Merge pull request #239 from kerberos-io/feat/hub-kyverno-missing-images

feat(hub): Kyverno policies for every image, trust only ghcr.io/uug-ai, hardened Admin default; remove hub-proxy and vault-forwarder (0.184.0)
feat(hub): default Admin to signed, hardened ghcr.io/uug-ai/admin v1.4.5
2026-11-11 21:20:24 +00:00 · 2026-11-11 21:55:02 +01:00 · 2026-11-11 20:52:01 +00:00 · 2026-11-11 20:46:34 +00:00 · 2026-11-11 20:40:03 +00:00 · 2026-11-11 20:37:09 +00:00
55 changed files with 1251 additions and 464 deletions
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.181.0
+version: 0.184.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -58,7 +58,7 @@ legacy opt-out, TLS/configuration mounts and deployment modes.
 ### Hardened frontend images

 Starting with chart **`0.170.0`**, both frontends default to shell-free
-`ghcr.io/uug-ai/hub-frontend:v1.19.28`, running as `65532:65532` on port `8080`
+`ghcr.io/uug-ai/hub-frontend:v1.19.35`, running as `65532:65532` on port `8080`
 with a read-only root filesystem and writable `/tmp`. The Service and ingress
 remain on port `80`. Admin retains its legacy image and port `80`; its hardened
 runtime remains opt-in.
@@ -122,61 +122,35 @@ instructions below if the existing Deployment cannot be patched to `8080`.
 Run `bash scripts/check-frontend-runtime.sh` for default, demo, legacy override,
 and deployment-values regression coverage.

-### Hardened Admin image (opt-in, chart 0.167.3)
+### Hardened Admin image (default since chart 0.184.0)

-`charts/hub` deploys Admin in `all` and `ui` modes. Shell-free Admin `v1.4.3`
-runs as `65532:65532` and listens on `8080`, unlike the legacy image on `80`.
-Set these values together; the chart does not upgrade the image automatically:
+`charts/hub` deploys Admin in `all` and `ui` modes. Since chart **`0.184.0`** the
+default is the signed, shell-free `ghcr.io/uug-ai/admin` (`v1.4.5`): it runs as
+`65532:65532` on `8080` with a read-only root filesystem, a memory-backed `/tmp`
+(`admin-tmp`, the only writable path) and `/healthz` probes. These settings are
+the defaults in `values.yaml`; keep them together with the image. Append extra
+volumes and mounts to the `admin.volumes` / `admin.volumeMounts` lists (Helm
+replaces lists in overrides). Memory-backed scratch counts against the pod memory
+limit. The `admin-svc` Service and Admin ingress use port `80`; the Service
+targets the named `http` container port. OAuth2-proxy is unchanged.
+
+Only `ghcr.io/uug-ai` images are trusted (see *Image signature verification*).
+To run a legacy image on port `80` instead, restore all of these together:

 ```yaml
 admin:
-    repository: ghcr.io/uug-ai/admin
-    tag: v1.4.3
-    containerPort: 8080
-    securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        readOnlyRootFilesystem: true
-        allowPrivilegeEscalation: false
-        capabilities:
-            drop: ["ALL"]
-        seccompProfile:
-            type: RuntimeDefault
-    volumes:
-        - name: admin-tmp
-          emptyDir:
-              medium: Memory
-              sizeLimit: 16Mi # Example; size for your runtime configuration.
-    volumeMounts:
-        - name: admin-tmp
-          mountPath: /tmp
-    readinessProbe:
-        httpGet:
-            path: /healthz
-            port: http
-        periodSeconds: 10
-    livenessProbe:
-        httpGet:
-            path: /healthz
-            port: http
-        initialDelaySeconds: 10
-        periodSeconds: 10
+    repository: uugai/admin
+    tag: v1.3.0
+    containerPort: 80
+    securityContext: null
+    readinessProbe: null
+    livenessProbe: null
+    volumes: null
+    volumeMounts: null
 ```

-Merge the scratch volume with any existing mounts. Only `/tmp` is writable;
-application files remain read-only. Memory-backed scratch counts against the
-pod memory limit. The `admin-svc` Service and Admin ingress still use port `80`;
-the Service targets the named `http` container port. OAuth2-proxy is unchanged.
-Defaults remain port `80` with no security context, added volumes, or probes. Coordinate
-the image, values and a chart revision containing these settings: published
-`0.167.2` does not contain Admin runtime support.
-
-Rollbacks to legacy images must restore port `80`, remove the hardened
-security context, and disable `/healthz` probes together. Run
-`bash scripts/check-admin-runtime.sh` from the repository root to verify
-legacy defaults, hardened runtime/probes, and unchanged OAuth2 routing.
-
+Run `bash scripts/check-admin-runtime.sh` from the repository root to verify the
+hardened defaults, the legacy opt-out and unchanged OAuth2 routing.
 ### Recovering a duplicate HTTP port during upgrades

 Chart `0.169.1` publishes this recovery guidance. The helper is available in the
@@ -327,14 +301,6 @@ Optional dataset mode also requires its own writable `ANPR_DATASET_DIR` mount.
 Models and application directories stay read-only.

 This repository has **no Vault server or design-system chart**. The files named
-`vault-proxy` and `vault-forwarder` deploy different legacy applications; their
-ports are not the Vault server's port. Do not change them for `uug-ai/vault#119`.
-That proposed Vault image requires port `8080` (legacy `80`), UID/GID `65532`,
-read-only `/home/vault`, workload-sized writable `/run/vault`, and compatible
-ownership on existing optional `LOCAL_CACHE_DIRECTORY` mounts. Its liveness
-endpoint is `GET /api/health`. Wire those settings in the actual Vault deployment
-only when a compatible image release is selected; no migration is required.
-
 ### Image signature verification (Kyverno)

 Starting with chart **`0.179.0`**, the chart can verify that UUG.AI images are
@@ -350,6 +316,10 @@ When enabled and [Kyverno](https://kyverno.io) is installed in the cluster, it
 creates Kyverno policies in the release namespace. Without Kyverno (no
 `kyverno.io/v1` API), nothing is created even when enabled.

+Signature policies use the Kyverno category **`Image signing`** and hardening
+policies **`Image hardening`** (chart `0.182.1`), so Policy Reporter and its
+dashboards can filter on each check separately.
+
 Each policy is a plain, namespaced Kyverno `Policy` in its own file in
 `templates/kyverno/`, so it applies only to the release namespace. There is one
 per `ghcr.io/uug-ai` image the chart can deploy; each requires the image to be
@@ -369,26 +339,39 @@ signed for its own `uug-ai/<image>` repository. "Mode" is the
 | `hub-pipeline-monitor-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` | ✅ signed | value |
 | `hub-pipeline-sequence-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` | ✅ signed | value |
 | `hub-pipeline-throttler-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` | ✅ signed | value |
-| `hub-audit-signed-images.yaml` | `ghcr.io/uug-ai/hub-audit` | ❌ not yet | always `Audit` |
-| `hub-objecttracking-signed-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` | ❌ not yet | always `Audit` |
-| `hub-vlm-signed-images.yaml` | `ghcr.io/uug-ai/hub-vlm` | ❌ not yet | always `Audit` |
-| `hub-pipeline-dominantcolors-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` | ❌ not yet | always `Audit` |
-| `hub-pipeline-event-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` | ❌ not yet | always `Audit` |
-| `hub-pipeline-export-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` | ❌ not yet | always `Audit` |
-| `hub-pipeline-notification-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` | ❌ not yet | always `Audit` |
-| `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ❌ not yet | always `Audit` |
-| `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ❌ not yet | always `Audit` |
-| `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ❌ not yet | always `Audit` |
+| `hub-audit-signed-images.yaml` | `ghcr.io/uug-ai/hub-audit` | ✅ signed (from v1.0.11) | value |
+| `hub-objecttracking-signed-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` | ✅ signed (from v1.0.10); `-gpu` image not yet | always `Audit` |
+| `hub-vlm-signed-images.yaml` | `ghcr.io/uug-ai/hub-vlm` | ✅ signed (from v1.0.8) | value |
+| `hub-pipeline-dominantcolors-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` | ✅ signed (from v2.0.10) | value |
+| `hub-pipeline-event-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` | ✅ signed (from v1.3.10) | value |
+| `hub-pipeline-export-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` | ✅ signed (from v1.2.22) | value |
+| `hub-pipeline-notification-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` | ✅ signed (from v1.3.48) | value |
+| `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ✅ signed (from v1.2.7) | value |
+| `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ✅ signed (from v1.1.28) | value |
+| `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ✅ signed (from v1.3.24) | value |
+| `admin-signed-images.yaml` | `ghcr.io/uug-ai/admin` | ✅ signed (from v1.4.5) | always `Audit` |
+| `hub-reactivatesubscriptions-signed-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` | ❌ not on GHCR yet; the chart uses Docker Hub `uugai/hub-reactivatesubscriptions` | always `Audit` |

-Images whose releases are not signed yet stay in `Audit` even when
-`imageVerification.validationFailureAction` is `Enforce`, so enabling
-`Enforce` never blocks them. Their repositories need `sign: true` (and
-`id-token: write`) in their release workflow; once their releases are signed,
-the policy file switches to the configured value in a chart release.
+Since chart **`0.182.0`** every `ghcr.io/uug-ai` image's releases are signed, so
+every policy follows `imageVerification.validationFailureAction`, except
+`hub-objecttracking`: its GPU image (`<tag>-gpu`) is not signed yet, so that
+policy stays in `Audit` and enabling `Enforce` never blocks it. Images are signed
+from the release noted in the table; **older tags are unsigned and are rejected
+in `Enforce`**, so check the tags you run before enforcing. Since chart
+**`0.183.0`** the default image tags are signed releases, and since **`0.183.1`** hardened
+releases (with the attestation) for every image that has a hardening policy.

-Not covered: `uugai/admin`, `uugai/hub-proxy` and
-`uugai/hub-reactivatesubscriptions` are pulled from Docker Hub rather than the
-signed `ghcr.io/uug-ai` releases, and `oauth2-proxy` is a third-party image.
+Since chart **`0.184.0`** only `ghcr.io/uug-ai` images are trusted:
+
+- every UUG.AI image has a signature and a hardening policy, matching its
+  `ghcr.io/uug-ai/<image>` repository only. Images that are not signed or
+  hardened yet stay in `Audit` (the tables mark them), so they show up as
+  failures in Policy Reporter without ever being blocked;
+- `trusted-registry.yaml` (category **`Image registry`**, `Audit`) reports every
+  container image from any other registry or organisation. The chart can still
+  deploy two: `uugai/hub-reactivatesubscriptions` (Docker Hub; not released to
+  GHCR yet) and the third-party `quay.io/oauth2-proxy/oauth2-proxy` (pin it to
+  a version or digest rather than `:latest`).

 To change a policy, edit its file. To add an image, copy a policy file and
 change the image and repository.
@@ -466,6 +449,18 @@ image whose repository makes hardened releases, in `templates/kyverno/`:
 | `hub-pipeline-monitor-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` |
 | `hub-pipeline-sequence-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` |
 | `hub-pipeline-throttler-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` |
+| `hub-audit-hardened-images.yaml` | `ghcr.io/uug-ai/hub-audit` (not hardened yet; always `Audit`) |
+| `hub-objecttracking-hardened-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` (not hardened yet; always `Audit`) |
+| `hub-vlm-hardened-images.yaml` | `ghcr.io/uug-ai/hub-vlm` (not hardened yet; always `Audit`) |
+| `hub-pipeline-dominantcolors-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` (not hardened yet; always `Audit`) |
+| `hub-pipeline-event-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` (not hardened yet; always `Audit`) |
+| `hub-pipeline-export-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` (not hardened yet; always `Audit`) |
+| `hub-pipeline-notification-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` (not hardened yet; always `Audit`) |
+| `hub-pipeline-notification-test-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` (not hardened yet; always `Audit`) |
+| `hub-pipeline-sprite-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` (not hardened yet; always `Audit`) |
+| `hub-pipeline-thumbnail-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` (not hardened yet; always `Audit`) |
+| `admin-hardened-images.yaml` | `ghcr.io/uug-ai/admin` (not hardened yet; always `Audit`) |
+| `hub-reactivatesubscriptions-hardened-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` (not hardened yet; always `Audit`) |

 Each requires the attestation to be signed by the UUG.AI release workflow for
 the image's own repository, and its `result` and `repository` to be `passed`
@@ -837,9 +832,9 @@ kerberospipeline:
 | `kerberosvault.sprite.provider` | Configuration value for `kerberosvault.sprite.provider`. | `"a-sprite-provider"` |
 | `kerberosvault.sprite.accessKey` | Access key for `kerberosvault.sprite`. | `"xxx"` |
 | `kerberosvault.sprite.secretKey` | Secret key for `kerberosvault.sprite`. | `"xxx"` |
-| `admin.repository` | Container image repository for `admin`. | `"uugai/admin"` |
+| `admin.repository` | Container image repository for `admin`. | `"ghcr.io/uug-ai/admin"` |
 | `admin.pullPolicy` | Image pull policy for `admin`. | `"IfNotPresent"` |
-| `admin.tag` | Container image tag/version for `admin`. | `"v1.3.0"` |
+| `admin.tag` | Container image tag/version for `admin`. | `"v1.4.5"` |
 | `admin.replicas` | Number of replicas for `admin`. | `2` |
 | `admin.logLevel` | Log verbosity level for `admin`. | `"info"` |
 | `admin.resources.requests.memory` | Memory request for `admin`. | `"100Mi"` |
@@ -859,7 +854,7 @@ kerberospipeline:
 | `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
 | `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.9.8"` |
+| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.41"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
 | `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
@@ -917,7 +912,7 @@ kerberospipeline:
 | `kerberoshub.api.sso.extraHeaders.value` | Header value for each configured SSO extra header entry. | `""` |
 | `kerberoshub.frontend.repository` | The Docker registry where the Kerberos Hub frontend is hosted. | `"ghcr.io/uug-ai/hub-frontend"` |
 | `kerberoshub.frontend.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.9.11"` |
+| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.19.35"` |
 | `kerberoshub.frontend.replicas` | The number of pods/replicas running for the Kerberos Hub frontend deployment. | `2` |
 | `kerberoshub.frontend.logLevel` | Log verbosity level for `kerberoshub.frontend`. | `"info"` |
 | `kerberoshub.frontend.schema` | The protocol to serve the Kerberos Hub frontend, `'http'` or `'https'`. | `"https"` |
@@ -1041,7 +1036,7 @@ kerberospipeline:
 | `kerberoshub.oauth2Proxy.github.team` | Team value used by `kerberoshub.oauth2Proxy.github`. | `"github-team"` |
 | `kerberoshub.cleanup.repository` | The Docker container that is responsible for cleaning up the Kerberos Hub API content and related MongoDB collections. | `"ghcr.io/uug-ai/hub-cleanup"` |
 | `kerberoshub.cleanup.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.cleanup.tag` | The Docker image tag/version. | `"v1.4.13"` |
+| `kerberoshub.cleanup.tag` | The Docker image tag/version. | `"v1.4.27"` |
 | `kerberoshub.cleanup.replicas` | Number of replicas for `kerberoshub.cleanup`. | `1` |
 | `kerberoshub.cleanup.mode` | Cleanup service mode: `serve`, `dry-run`, or `version`. | `"serve"` |
 | `kerberoshub.cleanup.logLevel` | Log verbosity level for `kerberoshub.cleanup`. | `"info"` |
@@ -1069,7 +1064,7 @@ kerberospipeline:
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
 | `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
 | `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
-| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.10"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.11"` |
 | `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
 | `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
 | `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
@@ -1107,7 +1102,7 @@ kerberospipeline:
 | `kerberoshub.audit.topologySpreadConstraints` | Topology spread constraints for audit service pods. | `[]` |
 | `kerberoshub.monitordevice.repository` | The monitoring microservice, following up the status of your cameras and Kerberos Agents. | `"ghcr.io/uug-ai/hub-monitor-device"` |
 | `kerberoshub.monitordevice.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.0"` |
+| `kerberoshub.monitordevice.tag` | The Docker image tag/version. | `"v1.4.15"` |
 | `kerberoshub.monitordevice.replicas` | Number of replicas for `kerberoshub.monitordevice`. | `1` |
 | `kerberoshub.monitordevice.logLevel` | Log verbosity level for `kerberoshub.monitordevice`. | `"info"` |
 | `kerberoshub.monitordevice.scanIntervalSeconds` | Seconds between device status scans. Sets how quickly a camera going offline or online is detected. For accounts with "Group notifications" on, `hub-monitor-device` v1.4.10 and later then hold a change 20 seconds (`DEVICE_GROUPING_HOLD_SECONDS`) to collect other cameras that change status at the same time; older releases hold it one scan. | `60` |
@@ -1120,45 +1115,36 @@ kerberospipeline:
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
-| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
-| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
-| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
-| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
-| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
-| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
-| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
-| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
 | `kerberospipeline.event.repository` | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice. | `"ghcr.io/uug-ai/hub-pipeline-event"` |
 | `kerberospipeline.event.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.0"` |
+| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.10"` |
 | `kerberospipeline.event.replicas` | Number of replicas for `kerberospipeline.event`. | `1` |
 | `kerberospipeline.event.logLevel` | Log verbosity level for `kerberospipeline.event`. | `"info"` |
 | `kerberospipeline.event.resources.requests.memory` | Memory request for `kerberospipeline.event`. | `"10Mi"` |
 | `kerberospipeline.event.resources.requests.cpu` | CPU request for `kerberospipeline.event`. | `"10m"` |
 | `kerberospipeline.monitor.repository` | The [monitoring microservice](https://doc.kerberos.io/hub/pipeline/#monitoring), calculating metrics of incoming messages. | `"ghcr.io/uug-ai/hub-pipeline-monitor"` |
 | `kerberospipeline.monitor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.9"` |
+| `kerberospipeline.monitor.tag` | The Docker image tag/version. | `"v1.3.30"` |
 | `kerberospipeline.monitor.replicas` | Number of replicas for `kerberospipeline.monitor`. | `1` |
 | `kerberospipeline.monitor.logLevel` | Monitor log level. Set to `debug` for per-event processing checkpoints. | `"info"` |
 | `kerberospipeline.monitor.resources.requests.memory` | Memory request for `kerberospipeline.monitor`. | `"10Mi"` |
 | `kerberospipeline.monitor.resources.requests.cpu` | CPU request for `kerberospipeline.monitor`. | `"10m"` |
 | `kerberospipeline.sequence.repository` | The [sequencer microservice](https://doc.kerberos.io/hub/pipeline/#sequencer), grouping recordings in chunks/groups. | `"ghcr.io/uug-ai/hub-pipeline-sequence"` |
 | `kerberospipeline.sequence.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.sequence.tag` | The Docker image tag/version. | `"v1.6.18"` |
+| `kerberospipeline.sequence.tag` | The Docker image tag/version. | `"v1.7.15"` |
 | `kerberospipeline.sequence.replicas` | Number of replicas for `kerberospipeline.sequence`. | `1` |
 | `kerberospipeline.sequence.resources.requests.memory` | Memory request for `kerberospipeline.sequence`. | `"10Mi"` |
 | `kerberospipeline.sequence.resources.requests.cpu` | CPU request for `kerberospipeline.sequence`. | `"10m"` |
 | `kerberospipeline.throttler.repository` | The [throttler microservice](https://doc.kerberos.io/hub/pipeline/#throttler), throttling events. | `"uugai/hub-pipeline-throttler"` |
 | `kerberospipeline.throttler.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.throttler.tag` | The Docker image tag/version. | `"v1.2.0"` |
+| `kerberospipeline.throttler.tag` | The Docker image tag/version. | `"v1.2.11"` |
 | `kerberospipeline.throttler.replicas` | Number of replicas for `kerberospipeline.throttler`. | `1` |
 | `kerberospipeline.throttler.logLevel` | Log verbosity level for `kerberospipeline.throttler`. | `"info"` |
 | `kerberospipeline.throttler.resources.requests.memory` | Memory request for `kerberospipeline.throttler`. | `"10Mi"` |
 | `kerberospipeline.throttler.resources.requests.cpu` | CPU request for `kerberospipeline.throttler`. | `"10m"` |
 | `kerberospipeline.notify.repository` | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events. | `"ghcr.io/uug-ai/hub-pipeline-notification"` |
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.9"` |
+| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.48"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
 | `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
@@ -1167,13 +1153,13 @@ kerberospipeline:
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
 | `kerberospipeline.notifyTest.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.1"` |
+| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.7"` |
 | `kerberospipeline.notifyTest.replicas` | Number of replicas for `kerberospipeline.notifyTest`. | `1` |
 | `kerberospipeline.notifyTest.resources.requests.memory` | Memory request for `kerberospipeline.notifyTest`. | `"10Mi"` |
 | `kerberospipeline.notifyTest.resources.requests.cpu` | CPU request for `kerberospipeline.notifyTest`. | `"10m"` |
 | `kerberospipeline.analysis.repository` | The [analysis microservices](https://doc.kerberos.io/hub/pipeline/#analyser) which executed specific analysis in parallel. | `"ghcr.io/uug-ai/hub-pipeline-analysis"` |
 | `kerberospipeline.analysis.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.7.8"` |
+| `kerberospipeline.analysis.tag` | The Docker image tag/version. | `"v1.8.31"` |
 | `kerberospipeline.analysis.replicas` | Number of replicas for `kerberospipeline.analysis`. | `1` |
 | `kerberospipeline.analysis.logLevel` | Log verbosity level for `kerberospipeline.analysis`. | `"info"` |
 | `kerberospipeline.analysis.thumbnailRegeneration.enabled` | Regenerate thumbnails from the first frame of a classified moving object (`THUMBNAIL_REGENERATION_ENABLED`). Adds up to one thumbnail job per classified recording. Requires an analysis image that reads the flag. | `false` |
@@ -1185,7 +1171,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.enabled` | Deploy `pipe-dominantcolor` and let the analysis stage schedule it (`DOMINANTCOLOR_ENABLED`). Requires an analysis image that reads the flag. | `false` |
 | `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
 | `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.2"` |
+| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.10"` |
 | `kerberospipeline.dominantColor.replicas` | Number of replicas for `kerberospipeline.dominantColor`. | `3` |
 | `kerberospipeline.dominantColor.logLevel` | Log verbosity level for `kerberospipeline.dominantColor`. | `"info"` |
 | `kerberospipeline.dominantColor.resources.requests.memory` | Memory request for `kerberospipeline.dominantColor`. | `"512Mi"` |
@@ -1194,7 +1180,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.resources.limits.cpu` | CPU limit for `kerberospipeline.dominantColor`. | `"1000m"` |
 | `kerberospipeline.thumbnail.repository` | The thumbnail microservices generated a thumbnail for a recordings. | `"ghcr.io/uug-ai/hub-pipeline-thumbnail"` |
 | `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.4"` |
+| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.24"` |
 | `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
 | `kerberospipeline.thumbnail.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-thumbnail ≥ v1.3.15. | `0` |
 | `kerberospipeline.sprite.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-sprite ≥ v1.1.21. | `0` |
@@ -1209,7 +1195,7 @@ kerberospipeline:
 | `kerberospipeline.thumbnail.resources.limits.cpu` | CPU limit for `kerberospipeline.thumbnail`. | `"1000m"` |
 | `kerberospipeline.counting.repository` | The counting microservices computes objects passing different line segments. | `"uugai/hub-pipeline-counting"` |
 | `kerberospipeline.counting.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.counting.tag` | The Docker image tag/version. | `"v1.6.3"` |
+| `kerberospipeline.counting.tag` | The Docker image tag/version. | `"v2.0.7"` |
 | `kerberospipeline.counting.replicas` | Number of replicas for `kerberospipeline.counting`. | `1` |
 | `kerberospipeline.counting.logLevel` | Log verbosity level for `kerberospipeline.counting`. | `"info"` |
 | `kerberospipeline.counting.resources.requests.memory` | Memory request for `kerberospipeline.counting`. | `"10Mi"` |
@@ -1217,7 +1203,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.enabled` | Enable or disable `kerberospipeline.sprite`. | `false` |
 | `kerberospipeline.sprite.repository` | Container image repository for `kerberospipeline.sprite`. | `"ghcr.io/uug-ai/hub-pipeline-sprite"` |
 | `kerberospipeline.sprite.pullPolicy` | Image pull policy for `kerberospipeline.sprite`. | `"IfNotPresent"` |
-| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.12"` |
+| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.28"` |
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
@@ -1229,7 +1215,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.resources.limits.cpu` | CPU limit for `kerberospipeline.sprite`. | `"1000m"` |
 | `kerberospipeline.export.repository` | Container image repository for `kerberospipeline.export`. | `"ghcr.io/uug-ai/hub-pipeline-export"` |
 | `kerberospipeline.export.pullPolicy` | Image pull policy for `kerberospipeline.export`. | `"IfNotPresent"` |
-| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.4"` |
+| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.22"` |
 | `kerberospipeline.export.replicas` | Number of replicas for `kerberospipeline.export`. | `2` |
 | `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
 | `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
@@ -1265,9 +1251,6 @@ kerberospipeline:
 | `email.templates.recordingTitle` | Email subject for recording check alerts. Empty uses "[Device] A camera stopped recording", "[Device] A camera is recording again" and their forms for several cameras. | `""` |
 | `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
 | `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
-| `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
-| `kerberoshub.forwarder.repository` | The Docker container which orchestrates forwarding coming from different Kerberos Vaults. | `""` |
-| `kerberoshub.forwarder.tag` | The Docker image tag/version. | `""` |
 | `kerberoshub.frontend.ssoDomain` | The domain that's being used to activate SSO from the login page. | `""` |
 | `kerberoshub.frontend.stripe.apikey` | If using the public version, `stripe` can be used for automated billing and subscriptions. | `""` |

@@ -1,76 +0,0 @@
-# If .Values.kerberoshub.forwarder.enabled is set to true 
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-forwarder
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vault-forwarder
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: vault-forwarder
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.forwarder.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: vault-forwarder
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
-          resources:
-            requests:
-              memory: 10Mi
-              cpu: 10m
-          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-          - configMapRef:
-              name: mongodb-config
-          env:
-          {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
-          - name: ITERATION_SPEED
-            value: "5"
-          - name: BUFFER_TIME
-            value: "3"
-          - name: MQTT_URI
-            value: "{{ .Values.mqtt.host }}"
-          - name: MQTT_USERNAME
-            value: "{{ .Values.mqtt.username }}"
-          - name: MQTT_PASSWORD
-            value: "{{ .Values.mqtt.password }}"
-{{- end }}
@@ -1,78 +0,0 @@
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-proxy
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.proxy.replicas }}
-  selector:
-    matchLabels:
-      app: vault-proxy
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: vault-proxy
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: vault-proxy
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
-          {{- with .Values.kerberoshub.proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - containerPort: 8080
-              name: http
-          env:
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.proxy.logLevel }}"
-            # Kerberos Hub API
-            - name: KERBEROS_API_CHECK_SUBSCRIPTION
-              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
-            # Kerberos Vault
-            - name: KSTORAGE_URI
-              value: "{{ .Values.kerberosvault.uri }}/storage"
-            - name: KSTORAGE_ACCESSKEY
-              value: "{{ .Values.kerberosvault.accesskey }}"
-            - name: KSTORAGE_SECRET
-              value: "{{ .Values.kerberosvault.secretkey }}"
-            - name: KSTORAGE_PROVIDER
-              value: "{{ .Values.kerberosvault.provider }}"
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: vault-proxy-svc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: vault-proxy-svc
-spec:
-  type: LoadBalancer
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-      name: http
-  selector:
-    app: vault-proxy
-{{- end }}
@@ -0,0 +1,68 @@
+{{- /*
+admin images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/admin.
+The signature itself is checked by admin-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: admin-hardened-images
+  annotations:
+    policies.kyverno.io/title: admin images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/admin has no hardened release with the
+  # image-hardening attestation. Only ghcr.io/uug-ai/admin is trusted.
+  # This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-admin-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/admin:*"
+            - "ghcr.io/uug-ai/admin@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/admin
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/admin
+{{- end }}
@@ -0,0 +1,57 @@
+{{- /*
+admin images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/admin.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: admin-signed-images
+  annotations:
+    policies.kyverno.io/title: admin images must be signed by UUG.AI
+    policies.kyverno.io/category: Image signing
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Only ghcr.io/uug-ai/admin is trusted. The chart's default image comes from
+  # Docker Hub (not matched here; reported by trusted-registry.yaml); switch it to
+  # the signed ghcr.io/uug-ai/admin release.
+  # This policy reports that gap and stays in Audit, even when
+  # imageVerification.validationFailureAction is Enforce.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-admin
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/admin:*"
+            - "ghcr.io/uug-ai/admin@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to uug-ai/admin.
+                      githubWorkflowRepository: uug-ai/admin
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -13,7 +13,7 @@ metadata:
  name: hub-api-hardened-images
  annotations:
    policies.kyverno.io/title: hub-api images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-api-signed-images
  annotations:
    policies.kyverno.io/title: hub-api images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-audit images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-audit.
+The signature itself is checked by hub-audit-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-audit-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-audit images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-audit has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-audit-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-audit:*"
+            - "ghcr.io/uug-ai/hub-audit@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-audit
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-audit
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-audit-signed-images
  annotations:
    policies.kyverno.io/title: hub-audit images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-audit releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -13,7 +13,7 @@ metadata:
  name: hub-cleanup-hardened-images
  annotations:
    policies.kyverno.io/title: hub-cleanup images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-cleanup-signed-images
  annotations:
    policies.kyverno.io/title: hub-cleanup images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -13,7 +13,7 @@ metadata:
  name: hub-frontend-hardened-images
  annotations:
    policies.kyverno.io/title: hub-frontend images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-frontend-signed-images
  annotations:
    policies.kyverno.io/title: hub-frontend images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -13,7 +13,7 @@ metadata:
  name: hub-loitering-hardened-images
  annotations:
    policies.kyverno.io/title: hub-loitering images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-loitering-signed-images
  annotations:
    policies.kyverno.io/title: hub-loitering images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -13,7 +13,7 @@ metadata:
  name: hub-monitor-device-hardened-images
  annotations:
    policies.kyverno.io/title: hub-monitor-device images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-monitor-device-signed-images
  annotations:
    policies.kyverno.io/title: hub-monitor-device images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-objecttracking images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-objecttracking.
+The signature itself is checked by hub-objecttracking-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-objecttracking-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-objecttracking images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-objecttracking has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-objecttracking-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-objecttracking:*"
+            - "ghcr.io/uug-ai/hub-objecttracking@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-objecttracking
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-objecttracking
+{{- end }}
@@ -11,16 +11,17 @@ metadata:
  name: hub-objecttracking-signed-images
  annotations:
    policies.kyverno.io/title: hub-objecttracking images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-objecttracking releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
+  # hub-objecttracking releases are signed (from v1.0.10), but the GPU image
+  # (<tag>-gpu, built by the repository's release-gpu-image.yml) is not, and this
+  # policy matches every hub-objecttracking tag. It therefore stays in Audit even
+  # when imageVerification.validationFailureAction is Enforce, until the GPU
+  # image is signed too. Then use the same line as hub-api-signed-images.yaml.
  validationFailureAction: Audit
  # Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
  failurePolicy: Ignore
@@ -13,7 +13,7 @@ metadata:
  name: hub-pipeline-analysis-hardened-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-analysis images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-pipeline-analysis-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-analysis images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -13,7 +13,7 @@ metadata:
  name: hub-pipeline-counting-hardened-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-counting images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-pipeline-counting-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-counting images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-dominantcolors images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-dominantcolors.
+The signature itself is checked by hub-pipeline-dominantcolors-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-dominantcolors-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-dominantcolors images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-dominantcolors has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-dominantcolors-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-dominantcolors
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-dominantcolors-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-dominantcolors images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-dominantcolors releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-event images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-event.
+The signature itself is checked by hub-pipeline-event-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-event-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-event images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-event has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-event-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-event:*"
+            - "ghcr.io/uug-ai/hub-pipeline-event@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-event
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-event
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-event-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-event images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-event releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-export images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-export.
+The signature itself is checked by hub-pipeline-export-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-export-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-export images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-export has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-export-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-export:*"
+            - "ghcr.io/uug-ai/hub-pipeline-export@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-export
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-export
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-export-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-export images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-export releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -13,7 +13,7 @@ metadata:
  name: hub-pipeline-monitor-hardened-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-monitor images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-pipeline-monitor-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-monitor images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-notification images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-notification.
+The signature itself is checked by hub-pipeline-notification-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-notification has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-notification
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-notification
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-notification-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-notification images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-notification releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-notification-test images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-notification-test.
+The signature itself is checked by hub-pipeline-notification-test-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-test-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification-test images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-notification-test has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification-test-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-notification-test
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-notification-test-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-notification-test images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-notification-test releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -13,7 +13,7 @@ metadata:
  name: hub-pipeline-sequence-hardened-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-sequence images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-pipeline-sequence-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-sequence images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-sprite images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-sprite.
+The signature itself is checked by hub-pipeline-sprite-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-sprite-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-sprite images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-sprite has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-sprite-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-sprite:*"
+            - "ghcr.io/uug-ai/hub-pipeline-sprite@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-sprite
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-sprite
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-sprite-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-sprite images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-sprite releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -13,7 +13,7 @@ metadata:
  name: hub-pipeline-throttler-hardened-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-throttler images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-pipeline-throttler-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-throttler images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,69 @@
+{{- /*
+hub-pipeline-thumbnail images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-thumbnail.
+The signature itself is checked by hub-pipeline-thumbnail-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-thumbnail-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-thumbnail images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-pipeline-thumbnail has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-thumbnail-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-thumbnail
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-pipeline-thumbnail-signed-images
  annotations:
    policies.kyverno.io/title: hub-pipeline-thumbnail images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-pipeline-thumbnail releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -0,0 +1,68 @@
+{{- /*
+hub-reactivatesubscriptions images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-reactivatesubscriptions.
+The signature itself is checked by hub-reactivatesubscriptions-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-reactivatesubscriptions-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-reactivatesubscriptions images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-reactivatesubscriptions has no hardened release with the
+  # image-hardening attestation. Only ghcr.io/uug-ai/hub-reactivatesubscriptions is trusted.
+  # This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-reactivatesubscriptions-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-reactivatesubscriptions
+{{- end }}
@@ -0,0 +1,57 @@
+{{- /*
+hub-reactivatesubscriptions images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-reactivatesubscriptions.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-reactivatesubscriptions-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-reactivatesubscriptions images must be signed by UUG.AI
+    policies.kyverno.io/category: Image signing
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Only ghcr.io/uug-ai/hub-reactivatesubscriptions is trusted. The chart's default image comes from
+  # Docker Hub (not matched here; reported by trusted-registry.yaml); switch it to
+  # the signed ghcr.io/uug-ai/hub-reactivatesubscriptions release.
+  # This policy reports that gap and stays in Audit, even when
+  # imageVerification.validationFailureAction is Enforce.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-reactivatesubscriptions
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to uug-ai/hub-reactivatesubscriptions.
+                      githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,69 @@
+{{- /*
+hub-vlm images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-vlm.
+The signature itself is checked by hub-vlm-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-vlm-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-vlm images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Not hardened yet: uug-ai/hub-vlm has no hardened release with the
+  # image-hardening attestation (the image does not meet the hardened contract
+  # yet). This policy reports that gap and stays in Audit, even when
+  # imageHardening.validationFailureAction is Enforce. Once its releases are
+  # hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-vlm-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-vlm:*"
+            - "ghcr.io/uug-ai/hub-vlm@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-vlm
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-vlm
+{{- end }}
@@ -11,17 +11,14 @@ metadata:
  name: hub-vlm-signed-images
  annotations:
    policies.kyverno.io/title: hub-vlm images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not signed yet: uug-ai/hub-vlm releases need `sign: true` (and
-  # `id-token: write`) in their release workflow. Until then this policy stays
-  # in Audit, even when imageVerification.validationFailureAction is Enforce.
-  # Once signed, use the same line as hub-api-signed-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -13,7 +13,7 @@ metadata:
  name: hub-workflows-hardened-images
  annotations:
    policies.kyverno.io/title: hub-workflows images must come from a hardened UUG.AI release
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image hardening
    policies.kyverno.io/severity: medium
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, attestation required.
@@ -11,7 +11,7 @@ metadata:
  name: hub-workflows-signed-images
  annotations:
    policies.kyverno.io/title: hub-workflows images must be signed by UUG.AI
-    policies.kyverno.io/category: Supply chain
+    policies.kyverno.io/category: Image signing
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 # Kyverno defaults apply: background scans of running pods, signature required.
@@ -0,0 +1,45 @@
+{{- /*
+Only images from ghcr.io/uug-ai are trusted: report every container, init
+container and ephemeral container image from any other registry or
+organisation (Docker Hub, quay.io, ...). Signature and hardening are checked per
+image by the *-signed-images / *-hardened-images policies, which match
+ghcr.io/uug-ai images only.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: trusted-registry
+  annotations:
+    policies.kyverno.io/title: Images must come from ghcr.io/uug-ai
+    policies.kyverno.io/category: Image registry
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+spec:
+  # Reports images from other registries without blocking them, even when
+  # imageVerification.validationFailureAction is Enforce: some images the chart
+  # can deploy are not on ghcr.io/uug-ai yet (see README). Switch to the
+  # configured value once every image is.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  rules:
+    - name: images-from-ghcr-uug-ai
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: "Every container image must come from the trusted registry ghcr.io/uug-ai/."
+        foreach:
+          - list: "request.object.spec.[containers, initContainers, ephemeralContainers][]"
+            deny:
+              conditions:
+                all:
+                  - key: "{{`{{ element.image }}`}}"
+                    operator: NotEquals
+                    value: "ghcr.io/uug-ai/*"
+{{- end }}
@@ -286,14 +286,34 @@ kerberosvault:
 # For now it's used to create, edit users for Hub.
 ###########################################################################
 admin:
-  repository: uugai/admin
-  # Opt in to 8080 and a securityContext only with a compatible hardened image.
-  containerPort: 80
-  securityContext: {}
-  readinessProbe: {}
-  livenessProbe: {}
+  # Signed release from the UUG.AI release workflow (only ghcr.io/uug-ai is trusted).
+  # It runs shell-free as 65532:65532 on 8080 with a read-only root filesystem:
+  # keep the runtime settings below together with the image (see README).
+  repository: ghcr.io/uug-ai/admin
+  containerPort: 8080
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: RuntimeDefault
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    periodSeconds: 10
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
  pullPolicy: IfNotPresent
-  tag: "v1.3.0"
+  tag: "v1.4.5"
  replicas: 2
  # Optional pod topology spread constraints for this deployment. Empty by
  # default. Example:
@@ -305,13 +325,16 @@ admin:
  #         matchLabels:
  #           app: admin
  topologySpreadConstraints: []
-  # Optional extra volumes / volumeMounts for this deployment (empty = none).
-  #volumes:
-  #  - name: extra
-  #    emptyDir: {}
-  #volumeMounts:
-  #  - name: extra
-  #    mountPath: /data
+  # The only writable path: memory-backed /tmp (counts against the pod memory
+  # limit). Append extra volumes / volumeMounts to these lists.
+  volumes:
+    - name: admin-tmp
+      emptyDir:
+        medium: Memory
+        sizeLimit: 16Mi
+  volumeMounts:
+    - name: admin-tmp
+      mountPath: /tmp
  logLevel: "info" # possible values: trace, debug, info, warn, error
  resources:
    requests:
@@ -358,7 +381,7 @@ kerberoshub:
  api:
    repository: ghcr.io/uug-ai/hub-api
    pullPolicy: IfNotPresent
-    tag: "v1.11.31"
+    tag: "v1.11.41"
    replicas: 2
    podSecurityContext:
      fsGroup: 65532
@@ -527,7 +550,7 @@ kerberoshub:
  frontend:
    repository: ghcr.io/uug-ai/hub-frontend
    pullPolicy: IfNotPresent
-    tag: "v1.19.28"
+    tag: "v1.19.35"
    replicas: 2
    containerPort: 8080
    securityContext:
@@ -839,7 +862,7 @@ kerberoshub:
    podSecurityContext: {}
    repository: ghcr.io/uug-ai/hub-cleanup
    pullPolicy: IfNotPresent
-    tag: "v1.4.26"
+    tag: "v1.4.27"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -893,7 +916,7 @@ kerberoshub:
  audit:
    repository: ghcr.io/uug-ai/hub-audit
    pullPolicy: IfNotPresent
-    tag: "v1.0.10"
+    tag: "v1.0.11"
    replicas: 1
    resources: {}
    # resources:
@@ -1092,7 +1115,7 @@ kerberoshub:
      securityContext: {}
      podSecurityContext: {}
      pullPolicy: IfNotPresent
-      tag: "v1.0.0"
+      tag: "v1.0.49"
      replicas: 1 # Number of pods for the service.
      topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
      # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1122,7 +1145,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-loitering
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.0"
+          #  tag: "v1.0.11"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  #volumes:
@@ -1151,7 +1174,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-objecttracking
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.0"
+          #  tag: "v1.0.10"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1176,7 +1199,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-vlm
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.0"
+          #  tag: "v1.0.8"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1203,7 +1226,7 @@ kerberoshub:
    podSecurityContext: {}
    repository: ghcr.io/uug-ai/hub-monitor-device
    pullPolicy: IfNotPresent
-    tag: "v1.4.10"
+    tag: "v1.4.15"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1242,43 +1265,6 @@ kerberoshub:
      requests:
        memory: 10Mi
        cpu: 10m
-  forwarder:
-    enabled: false
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    #repository: kerberos/vault-forwarder
-    #pullPolicy: IfNotPresent
-    #tag: "1.0.2732389692"
-    #resources:
-    #  requests:
-    #    memory: 10Mi
-    #    cpu: 10m
-  # This proxy is legacy for the old agent, will be migrated in the new Hub API.
-  proxy:
-    enabled: false
-    repository: uugai/hub-proxy
-    pullPolicy: IfNotPresent
-    tag: "v1.0.0"
-    replicas: 0 # Number of pods for the service when enabled.
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    logLevel: "info" # possible values: trace, debug, info, warn, error
-    resources:
-      requests:
-        memory: 10Mi
-        cpu: 10m
 # The Kerberos Hub pipeline is a series of microservices that process the recordings.
 # Each microservice is responsible for a specific task, like counting objects, generating thumbnails, etc.
 # The pipeline is orchestrated through Kafka topics or RabbitMQ queues.
@@ -1291,7 +1277,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "10"
    repository: ghcr.io/uug-ai/hub-pipeline-event
    pullPolicy: IfNotPresent
-    tag: "v1.3.9"
+    tag: "v1.3.10"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1312,7 +1298,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "70"
    pullPolicy: IfNotPresent
-    tag: "v1.3.29"
+    tag: "v1.3.30"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1333,7 +1319,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "60"
    pullPolicy: IfNotPresent
-    tag: "v1.7.14"
+    tag: "v1.7.15"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1356,7 +1342,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "30"
    pullPolicy: IfNotPresent
-    tag: "v1.2.10"
+    tag: "v1.2.11"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1379,7 +1365,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "20"
    pullPolicy: IfNotPresent
-    tag: "v1.3.46"
+    tag: "v1.3.48"
    replicas: 1 # Number of pods for the service.
    audit:
      enabled: true
@@ -1401,7 +1387,7 @@ kerberospipeline:
  notifyTest:
    repository: ghcr.io/uug-ai/hub-pipeline-notification-test
    pullPolicy: IfNotPresent
-    tag: "v1.2.6"
+    tag: "v1.2.7"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    resources:
@@ -1422,7 +1408,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "40"
    pullPolicy: IfNotPresent
-    tag: "v1.8.29"
+    tag: "v1.8.31"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1464,7 +1450,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v2.0.9"
+    tag: "v2.0.10"
    replicas: 3 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1490,7 +1476,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v1.3.22"
+    tag: "v1.3.24"
    replicas: 2 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1523,7 +1509,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v2.0.6"
+    tag: "v2.0.7"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1545,7 +1531,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "50"
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
-    tag: "v1.1.27"
+    tag: "v1.1.28"
    replicas: 5 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1572,7 +1558,7 @@ kerberospipeline:
  export:
    repository: ghcr.io/uug-ai/hub-pipeline-export
    pullPolicy: IfNotPresent
-    tag: "v1.2.20"
+    tag: "v1.2.22"
    replicas: 2 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -28,28 +28,26 @@ assert_absent() {
  fi
 }

-HARDENED_FLAGS=(
-  --set admin.containerPort=8080
-  --set-json 'admin.securityContext={"runAsNonRoot":true,"runAsUser":65532,"runAsGroup":65532,"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}'
-  --set-json 'admin.volumes=[{"name":"admin-tmp","emptyDir":{"medium":"Memory","sizeLimit":"16Mi"}}]'
-  --set-json 'admin.volumeMounts=[{"name":"admin-tmp","mountPath":"/tmp"}]'
-  --set-json 'admin.readinessProbe={"httpGet":{"path":"/healthz","port":"http"},"periodSeconds":10}'
-  --set-json 'admin.livenessProbe={"httpGet":{"path":"/healthz","port":"http"},"initialDelaySeconds":10,"periodSeconds":10}'
+# Since chart 0.184.0 the hardened ghcr.io/uug-ai/admin runtime is the default;
+# LEGACY_FLAGS opts back into a legacy image on port 80.
+LEGACY_FLAGS=(
+  --set admin.repository=uugai/admin
+  --set admin.tag=v1.3.0
+  --set admin.containerPort=80
+  --set admin.securityContext=null
+  --set admin.readinessProbe=null
+  --set admin.livenessProbe=null
+  --set admin.volumes=null
+  --set admin.volumeMounts=null
 )

 for mode in all ui; do
-  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
-  default_deployment="$(resource deployment <<< "$default_render")"
-  default_service="$(resource service <<< "$default_render")"
-  default_ingress="$(resource ingress <<< "$default_render")"
-  default_oauth="$(resource oauth2-proxy <<< "$default_render")"
-  assert_contains "$default_deployment" 'containerPort: 80$'
-  assert_absent "$default_deployment" 'securityContext:|readinessProbe:|livenessProbe:'
-  assert_contains "$default_service" 'port: 80$'
-  assert_contains "$default_service" 'targetPort: http$'
-
-  hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${HARDENED_FLAGS[@]}")"
+  hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
  hardened_deployment="$(resource deployment <<< "$hardened_render")"
+  hardened_service="$(resource service <<< "$hardened_render")"
+  hardened_ingress="$(resource ingress <<< "$hardened_render")"
+  hardened_oauth="$(resource oauth2-proxy <<< "$hardened_render")"
+  assert_contains "$hardened_deployment" 'image: "ghcr.io/uug-ai/admin:'
  assert_contains "$hardened_deployment" 'containerPort: 8080$'
  assert_absent "$hardened_deployment" 'containerPort: 80$'
  for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
@@ -66,17 +64,24 @@ for mode in all ui; do
    assert_contains "$probe_render" 'path: /healthz$'
    assert_contains "$probe_render" 'port: http$'
  done
+  assert_contains "$hardened_service" 'port: 80$'
+  assert_contains "$hardened_service" 'targetPort: http$'

-  [[ "$(resource service <<< "$hardened_render")" == "$default_service" ]]
-  [[ "$(resource ingress <<< "$hardened_render")" == "$default_ingress" ]]
-  [[ "$(resource oauth2-proxy <<< "$hardened_render")" == "$default_oauth" ]]
-  assert_contains "$default_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
-  assert_contains "$default_ingress" 'number: 80$'
+  legacy_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${LEGACY_FLAGS[@]}")"
+  legacy_deployment="$(resource deployment <<< "$legacy_render")"
+  assert_contains "$legacy_deployment" 'containerPort: 80$'
+  assert_absent "$legacy_deployment" 'securityContext:|readinessProbe:|livenessProbe:|admin-tmp'

-  echo "OK ($mode): legacy defaults; hardened runtime/probes; stable Service, ingress and OAuth2"
+  [[ "$(resource service <<< "$legacy_render")" == "$hardened_service" ]]
+  [[ "$(resource ingress <<< "$legacy_render")" == "$hardened_ingress" ]]
+  [[ "$(resource oauth2-proxy <<< "$legacy_render")" == "$hardened_oauth" ]]
+  assert_contains "$hardened_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
+  assert_contains "$hardened_ingress" 'number: 80$'
+
+  echo "OK ($mode): hardened ghcr.io defaults; legacy opt-out; stable Service, ingress and OAuth2"
 done

-pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline "${HARDENED_FLAGS[@]}")"
+pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline)"
 assert_absent "$pipeline_render" '^# Source: hub/templates/admin/'

 echo "All Admin runtime checks passed."
@@ -29,7 +29,7 @@ for mode in all ui; do
    --set kerberoshub.frontend.demoEnabled=true)"
  for name in hub-frontend hub-frontend-demo; do
    deployment="$(resource Deployment "$name" <<< "$rendered")"
-    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
+    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.35"$'
    assert_contains "$deployment" 'containerPort: 8080$'
    [[ "$(grep -c 'containerPort:' <<< "$deployment")" == 1 ]]
    for setting in 'name: http' 'runAsNonRoot: true' 'runAsUser: 65532' \
@@ -44,7 +44,7 @@ for mode in all ui; do
    echo "OK ($mode): $name hardened image, security, scratch and named routing"
  done
  admin="$(resource Deployment admin <<< "$rendered")"
-  assert_contains "$admin" 'containerPort: 80$'
+  assert_contains "$admin" 'containerPort: 8080$'

  legacy="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
    --set kerberoshub.frontend.demoEnabled=true \
@@ -60,6 +60,14 @@ assert_line() {
  fi
 }

+without_admin() {
+  awk '
+    /^---$/ { skip=0 }
+    /^# Source: hub\/templates\/admin\/deployment\.yaml$/ { skip=1 }
+    !skip { print }
+  '
+}
+
 without_frontends() {
  awk '
    /^---$/ { skip=0 }
@@ -70,7 +78,8 @@ without_frontends() {

 for mode in all pipeline ui; do
  defaults="$(helm template hub "$CHART_DIR" --set "mode=$mode")"
-  worker_defaults="$(without_frontends <<< "$defaults")"
+  # Frontends, hub-api and Admin (since 0.184.0) are hardened by default.
+  worker_defaults="$(without_frontends <<< "$defaults" | without_admin)"
  if grep -q 'securityContext:' <<< "$worker_defaults"; then
    echo "Default $mode mode unexpectedly enables worker security settings" >&2
    exit 1
@@ -120,8 +129,8 @@ for mode in all pipeline ui; do
    fi
  done
  expected="${#names[@]}"
-  [[ "$(without_frontends <<< "$hardened" | grep -c 'runAsUser: 65532')" == "$expected" ]]
-  [[ "$(without_frontends <<< "$hardened" | grep -c 'fsGroup: 65532')" == "$expected" ]]
+  [[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'runAsUser: 65532')" == "$expected" ]]
+  [[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'fsGroup: 65532')" == "$expected" ]]

  # Image selection, Services, env and TLS mounts must not change.
  for pattern in '^[ ]+image:' '^[ ]+(port|targetPort|containerPort):' 'mongodb-tls'; do
@@ -137,26 +146,23 @@ isolated="$(helm template hub "$CHART_DIR" --set mode=pipeline \
 assert_line "$(resource Deployment pipe-counting <<< "$isolated")" '^[ ]+runAsUser: 65532$'
 echo "All hardened worker checks passed."

-admin_flags=(
-  --set admin.containerPort=8080
-  --set admin.securityContext.runAsNonRoot=true
-  --set admin.securityContext.runAsUser=65532
-  --set admin.securityContext.runAsGroup=65532
-  --set admin.securityContext.readOnlyRootFilesystem=true
-  --set admin.securityContext.allowPrivilegeEscalation=false
-  --set admin.securityContext.capabilities.drop[0]=ALL
-  --set admin.securityContext.seccompProfile.type=RuntimeDefault
-  --set admin.volumes[0].name=admin-tmp
-  --set admin.volumes[0].emptyDir.medium=Memory
-  --set admin.volumes[0].emptyDir.sizeLimit=16Mi
-  --set admin.volumeMounts[0].name=admin-tmp
-  --set admin.volumeMounts[0].mountPath=/tmp
+# Since chart 0.184.0 the hardened Admin runtime is the default; these flags
+# opt back into a legacy image on port 80.
+legacy_admin_flags=(
+  --set admin.repository=uugai/admin
+  --set admin.tag=v1.3.0
+  --set admin.containerPort=80
+  --set admin.securityContext=null
+  --set admin.readinessProbe=null
+  --set admin.livenessProbe=null
+  --set admin.volumes=null
+  --set admin.volumeMounts=null
  --set admin.oauth2Proxy.enabled=true
 )
 for mode in all ui pipeline; do
-  legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
-  configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${admin_flags[@]}")"
-  helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${admin_flags[@]}"
+  legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${legacy_admin_flags[@]}")"
+  configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
+  helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${legacy_admin_flags[@]}"
  if [[ "$mode" == pipeline ]]; then
    [[ -z "$(resource Deployment admin <<< "$configured")" ]]
    [[ -z "$(resource Service admin-svc <<< "$configured")" ]]
@@ -186,9 +192,11 @@ for mode in all ui pipeline; do
  [[ "$(resource Ingress admin-ingress <<< "$legacy")" == "$(resource Ingress admin-ingress <<< "$configured")" ]]
  [[ "$(resource Deployment oauth2-proxy-admin <<< "$legacy")" == "$(resource Deployment oauth2-proxy-admin <<< "$configured")" ]]
  [[ "$(resource Service oauth2-proxy-admin <<< "$legacy")" == "$(resource Service oauth2-proxy-admin <<< "$configured")" ]]
-  [[ "$(grep 'image:' <<< "$legacy")" == "$(grep 'image:' <<< "$configured")" ]]
+  [[ "$(without_admin <<< "$legacy" | grep 'image:')" == "$(without_admin <<< "$configured" | grep 'image:')" ]]
+  assert_line "$old" 'image: "uugai/admin:v1.3.0"$'
+  assert_line "$block" 'image: "ghcr.io/uug-ai/admin:v1.4.5"$'
  # No other workload inherits Admin's container port or security settings.
  [[ "$(without_frontends <<< "$configured" | grep -c 'runAsUser: 65532')" == 1 ]]
-  echo "OK ($mode): Admin opt-in port/security/tmpfs; legacy image, Service port, ingress and OAuth2-proxy preserved"
+  echo "OK ($mode): Admin hardened defaults; legacy opt-out; Service port, ingress and OAuth2-proxy preserved"
 done
 echo "All hardened Admin checks passed."
Author	SHA1	Message	Date
Cédric Verstraeten	caab6f6f55	Merge pull request #239 from kerberos-io/feat/hub-kyverno-missing-images feat(hub): Kyverno policies for every image, trust only ghcr.io/uug-ai, hardened Admin default; remove hub-proxy and vault-forwarder (0.184.0)	2026-11-11 21:55:02 +01:00
Cédric VerstraetenandClaude Opus 5.5	3949cb4bac	feat(hub): default Admin to signed, hardened ghcr.io/uug-ai/admin v1.4.5 Only ghcr.io/uug-ai images are trusted, so Admin now defaults to the signed GHCR release with the hardened runtime production already uses (8080, 65532 non-root, read-only root, memory /tmp, /healthz probes). A legacy image can be restored with the documented opt-out values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:52:01 +00:00
Cédric VerstraetenandClaude Opus 5.5	1fe8fe9727	feat(hub): trust only ghcr.io/uug-ai images - admin and hub-reactivatesubscriptions signature/hardening policies match ghcr.io/uug-ai only (Docker Hub references removed). - Remove the oauth2-proxy (quay.io) signature policy. - Add trusted-registry.yaml (category "Image registry", Audit): reports every container, init and ephemeral container image that is not from ghcr.io/uug-ai/. It flags the remaining non-GHCR images the chart can deploy: uugai/admin and uugai/hub-reactivatesubscriptions (Docker Hub) and quay.io/oauth2-proxy/oauth2-proxy. - README updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:46:34 +00:00
Cédric VerstraetenandClaude Opus 5.5	5eb0d41aa7	feat(hub): keep the reactivate-subscriptions service hub-reactivate-subscription is still needed: restore its template, kerberoshub.reactivate values, README rows and its Kyverno signature and hardening policies (Audit until the chart uses the signed ghcr.io/uug-ai/hub-reactivatesubscriptions image). Only hub-proxy and vault-forwarder are removed. The reactivate output is unchanged from main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:40:03 +00:00
Cédric VerstraetenandClaude Opus 5.5	5a445e0179	feat(hub): remove unused hub-proxy, reactivate-subscriptions and vault-forwarder These services are no longer used. Remove their templates (kerberos-vault/vault-proxy.yaml, kerberos-vault/vault-forwarder.yaml, kerberos-hub/hub-reactivate-subscription.yaml), their values (kerberoshub.proxy, kerberoshub.forwarder, kerberoshub.reactivate), their README sections, and the Kyverno policies added for them in this change. Installs that still set these values keep rendering; the keys are ignored. Upgrading removes the hub-reactivate-subscription Deployment (and the vault-proxy / vault-forwarder ones where enabled). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:37:09 +00:00
Cédric Verstraeten	a34a82138a	Merge pull request #238 from kerberos-io/feat/hub-frontend-v1.19.35-default feat(hub): default hub-frontend v1.19.35, the first attested hardened release (0.183.1)	2026-11-11 21:36:15 +01:00
Cédric VerstraetenandClaude Opus 5.5	714e59f6fe	feat(hub): Kyverno policies for every container image the chart deploys (0.184.0) A scan of every container and init container the chart can render (all modes and optional components) found 26 images; 21 had a signature policy and 11 a hardening policy. Add the missing ones so Policy Reporter shows every gap instead of "no policy": - Hardening policies for the 10 ghcr.io/uug-ai images without a hardened release yet (audit, objecttracking, vlm, dominantcolors, event, export, notification, notification-test, sprite, thumbnail). - Signature and hardening policies for the Docker Hub images uugai/admin, uugai/hub-proxy, uugai/hub-reactivatesubscriptions (also matching their ghcr.io/uug-ai releases) and the legacy kerberos/vault-forwarder. - A visibility-only signature policy for the third-party oauth2-proxy. All new policies stay in Audit regardless of the configured mode, so they report gaps without ever blocking. README tables updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:31:32 +00:00
Cédric VerstraetenandClaude Opus 5.5	73106bfa10	feat(hub): default hub-frontend v1.19.35, the first attested hardened release (0.183.1) hub-frontend v1.19.35 is a hardened release with the signed image-hardening attestation (v1.19.34 was hardened before attestations existed). With it, every chart default with a hardening policy is an attested hardened release. Frontend runtime check and README updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:17:49 +00:00
Cédric Verstraeten	284765c401	Merge pull request #237 from kerberos-io/feat/hub-signed-image-defaults feat(hub): default to signed and hardened image releases (0.183.0)	2026-11-11 19:18:58 +01:00
Cédric VerstraetenandClaude Opus 5.5	90be00011d	Update frontend runtime check and README defaults for the new image tags check-frontend-runtime.sh asserted the old default hub-frontend tag (v1.19.28); README parameter table defaults were stale. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 18:14:58 +00:00
Cédric VerstraetenandClaude Opus 5.5	2d0ad37170	feat(hub): default to signed and hardened image releases (0.183.0) Update every ghcr.io/uug-ai default image tag to the release running in production: all signed by the UUG.AI release workflow for their own repository, and hardened releases with the image-hardening attestation for every image that has a hardening policy except hub-frontend. Older defaults (e.g. hub-api v1.11.31, hub-workflows v1.0.0) were unsigned and failed the chart's own Kyverno policies. Commented examples (loitering, objecttracking, vlm) updated too. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 18:10:44 +00:00
Cédric Verstraeten	113aa1fe34	Merge pull request #236 from kerberos-io/feat/hub-kyverno-categories feat(hub): separate Kyverno categories for image signing and hardening (0.182.1)	2026-11-11 16:58:49 +01:00
Cédric VerstraetenandClaude Opus 5.5	2274c29e95	feat(hub): separate Kyverno categories for image signing and hardening (0.182.1) All 32 image policies used the category "Supply chain", so Policy Reporter and its dashboards could not tell signing from hardening results. Signature policies (-signed-images) now use "Image signing" and hardening policies (-hardened-images) "Image hardening". No change to what the policies check. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 15:44:51 +00:00
Cédric Verstraeten	13cb6b27b1	Merge pull request #235 from kerberos-io/feat/hub-signed-images-0.182.0 feat(hub): signature policies follow the configured mode for newly signed images (0.182.0)	2026-11-11 14:45:43 +01:00
Cédric VerstraetenandClaude Opus 5.5	96f3c6db68	feat(hub): signature policies follow the configured mode for newly signed images (0.182.0) hub-audit, hub-vlm and the dominantcolors, event, export, notification, notification-test, sprite and thumbnail pipelines now sign every release (signed from the releases noted in the README). Their signature policies drop the forced Audit and follow imageVerification.validationFailureAction like the others. hub-objecttracking stays in Audit: its releases are signed from v1.0.10, but its GPU image (<tag>-gpu) is not, and the policy matches every tag. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 13:32:42 +00:00