Merge pull request #245 from kerberos-io/feat/hub-inspect

feat(hub): flag for in-app bug reports with inspect (0.188.0)
2026-11-12 21:30:24 +00:00 · 2026-11-12 18:00:20 +01:00 · 2026-11-12 16:19:37 +00:00 · 2026-11-12 10:11:12 +01:00 · 2026-11-12 09:07:56 +00:00 · 2026-11-12 10:06:24 +01:00
26 changed files with 1151 additions and 359 deletions
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.183.0
+version: 0.188.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -58,7 +58,7 @@ legacy opt-out, TLS/configuration mounts and deployment modes.
 ### Hardened frontend images

 Starting with chart **`0.170.0`**, both frontends default to shell-free
-`ghcr.io/uug-ai/hub-frontend:v1.19.34`, running as `65532:65532` on port `8080`
+`ghcr.io/uug-ai/hub-frontend:v1.19.35`, running as `65532:65532` on port `8080`
 with a read-only root filesystem and writable `/tmp`. The Service and ingress
 remain on port `80`. Admin retains its legacy image and port `80`; its hardened
 runtime remains opt-in.
@@ -122,61 +122,35 @@ instructions below if the existing Deployment cannot be patched to `8080`.
 Run `bash scripts/check-frontend-runtime.sh` for default, demo, legacy override,
 and deployment-values regression coverage.

-### Hardened Admin image (opt-in, chart 0.167.3)
+### Hardened Admin image (default since chart 0.184.0)

-`charts/hub` deploys Admin in `all` and `ui` modes. Shell-free Admin `v1.4.3`
-runs as `65532:65532` and listens on `8080`, unlike the legacy image on `80`.
-Set these values together; the chart does not upgrade the image automatically:
+`charts/hub` deploys Admin in `all` and `ui` modes. Since chart **`0.184.0`** the
+default is the signed, shell-free `ghcr.io/uug-ai/admin` (`v1.4.6` since 0.185.0): it runs as
+`65532:65532` on `8080` with a read-only root filesystem, a memory-backed `/tmp`
+(`admin-tmp`, the only writable path) and `/healthz` probes. These settings are
+the defaults in `values.yaml`; keep them together with the image. Append extra
+volumes and mounts to the `admin.volumes` / `admin.volumeMounts` lists (Helm
+replaces lists in overrides). Memory-backed scratch counts against the pod memory
+limit. The `admin-svc` Service and Admin ingress use port `80`; the Service
+targets the named `http` container port. OAuth2-proxy is unchanged.
+
+Only `ghcr.io/uug-ai` images are trusted (see *Image signature verification*).
+To run a legacy image on port `80` instead, restore all of these together:

 ```yaml
 admin:
-    repository: ghcr.io/uug-ai/admin
-    tag: v1.4.3
-    containerPort: 8080
-    securityContext:
-        runAsNonRoot: true
-        runAsUser: 65532
-        runAsGroup: 65532
-        readOnlyRootFilesystem: true
-        allowPrivilegeEscalation: false
-        capabilities:
-            drop: ["ALL"]
-        seccompProfile:
-            type: RuntimeDefault
-    volumes:
-        - name: admin-tmp
-          emptyDir:
-              medium: Memory
-              sizeLimit: 16Mi # Example; size for your runtime configuration.
-    volumeMounts:
-        - name: admin-tmp
-          mountPath: /tmp
-    readinessProbe:
-        httpGet:
-            path: /healthz
-            port: http
-        periodSeconds: 10
-    livenessProbe:
-        httpGet:
-            path: /healthz
-            port: http
-        initialDelaySeconds: 10
-        periodSeconds: 10
+    repository: uugai/admin
+    tag: v1.3.0
+    containerPort: 80
+    securityContext: null
+    readinessProbe: null
+    livenessProbe: null
+    volumes: null
+    volumeMounts: null
 ```

-Merge the scratch volume with any existing mounts. Only `/tmp` is writable;
-application files remain read-only. Memory-backed scratch counts against the
-pod memory limit. The `admin-svc` Service and Admin ingress still use port `80`;
-the Service targets the named `http` container port. OAuth2-proxy is unchanged.
-Defaults remain port `80` with no security context, added volumes, or probes. Coordinate
-the image, values and a chart revision containing these settings: published
-`0.167.2` does not contain Admin runtime support.
-
-Rollbacks to legacy images must restore port `80`, remove the hardened
-security context, and disable `/healthz` probes together. Run
-`bash scripts/check-admin-runtime.sh` from the repository root to verify
-legacy defaults, hardened runtime/probes, and unchanged OAuth2 routing.
-
+Run `bash scripts/check-admin-runtime.sh` from the repository root to verify the
+hardened defaults, the legacy opt-out and unchanged OAuth2 routing.
 ### Recovering a duplicate HTTP port during upgrades

 Chart `0.169.1` publishes this recovery guidance. The helper is available in the
@@ -327,14 +301,6 @@ Optional dataset mode also requires its own writable `ANPR_DATASET_DIR` mount.
 Models and application directories stay read-only.

 This repository has **no Vault server or design-system chart**. The files named
-`vault-proxy` and `vault-forwarder` deploy different legacy applications; their
-ports are not the Vault server's port. Do not change them for `uug-ai/vault#119`.
-That proposed Vault image requires port `8080` (legacy `80`), UID/GID `65532`,
-read-only `/home/vault`, workload-sized writable `/run/vault`, and compatible
-ownership on existing optional `LOCAL_CACHE_DIRECTORY` mounts. Its liveness
-endpoint is `GET /api/health`. Wire those settings in the actual Vault deployment
-only when a compatible image release is selected; no migration is required.
-
 ### Image signature verification (Kyverno)

 Starting with chart **`0.179.0`**, the chart can verify that UUG.AI images are
@@ -383,6 +349,8 @@ signed for its own `uug-ai/<image>` repository. "Mode" is the
 | `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ✅ signed (from v1.2.7) | value |
 | `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ✅ signed (from v1.1.28) | value |
 | `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ✅ signed (from v1.3.24) | value |
+| `admin-signed-images.yaml` | `ghcr.io/uug-ai/admin` | ✅ signed (from v1.4.5) | value |
+| `hub-reactivatesubscriptions-signed-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` | ✅ signed (from v1.0.3, the first GHCR release) | value |

 Since chart **`0.182.0`** every `ghcr.io/uug-ai` image's releases are signed, so
 every policy follows `imageVerification.validationFailureAction`, except
@@ -390,13 +358,28 @@ every policy follows `imageVerification.validationFailureAction`, except
 policy stays in `Audit` and enabling `Enforce` never blocks it. Images are signed
 from the release noted in the table; **older tags are unsigned and are rejected
 in `Enforce`**, so check the tags you run before enforcing. Since chart
-**`0.183.0`** the default image tags are signed releases, and hardened releases
-(with the attestation) for every image that has a hardening policy except
-`hub-frontend`.
+**`0.183.0`** the default image tags are signed releases, and since **`0.183.1`** hardened
+releases (with the attestation) for every image that has a hardening policy.

-Not covered: `uugai/admin`, `uugai/hub-proxy` and
-`uugai/hub-reactivatesubscriptions` are pulled from Docker Hub rather than the
-signed `ghcr.io/uug-ai` releases, and `oauth2-proxy` is a third-party image.
+Since chart **`0.184.0`** only `ghcr.io/uug-ai` images are trusted:
+
+- every UUG.AI image has a signature and a hardening policy, matching its
+  `ghcr.io/uug-ai/<image>` repository only. Images that are not signed or
+  hardened yet stay in `Audit` (the tables mark them), so they show up as
+  failures in Policy Reporter without ever being blocked;
+- `trusted-registry.yaml` (category **`Image registry`**, `Audit`) reports a
+  UUG.AI image (`uugai/...`, or a `uugai/` or `uug-ai/` organisation on any
+  registry) that is not pulled from `ghcr.io/uug-ai`. Since **`0.185.1`** it
+  ignores every other image in the namespace: workloads the chart doesn't
+  deploy (agents, cert-manager solvers, other tools) and the third-party
+  `quay.io/oauth2-proxy/oauth2-proxy` (pin that one to a version or digest
+  rather than `:latest`).
+
+Since chart **`0.185.0`** every UUG.AI image defaults to a signed, hardened
+release with the attestation (Admin `v1.4.6`, hub-reactivatesubscriptions
+`v1.0.3` on `ghcr.io/uug-ai`), and every policy follows its
+`validationFailureAction` value except `hub-objecttracking`'s, whose `-gpu`
+image is not signed or hardened yet.

 To change a policy, edit its file. To add an image, copy a policy file and
 change the image and repository.
@@ -474,6 +457,18 @@ image whose repository makes hardened releases, in `templates/kyverno/`:
 | `hub-pipeline-monitor-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` |
 | `hub-pipeline-sequence-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` |
 | `hub-pipeline-throttler-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` |
+| `hub-audit-hardened-images.yaml` | `ghcr.io/uug-ai/hub-audit` (hardened from v1.0.12) |
+| `hub-objecttracking-hardened-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` (hardened from v1.0.11; `-gpu` image not yet; always `Audit`) |
+| `hub-vlm-hardened-images.yaml` | `ghcr.io/uug-ai/hub-vlm` (hardened from v1.0.9) |
+| `hub-pipeline-dominantcolors-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` (hardened from v2.0.11) |
+| `hub-pipeline-event-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` (hardened from v1.3.11) |
+| `hub-pipeline-export-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` (hardened from v1.2.23) |
+| `hub-pipeline-notification-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` (hardened from v1.3.49) |
+| `hub-pipeline-notification-test-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` (hardened from v1.2.8) |
+| `hub-pipeline-sprite-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` (hardened from v1.1.29) |
+| `hub-pipeline-thumbnail-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` (hardened from v1.3.25) |
+| `admin-hardened-images.yaml` | `ghcr.io/uug-ai/admin` (hardened from v1.4.6) |
+| `hub-reactivatesubscriptions-hardened-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` (hardened from v1.0.3) |

 Each requires the attestation to be signed by the UUG.AI release workflow for
 the image's own repository, and its `result` and `repository` to be `passed`
@@ -845,9 +840,9 @@ kerberospipeline:
 | `kerberosvault.sprite.provider` | Configuration value for `kerberosvault.sprite.provider`. | `"a-sprite-provider"` |
 | `kerberosvault.sprite.accessKey` | Access key for `kerberosvault.sprite`. | `"xxx"` |
 | `kerberosvault.sprite.secretKey` | Secret key for `kerberosvault.sprite`. | `"xxx"` |
-| `admin.repository` | Container image repository for `admin`. | `"uugai/admin"` |
+| `admin.repository` | Container image repository for `admin`. | `"ghcr.io/uug-ai/admin"` |
 | `admin.pullPolicy` | Image pull policy for `admin`. | `"IfNotPresent"` |
-| `admin.tag` | Container image tag/version for `admin`. | `"v1.3.0"` |
+| `admin.tag` | Container image tag/version for `admin`. | `"v1.4.6"` |
 | `admin.replicas` | Number of replicas for `admin`. | `2` |
 | `admin.logLevel` | Log verbosity level for `admin`. | `"info"` |
 | `admin.resources.requests.memory` | Memory request for `admin`. | `"100Mi"` |
@@ -867,11 +862,14 @@ kerberospipeline:
 | `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
 | `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.41"` |
+| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.42"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
 | `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
+| `kerberoshub.api.session.accessTokenTimeout` | Lifetime of one access token (Go duration). The frontend renews it silently while the session is valid. | `"15m"` |
+| `kerberoshub.api.session.idleTimeout` | A session that is not used for this long ends (lifetime of the refresh token). | `"12h"` |
+| `kerberoshub.api.session.maxLifetime` | Hard session limit counted from login; refreshing never extends a session past it. | `"24h"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
 | `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
 | `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |
@@ -925,7 +923,7 @@ kerberospipeline:
 | `kerberoshub.api.sso.extraHeaders.value` | Header value for each configured SSO extra header entry. | `""` |
 | `kerberoshub.frontend.repository` | The Docker registry where the Kerberos Hub frontend is hosted. | `"ghcr.io/uug-ai/hub-frontend"` |
 | `kerberoshub.frontend.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.19.34"` |
+| `kerberoshub.frontend.tag` | The Docker image tag/version. | `"v1.19.35"` |
 | `kerberoshub.frontend.replicas` | The number of pods/replicas running for the Kerberos Hub frontend deployment. | `2` |
 | `kerberoshub.frontend.logLevel` | Log verbosity level for `kerberoshub.frontend`. | `"info"` |
 | `kerberoshub.frontend.schema` | The protocol to serve the Kerberos Hub frontend, `'http'` or `'https'`. | `"https"` |
@@ -962,6 +960,7 @@ kerberospipeline:
 | `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
+| `kerberoshub.frontend.features.inspection.enabled` | Show the [inspect](https://github.com/uug-ai/inspect) bug-report launcher (and Alt+Shift+I): screenshot or record part of Hub, annotate it and file it as a GitHub issue via `https://inspect.uug.ai`. Needs hub-frontend with inspect support, and the Hub URL on the inspect server's origin allowlist. Sets `ALLOW_INSPECTION`. | `"false"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
@@ -1077,7 +1076,7 @@ kerberospipeline:
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
 | `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
 | `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
-| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.11"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.12"` |
 | `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
 | `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
 | `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
@@ -1121,25 +1120,16 @@ kerberospipeline:
 | `kerberoshub.monitordevice.scanIntervalSeconds` | Seconds between device status scans. Sets how quickly a camera going offline or online is detected. For accounts with "Group notifications" on, `hub-monitor-device` v1.4.10 and later then hold a change 20 seconds (`DEVICE_GROUPING_HOLD_SECONDS`) to collect other cameras that change status at the same time; older releases hold it one scan. | `60` |
 | `kerberoshub.monitordevice.resources.requests.memory` | Memory request for `kerberoshub.monitordevice`. | `"10Mi"` |
 | `kerberoshub.monitordevice.resources.requests.cpu` | CPU request for `kerberoshub.monitordevice`. | `"10m"` |
-| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
+| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"ghcr.io/uug-ai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
-| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
+| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.3"` |
 | `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
-| `kerberoshub.forwarder.enabled` | Enable or disable the Hub forwarder component. | `false` |
-| `kerberoshub.proxy.enabled` | Enable or disable the legacy Hub proxy Deployment and LoadBalancer Service. | `false` |
-| `kerberoshub.proxy.repository` | Container image repository for `kerberoshub.proxy`. | `"uugai/hub-proxy"` |
-| `kerberoshub.proxy.pullPolicy` | Image pull policy for `kerberoshub.proxy`. | `"IfNotPresent"` |
-| `kerberoshub.proxy.tag` | Container image tag/version for `kerberoshub.proxy`. | `"v1.0.0"` |
-| `kerberoshub.proxy.replicas` | Number of replicas for `kerberoshub.proxy` when enabled. | `0` |
-| `kerberoshub.proxy.logLevel` | Log verbosity level for `kerberoshub.proxy`. | `"info"` |
-| `kerberoshub.proxy.resources.requests.memory` | Memory request for `kerberoshub.proxy`. | `"10Mi"` |
-| `kerberoshub.proxy.resources.requests.cpu` | CPU request for `kerberoshub.proxy`. | `"10m"` |
 | `kerberospipeline.event.repository` | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice. | `"ghcr.io/uug-ai/hub-pipeline-event"` |
 | `kerberospipeline.event.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.10"` |
+| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.11"` |
 | `kerberospipeline.event.replicas` | Number of replicas for `kerberospipeline.event`. | `1` |
 | `kerberospipeline.event.logLevel` | Log verbosity level for `kerberospipeline.event`. | `"info"` |
 | `kerberospipeline.event.resources.requests.memory` | Memory request for `kerberospipeline.event`. | `"10Mi"` |
@@ -1166,7 +1156,7 @@ kerberospipeline:
 | `kerberospipeline.throttler.resources.requests.cpu` | CPU request for `kerberospipeline.throttler`. | `"10m"` |
 | `kerberospipeline.notify.repository` | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events. | `"ghcr.io/uug-ai/hub-pipeline-notification"` |
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.48"` |
+| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.49"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
 | `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
@@ -1175,7 +1165,7 @@ kerberospipeline:
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
 | `kerberospipeline.notifyTest.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.7"` |
+| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.8"` |
 | `kerberospipeline.notifyTest.replicas` | Number of replicas for `kerberospipeline.notifyTest`. | `1` |
 | `kerberospipeline.notifyTest.resources.requests.memory` | Memory request for `kerberospipeline.notifyTest`. | `"10Mi"` |
 | `kerberospipeline.notifyTest.resources.requests.cpu` | CPU request for `kerberospipeline.notifyTest`. | `"10m"` |
@@ -1193,7 +1183,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.enabled` | Deploy `pipe-dominantcolor` and let the analysis stage schedule it (`DOMINANTCOLOR_ENABLED`). Requires an analysis image that reads the flag. | `false` |
 | `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
 | `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.10"` |
+| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.11"` |
 | `kerberospipeline.dominantColor.replicas` | Number of replicas for `kerberospipeline.dominantColor`. | `3` |
 | `kerberospipeline.dominantColor.logLevel` | Log verbosity level for `kerberospipeline.dominantColor`. | `"info"` |
 | `kerberospipeline.dominantColor.resources.requests.memory` | Memory request for `kerberospipeline.dominantColor`. | `"512Mi"` |
@@ -1202,7 +1192,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.resources.limits.cpu` | CPU limit for `kerberospipeline.dominantColor`. | `"1000m"` |
 | `kerberospipeline.thumbnail.repository` | The thumbnail microservices generated a thumbnail for a recordings. | `"ghcr.io/uug-ai/hub-pipeline-thumbnail"` |
 | `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.24"` |
+| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.25"` |
 | `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
 | `kerberospipeline.thumbnail.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-thumbnail ≥ v1.3.15. | `0` |
 | `kerberospipeline.sprite.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-sprite ≥ v1.1.21. | `0` |
@@ -1225,7 +1215,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.enabled` | Enable or disable `kerberospipeline.sprite`. | `false` |
 | `kerberospipeline.sprite.repository` | Container image repository for `kerberospipeline.sprite`. | `"ghcr.io/uug-ai/hub-pipeline-sprite"` |
 | `kerberospipeline.sprite.pullPolicy` | Image pull policy for `kerberospipeline.sprite`. | `"IfNotPresent"` |
-| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.28"` |
+| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.29"` |
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
@@ -1237,7 +1227,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.resources.limits.cpu` | CPU limit for `kerberospipeline.sprite`. | `"1000m"` |
 | `kerberospipeline.export.repository` | Container image repository for `kerberospipeline.export`. | `"ghcr.io/uug-ai/hub-pipeline-export"` |
 | `kerberospipeline.export.pullPolicy` | Image pull policy for `kerberospipeline.export`. | `"IfNotPresent"` |
-| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.22"` |
+| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.23"` |
 | `kerberospipeline.export.replicas` | Number of replicas for `kerberospipeline.export`. | `2` |
 | `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
 | `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
@@ -1273,9 +1263,6 @@ kerberospipeline:
 | `email.templates.recordingTitle` | Email subject for recording check alerts. Empty uses "[Device] A camera stopped recording", "[Device] A camera is recording again" and their forms for several cameras. | `""` |
 | `email.mailgun.apiKey` | The Mailgun API key linked to your Mailgun domain. | `""` |
 | `imagePullSecrets.name` | Docker registry secret name, which is also granted with the license. This allows you to download the Docker images. | `""` |
-| `kerberoshub.forwarder.pullPolicy` | The Docker registry pull policy. | `""` |
-| `kerberoshub.forwarder.repository` | The Docker container which orchestrates forwarding coming from different Kerberos Vaults. | `""` |
-| `kerberoshub.forwarder.tag` | The Docker image tag/version. | `""` |
 | `kerberoshub.frontend.ssoDomain` | The domain that's being used to activate SSO from the login page. | `""` |
 | `kerberoshub.frontend.stripe.apikey` | If using the public version, `stripe` can be used for automated billing and subscriptions. | `""` |

@@ -303,6 +303,12 @@ spec:
              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
            - name: PUBLIC_URL
              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: ACCESS_TOKEN_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.accessTokenTimeout | quote }}
+            - name: SESSION_IDLE_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.idleTimeout | quote }}
+            - name: SESSION_MAX_LIFETIME
+              value: {{ .Values.kerberoshub.api.session.maxLifetime | quote }}
            - name: REFRESH_COOKIE_SECURE
              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
@@ -273,6 +273,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
        - name: FEATURE_SPLASH_SCREEN_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: ALLOW_INSPECTION
+          value: "{{ .Values.kerberoshub.frontend.features.inspection.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -352,6 +352,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
        - name: FEATURE_SPLASH_SCREEN_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: ALLOW_INSPECTION
+          value: "{{ .Values.kerberoshub.frontend.features.inspection.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -1,76 +0,0 @@
-# If .Values.kerberoshub.forwarder.enabled is set to true 
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.forwarder.enabled }}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-forwarder
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: 1
-  selector:
-    matchLabels:
-      app: vault-forwarder
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      annotations:
-        checksum/config: {{ include (print $.Template.BasePath "/configMaps/configmap-mongodb.yaml") . | sha256sum }}
-      labels:
-        app: vault-forwarder
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- $mongodbTLS := .Values.mongodb.tls }}
-      {{- if or .Values.kerberoshub.forwarder.volumes (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-      volumes:
-      {{- with .Values.kerberoshub.forwarder.volumes }}
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-        {{- include "hub.mongodb.tlsVolume" . | nindent 8 }}
-      {{- end }}
-      {{- end }}
-      {{- with .Values.kerberoshub.forwarder.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: vault-forwarder
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.forwarder.repository }}:{{ .Values.kerberoshub.forwarder.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.forwarder.pullPolicy }}
-          resources:
-            requests:
-              memory: 10Mi
-              cpu: 10m
-          {{- if or .Values.kerberoshub.forwarder.volumeMounts (and $mongodbTLS.enabled $mongodbTLS.existingSecret) }}
-          volumeMounts:
-          {{- with .Values.kerberoshub.forwarder.volumeMounts }}
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          {{- if and $mongodbTLS.enabled $mongodbTLS.existingSecret }}
-            {{- include "hub.mongodb.tlsVolumeMount" . | nindent 12 }}
-          {{- end }}
-          {{- end }}
-          envFrom:
-          - configMapRef:
-              name: mongodb-config
-          env:
-          {{- include "hub.mongodb.appUriEnv" (dict "root" $ "app" "vault-forwarder") | nindent 10 }}
-          - name: ITERATION_SPEED
-            value: "5"
-          - name: BUFFER_TIME
-            value: "3"
-          - name: MQTT_URI
-            value: "{{ .Values.mqtt.host }}"
-          - name: MQTT_USERNAME
-            value: "{{ .Values.mqtt.username }}"
-          - name: MQTT_PASSWORD
-            value: "{{ .Values.mqtt.password }}"
-{{- end }}
@@ -1,78 +0,0 @@
-{{- if and (eq .Values.mode "all") .Values.kerberoshub.proxy.enabled -}}
-apiVersion: apps/v1
-kind: Deployment
-metadata:
-  name: vault-proxy
-  namespace: {{ .Release.Namespace }}
-spec:
-  replicas: {{ .Values.kerberoshub.proxy.replicas }}
-  selector:
-    matchLabels:
-      app: vault-proxy
-  minReadySeconds: 10
-  strategy:
-    type: RollingUpdate
-    rollingUpdate:
-      maxUnavailable: 1
-      maxSurge: 1
-  template:
-    metadata:
-      labels:
-        app: vault-proxy
-    spec:
-      {{- with .Values.imagePullSecrets }}
-      imagePullSecrets:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.volumes }}
-      volumes:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      {{- with .Values.kerberoshub.proxy.topologySpreadConstraints }}
-      topologySpreadConstraints:
-        {{- toYaml . | nindent 8 }}
-      {{- end }}
-      containers:
-        - name: vault-proxy
-          image: "{{ .Values.global.imageRegistry }}{{ .Values.kerberoshub.proxy.repository }}:{{ .Values.kerberoshub.proxy.tag }}"
-          imagePullPolicy: {{ .Values.kerberoshub.proxy.pullPolicy }}
-          {{- with .Values.kerberoshub.proxy.volumeMounts }}
-          volumeMounts:
-            {{- toYaml . | nindent 12 }}
-          {{- end }}
-          ports:
-            - containerPort: 8080
-              name: http
-          env:
-            - name: LOG_LEVEL
-              value: "{{ .Values.kerberoshub.proxy.logLevel }}"
-            # Kerberos Hub API
-            - name: KERBEROS_API_CHECK_SUBSCRIPTION
-              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}/user/has-subscription"
-            # Kerberos Vault
-            - name: KSTORAGE_URI
-              value: "{{ .Values.kerberosvault.uri }}/storage"
-            - name: KSTORAGE_ACCESSKEY
-              value: "{{ .Values.kerberosvault.accesskey }}"
-            - name: KSTORAGE_SECRET
-              value: "{{ .Values.kerberosvault.secretkey }}"
-            - name: KSTORAGE_PROVIDER
-              value: "{{ .Values.kerberosvault.provider }}"
---
-apiVersion: v1
-kind: Service
-metadata:
-  name: vault-proxy-svc
-  namespace: {{ .Release.Namespace }}
-  labels:
-    app: vault-proxy-svc
-spec:
-  type: LoadBalancer
-  ports:
-    - protocol: TCP
-      port: 80
-      targetPort: 8080
-      name: http
-  selector:
-    app: vault-proxy
-{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+admin images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/admin.
+The signature itself is checked by admin-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: admin-hardened-images
+  annotations:
+    policies.kyverno.io/title: admin images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-admin-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/admin:*"
+            - "ghcr.io/uug-ai/admin@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/admin
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/admin
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+admin images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/admin.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: admin-signed-images
+  annotations:
+    policies.kyverno.io/title: admin images must be signed by UUG.AI
+    policies.kyverno.io/category: Image signing
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-admin
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/admin:*"
+            - "ghcr.io/uug-ai/admin@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to admin's own repository.
+                      githubWorkflowRepository: uug-ai/admin
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-audit images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-audit.
+The signature itself is checked by hub-audit-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-audit-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-audit images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-audit-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-audit:*"
+            - "ghcr.io/uug-ai/hub-audit@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-audit
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-audit
+{{- end }}
@@ -0,0 +1,68 @@
+{{- /*
+hub-objecttracking images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-objecttracking.
+The signature itself is checked by hub-objecttracking-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-objecttracking-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-objecttracking images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # The standard image is hardened (from v1.0.11), but its `-gpu` image is not:
+  # it is built outside the shared release workflow. This policy stays in Audit,
+  # even when imageHardening.validationFailureAction is Enforce. Once the `-gpu`
+  # image is hardened, use the same line as hub-api-hardened-images.yaml.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-objecttracking-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-objecttracking:*"
+            - "ghcr.io/uug-ai/hub-objecttracking@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-objecttracking
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-objecttracking
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-dominantcolors images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-dominantcolors.
+The signature itself is checked by hub-pipeline-dominantcolors-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-dominantcolors-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-dominantcolors images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-dominantcolors-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors:*"
+            - "ghcr.io/uug-ai/hub-pipeline-dominantcolors@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-dominantcolors
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-dominantcolors
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-event images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-event.
+The signature itself is checked by hub-pipeline-event-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-event-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-event images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-event-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-event:*"
+            - "ghcr.io/uug-ai/hub-pipeline-event@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-event
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-event
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-export images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-export.
+The signature itself is checked by hub-pipeline-export-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-export-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-export images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-export-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-export:*"
+            - "ghcr.io/uug-ai/hub-pipeline-export@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-export
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-export
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-notification images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-notification.
+The signature itself is checked by hub-pipeline-notification-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-notification
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-notification
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-notification-test images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-notification-test.
+The signature itself is checked by hub-pipeline-notification-test-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-notification-test-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-notification-test images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-notification-test-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test:*"
+            - "ghcr.io/uug-ai/hub-pipeline-notification-test@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-notification-test
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-notification-test
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-sprite images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-sprite.
+The signature itself is checked by hub-pipeline-sprite-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-sprite-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-sprite images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-sprite-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-sprite:*"
+            - "ghcr.io/uug-ai/hub-pipeline-sprite@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-sprite
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-sprite
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-pipeline-thumbnail images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-pipeline-thumbnail.
+The signature itself is checked by hub-pipeline-thumbnail-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-pipeline-thumbnail-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-pipeline-thumbnail images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-pipeline-thumbnail-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail:*"
+            - "ghcr.io/uug-ai/hub-pipeline-thumbnail@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-pipeline-thumbnail
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-pipeline-thumbnail
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-reactivatesubscriptions images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-reactivatesubscriptions.
+The signature itself is checked by hub-reactivatesubscriptions-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-reactivatesubscriptions-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-reactivatesubscriptions images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-reactivatesubscriptions-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-reactivatesubscriptions
+{{- end }}
@@ -0,0 +1,53 @@
+{{- /*
+hub-reactivatesubscriptions images must be signed by UUG.AI: a keyless cosign signature issued by
+GitHub Actions, made by the UUG.AI release workflow, for uug-ai/hub-reactivatesubscriptions.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-reactivatesubscriptions-signed-images
+  annotations:
+    policies.kyverno.io/title: hub-reactivatesubscriptions images must be signed by UUG.AI
+    policies.kyverno.io/category: Image signing
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, signature required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-reactivatesubscriptions
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions:*"
+            - "ghcr.io/uug-ai/hub-reactivatesubscriptions@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestors:
+            - entries:
+                - keyless:
+                    issuer: https://token.actions.githubusercontent.com
+                    # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                    additionalExtensions:
+                      # That workflow signs for every UUG.AI repository; this
+                      # binds the signature to hub-reactivatesubscriptions's own repository.
+                      githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
+                    rekor:
+                      url: https://rekor.sigstore.dev
+{{- end }}
@@ -0,0 +1,65 @@
+{{- /*
+hub-vlm images must come from a hardened release: they carry the signed
+image-hardening attestation (result "passed") that the UUG.AI release workflow
+adds after all hardening gates pass, for uug-ai/hub-vlm.
+The signature itself is checked by hub-vlm-signed-images.yaml.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageHardening.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageHardening.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: hub-vlm-hardened-images
+  annotations:
+    policies.kyverno.io/title: hub-vlm images must come from a hardened UUG.AI release
+    policies.kyverno.io/category: Image hardening
+    policies.kyverno.io/severity: medium
+    policies.kyverno.io/subject: Pod
+# Kyverno defaults apply: background scans of running pods, attestation required.
+# Only settings whose Kyverno default would change behaviour are set below.
+spec:
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
+  # Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  # Verifying against GHCR and Rekor can exceed the 10s default.
+  webhookTimeoutSeconds: 30
+  rules:
+    - name: verify-hub-vlm-hardened
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      verifyImages:
+        - imageReferences:
+            - "ghcr.io/uug-ai/hub-vlm:*"
+            - "ghcr.io/uug-ai/hub-vlm@*"
+          # Kyverno's defaults (true) would rewrite pod images to digests and
+          # report every tag-based image; enable together with Enforce.
+          mutateDigest: false
+          verifyDigest: false
+          attestations:
+            - type: https://github.com/uug-ai/workflows/attestations/image-hardening/v1
+              attestors:
+                - entries:
+                    - keyless:
+                        issuer: https://token.actions.githubusercontent.com
+                        # The UUG.AI release workflow, at a branch/tag ref or a commit.
+                        subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
+                        additionalExtensions:
+                          githubWorkflowRepository: uug-ai/hub-vlm
+                        rekor:
+                          url: https://rekor.sigstore.dev
+              # Fields of the attestation's predicate. {{`{{ ... }}`}} is Kyverno
+              # syntax, escaped so Helm leaves it alone.
+              conditions:
+                - all:
+                    - key: "{{`{{ result }}`}}"
+                      operator: Equals
+                      value: passed
+                    - key: "{{`{{ repository }}`}}"
+                      operator: Equals
+                      value: uug-ai/hub-vlm
+{{- end }}
@@ -0,0 +1,54 @@
+{{- /*
+UUG.AI images are trusted only from ghcr.io/uug-ai: report a container, init
+container or ephemeral container image that is a UUG.AI image (uugai/... on
+Docker Hub, or any registry's uugai/ or uug-ai/ organisation) pulled from
+anywhere else. Other images in the namespace (agents, cert-manager solvers,
+third-party tools) are not the chart's to vouch for and are ignored. Signature
+and hardening are checked per image by the *-signed-images / *-hardened-images
+policies, which match ghcr.io/uug-ai images only.
+A namespaced Policy, so it applies only to the release namespace.
+Rendered only when imageVerification.enabled is true and Kyverno is installed.
+*/ -}}
+{{- if and .Values.imageVerification.enabled (.Capabilities.APIVersions.Has "kyverno.io/v1") }}
+apiVersion: kyverno.io/v1
+kind: Policy
+metadata:
+  name: trusted-registry
+  annotations:
+    policies.kyverno.io/title: UUG.AI images must come from ghcr.io/uug-ai
+    policies.kyverno.io/category: Image registry
+    policies.kyverno.io/severity: high
+    policies.kyverno.io/subject: Pod
+spec:
+  # Reports UUG.AI images from other registries without blocking them, even
+  # when imageVerification.validationFailureAction is Enforce.
+  validationFailureAction: Audit
+  # Kyverno's default (Fail) would stop pods starting while Kyverno is down.
+  failurePolicy: Ignore
+  rules:
+    - name: images-from-ghcr-uug-ai
+      match:
+        any:
+          - resources:
+              kinds:
+                - Pod
+      validate:
+        message: "UUG.AI images must come from the trusted registry ghcr.io/uug-ai/."
+        foreach:
+          - list: "request.object.spec.[containers, initContainers, ephemeralContainers][]"
+            deny:
+              conditions:
+                all:
+                  # A UUG.AI image: Docker Hub uugai/..., or a uugai/ or uug-ai/
+                  # organisation on any registry ...
+                  - key: "{{`{{ element.image }}`}}"
+                    operator: AnyIn
+                    value:
+                      - "uugai/*"
+                      - "*/uugai/*"
+                      - "*/uug-ai/*"
+                  # ... that is not pulled from ghcr.io/uug-ai.
+                  - key: "{{`{{ element.image }}`}}"
+                    operator: NotEquals
+                    value: "ghcr.io/uug-ai/*"
+{{- end }}
@@ -286,14 +286,34 @@ kerberosvault:
 # For now it's used to create, edit users for Hub.
 ###########################################################################
 admin:
-  repository: uugai/admin
-  # Opt in to 8080 and a securityContext only with a compatible hardened image.
-  containerPort: 80
-  securityContext: {}
-  readinessProbe: {}
-  livenessProbe: {}
+  # Signed release from the UUG.AI release workflow (only ghcr.io/uug-ai is trusted).
+  # It runs shell-free as 65532:65532 on 8080 with a read-only root filesystem:
+  # keep the runtime settings below together with the image (see README).
+  repository: ghcr.io/uug-ai/admin
+  containerPort: 8080
+  securityContext:
+    runAsNonRoot: true
+    runAsUser: 65532
+    runAsGroup: 65532
+    readOnlyRootFilesystem: true
+    allowPrivilegeEscalation: false
+    capabilities:
+      drop: ["ALL"]
+    seccompProfile:
+      type: RuntimeDefault
+  readinessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    periodSeconds: 10
+  livenessProbe:
+    httpGet:
+      path: /healthz
+      port: http
+    initialDelaySeconds: 10
+    periodSeconds: 10
  pullPolicy: IfNotPresent
-  tag: "v1.3.0"
+  tag: "v1.4.6"
  replicas: 2
  # Optional pod topology spread constraints for this deployment. Empty by
  # default. Example:
@@ -305,13 +325,16 @@ admin:
  #         matchLabels:
  #           app: admin
  topologySpreadConstraints: []
-  # Optional extra volumes / volumeMounts for this deployment (empty = none).
-  #volumes:
-  #  - name: extra
-  #    emptyDir: {}
-  #volumeMounts:
-  #  - name: extra
-  #    mountPath: /data
+  # The only writable path: memory-backed /tmp (counts against the pod memory
+  # limit). Append extra volumes / volumeMounts to these lists.
+  volumes:
+    - name: admin-tmp
+      emptyDir:
+        medium: Memory
+        sizeLimit: 16Mi
+  volumeMounts:
+    - name: admin-tmp
+      mountPath: /tmp
  logLevel: "info" # possible values: trace, debug, info, warn, error
  resources:
    requests:
@@ -358,7 +381,7 @@ kerberoshub:
  api:
    repository: ghcr.io/uug-ai/hub-api
    pullPolicy: IfNotPresent
-    tag: "v1.11.41"
+    tag: "v1.11.42"
    replicas: 2
    podSecurityContext:
      fsGroup: 65532
@@ -387,6 +410,11 @@ kerberoshub:
    serviceEnabled: true
    logLevel: "info" # possible values: trace, debug, info, warn, error
    jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
+    # How long a user stays signed in (Go durations, e.g. "15m", "12h").
+    session:
+      accessTokenTimeout: "15m" # Lifetime of one access token; the frontend renews it silently.
+      idleTimeout: "12h" # A session that is not used for this long ends.
+      maxLifetime: "24h" # Hard limit counted from login; the user must sign in again after it.
    schema: "https"
    url: "api.yourdomain.com"
    # Additional complete HTTP(S) origins allowed to call the Hub API.
@@ -527,7 +555,7 @@ kerberoshub:
  frontend:
    repository: ghcr.io/uug-ai/hub-frontend
    pullPolicy: IfNotPresent
-    tag: "v1.19.34"
+    tag: "v1.19.35"
    replicas: 2
    containerPort: 8080
    securityContext:
@@ -658,6 +686,8 @@ kerberoshub:
      darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
      splashScreen:
        enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
+      inspection:
+        enabled: "false" # In-app bug reports filed as GitHub issues via inspect.uug.ai (https://github.com/uug-ai/inspect) 'true' or 'false'
      landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
      # Internationalization (i18n): controls the runtime language behaviour
      # of the front-end. When `enabled` is "false" the language switcher is
@@ -893,7 +923,7 @@ kerberoshub:
  audit:
    repository: ghcr.io/uug-ai/hub-audit
    pullPolicy: IfNotPresent
-    tag: "v1.0.11"
+    tag: "v1.0.12"
    replicas: 1
    resources: {}
    # resources:
@@ -1151,7 +1181,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-objecttracking
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.10"
+          #  tag: "v1.0.11"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1176,7 +1206,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-vlm
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.8"
+          #  tag: "v1.0.9"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1225,9 +1255,9 @@ kerberoshub:
        #    persistentVolumeClaim:
        #      claimName: custom-layout-claim
  reactivate:
-    repository: uugai/hub-reactivatesubscriptions
+    repository: ghcr.io/uug-ai/hub-reactivatesubscriptions
    pullPolicy: IfNotPresent
-    tag: "v1.0.2"
+    tag: "v1.0.3"
    replicas: 0 # Number of pods for the service. Set to 0 to disable.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1242,43 +1272,6 @@ kerberoshub:
      requests:
        memory: 10Mi
        cpu: 10m
-  forwarder:
-    enabled: false
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    #repository: kerberos/vault-forwarder
-    #pullPolicy: IfNotPresent
-    #tag: "1.0.2732389692"
-    #resources:
-    #  requests:
-    #    memory: 10Mi
-    #    cpu: 10m
-  # This proxy is legacy for the old agent, will be migrated in the new Hub API.
-  proxy:
-    enabled: false
-    repository: uugai/hub-proxy
-    pullPolicy: IfNotPresent
-    tag: "v1.0.0"
-    replicas: 0 # Number of pods for the service when enabled.
-    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
-    # Optional extra volumes / volumeMounts for this deployment (empty = none).
-    #volumes:
-    #  - name: extra
-    #    emptyDir: {}
-    #volumeMounts:
-    #  - name: extra
-    #    mountPath: /data
-    logLevel: "info" # possible values: trace, debug, info, warn, error
-    resources:
-      requests:
-        memory: 10Mi
-        cpu: 10m
 # The Kerberos Hub pipeline is a series of microservices that process the recordings.
 # Each microservice is responsible for a specific task, like counting objects, generating thumbnails, etc.
 # The pipeline is orchestrated through Kafka topics or RabbitMQ queues.
@@ -1291,7 +1284,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "10"
    repository: ghcr.io/uug-ai/hub-pipeline-event
    pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.11"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1379,7 +1372,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "20"
    pullPolicy: IfNotPresent
-    tag: "v1.3.48"
+    tag: "v1.3.49"
    replicas: 1 # Number of pods for the service.
    audit:
      enabled: true
@@ -1401,7 +1394,7 @@ kerberospipeline:
  notifyTest:
    repository: ghcr.io/uug-ai/hub-pipeline-notification-test
    pullPolicy: IfNotPresent
-    tag: "v1.2.7"
+    tag: "v1.2.8"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    resources:
@@ -1464,7 +1457,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v2.0.10"
+    tag: "v2.0.11"
    replicas: 3 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1490,7 +1483,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v1.3.24"
+    tag: "v1.3.25"
    replicas: 2 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1545,7 +1538,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "50"
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
-    tag: "v1.1.28"
+    tag: "v1.1.29"
    replicas: 5 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1572,7 +1565,7 @@ kerberospipeline:
  export:
    repository: ghcr.io/uug-ai/hub-pipeline-export
    pullPolicy: IfNotPresent
-    tag: "v1.2.22"
+    tag: "v1.2.23"
    replicas: 2 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -28,28 +28,26 @@ assert_absent() {
  fi
 }

-HARDENED_FLAGS=(
-  --set admin.containerPort=8080
-  --set-json 'admin.securityContext={"runAsNonRoot":true,"runAsUser":65532,"runAsGroup":65532,"readOnlyRootFilesystem":true,"allowPrivilegeEscalation":false,"capabilities":{"drop":["ALL"]},"seccompProfile":{"type":"RuntimeDefault"}}'
-  --set-json 'admin.volumes=[{"name":"admin-tmp","emptyDir":{"medium":"Memory","sizeLimit":"16Mi"}}]'
-  --set-json 'admin.volumeMounts=[{"name":"admin-tmp","mountPath":"/tmp"}]'
-  --set-json 'admin.readinessProbe={"httpGet":{"path":"/healthz","port":"http"},"periodSeconds":10}'
-  --set-json 'admin.livenessProbe={"httpGet":{"path":"/healthz","port":"http"},"initialDelaySeconds":10,"periodSeconds":10}'
+# Since chart 0.184.0 the hardened ghcr.io/uug-ai/admin runtime is the default;
+# LEGACY_FLAGS opts back into a legacy image on port 80.
+LEGACY_FLAGS=(
+  --set admin.repository=uugai/admin
+  --set admin.tag=v1.3.0
+  --set admin.containerPort=80
+  --set admin.securityContext=null
+  --set admin.readinessProbe=null
+  --set admin.livenessProbe=null
+  --set admin.volumes=null
+  --set admin.volumeMounts=null
 )

 for mode in all ui; do
-  default_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
-  default_deployment="$(resource deployment <<< "$default_render")"
-  default_service="$(resource service <<< "$default_render")"
-  default_ingress="$(resource ingress <<< "$default_render")"
-  default_oauth="$(resource oauth2-proxy <<< "$default_render")"
-  assert_contains "$default_deployment" 'containerPort: 80$'
-  assert_absent "$default_deployment" 'securityContext:|readinessProbe:|livenessProbe:'
-  assert_contains "$default_service" 'port: 80$'
-  assert_contains "$default_service" 'targetPort: http$'
-
-  hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${HARDENED_FLAGS[@]}")"
+  hardened_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
  hardened_deployment="$(resource deployment <<< "$hardened_render")"
+  hardened_service="$(resource service <<< "$hardened_render")"
+  hardened_ingress="$(resource ingress <<< "$hardened_render")"
+  hardened_oauth="$(resource oauth2-proxy <<< "$hardened_render")"
+  assert_contains "$hardened_deployment" 'image: "ghcr.io/uug-ai/admin:'
  assert_contains "$hardened_deployment" 'containerPort: 8080$'
  assert_absent "$hardened_deployment" 'containerPort: 80$'
  for setting in 'runAsNonRoot: true' 'runAsUser: 65532' 'runAsGroup: 65532' \
@@ -66,17 +64,24 @@ for mode in all ui; do
    assert_contains "$probe_render" 'path: /healthz$'
    assert_contains "$probe_render" 'port: http$'
  done
+  assert_contains "$hardened_service" 'port: 80$'
+  assert_contains "$hardened_service" 'targetPort: http$'

-  [[ "$(resource service <<< "$hardened_render")" == "$default_service" ]]
-  [[ "$(resource ingress <<< "$hardened_render")" == "$default_ingress" ]]
-  [[ "$(resource oauth2-proxy <<< "$hardened_render")" == "$default_oauth" ]]
-  assert_contains "$default_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
-  assert_contains "$default_ingress" 'number: 80$'
+  legacy_render="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true "${LEGACY_FLAGS[@]}")"
+  legacy_deployment="$(resource deployment <<< "$legacy_render")"
+  assert_contains "$legacy_deployment" 'containerPort: 80$'
+  assert_absent "$legacy_deployment" 'securityContext:|readinessProbe:|livenessProbe:|admin-tmp'

-  echo "OK ($mode): legacy defaults; hardened runtime/probes; stable Service, ingress and OAuth2"
+  [[ "$(resource service <<< "$legacy_render")" == "$hardened_service" ]]
+  [[ "$(resource ingress <<< "$legacy_render")" == "$hardened_ingress" ]]
+  [[ "$(resource oauth2-proxy <<< "$legacy_render")" == "$hardened_oauth" ]]
+  assert_contains "$hardened_ingress" 'nginx.ingress.kubernetes.io/auth-url:'
+  assert_contains "$hardened_ingress" 'number: 80$'
+
+  echo "OK ($mode): hardened ghcr.io defaults; legacy opt-out; stable Service, ingress and OAuth2"
 done

-pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline "${HARDENED_FLAGS[@]}")"
+pipeline_render="$(helm template hub "$CHART_DIR" --set mode=pipeline)"
 assert_absent "$pipeline_render" '^# Source: hub/templates/admin/'

 echo "All Admin runtime checks passed."
@@ -29,7 +29,7 @@ for mode in all ui; do
    --set kerberoshub.frontend.demoEnabled=true)"
  for name in hub-frontend hub-frontend-demo; do
    deployment="$(resource Deployment "$name" <<< "$rendered")"
-    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.34"$'
+    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.35"$'
    assert_contains "$deployment" 'containerPort: 8080$'
    [[ "$(grep -c 'containerPort:' <<< "$deployment")" == 1 ]]
    for setting in 'name: http' 'runAsNonRoot: true' 'runAsUser: 65532' \
@@ -44,7 +44,7 @@ for mode in all ui; do
    echo "OK ($mode): $name hardened image, security, scratch and named routing"
  done
  admin="$(resource Deployment admin <<< "$rendered")"
-  assert_contains "$admin" 'containerPort: 80$'
+  assert_contains "$admin" 'containerPort: 8080$'

  legacy="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
    --set kerberoshub.frontend.demoEnabled=true \
@@ -60,6 +60,14 @@ assert_line() {
  fi
 }

+without_admin() {
+  awk '
+    /^---$/ { skip=0 }
+    /^# Source: hub\/templates\/admin\/deployment\.yaml$/ { skip=1 }
+    !skip { print }
+  '
+}
+
 without_frontends() {
  awk '
    /^---$/ { skip=0 }
@@ -70,7 +78,8 @@ without_frontends() {

 for mode in all pipeline ui; do
  defaults="$(helm template hub "$CHART_DIR" --set "mode=$mode")"
-  worker_defaults="$(without_frontends <<< "$defaults")"
+  # Frontends, hub-api and Admin (since 0.184.0) are hardened by default.
+  worker_defaults="$(without_frontends <<< "$defaults" | without_admin)"
  if grep -q 'securityContext:' <<< "$worker_defaults"; then
    echo "Default $mode mode unexpectedly enables worker security settings" >&2
    exit 1
@@ -120,8 +129,8 @@ for mode in all pipeline ui; do
    fi
  done
  expected="${#names[@]}"
-  [[ "$(without_frontends <<< "$hardened" | grep -c 'runAsUser: 65532')" == "$expected" ]]
-  [[ "$(without_frontends <<< "$hardened" | grep -c 'fsGroup: 65532')" == "$expected" ]]
+  [[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'runAsUser: 65532')" == "$expected" ]]
+  [[ "$(without_frontends <<< "$hardened" | without_admin | grep -c 'fsGroup: 65532')" == "$expected" ]]

  # Image selection, Services, env and TLS mounts must not change.
  for pattern in '^[ ]+image:' '^[ ]+(port|targetPort|containerPort):' 'mongodb-tls'; do
@@ -137,26 +146,23 @@ isolated="$(helm template hub "$CHART_DIR" --set mode=pipeline \
 assert_line "$(resource Deployment pipe-counting <<< "$isolated")" '^[ ]+runAsUser: 65532$'
 echo "All hardened worker checks passed."

-admin_flags=(
-  --set admin.containerPort=8080
-  --set admin.securityContext.runAsNonRoot=true
-  --set admin.securityContext.runAsUser=65532
-  --set admin.securityContext.runAsGroup=65532
-  --set admin.securityContext.readOnlyRootFilesystem=true
-  --set admin.securityContext.allowPrivilegeEscalation=false
-  --set admin.securityContext.capabilities.drop[0]=ALL
-  --set admin.securityContext.seccompProfile.type=RuntimeDefault
-  --set admin.volumes[0].name=admin-tmp
-  --set admin.volumes[0].emptyDir.medium=Memory
-  --set admin.volumes[0].emptyDir.sizeLimit=16Mi
-  --set admin.volumeMounts[0].name=admin-tmp
-  --set admin.volumeMounts[0].mountPath=/tmp
+# Since chart 0.184.0 the hardened Admin runtime is the default; these flags
+# opt back into a legacy image on port 80.
+legacy_admin_flags=(
+  --set admin.repository=uugai/admin
+  --set admin.tag=v1.3.0
+  --set admin.containerPort=80
+  --set admin.securityContext=null
+  --set admin.readinessProbe=null
+  --set admin.livenessProbe=null
+  --set admin.volumes=null
+  --set admin.volumeMounts=null
  --set admin.oauth2Proxy.enabled=true
 )
 for mode in all ui pipeline; do
-  legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
-  configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${admin_flags[@]}")"
-  helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${admin_flags[@]}"
+  legacy="$(helm template hub "$CHART_DIR" --set "mode=$mode" "${legacy_admin_flags[@]}")"
+  configured="$(helm template hub "$CHART_DIR" --set "mode=$mode" --set admin.oauth2Proxy.enabled=true)"
+  helm lint "$CHART_DIR" --quiet --set "mode=$mode" "${legacy_admin_flags[@]}"
  if [[ "$mode" == pipeline ]]; then
    [[ -z "$(resource Deployment admin <<< "$configured")" ]]
    [[ -z "$(resource Service admin-svc <<< "$configured")" ]]
@@ -186,9 +192,11 @@ for mode in all ui pipeline; do
  [[ "$(resource Ingress admin-ingress <<< "$legacy")" == "$(resource Ingress admin-ingress <<< "$configured")" ]]
  [[ "$(resource Deployment oauth2-proxy-admin <<< "$legacy")" == "$(resource Deployment oauth2-proxy-admin <<< "$configured")" ]]
  [[ "$(resource Service oauth2-proxy-admin <<< "$legacy")" == "$(resource Service oauth2-proxy-admin <<< "$configured")" ]]
-  [[ "$(grep 'image:' <<< "$legacy")" == "$(grep 'image:' <<< "$configured")" ]]
+  [[ "$(without_admin <<< "$legacy" | grep 'image:')" == "$(without_admin <<< "$configured" | grep 'image:')" ]]
+  assert_line "$old" 'image: "uugai/admin:v1.3.0"$'
+  assert_line "$block" 'image: "ghcr.io/uug-ai/admin:v1.4.6"$'
  # No other workload inherits Admin's container port or security settings.
  [[ "$(without_frontends <<< "$configured" | grep -c 'runAsUser: 65532')" == 1 ]]
-  echo "OK ($mode): Admin opt-in port/security/tmpfs; legacy image, Service port, ingress and OAuth2-proxy preserved"
+  echo "OK ($mode): Admin hardened defaults; legacy opt-out; Service port, ingress and OAuth2-proxy preserved"
 done
 echo "All hardened Admin checks passed."
Author	SHA1	Message	Date
Cédric Verstraeten	9a5a5e2287	Merge pull request #245 from kerberos-io/feat/hub-inspect feat(hub): flag for in-app bug reports with inspect (0.188.0)	2026-11-12 18:00:20 +01:00
Cédric VerstraetenandClaude Opus 5.5	8c329bb67c	feat(hub): flag for in-app bug reports with inspect (0.188.0) Adds kerberoshub.frontend.features.inspection.enabled (default "false"), setting ALLOW_INSPECTION on the frontend and the demo frontend. When true, hub-frontend shows the inspect launcher, which files bug reports as GitHub issues via https://inspect.uug.ai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 16:19:37 +00:00
Cédric Verstraeten	549dbf707b	Merge pull request #240 from kerberos-io/feat/hub-api-session-lifetime feat(hub): configurable hub-api session lifetime, hub-api v1.11.42 (0.186.0)	2026-11-12 10:11:12 +01:00
Cedric VerstraetenandClaude Opus 5.5	9695209b0e	feat(hub): configurable hub-api session lifetime, hub-api v1.11.42 (0.186.0) Add kerberoshub.api.session.{accessTokenTimeout,idleTimeout,maxLifetime} (defaults 15m / 12h / 24h), passed to hub-api as ACCESS_TOKEN_TIMEOUT, SESSION_IDLE_TIMEOUT and SESSION_MAX_LIFETIME, and default hub-api to v1.11.42, which enforces them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 09:07:56 +00:00
Cédric Verstraeten	3dec5944f2	Merge pull request #242 from kerberos-io/feat/hub-trusted-registry-own-images feat(hub): trusted-registry reports only UUG.AI images (0.185.1)	2026-11-12 10:06:24 +01:00
Cédric VerstraetenandClaude Opus 5.5	02ab752118	feat(hub): trusted-registry reports only UUG.AI images (0.185.1) trusted-registry matched every pod in the namespace and reported workloads the chart doesn't deploy (agents, cert-manager solvers, jobs). Report only UUG.AI images (uugai/, uug-ai/) not pulled from ghcr.io/uug-ai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 09:03:47 +00:00
Cédric Verstraeten	f2d462e95e	Merge pull request #241 from kerberos-io/feat/hub-reactivate-ghcr feat(hub): hardened defaults for every UUG.AI image, reactivate on GHCR (0.185.0)	2026-11-12 09:56:12 +01:00
Cédric VerstraetenandClaude Opus 5.5	6730f5c756	feat(hub): hardened defaults for every UUG.AI image, reactivate on GHCR (0.185.0) Default to the signed, hardened releases of admin, hub-audit and the dominantcolors, event, export, notification, notification-test, sprite and thumbnail pipelines; run hub-reactivatesubscriptions from ghcr.io/uug-ai (v1.0.3). Their policies now follow the configured validationFailureAction; only hub-objecttracking (unsigned -gpu image) and trusted-registry stay in Audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 08:50:09 +00:00
Cédric Verstraeten	caab6f6f55	Merge pull request #239 from kerberos-io/feat/hub-kyverno-missing-images feat(hub): Kyverno policies for every image, trust only ghcr.io/uug-ai, hardened Admin default; remove hub-proxy and vault-forwarder (0.184.0)	2026-11-11 21:55:02 +01:00
Cédric VerstraetenandClaude Opus 5.5	3949cb4bac	feat(hub): default Admin to signed, hardened ghcr.io/uug-ai/admin v1.4.5 Only ghcr.io/uug-ai images are trusted, so Admin now defaults to the signed GHCR release with the hardened runtime production already uses (8080, 65532 non-root, read-only root, memory /tmp, /healthz probes). A legacy image can be restored with the documented opt-out values. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:52:01 +00:00
Cédric VerstraetenandClaude Opus 5.5	1fe8fe9727	feat(hub): trust only ghcr.io/uug-ai images - admin and hub-reactivatesubscriptions signature/hardening policies match ghcr.io/uug-ai only (Docker Hub references removed). - Remove the oauth2-proxy (quay.io) signature policy. - Add trusted-registry.yaml (category "Image registry", Audit): reports every container, init and ephemeral container image that is not from ghcr.io/uug-ai/. It flags the remaining non-GHCR images the chart can deploy: uugai/admin and uugai/hub-reactivatesubscriptions (Docker Hub) and quay.io/oauth2-proxy/oauth2-proxy. - README updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:46:34 +00:00
Cédric VerstraetenandClaude Opus 5.5	5eb0d41aa7	feat(hub): keep the reactivate-subscriptions service hub-reactivate-subscription is still needed: restore its template, kerberoshub.reactivate values, README rows and its Kyverno signature and hardening policies (Audit until the chart uses the signed ghcr.io/uug-ai/hub-reactivatesubscriptions image). Only hub-proxy and vault-forwarder are removed. The reactivate output is unchanged from main. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:40:03 +00:00
Cédric VerstraetenandClaude Opus 5.5	5a445e0179	feat(hub): remove unused hub-proxy, reactivate-subscriptions and vault-forwarder These services are no longer used. Remove their templates (kerberos-vault/vault-proxy.yaml, kerberos-vault/vault-forwarder.yaml, kerberos-hub/hub-reactivate-subscription.yaml), their values (kerberoshub.proxy, kerberoshub.forwarder, kerberoshub.reactivate), their README sections, and the Kyverno policies added for them in this change. Installs that still set these values keep rendering; the keys are ignored. Upgrading removes the hub-reactivate-subscription Deployment (and the vault-proxy / vault-forwarder ones where enabled). Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:37:09 +00:00
Cédric Verstraeten	a34a82138a	Merge pull request #238 from kerberos-io/feat/hub-frontend-v1.19.35-default feat(hub): default hub-frontend v1.19.35, the first attested hardened release (0.183.1)	2026-11-11 21:36:15 +01:00
Cédric VerstraetenandClaude Opus 5.5	714e59f6fe	feat(hub): Kyverno policies for every container image the chart deploys (0.184.0) A scan of every container and init container the chart can render (all modes and optional components) found 26 images; 21 had a signature policy and 11 a hardening policy. Add the missing ones so Policy Reporter shows every gap instead of "no policy": - Hardening policies for the 10 ghcr.io/uug-ai images without a hardened release yet (audit, objecttracking, vlm, dominantcolors, event, export, notification, notification-test, sprite, thumbnail). - Signature and hardening policies for the Docker Hub images uugai/admin, uugai/hub-proxy, uugai/hub-reactivatesubscriptions (also matching their ghcr.io/uug-ai releases) and the legacy kerberos/vault-forwarder. - A visibility-only signature policy for the third-party oauth2-proxy. All new policies stay in Audit regardless of the configured mode, so they report gaps without ever blocking. README tables updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:31:32 +00:00
Cédric VerstraetenandClaude Opus 5.5	73106bfa10	feat(hub): default hub-frontend v1.19.35, the first attested hardened release (0.183.1) hub-frontend v1.19.35 is a hardened release with the signed image-hardening attestation (v1.19.34 was hardened before attestations existed). With it, every chart default with a hardening policy is an attested hardened release. Frontend runtime check and README updated. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-11 20:17:49 +00:00