "default values" "${default_vals[@]}" || exit 1
+
+echo "== Rendering ${CHART_DIR} with an overridden workflows queue (-> ${PROBE}) =="
+probe_out="$(helm template hub "${CHART_DIR}" "${RENDER_FLAGS[@]}" \
+  --set kerberoshub.services.workflows.queue="${PROBE}")"
+mapfile -t probe_vals < <(printf '%s\n' "${probe_out}" | extract_workflows_queue)
+assert_all_equal "${PROBE}" "override probe" "${probe_vals[@]}" || exit 1
+
+echo "All WORKFLOWS_QUEUE consistency checks passed."