Merge pull request #143 from kerberos-io/public-release-1786904956

A new public release - 1786904956

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.126.2
+version: 0.130.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -53,6 +53,11 @@ Below all configuration options and parameters are listed.
 | `mongodb.password` | MongoDB user password, by default `'yourmongodbpassword'` | `"yourpassword"` |
 | `mongodb.retryWrites` | Enable or disable MongoDB retryable writes. | `"true"` |
 | `mongodb.flavor` | Backend engine flavor: `"mongodb"` (native MongoDB / Atlas) or `"documentdb"` (AWS DocumentDB). The `documentdb` flavor disables features DocumentDB does not support (geospatial queries/indexes, complex `$lookup` pipelines). When set to `documentdb`, also set `mongodb.retryWrites: "false"`. | `"mongodb"` |
+| `mongodb.tls.enabled` | Enable TLS for MongoDB connections. When `mongodb.uri` is set, the chart appends missing `tls=true` and `tlsCAFile` query parameters. | `false` |
+| `mongodb.tls.existingSecret` | Existing Kubernetes Secret containing the MongoDB CA bundle. The Secret is mounted into every workload that consumes `mongodb-config`. | `""` |
+| `mongodb.tls.caFileName` | Key and filename of the CA bundle in `mongodb.tls.existingSecret` (for AWS DocumentDB, typically `global-bundle.pem`). | `""` |
+| `mongodb.tls.mountPath` | Read-only directory where the MongoDB CA Secret is mounted. | `"/etc/mongodb/tls"` |
+| `mongodb.tls.insecureSkipVerify` | Skip MongoDB certificate and hostname verification. This is insecure and intended only for local testing. | `false` |
 | `mqtt.host` | MQTT (Vernemq) hostname. | `"mqtt.yourdomain.com"` |
 | `mqtt.port` | MQTT (Vernemq) port for WSS (secure sockets), by default `'8443'`. | `"8443"` |
 | `mqtt.protocol` | MQTT (Vernemq) protocol, by default `'wss'`. | `"wss"` |
@@ -202,8 +207,14 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
 | `kerberoshub.frontend.features.workflows.enabled` | Enable or disable the workflows feature in the frontend. | `"false"` |
+| `kerberoshub.frontend.features.organisations.enabled` | Enable or disable all organisation feature flags. When empty, the child settings apply independently. | `""` |
 | `kerberoshub.frontend.features.organisations.switcherEnabled` | Enable or disable the organisation dropdown and switching. The current organisation remains visible when disabled. | `"false"` |
 | `kerberoshub.frontend.features.organisations.creationEnabled` | Enable or disable organisation creation. Requires organisation switching to be enabled. | `"false"` |
+| `kerberoshub.frontend.features.organisations.settingsEnabled` | Enable or disable the organisation identity link to organisation settings. | `"false"` |
+| `kerberoshub.frontend.features.projects.enabled` | Enable or disable all project feature flags. When empty, the child settings apply independently. | `""` |
+| `kerberoshub.frontend.features.projects.switcherEnabled` | Enable or disable the read-only project dropdown. | `"false"` |
+| `kerberoshub.frontend.features.projects.creationEnabled` | Reserved for the project creation UI. | `"false"` |
+| `kerberoshub.frontend.features.projects.settingsEnabled` | Reserved for the project settings UI. | `"false"` |
 | `kerberoshub.frontend.features.map.tileUrlLight` | Tile URL used by the map in light mode. | `"https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.tileUrlDark` | Tile URL used by the map in dark mode. | `"https://{s}.basemaps.cartocdn.com/dark_all/{z}/{x}/{y}{r}.png"` |
 | `kerberoshub.frontend.features.map.attribution` | Attribution text displayed on the map tiles. | `"&copy; <a href='https://www.openstreetmap.org/copyright' target='_blank'>OpenStreetMap</a>"` |
@@ -248,6 +259,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxDrawing` | Color customization for `floorplan` in the frontend. | `"hsla(204, 100%, 50%, 1)"` |
 | `kerberoshub.frontend.features.floorplan.colorTrackBoxControlsDelete` | Color customization for `floorplan` in the frontend. | `"hsla(219, 100%, 94%, 1)"` |
 | `kerberoshub.frontend.features.faceRedaction.enabled` | Enable or disable `kerberoshub.frontend.features.faceRedaction`. | `"false"` |
+| `kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled` | Make classifier-generated tracks available in the redaction modal. | `"true"` |
 | `kerberoshub.support.enabled` | Enable or disable in-app support features. | `false` |
 | `kerberoshub.oauth2Proxy.enabled` | Enable or disable `kerberoshub.oauth2Proxy`. | `false` |
 | `kerberoshub.oauth2Proxy.github.clientId` | Client ID used by `kerberoshub.oauth2Proxy.github`. | `"github-client-id"` |
@@ -291,7 +303,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
 | `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
-| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. | `1` |
+| `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
@@ -299,7 +311,7 @@ Below all configuration options and parameters are listed.
 | `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
 | `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
 | `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. | `1` |
+| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy`. Set to `0` to disable. | `0` |
 | `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
 | `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
 | `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
@@ -486,6 +498,7 @@ Following indexes should be executed on the MongoDB database (Kerberos) to impro
 #### Analysis collection
 
     db.getCollection("analysis").createIndex({start:1})
+    db.getCollection("analysis").createIndex({organisationId:1, projectId:1, key:1}, {name:"analysis_org_project_key"})
     db.getCollection("analysis").createIndex({userid:1, key:1})
     db.getCollection("analysis").createIndex({userid:1, start:1})
 

charts/hub/custom-layout/i18n/en.json

@@ -1702,7 +1702,9 @@
                   "k14": "fps",
                   "k15": "Detection run",
                   "k16": "Select a detection run",
-                  "k17": "No detections"
+                  "k17": "No detections",
+                  "k18": "Automatic tracks unavailable",
+                  "k19": "Automatic face tracks are disabled. You can still draw redaction boxes manually on the player and submit."
                 }
               },
               "motionmap": {

charts/hub/templates/_helpers.tpl

@@ -0,0 +1,48 @@
+{{/* Build the path to the configured MongoDB CA bundle. */}}
+{{- define "hub.mongodb.tlsCAFile" -}}
+{{- if and .Values.mongodb.tls.enabled .Values.mongodb.tls.existingSecret .Values.mongodb.tls.caFileName -}}
+{{- printf "%s/%s" .Values.mongodb.tls.mountPath .Values.mongodb.tls.caFileName | clean -}}
+{{- end -}}
+{{- end -}}
+
+{{/* Add TLS options to a configured MongoDB URI unless they are already present. */}}
+{{- define "hub.mongodb.uri" -}}
+{{- $uri := .Values.mongodb.uri | default "" -}}
+{{- if and .Values.mongodb.tls.enabled $uri -}}
+  {{- if not (regexMatch "(?i)(^|[?&])tls=" $uri) -}}
+    {{- $separator := "?" -}}
+    {{- if contains "?" $uri -}}
+      {{- $separator = "&" -}}
+    {{- end -}}
+    {{- if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stls=true" $uri $separator -}}
+  {{- end -}}
+  {{- $caFile := include "hub.mongodb.tlsCAFile" . -}}
+  {{- if and $caFile (not (regexMatch "(?i)(^|[?&])tlsCAFile=" $uri)) -}}
+    {{- $separator := "&" -}}
+    {{- if not (contains "?" $uri) -}}
+      {{- $separator = "?" -}}
+    {{- else if or (hasSuffix "?" $uri) (hasSuffix "&" $uri) -}}
+      {{- $separator = "" -}}
+    {{- end -}}
+    {{- $uri = printf "%s%stlsCAFile=%s" $uri $separator $caFile -}}
+  {{- end -}}
+{{- end -}}
+{{- $uri -}}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA Secret volume. */}}
+{{- define "hub.mongodb.tlsVolume" -}}
+- name: mongodb-tls
+  secret:
+    secretName: {{ .Values.mongodb.tls.existingSecret }}
+{{- end -}}
+
+{{/* Render the shared MongoDB CA volume mount. */}}
+{{- define "hub.mongodb.tlsVolumeMount" -}}
+- name: mongodb-tls
+  mountPath: {{ .Values.mongodb.tls.mountPath }}
+  readOnly: true
+{{- end -}}

charts/hub/templates/configmap-mongodb.yaml

@@ -4,7 +4,7 @@ metadata:
   name: mongodb-config
   namespace: {{ .Release.Namespace }}
 data:
-  MONGODB_URI: "{{ .Values.mongodb.uri }}"
+  MONGODB_URI: {{ include "hub.mongodb.uri" . | quote }}
   MONGODB_HOST: "{{ .Values.mongodb.host }}"
   MONGODB_AUTHENTICATION_MECHANISM: "{{ .Values.mongodb.authenticationMechanism }}"
   MONGODB_DATABASE_CREDENTIALS: "{{ .Values.mongodb.adminDatabase }}"
@@ -12,4 +12,7 @@ data:
   MONGODB_PASSWORD: "{{ .Values.mongodb.password }}"
   MONGODB_RETRY_WRITES: "{{ .Values.mongodb.retryWrites }}"
   MONGODB_FLAVOR: "{{ .Values.mongodb.flavor | default "mongodb" }}"
+  MONGODB_TLS: "{{ .Values.mongodb.tls.enabled }}"
+  MONGODB_TLS_CA_FILE: {{ include "hub.mongodb.tlsCAFile" . | quote }}
+  MONGODB_TLS_INSECURE_SKIP_VERIFY: "{{ .Values.mongodb.tls.insecureSkipVerify }}"
   MONGODB_DATABASE_CLOUD: "Kerberos"

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -131,7 +131,8 @@ spec:
         {{- toYaml . | nindent 8 }}
       {{- end }}
       {{- $serverTLS := .Values.kerberoshub.api.serverTLS }}
-      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.api.volumes (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
       {{- with .Values.kerberoshub.api.volumes }}
         {{- toYaml . | nindent 8 }}
@@ -141,6 +142,9 @@ spec:
           secret:
             secretName: {{ $serverTLS.secretName }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
       {{- end }}
       {{- with .Values.kerberoshub.api.topologySpreadConstraints }}
       topologySpreadConstraints:
@@ -157,7 +161,7 @@ spec:
           ports:
             - containerPort: 80
               name: http
-          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) }}
+          {{- if or .Values.kerberoshub.api.volumeMounts (and $serverTLS.enabled $serverTLS.secretName) (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
           {{- with .Values.kerberoshub.api.volumeMounts}}
             {{- toYaml . | nindent 12 }}
@@ -167,6 +171,9 @@ spec:
               mountPath: {{ $serverTLS.mountPath }}
               readOnly: true
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
           {{- end }}
           # Mongodb - loaded from ConfigMap
           envFrom:
@@ -187,6 +194,23 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: REFRESH_COOKIE_SECURE
+              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
+            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
+            {{- with .Values.kerberoshub.frontend.legacyUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- range .Values.kerberoshub.frontend.domains }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" $.Values.kerberoshub.frontend.schema .) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.multiTenant .Values.kerberoshub.frontend.tenantBaseDomain }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://*.%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.tenantBaseDomain) }}
+            {{- end }}
+            {{- if and .Values.kerberoshub.frontend.demoEnabled .Values.kerberoshub.frontend.demoUrl }}
+            {{- $corsOrigins = append $corsOrigins (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.demoUrl) }}
+            {{- end }}
+            - name: CORS_ALLOWED_ORIGINS
+              value: {{ join "," $corsOrigins | quote }}
             {{ if .Values.isPrivate }}
             - name: KERBEROS_PRIVATE_CLOUD
               value: "true"

charts/hub/templates/kerberos-hub/hub-cleanup.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.cleanup.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.cleanup.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.cleanup.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.cleanup.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
+          {{- if or .Values.kerberoshub.cleanup.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.cleanup.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -300,7 +300,9 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -312,10 +312,22 @@ spec:
           value: "{{ .Values.kerberoshub.frontend.features.case.enabled }}"
         - name: FEATURE_WORKFLOWS_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.workflows.enabled }}"
+        - name: FEATURE_ORGANISATIONS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.enabled }}"
         - name: FEATURE_ORGANISATION_SWITCHER_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.switcherEnabled }}"
         - name: FEATURE_ORGANISATION_CREATION_ENABLED
           value: "{{ .Values.kerberoshub.frontend.features.organisations.creationEnabled }}"
+        - name: FEATURE_ORGANISATION_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.organisations.settingsEnabled }}"
+        - name: FEATURE_PROJECTS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.enabled }}"
+        - name: FEATURE_PROJECT_SWITCHER_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.switcherEnabled }}"
+        - name: FEATURE_PROJECT_CREATION_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.creationEnabled }}"
+        - name: FEATURE_PROJECT_SETTINGS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.projects.settingsEnabled }}"
         - name: FEATURE_DARK_MODE
           value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
         - name: FEATURE_SPLASH_SCREEN_ENABLED
@@ -406,7 +418,9 @@ spec:
 
         # features > face redaction 
         - name: FEATURE_FACE_REDACTION_ENABLED
-          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}" 
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.enabled }}"
+        - name: FEATURE_FACE_REDACTION_CLASSIFIER_TRACKS_ENABLED
+          value: "{{ .Values.kerberoshub.frontend.features.faceRedaction.classifierTracksEnabled }}"
         
         # features > media
         - name: FEATURE_MEDIA_FILTER_DATE_ENABLED

charts/hub/templates/kerberos-hub/hub-monitor-device.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.monitordevice.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.monitordevice.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.monitordevice.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.monitordevice.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
           resources:
             {{- toYaml . | nindent 12 }}
           {{- end }}
-          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
+          {{- if or .Values.kerberoshub.monitordevice.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.monitordevice.volumeMounts}}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-hub/hub-reactivate-subscription.yaml

@@ -26,10 +26,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.reactivate.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.reactivate.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.reactivate.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.reactivate.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -38,10 +44,15 @@ spec:
         - name: hub-reactivate-subscription
           image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.reactivate.repository }}:{{ .Values.kerberoshub.reactivate.tag }}"
           imagePullPolicy: {{ .Values.kerberoshub.reactivate.pullPolicy }}
-          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
+          {{- if or .Values.kerberoshub.reactivate.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.reactivate.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
             - configMapRef:
                 name: mongodb-config

charts/hub/templates/kerberos-pipeline/_workflows-helpers.tpl

@@ -1,15 +1,17 @@
 {{/*
 Assemble the deployment-global workflow definitions (WORKFLOW_DEFINITIONS) as a
 JSON array from every *enabled* workflow under kerberoshub.workflows.definitions.
-This is the engine's single routing source: several distinct workflows can run
-over one recording — each opens its own run and dispatches only its own stages.
+This is the engine's boot-loaded configuration source and deployment stage
+catalog: several distinct config workflows can run over one recording — each
+opens its own run and dispatches only its own stages. Organisation-scoped
+database workflows are discovered separately at runtime.
 
 Each enabled definition contributes one workflow object:
   name      the map key (the workflow's human-readable name; also its identity —
             the engine derives a stable id from it when the definition carries
             no explicit id).
   enabled   always true here (a disabled definition is skipped entirely).
-  source    "config" — provenance marking a Helm-seeded, deployment-global,
+  source    "config" — provenance marking a Helm-defined, deployment-global,
             ops-managed workflow (read-only in the API, no owning organisation).
   triggers  how a run OPENS. Defaults to a single bare automatic trigger
             (opens for every recording); narrow with device/schedule triggers.

charts/hub/templates/kerberos-pipeline/hub-workflows.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.services.workflows.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.services.workflows.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.services.workflows.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.services.workflows.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
+        {{- if or .Values.kerberoshub.services.workflows.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberoshub.services.workflows.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config
@@ -62,8 +73,10 @@ spec:
         # named workflows it runs (WORKFLOW_DEFINITIONS): each with its own
         # trigger and executable stages, assembled from the enabled definitions
         # under kerberoshub.workflows.definitions (see _workflows-helpers.tpl).
-        # Definitions are the engine's single routing source; empty means no
-        # workflows run.
+        # Definitions are the engine's boot-loaded config source and deployment
+        # stage catalog. Organisation-scoped database workflows are read per
+        # recording; an in-cluster engine still requires at least one config
+        # definition so an empty catalog cannot silently drop traffic.
         - name: WORKFLOWS_QUEUE
           value: "{{ .Values.kerberoshub.services.workflows.queue }}"
         - name: WORKFLOW_DEFINITIONS

charts/hub/templates/kerberos-pipeline/pipe-analysis.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.analysis.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.analysis.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.analysis.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.analysis.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
+        {{- if or .Values.kerberospipeline.analysis.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.analysis.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-event.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.event.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.event.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.event.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.event.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.event.volumeMounts }}
+        {{- if or .Values.kerberospipeline.event.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.event.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         ports:
           - containerPort: 8080
         envFrom:

charts/hub/templates/kerberos-pipeline/pipe-export.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.export.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.export.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.export.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.export.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.export.volumeMounts }}
+        {{- if or .Values.kerberospipeline.export.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.export.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-monitor.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.monitor.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.monitor.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.monitor.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.monitor.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
+        {{- if or .Values.kerberospipeline.monitor.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.monitor.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-notify-test.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notifyTest.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notifyTest.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notifyTest.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.notifyTest.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notifyTest.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notifyTest.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-notify.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.notify.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.notify.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.notify.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.notify.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.notify.volumeMounts}}
+        {{- if or .Values.kerberospipeline.notify.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.notify.volumeMounts}}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-sequence.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.sequence.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.sequence.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.sequence.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.sequence.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
+        {{- if or .Values.kerberospipeline.sequence.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.sequence.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-pipeline/pipe-throttler.yaml

@@ -29,10 +29,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberospipeline.throttler.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberospipeline.throttler.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberospipeline.throttler.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberospipeline.throttler.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -45,10 +51,15 @@ spec:
         resources:
           {{- toYaml . | nindent 12 }}
         {{- end }}
-        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
+        {{- if or .Values.kerberospipeline.throttler.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
         volumeMounts:
+        {{- with .Values.kerberospipeline.throttler.volumeMounts }}
           {{- toYaml . | nindent 12 }}
         {{- end }}
+        {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+          {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+        {{- end }}
+        {{- end }}
         envFrom:
         - configMapRef:
             name: mongodb-config

charts/hub/templates/kerberos-vault/vault-forwarder.yaml

@@ -27,10 +27,16 @@ spec:
       imagePullSecrets:
         {{- toYaml . | nindent 8 }}
       {{- end }}
-      {{- with .Values.kerberoshub.forwarder.volumes }}
+      {{- $mongodbTLS := .Values.mongodb.tls }}
+      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
       volumes:
+      {{- with .Values.kerberoshub.forwarder.volumes }}
         {{- toYaml . | nindent 8 }}
       {{- end }}
+      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
+      {{- end }}
+      {{- end }}
       {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
       topologySpreadConstraints:
         {{- toYaml . | nindent 8 }}
@@ -43,10 +49,15 @@ spec:
             requests:
               memory: 10Mi
               cpu: 10m
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
+          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
           volumeMounts:
+          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
             {{- toYaml . | nindent 12 }}
           {{- end }}
+          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
+            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
+          {{- end }}
+          {{- end }}
           envFrom:
           - configMapRef:
               name: mongodb-config

charts/hub/values.yaml

@@ -60,6 +60,15 @@ mongodb:
   # and indexes, complex $lookup pipelines, etc.). When using DocumentDB you
   # should also set retryWrites: "false".
   flavor: "mongodb"
+  # TLS for MongoDB-compatible backends. When uri is set, missing TLS query
+  # parameters are appended automatically. AWS DocumentDB requires TLS and a
+  # trusted RDS CA bundle, typically stored in an existing Kubernetes Secret.
+  tls:
+    enabled: false
+    existingSecret: ""
+    caFileName: ""
+    mountPath: "/etc/mongodb/tls"
+    insecureSkipVerify: false
 ###################################################
 # MQTT configuration (bi-directional communication)
 ###################################################
@@ -231,7 +240,7 @@ kerberoshub:
   api:
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
-    tag: "v1.9.29"
+    tag: "v1.9.51"
     replicas: 2
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-api Service (e.g. when an
@@ -344,7 +353,7 @@ kerberoshub:
   frontend:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
-    tag: "v1.9.32"
+    tag: "v1.13.9"
     replicas: 2
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-frontend Service (e.g. when an
@@ -470,8 +479,15 @@ kerberoshub:
         enabled: "false" # Enable or disable workflows feature 'true' or 'false'
       # Organisation controls remain visible as a read-only current organisation when switching is disabled.
       organisations:
+        enabled: "" # Enable or disable all organisation feature flags; when empty, the child settings apply independently
         switcherEnabled: "false" # Enable or disable organisation switching 'true' or 'false'
         creationEnabled: "false" # Enable or disable organisation creation; requires switcherEnabled 'true' or 'false'
+        settingsEnabled: "false" # Enable or disable the organisation settings link 'true' or 'false'
+      projects:
+        enabled: "" # Enable or disable all project feature flags; when empty, the child settings apply independently
+        switcherEnabled: "false" # Enable or disable the read-only project dropdown 'true' or 'false'
+        creationEnabled: "false" # Reserved for project creation UI 'true' or 'false'
+        settingsEnabled: "false" # Reserved for project settings UI 'true' or 'false'
       # Map tile configuration  
       map:
         tileUrlLight: "https://{s}.basemaps.cartocdn.com/rastertiles/voyager/{z}/{x}/{y}{r}.png" # Map tile URL for light mode
@@ -548,6 +564,7 @@ kerberoshub:
       # Face redaction feature
       faceRedaction:
         enabled: "false" # Enable or disable face redaction 'true' or 'false'
+        classifierTracksEnabled: "true" # Make classifier-generated tracks available in the redaction modal
     # Optional integrations
     mixpanel: # We can keep track logging in Mixpanel as well
       apikey: "xxx"
@@ -583,7 +600,7 @@ kerberoshub:
   cleanup:
     repository: ghcr.io/uug-ai/hub-cleanup
     pullPolicy: IfNotPresent
-    tag: "v1.4.16"
+    tag: "v1.4.19"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -642,16 +659,18 @@ kerberoshub:
     # -----------------------------------------------------------------------
     # Global workflow definitions — the named workflows the engine runs.
     #
-    # `definitions` is the engine's single routing source: several distinct
-    # workflows can run over one recording, each opening its own run and
-    # dispatching only its own stages. It is a MAP keyed by workflow name (names
-    # are unique and merge cleanly across -f / --set overrides). Ships empty; the
-    # commented block is a worked example of an object-tracking + loitering
-    # pipeline. Add more keys to run more workflows.
+    # `definitions` is the engine's deployment-global configuration source and
+    # stage catalog: several distinct workflows can run over one recording, each
+    # opening its own run and dispatching only its own stages. Database-backed
+    # organisation workflows, when present, are read separately per recording.
+    # This is a MAP keyed by workflow name (names are unique and merge cleanly
+    # across -f / --set overrides). Ships empty; the commented block is a worked
+    # example of an object-tracking + loitering pipeline. Add more keys to run
+    # more config workflows.
     #
     # Each definition:
     #   enabled   include this workflow (soft-delete toggle).
-    #   source    always rendered as "config" (a Helm-seeded, ops-managed,
+    #   source    always rendered as "config" (a Helm-defined, ops-managed,
     #             deployment-global workflow — read-only in the API).
     #   triggers  how a run OPENS. Omit for a single bare automatic trigger
     #             (opens for every recording); the per-stage `needs` then decide
@@ -663,9 +682,9 @@ kerberoshub:
     #             {operation?, condition?} — operation is the readiness GATE (the
     #             upstream op whose data must be present before the condition is
     #             read; omit for a check on the run root itself), condition is
-    #             {path, op, value} where path is ABSOLUTE from the run root and
-    #             resolves through string-keyed maps only (it cannot index into
-    #             arrays). needsMode combines multiple needs: "any" (default;
+    #             {path, op, value} where path is ABSOLUTE from the run root;
+    #             a `*` segment fans out across array elements. needsMode combines
+    #             multiple needs: "any" (default;
     #             fire on the first match) or "all" (a join; fire once every need
     #             has resolved and matched). The queue is taken from the matching
     #             services.<operation> entry, so dispatch and consume cannot drift.
@@ -674,19 +693,19 @@ kerberoshub:
     # kerberoshub.services.<operation> (deploy the objecttracking / loitering
     # workers below).
     definitions: {}
-      #tracking-workflow:
-      #  enabled: true
-      #  triggers:
-      #    - type: automatic
-      #  stages:
-      #    - operation: objecttracking
-      #      dispatch: always
-      #    - operation: loitering
-      #      dispatch: conditional
-      #      # Fire loitering once objecttracking has resolved — a readiness join
-      #      # (no condition ⇒ gate on the upstream's presence, not a value).
-      #      needs:
-      #        - operation: objecttracking
+    #tracking-workflow:
+    #  enabled: true
+    #  triggers:
+    #    - type: automatic
+    #  stages:
+    #    - operation: objecttracking
+    #      dispatch: always
+    #    - operation: loitering
+    #      dispatch: conditional
+    #      # Fire loitering once objecttracking has resolved — a readiness join
+    #      # (no condition ⇒ gate on the upstream's presence, not a value).
+    #      needs:
+    #        - operation: objecttracking
   # Workflow deployments. Every workflows-subsystem Deployment's image/tag/
   # replicas/resources/queue lives here in a single, uniform shape:
   #   - `workflows` is the engine itself (the orchestrator). It is deployed
@@ -699,9 +718,10 @@ kerberoshub:
   #     when its own `enabled` is true AND the workflows engine is enabled.
   services:
     # hub-workflows — the workflows engine (orchestrator). Consumes the engine
-    # queue, evaluates the workflow definitions (WORKFLOW_DEFINITIONS) and
-    # dispatches to the stage workers below. Deployed when workflows.enabled is
-    # true; it has no separate `enabled` here.
+    # queue, evaluates the boot-loaded config workflows (WORKFLOW_DEFINITIONS)
+    # plus organisation-scoped database workflows, and dispatches to the stage
+    # workers below. Deployed when workflows.enabled is true; it has no separate
+    # `enabled` here.
     workflows:
       repository: ghcr.io/uug-ai/hub-workflows
       pullPolicy: IfNotPresent
@@ -723,61 +743,61 @@ kerberoshub:
         requests:
           memory: 10Mi
           cpu: 10m
-    # ---------------------------------------------------------------------
-    # EXAMPLE custom stage worker (commented out) — hub-loitering.
-    #
-    # Companion deployment for the workflows.definitions example above (the
-    # loitering stage of tracking-workflow). Uncomment to deploy the demo
-    # worker. It ships as its own repository/module.
-    # See https://github.com/uug-ai/hub-loitering.
-    #loitering:
-    #  # Deploy the hub-loitering worker.
-    #  enabled: true
-    #  repository: ghcr.io/uug-ai/hub-loitering
-    #  pullPolicy: IfNotPresent
-    #  tag: "v1.0.0"
-    #  replicas: 1 # Number of pods for the worker.
-    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    #  #volumes:
-    #  #  - name: extra
-    #  #    emptyDir: {}
-    #  #volumeMounts:
-    #  #  - name: extra
-    #  #    mountPath: /data
-    #  logLevel: "info" # possible values: trace, debug, info, warn, error
-    #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
-    #  # same value is taken into the matching workflows.definitions stage, so the
-    #  # engine dispatches and the worker consumes the same queue with no drift.
-    #  # Convention: "kcloud-<operation>-queue.fifo".
-    #  queue: "kcloud-loitering-queue.fifo"
-    #  resources:
-    #    requests:
-    #      memory: 10Mi
-    #      cpu: 10m
-    # ---------------------------------------------------------------------
-    # EXAMPLE stage worker (commented out) for the workflows.definitions example
-    # above — hub-objecttracking. Uncomment the worker whose operation a
-    # definition references, so the engine dispatches and the worker consumes the
-    # same queue with no drift.
-    #objecttracking:
-    #  # Deploy the object-tracking worker (operation "objecttracking").
-    #  enabled: true
-    #  repository: ghcr.io/uug-ai/hub-objecttracking
-    #  pullPolicy: IfNotPresent
-    #  tag: "v1.0.0"
-    #  replicas: 1 # Number of pods for the worker.
-    #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    #  logLevel: "info" # possible values: trace, debug, info, warn, error
-    #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
-    #  queue: "kcloud-objecttracking-queue.fifo"
-    #  resources:
-    #    requests:
-    #      memory: 10Mi
-    #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE custom stage worker (commented out) — hub-loitering.
+          #
+          # Companion deployment for the workflows.definitions example above (the
+          # loitering stage of tracking-workflow). Uncomment to deploy the demo
+          # worker. It ships as its own repository/module.
+          # See https://github.com/uug-ai/hub-loitering.
+          #loitering:
+          #  # Deploy the hub-loitering worker.
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-loitering
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  #volumes:
+          #  #  - name: extra
+          #  #    emptyDir: {}
+          #  #volumeMounts:
+          #  #  - name: extra
+          #  #    mountPath: /data
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (LOITERING_QUEUE). This
+          #  # same value is taken into the matching workflows.definitions stage, so the
+          #  # engine dispatches and the worker consumes the same queue with no drift.
+          #  # Convention: "kcloud-<operation>-queue.fifo".
+          #  queue: "kcloud-loitering-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
+          # ---------------------------------------------------------------------
+          # EXAMPLE stage worker (commented out) for the workflows.definitions example
+          # above — hub-objecttracking. Uncomment the worker whose operation a
+          # definition references, so the engine dispatches and the worker consumes the
+          # same queue with no drift.
+          #objecttracking:
+          #  # Deploy the object-tracking worker (operation "objecttracking").
+          #  enabled: true
+          #  repository: ghcr.io/uug-ai/hub-objecttracking
+          #  pullPolicy: IfNotPresent
+          #  tag: "v1.0.0"
+          #  replicas: 1 # Number of pods for the worker.
+          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
+          #  logLevel: "info" # possible values: trace, debug, info, warn, error
+          #  # Queue this worker consumes dispatched messages from (OBJECTTRACKING_QUEUE).
+          #  queue: "kcloud-objecttracking-queue.fifo"
+          #  resources:
+          #    requests:
+          #      memory: 10Mi
+          #      cpu: 10m
   monitordevice:
     repository: ghcr.io/uug-ai/hub-monitor-device
     pullPolicy: IfNotPresent
-    tag: "v1.4.0"
+    tag: "v1.4.2"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -797,7 +817,7 @@ kerberoshub:
     repository: uugai/hub-reactivatesubscriptions
     pullPolicy: IfNotPresent
     tag: "v1.0.2"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service. Set to 0 to disable.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -833,7 +853,7 @@ kerberoshub:
     repository: uugai/hub-proxy
     pullPolicy: IfNotPresent
     tag: "v1.0.0"
-    replicas: 1 # Number of pods for the service.
+    replicas: 0 # Number of pods for the service. Set to 0 to disable.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
     #volumes:
@@ -855,7 +875,7 @@ kerberospipeline:
   event:
     repository: ghcr.io/uug-ai/hub-pipeline-event
     pullPolicy: IfNotPresent
-    tag: "v1.3.0"
+    tag: "v1.3.1"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -873,7 +893,7 @@ kerberospipeline:
   monitor:
     repository: ghcr.io/uug-ai/hub-pipeline-monitor
     pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.13"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -890,7 +910,7 @@ kerberospipeline:
   sequence:
     repository: ghcr.io/uug-ai/hub-pipeline-sequence
     pullPolicy: IfNotPresent
-    tag: "v1.6.18"
+    tag: "v1.6.26"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -907,7 +927,7 @@ kerberospipeline:
   throttler:
     repository: uugai/hub-pipeline-throttler
     pullPolicy: IfNotPresent
-    tag: "v1.2.0"
+    tag: "v1.2.1"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -925,7 +945,7 @@ kerberospipeline:
   notify:
     repository: ghcr.io/uug-ai/hub-pipeline-notification
     pullPolicy: IfNotPresent
-    tag: "v1.3.9"
+    tag: "v1.3.18"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -944,7 +964,7 @@ kerberospipeline:
   notifyTest:
     repository: uugai/hub-pipeline-notification-test
     pullPolicy: IfNotPresent
-    tag: "v1.2.1"
+    tag: "v1.2.2"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     resources:
@@ -962,7 +982,7 @@ kerberospipeline:
   analysis:
     repository: ghcr.io/uug-ai/hub-pipeline-analysis
     pullPolicy: IfNotPresent
-    tag: "v1.7.17"
+    tag: "v1.8.5"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -980,7 +1000,7 @@ kerberospipeline:
   dominantColor:
     repository: ghcr.io/uug-ai/hub-pipeline-dominantcolors
     pullPolicy: IfNotPresent
-    tag: "v2.0.2"
+    tag: "v2.0.3"
     replicas: 3 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1001,7 +1021,7 @@ kerberospipeline:
   thumbnail:
     repository: ghcr.io/uug-ai/hub-pipeline-thumbnail
     pullPolicy: IfNotPresent
-    tag: "v1.3.6"
+    tag: "v1.3.10"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1027,7 +1047,7 @@ kerberospipeline:
   counting:
     repository: uugai/hub-pipeline-counting
     pullPolicy: IfNotPresent
-    tag: "v1.6.3"
+    tag: "v2.0.0"
     replicas: 1 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1046,7 +1066,7 @@ kerberospipeline:
     enabled: false # Enable or disable the sprite generation 'true' or 'false
     repository: ghcr.io/uug-ai/hub-pipeline-sprite
     pullPolicy: IfNotPresent
-    tag: "v1.1.14"
+    tag: "v1.1.16"
     replicas: 5 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1070,7 +1090,7 @@ kerberospipeline:
   export:
     repository: ghcr.io/uug-ai/hub-pipeline-export
     pullPolicy: IfNotPresent
-    tag: "v1.2.8"
+    tag: "v1.2.10"
     replicas: 2 # Number of pods for the service.
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     logLevel: "info" # possible values: trace, debug, info, warn, error