Merge pull request #245 from kerberos-io/feat/hub-inspect

feat(hub): flag for in-app bug reports with inspect (0.188.0)
2026-11-13 21:40:23 +00:00 · 2026-11-12 18:00:20 +01:00 · 2026-11-12 16:19:37 +00:00 · 2026-11-12 10:11:12 +01:00 · 2026-11-12 09:07:56 +00:00 · 2026-11-12 10:06:24 +01:00
22 changed files with 129 additions and 142 deletions
@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.184.0
+version: 0.188.0

 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to
@@ -125,7 +125,7 @@ and deployment-values regression coverage.
 ### Hardened Admin image (default since chart 0.184.0)

 `charts/hub` deploys Admin in `all` and `ui` modes. Since chart **`0.184.0`** the
-default is the signed, shell-free `ghcr.io/uug-ai/admin` (`v1.4.5`): it runs as
+default is the signed, shell-free `ghcr.io/uug-ai/admin` (`v1.4.6` since 0.185.0): it runs as
 `65532:65532` on `8080` with a read-only root filesystem, a memory-backed `/tmp`
 (`admin-tmp`, the only writable path) and `/healthz` probes. These settings are
 the defaults in `values.yaml`; keep them together with the image. Append extra
@@ -349,8 +349,8 @@ signed for its own `uug-ai/<image>` repository. "Mode" is the
 | `hub-pipeline-notification-test-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` | ✅ signed (from v1.2.7) | value |
 | `hub-pipeline-sprite-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` | ✅ signed (from v1.1.28) | value |
 | `hub-pipeline-thumbnail-signed-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` | ✅ signed (from v1.3.24) | value |
-| `admin-signed-images.yaml` | `ghcr.io/uug-ai/admin` | ✅ signed (from v1.4.5) | always `Audit` |
-| `hub-reactivatesubscriptions-signed-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` | ❌ not on GHCR yet; the chart uses Docker Hub `uugai/hub-reactivatesubscriptions` | always `Audit` |
+| `admin-signed-images.yaml` | `ghcr.io/uug-ai/admin` | ✅ signed (from v1.4.5) | value |
+| `hub-reactivatesubscriptions-signed-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` | ✅ signed (from v1.0.3, the first GHCR release) | value |

 Since chart **`0.182.0`** every `ghcr.io/uug-ai` image's releases are signed, so
 every policy follows `imageVerification.validationFailureAction`, except
@@ -367,11 +367,19 @@ Since chart **`0.184.0`** only `ghcr.io/uug-ai` images are trusted:
  `ghcr.io/uug-ai/<image>` repository only. Images that are not signed or
  hardened yet stay in `Audit` (the tables mark them), so they show up as
  failures in Policy Reporter without ever being blocked;
- `trusted-registry.yaml` (category **`Image registry`**, `Audit`) reports every
-  container image from any other registry or organisation. The chart can still
-  deploy two: `uugai/hub-reactivatesubscriptions` (Docker Hub; not released to
-  GHCR yet) and the third-party `quay.io/oauth2-proxy/oauth2-proxy` (pin it to
-  a version or digest rather than `:latest`).
+- `trusted-registry.yaml` (category **`Image registry`**, `Audit`) reports a
+  UUG.AI image (`uugai/...`, or a `uugai/` or `uug-ai/` organisation on any
+  registry) that is not pulled from `ghcr.io/uug-ai`. Since **`0.185.1`** it
+  ignores every other image in the namespace: workloads the chart doesn't
+  deploy (agents, cert-manager solvers, other tools) and the third-party
+  `quay.io/oauth2-proxy/oauth2-proxy` (pin that one to a version or digest
+  rather than `:latest`).
+
+Since chart **`0.185.0`** every UUG.AI image defaults to a signed, hardened
+release with the attestation (Admin `v1.4.6`, hub-reactivatesubscriptions
+`v1.0.3` on `ghcr.io/uug-ai`), and every policy follows its
+`validationFailureAction` value except `hub-objecttracking`'s, whose `-gpu`
+image is not signed or hardened yet.

 To change a policy, edit its file. To add an image, copy a policy file and
 change the image and repository.
@@ -449,18 +457,18 @@ image whose repository makes hardened releases, in `templates/kyverno/`:
 | `hub-pipeline-monitor-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-monitor` |
 | `hub-pipeline-sequence-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sequence` |
 | `hub-pipeline-throttler-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-throttler` |
-| `hub-audit-hardened-images.yaml` | `ghcr.io/uug-ai/hub-audit` (not hardened yet; always `Audit`) |
-| `hub-objecttracking-hardened-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` (not hardened yet; always `Audit`) |
-| `hub-vlm-hardened-images.yaml` | `ghcr.io/uug-ai/hub-vlm` (not hardened yet; always `Audit`) |
-| `hub-pipeline-dominantcolors-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` (not hardened yet; always `Audit`) |
-| `hub-pipeline-event-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` (not hardened yet; always `Audit`) |
-| `hub-pipeline-export-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` (not hardened yet; always `Audit`) |
-| `hub-pipeline-notification-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` (not hardened yet; always `Audit`) |
-| `hub-pipeline-notification-test-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` (not hardened yet; always `Audit`) |
-| `hub-pipeline-sprite-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` (not hardened yet; always `Audit`) |
-| `hub-pipeline-thumbnail-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` (not hardened yet; always `Audit`) |
-| `admin-hardened-images.yaml` | `ghcr.io/uug-ai/admin` (not hardened yet; always `Audit`) |
-| `hub-reactivatesubscriptions-hardened-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` (not hardened yet; always `Audit`) |
+| `hub-audit-hardened-images.yaml` | `ghcr.io/uug-ai/hub-audit` (hardened from v1.0.12) |
+| `hub-objecttracking-hardened-images.yaml` | `ghcr.io/uug-ai/hub-objecttracking` (hardened from v1.0.11; `-gpu` image not yet; always `Audit`) |
+| `hub-vlm-hardened-images.yaml` | `ghcr.io/uug-ai/hub-vlm` (hardened from v1.0.9) |
+| `hub-pipeline-dominantcolors-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-dominantcolors` (hardened from v2.0.11) |
+| `hub-pipeline-event-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-event` (hardened from v1.3.11) |
+| `hub-pipeline-export-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-export` (hardened from v1.2.23) |
+| `hub-pipeline-notification-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification` (hardened from v1.3.49) |
+| `hub-pipeline-notification-test-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-notification-test` (hardened from v1.2.8) |
+| `hub-pipeline-sprite-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-sprite` (hardened from v1.1.29) |
+| `hub-pipeline-thumbnail-hardened-images.yaml` | `ghcr.io/uug-ai/hub-pipeline-thumbnail` (hardened from v1.3.25) |
+| `admin-hardened-images.yaml` | `ghcr.io/uug-ai/admin` (hardened from v1.4.6) |
+| `hub-reactivatesubscriptions-hardened-images.yaml` | `ghcr.io/uug-ai/hub-reactivatesubscriptions` (hardened from v1.0.3) |

 Each requires the attestation to be signed by the UUG.AI release workflow for
 the image's own repository, and its `result` and `repository` to be `passed`
@@ -834,7 +842,7 @@ kerberospipeline:
 | `kerberosvault.sprite.secretKey` | Secret key for `kerberosvault.sprite`. | `"xxx"` |
 | `admin.repository` | Container image repository for `admin`. | `"ghcr.io/uug-ai/admin"` |
 | `admin.pullPolicy` | Image pull policy for `admin`. | `"IfNotPresent"` |
-| `admin.tag` | Container image tag/version for `admin`. | `"v1.4.5"` |
+| `admin.tag` | Container image tag/version for `admin`. | `"v1.4.6"` |
 | `admin.replicas` | Number of replicas for `admin`. | `2` |
 | `admin.logLevel` | Log verbosity level for `admin`. | `"info"` |
 | `admin.resources.requests.memory` | Memory request for `admin`. | `"100Mi"` |
@@ -854,11 +862,14 @@ kerberospipeline:
 | `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
 | `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.41"` |
+| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.42"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
 | `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
+| `kerberoshub.api.session.accessTokenTimeout` | Lifetime of one access token (Go duration). The frontend renews it silently while the session is valid. | `"15m"` |
+| `kerberoshub.api.session.idleTimeout` | A session that is not used for this long ends (lifetime of the refresh token). | `"12h"` |
+| `kerberoshub.api.session.maxLifetime` | Hard session limit counted from login; refreshing never extends a session past it. | `"24h"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
 | `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
 | `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |
@@ -949,6 +960,7 @@ kerberospipeline:
 | `kerberoshub.frontend.features.case.enabled` | Enable or disable the case feature in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.darkModeEnabled` | Enable or disable dark mode in the frontend. | `"true"` |
 | `kerberoshub.frontend.features.splashScreen.enabled` | Enable or disable the pre-bootstrap splash screen and reveal delay. | `"true"` |
+| `kerberoshub.frontend.features.inspection.enabled` | Show the [inspect](https://github.com/uug-ai/inspect) bug-report launcher (and Alt+Shift+I): screenshot or record part of Hub, annotate it and file it as a GitHub issue via `https://inspect.uug.ai`. Needs hub-frontend with inspect support, and the Hub URL on the inspect server's origin allowlist. Sets `ALLOW_INSPECTION`. | `"false"` |
 | `kerberoshub.frontend.features.landingPage` | Frontend landing page configuration. | `"/dashboard"` |
 | `kerberoshub.frontend.features.i18n.enabled` | Enable or disable the runtime language switcher in the front-end. When `"false"`, `defaultLanguage` is forced and users cannot change it. | `"true"` |
 | `kerberoshub.frontend.features.i18n.defaultLanguage` | Default language code used by the front-end (e.g. `en`, `nl`, `pl`, `tr`, `fr`, `sv`, `de`). | `"en"` |
@@ -1064,7 +1076,7 @@ kerberospipeline:
 | `kerberoshub.cleanup.resources.requests.cpu` | CPU request for `kerberoshub.cleanup`. | `"10m"` |
 | `kerberoshub.audit.repository` | Hub audit service container image repository. | `"ghcr.io/uug-ai/hub-audit"` |
 | `kerberoshub.audit.pullPolicy` | Hub audit service image pull policy. | `"IfNotPresent"` |
-| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.11"` |
+| `kerberoshub.audit.tag` | Hub audit service image tag. S3 destinations need v1.0.9 or later, and `s3.allowUnlockedBucket` needs v1.0.10. | `"v1.0.12"` |
 | `kerberoshub.audit.replicas` | Number of audit service replicas. Per-destination MongoDB leases prevent concurrent delivery. | `1` |
 | `kerberoshub.audit.dispatchInterval` | How often the mounted destination configuration is reloaded and eligible destinations are polled. | `"5s"` |
 | `kerberoshub.audit.leaseDuration` | Per-destination lease duration. It must exceed every destination timeout by at least 30 seconds. | `"2m"` |
@@ -1108,16 +1120,16 @@ kerberospipeline:
 | `kerberoshub.monitordevice.scanIntervalSeconds` | Seconds between device status scans. Sets how quickly a camera going offline or online is detected. For accounts with "Group notifications" on, `hub-monitor-device` v1.4.10 and later then hold a change 20 seconds (`DEVICE_GROUPING_HOLD_SECONDS`) to collect other cameras that change status at the same time; older releases hold it one scan. | `60` |
 | `kerberoshub.monitordevice.resources.requests.memory` | Memory request for `kerberoshub.monitordevice`. | `"10Mi"` |
 | `kerberoshub.monitordevice.resources.requests.cpu` | CPU request for `kerberoshub.monitordevice`. | `"10m"` |
-| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"uugai/hub-reactivatesubscriptions"` |
+| `kerberoshub.reactivate.repository` | Container image repository for `kerberoshub.reactivate`. | `"ghcr.io/uug-ai/hub-reactivatesubscriptions"` |
 | `kerberoshub.reactivate.pullPolicy` | Image pull policy for `kerberoshub.reactivate`. | `"IfNotPresent"` |
-| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.2"` |
+| `kerberoshub.reactivate.tag` | Container image tag/version for `kerberoshub.reactivate`. | `"v1.0.3"` |
 | `kerberoshub.reactivate.replicas` | Number of replicas for `kerberoshub.reactivate`. Set to `0` to disable. | `0` |
 | `kerberoshub.reactivate.logLevel` | Log verbosity level for `kerberoshub.reactivate`. | `"info"` |
 | `kerberoshub.reactivate.resources.requests.memory` | Memory request for `kerberoshub.reactivate`. | `"10Mi"` |
 | `kerberoshub.reactivate.resources.requests.cpu` | CPU request for `kerberoshub.reactivate`. | `"10m"` |
 | `kerberospipeline.event.repository` | The [event orchestration](https://doc.kerberos.io/hub/pipeline/#orchestrator) microservice. | `"ghcr.io/uug-ai/hub-pipeline-event"` |
 | `kerberospipeline.event.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.10"` |
+| `kerberospipeline.event.tag` | The Docker image tag/version. | `"v1.3.11"` |
 | `kerberospipeline.event.replicas` | Number of replicas for `kerberospipeline.event`. | `1` |
 | `kerberospipeline.event.logLevel` | Log verbosity level for `kerberospipeline.event`. | `"info"` |
 | `kerberospipeline.event.resources.requests.memory` | Memory request for `kerberospipeline.event`. | `"10Mi"` |
@@ -1144,7 +1156,7 @@ kerberospipeline:
 | `kerberospipeline.throttler.resources.requests.cpu` | CPU request for `kerberospipeline.throttler`. | `"10m"` |
 | `kerberospipeline.notify.repository` | The [notification microservice](https://doc.kerberos.io/hub/pipeline/#notification), sending notifications on events. | `"ghcr.io/uug-ai/hub-pipeline-notification"` |
 | `kerberospipeline.notify.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.48"` |
+| `kerberospipeline.notify.tag` | The Docker image tag/version. | `"v1.3.49"` |
 | `kerberospipeline.notify.replicas` | Number of replicas for `kerberospipeline.notify`. | `1` |
 | `kerberospipeline.notify.audit.enabled` | Enable audit publishing from the notification worker when global auditing is enabled. | `true` |
 | `kerberospipeline.notify.logLevel` | Log verbosity level for `kerberospipeline.notify`. | `"info"` |
@@ -1153,7 +1165,7 @@ kerberospipeline:
 | `kerberospipeline.notify.resources.requests.cpu` | CPU request for `kerberospipeline.notify`. | `"10m"` |
 | `kerberospipeline.notifyTest.repository` | The notification service for testing, the different channels. | `"uugai/hub-pipeline-notification-test"` |
 | `kerberospipeline.notifyTest.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.7"` |
+| `kerberospipeline.notifyTest.tag` | The Docker image tag/version. | `"v1.2.8"` |
 | `kerberospipeline.notifyTest.replicas` | Number of replicas for `kerberospipeline.notifyTest`. | `1` |
 | `kerberospipeline.notifyTest.resources.requests.memory` | Memory request for `kerberospipeline.notifyTest`. | `"10Mi"` |
 | `kerberospipeline.notifyTest.resources.requests.cpu` | CPU request for `kerberospipeline.notifyTest`. | `"10m"` |
@@ -1171,7 +1183,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.enabled` | Deploy `pipe-dominantcolor` and let the analysis stage schedule it (`DOMINANTCOLOR_ENABLED`). Requires an analysis image that reads the flag. | `false` |
 | `kerberospipeline.dominantColor.repository` | The dominant color microservices is computing a top 3 color histogram. | `"ghcr.io/uug-ai/hub-pipeline-dominantcolors"` |
 | `kerberospipeline.dominantColor.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.10"` |
+| `kerberospipeline.dominantColor.tag` | The Docker image tag/version. | `"v2.0.11"` |
 | `kerberospipeline.dominantColor.replicas` | Number of replicas for `kerberospipeline.dominantColor`. | `3` |
 | `kerberospipeline.dominantColor.logLevel` | Log verbosity level for `kerberospipeline.dominantColor`. | `"info"` |
 | `kerberospipeline.dominantColor.resources.requests.memory` | Memory request for `kerberospipeline.dominantColor`. | `"512Mi"` |
@@ -1180,7 +1192,7 @@ kerberospipeline:
 | `kerberospipeline.dominantColor.resources.limits.cpu` | CPU limit for `kerberospipeline.dominantColor`. | `"1000m"` |
 | `kerberospipeline.thumbnail.repository` | The thumbnail microservices generated a thumbnail for a recordings. | `"ghcr.io/uug-ai/hub-pipeline-thumbnail"` |
 | `kerberospipeline.thumbnail.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.24"` |
+| `kerberospipeline.thumbnail.tag` | The Docker image tag/version. | `"v1.3.25"` |
 | `kerberospipeline.thumbnail.replicas` | Number of replicas for `kerberospipeline.thumbnail`. | `2` |
 | `kerberospipeline.thumbnail.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-thumbnail ≥ v1.3.15. | `0` |
 | `kerberospipeline.sprite.prefetchCount` | Max unacknowledged RabbitMQ messages per pod (`RABBITMQ_PREFETCH_COUNT`); `0` keeps the service default of 5. Requires hub-pipeline-sprite ≥ v1.1.21. | `0` |
@@ -1203,7 +1215,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.enabled` | Enable or disable `kerberospipeline.sprite`. | `false` |
 | `kerberospipeline.sprite.repository` | Container image repository for `kerberospipeline.sprite`. | `"ghcr.io/uug-ai/hub-pipeline-sprite"` |
 | `kerberospipeline.sprite.pullPolicy` | Image pull policy for `kerberospipeline.sprite`. | `"IfNotPresent"` |
-| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.28"` |
+| `kerberospipeline.sprite.tag` | Container image tag/version for `kerberospipeline.sprite`. | `"v1.1.29"` |
 | `kerberospipeline.sprite.replicas` | Number of replicas for `kerberospipeline.sprite`. | `5` |
 | `kerberospipeline.sprite.logLevel` | Log verbosity level for `kerberospipeline.sprite`. | `"info"` |
 | `kerberospipeline.sprite.interval` | Configuration value for `kerberospipeline.sprite.interval`. | `"1"` |
@@ -1215,7 +1227,7 @@ kerberospipeline:
 | `kerberospipeline.sprite.resources.limits.cpu` | CPU limit for `kerberospipeline.sprite`. | `"1000m"` |
 | `kerberospipeline.export.repository` | Container image repository for `kerberospipeline.export`. | `"ghcr.io/uug-ai/hub-pipeline-export"` |
 | `kerberospipeline.export.pullPolicy` | Image pull policy for `kerberospipeline.export`. | `"IfNotPresent"` |
-| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.22"` |
+| `kerberospipeline.export.tag` | Container image tag/version for `kerberospipeline.export`. | `"v1.2.23"` |
 | `kerberospipeline.export.replicas` | Number of replicas for `kerberospipeline.export`. | `2` |
 | `kerberospipeline.export.logLevel` | Log verbosity level for `kerberospipeline.export`. | `"info"` |
 | `kerberospipeline.export.resources.requests.memory` | Memory request for `kerberospipeline.export`. | `"10Mi"` |
@@ -303,6 +303,12 @@ spec:
              value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
            - name: PUBLIC_URL
              value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: ACCESS_TOKEN_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.accessTokenTimeout | quote }}
+            - name: SESSION_IDLE_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.idleTimeout | quote }}
+            - name: SESSION_MAX_LIFETIME
+              value: {{ .Values.kerberoshub.api.session.maxLifetime | quote }}
            - name: REFRESH_COOKIE_SECURE
              value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
            {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}
@@ -273,6 +273,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.darkMode }}"
        - name: FEATURE_SPLASH_SCREEN_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: ALLOW_INSPECTION
+          value: "{{ .Values.kerberoshub.frontend.features.inspection.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -352,6 +352,8 @@ spec:
          value: "{{ .Values.kerberoshub.frontend.features.darkModeEnabled }}"
        - name: FEATURE_SPLASH_SCREEN_ENABLED
          value: "{{ .Values.kerberoshub.frontend.features.splashScreen.enabled }}"
+        - name: ALLOW_INSPECTION
+          value: "{{ .Values.kerberoshub.frontend.features.inspection.enabled }}"
        - name: FEATURE_LANDING_PAGE
          value: "{{ .Values.kerberoshub.frontend.features.landingPage }}"

@@ -19,11 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/admin has no hardened release with the
-  # image-hardening attestation. Only ghcr.io/uug-ai/admin is trusted.
-  # This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -17,12 +17,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Only ghcr.io/uug-ai/admin is trusted. The chart's default image comes from
-  # Docker Hub (not matched here; reported by trusted-registry.yaml); switch it to
-  # the signed ghcr.io/uug-ai/admin release.
-  # This policy reports that gap and stays in Audit, even when
-  # imageVerification.validationFailureAction is Enforce.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop admin pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -50,7 +46,7 @@ spec:
                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
                    additionalExtensions:
                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to uug-ai/admin.
+                      # binds the signature to admin's own repository.
                      githubWorkflowRepository: uug-ai/admin
                    rekor:
                      url: https://rekor.sigstore.dev
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-audit has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-audit pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,11 +19,10 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-objecttracking has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
+  # The standard image is hardened (from v1.0.11), but its `-gpu` image is not:
+  # it is built outside the shared release workflow. This policy stays in Audit,
+  # even when imageHardening.validationFailureAction is Enforce. Once the `-gpu`
+  # image is hardened, use the same line as hub-api-hardened-images.yaml.
  validationFailureAction: Audit
  # Kyverno's default (Fail) would stop hub-objecttracking pods starting while Kyverno is down.
  failurePolicy: Ignore
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-dominantcolors has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-dominantcolors pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-event has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-event pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-export has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-export pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-notification has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-notification pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-notification-test has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-notification-test pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-sprite has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-sprite pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-pipeline-thumbnail has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-pipeline-thumbnail pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -19,11 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-reactivatesubscriptions has no hardened release with the
-  # image-hardening attestation. Only ghcr.io/uug-ai/hub-reactivatesubscriptions is trusted.
-  # This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -17,12 +17,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, signature required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Only ghcr.io/uug-ai/hub-reactivatesubscriptions is trusted. The chart's default image comes from
-  # Docker Hub (not matched here; reported by trusted-registry.yaml); switch it to
-  # the signed ghcr.io/uug-ai/hub-reactivatesubscriptions release.
-  # This policy reports that gap and stays in Audit, even when
-  # imageVerification.validationFailureAction is Enforce.
-  validationFailureAction: Audit
+  # Audit: report unsigned images, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageVerification.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-reactivatesubscriptions pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -50,7 +46,7 @@ spec:
                    subjectRegExp: '^https://github\.com/uug-ai/workflows/\.github/workflows/release-create\.yml@(refs/.+|[0-9a-f]{40})$'
                    additionalExtensions:
                      # That workflow signs for every UUG.AI repository; this
-                      # binds the signature to uug-ai/hub-reactivatesubscriptions.
+                      # binds the signature to hub-reactivatesubscriptions's own repository.
                      githubWorkflowRepository: uug-ai/hub-reactivatesubscriptions
                    rekor:
                      url: https://rekor.sigstore.dev
@@ -19,12 +19,8 @@ metadata:
 # Kyverno defaults apply: background scans of running pods, attestation required.
 # Only settings whose Kyverno default would change behaviour are set below.
 spec:
-  # Not hardened yet: uug-ai/hub-vlm has no hardened release with the
-  # image-hardening attestation (the image does not meet the hardened contract
-  # yet). This policy reports that gap and stays in Audit, even when
-  # imageHardening.validationFailureAction is Enforce. Once its releases are
-  # hardened, use the same line as hub-api-hardened-images.yaml.
-  validationFailureAction: Audit
+  # Audit: report images without a hardened release, don't block. Enforce: reject the pod.
+  validationFailureAction: {{ .Values.imageHardening.validationFailureAction }}
  # Kyverno's default (Fail) would stop hub-vlm pods starting while Kyverno is down.
  failurePolicy: Ignore
  # Verifying against GHCR and Rekor can exceed the 10s default.
@@ -1,9 +1,11 @@
 {{- /*
-Only images from ghcr.io/uug-ai are trusted: report every container, init
-container and ephemeral container image from any other registry or
-organisation (Docker Hub, quay.io, ...). Signature and hardening are checked per
-image by the *-signed-images / *-hardened-images policies, which match
-ghcr.io/uug-ai images only.
+UUG.AI images are trusted only from ghcr.io/uug-ai: report a container, init
+container or ephemeral container image that is a UUG.AI image (uugai/... on
+Docker Hub, or any registry's uugai/ or uug-ai/ organisation) pulled from
+anywhere else. Other images in the namespace (agents, cert-manager solvers,
+third-party tools) are not the chart's to vouch for and are ignored. Signature
+and hardening are checked per image by the *-signed-images / *-hardened-images
+policies, which match ghcr.io/uug-ai images only.
 A namespaced Policy, so it applies only to the release namespace.
 Rendered only when imageVerification.enabled is true and Kyverno is installed.
 */ -}}
@@ -13,15 +15,13 @@ kind: Policy
 metadata:
  name: trusted-registry
  annotations:
-    policies.kyverno.io/title: Images must come from ghcr.io/uug-ai
+    policies.kyverno.io/title: UUG.AI images must come from ghcr.io/uug-ai
    policies.kyverno.io/category: Image registry
    policies.kyverno.io/severity: high
    policies.kyverno.io/subject: Pod
 spec:
-  # Reports images from other registries without blocking them, even when
-  # imageVerification.validationFailureAction is Enforce: some images the chart
-  # can deploy are not on ghcr.io/uug-ai yet (see README). Switch to the
-  # configured value once every image is.
+  # Reports UUG.AI images from other registries without blocking them, even
+  # when imageVerification.validationFailureAction is Enforce.
  validationFailureAction: Audit
  # Kyverno's default (Fail) would stop pods starting while Kyverno is down.
  failurePolicy: Ignore
@@ -33,12 +33,21 @@ spec:
              kinds:
                - Pod
      validate:
-        message: "Every container image must come from the trusted registry ghcr.io/uug-ai/."
+        message: "UUG.AI images must come from the trusted registry ghcr.io/uug-ai/."
        foreach:
          - list: "request.object.spec.[containers, initContainers, ephemeralContainers][]"
            deny:
              conditions:
                all:
+                  # A UUG.AI image: Docker Hub uugai/..., or a uugai/ or uug-ai/
+                  # organisation on any registry ...
+                  - key: "{{`{{ element.image }}`}}"
+                    operator: AnyIn
+                    value:
+                      - "uugai/*"
+                      - "*/uugai/*"
+                      - "*/uug-ai/*"
+                  # ... that is not pulled from ghcr.io/uug-ai.
                  - key: "{{`{{ element.image }}`}}"
                    operator: NotEquals
                    value: "ghcr.io/uug-ai/*"
@@ -313,7 +313,7 @@ admin:
    initialDelaySeconds: 10
    periodSeconds: 10
  pullPolicy: IfNotPresent
-  tag: "v1.4.5"
+  tag: "v1.4.6"
  replicas: 2
  # Optional pod topology spread constraints for this deployment. Empty by
  # default. Example:
@@ -381,7 +381,7 @@ kerberoshub:
  api:
    repository: ghcr.io/uug-ai/hub-api
    pullPolicy: IfNotPresent
-    tag: "v1.11.41"
+    tag: "v1.11.42"
    replicas: 2
    podSecurityContext:
      fsGroup: 65532
@@ -410,6 +410,11 @@ kerberoshub:
    serviceEnabled: true
    logLevel: "info" # possible values: trace, debug, info, warn, error
    jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
+    # How long a user stays signed in (Go durations, e.g. "15m", "12h").
+    session:
+      accessTokenTimeout: "15m" # Lifetime of one access token; the frontend renews it silently.
+      idleTimeout: "12h" # A session that is not used for this long ends.
+      maxLifetime: "24h" # Hard limit counted from login; the user must sign in again after it.
    schema: "https"
    url: "api.yourdomain.com"
    # Additional complete HTTP(S) origins allowed to call the Hub API.
@@ -681,6 +686,8 @@ kerberoshub:
      darkModeEnabled: "true" # Enable or disable dark mode toggle 'true' or 'false'
      splashScreen:
        enabled: "true" # Enable or disable the pre-bootstrap splash screen 'true' or 'false'
+      inspection:
+        enabled: "false" # In-app bug reports filed as GitHub issues via inspect.uug.ai (https://github.com/uug-ai/inspect) 'true' or 'false'
      landingPage: "/dashboard" # Landing page after login '/dashboard', '/liveview', '/media', '/devices', '/sites', '/groups'
      # Internationalization (i18n): controls the runtime language behaviour
      # of the front-end. When `enabled` is "false" the language switcher is
@@ -916,7 +923,7 @@ kerberoshub:
  audit:
    repository: ghcr.io/uug-ai/hub-audit
    pullPolicy: IfNotPresent
-    tag: "v1.0.11"
+    tag: "v1.0.12"
    replicas: 1
    resources: {}
    # resources:
@@ -1174,7 +1181,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-objecttracking
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.10"
+          #  tag: "v1.0.11"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1199,7 +1206,7 @@ kerberoshub:
          #  enabled: true
          #  repository: ghcr.io/uug-ai/hub-vlm
          #  pullPolicy: IfNotPresent
-          #  tag: "v1.0.8"
+          #  tag: "v1.0.9"
          #  replicas: 1 # Number of pods for the worker.
          #  topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
          #  logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -1248,9 +1255,9 @@ kerberoshub:
        #    persistentVolumeClaim:
        #      claimName: custom-layout-claim
  reactivate:
-    repository: uugai/hub-reactivatesubscriptions
+    repository: ghcr.io/uug-ai/hub-reactivatesubscriptions
    pullPolicy: IfNotPresent
-    tag: "v1.0.2"
+    tag: "v1.0.3"
    replicas: 0 # Number of pods for the service. Set to 0 to disable.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1277,7 +1284,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "10"
    repository: ghcr.io/uug-ai/hub-pipeline-event
    pullPolicy: IfNotPresent
-    tag: "v1.3.10"
+    tag: "v1.3.11"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1365,7 +1372,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "20"
    pullPolicy: IfNotPresent
-    tag: "v1.3.48"
+    tag: "v1.3.49"
    replicas: 1 # Number of pods for the service.
    audit:
      enabled: true
@@ -1387,7 +1394,7 @@ kerberospipeline:
  notifyTest:
    repository: ghcr.io/uug-ai/hub-pipeline-notification-test
    pullPolicy: IfNotPresent
-    tag: "v1.2.7"
+    tag: "v1.2.8"
    replicas: 1 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    resources:
@@ -1450,7 +1457,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v2.0.10"
+    tag: "v2.0.11"
    replicas: 3 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    # Optional extra volumes / volumeMounts for this deployment (empty = none).
@@ -1476,7 +1483,7 @@ kerberospipeline:
    # deploymentAnnotations:
    #   argocd.argoproj.io/sync-wave: "50"
    pullPolicy: IfNotPresent
-    tag: "v1.3.24"
+    tag: "v1.3.25"
    replicas: 2 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1531,7 +1538,7 @@ kerberospipeline:
    #   argocd.argoproj.io/sync-wave: "50"
    repository: ghcr.io/uug-ai/hub-pipeline-sprite
    pullPolicy: IfNotPresent
-    tag: "v1.1.28"
+    tag: "v1.1.29"
    replicas: 5 # Number of pods for the service.
    prefetchCount: 0 # Max unacknowledged RabbitMQ messages per pod; 0 = service default (5).
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
@@ -1558,7 +1565,7 @@ kerberospipeline:
  export:
    repository: ghcr.io/uug-ai/hub-pipeline-export
    pullPolicy: IfNotPresent
-    tag: "v1.2.22"
+    tag: "v1.2.23"
    replicas: 2 # Number of pods for the service.
    topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
    logLevel: "info" # possible values: trace, debug, info, warn, error
@@ -194,7 +194,7 @@ for mode in all ui pipeline; do
  [[ "$(resource Service oauth2-proxy-admin <<< "$legacy")" == "$(resource Service oauth2-proxy-admin <<< "$configured")" ]]
  [[ "$(without_admin <<< "$legacy" | grep 'image:')" == "$(without_admin <<< "$configured" | grep 'image:')" ]]
  assert_line "$old" 'image: "uugai/admin:v1.3.0"$'
-  assert_line "$block" 'image: "ghcr.io/uug-ai/admin:v1.4.5"$'
+  assert_line "$block" 'image: "ghcr.io/uug-ai/admin:v1.4.6"$'
  # No other workload inherits Admin's container port or security settings.
  [[ "$(without_frontends <<< "$configured" | grep -c 'runAsUser: 65532')" == 1 ]]
  echo "OK ($mode): Admin hardened defaults; legacy opt-out; Service port, ingress and OAuth2-proxy preserved"
Author	SHA1	Message	Date
Cédric Verstraeten	9a5a5e2287	Merge pull request #245 from kerberos-io/feat/hub-inspect feat(hub): flag for in-app bug reports with inspect (0.188.0)	2026-11-12 18:00:20 +01:00
Cédric VerstraetenandClaude Opus 5.5	8c329bb67c	feat(hub): flag for in-app bug reports with inspect (0.188.0) Adds kerberoshub.frontend.features.inspection.enabled (default "false"), setting ALLOW_INSPECTION on the frontend and the demo frontend. When true, hub-frontend shows the inspect launcher, which files bug reports as GitHub issues via https://inspect.uug.ai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 16:19:37 +00:00
Cédric Verstraeten	549dbf707b	Merge pull request #240 from kerberos-io/feat/hub-api-session-lifetime feat(hub): configurable hub-api session lifetime, hub-api v1.11.42 (0.186.0)	2026-11-12 10:11:12 +01:00
Cedric VerstraetenandClaude Opus 5.5	9695209b0e	feat(hub): configurable hub-api session lifetime, hub-api v1.11.42 (0.186.0) Add kerberoshub.api.session.{accessTokenTimeout,idleTimeout,maxLifetime} (defaults 15m / 12h / 24h), passed to hub-api as ACCESS_TOKEN_TIMEOUT, SESSION_IDLE_TIMEOUT and SESSION_MAX_LIFETIME, and default hub-api to v1.11.42, which enforces them. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 09:07:56 +00:00
Cédric Verstraeten	3dec5944f2	Merge pull request #242 from kerberos-io/feat/hub-trusted-registry-own-images feat(hub): trusted-registry reports only UUG.AI images (0.185.1)	2026-11-12 10:06:24 +01:00
Cédric VerstraetenandClaude Opus 5.5	02ab752118	feat(hub): trusted-registry reports only UUG.AI images (0.185.1) trusted-registry matched every pod in the namespace and reported workloads the chart doesn't deploy (agents, cert-manager solvers, jobs). Report only UUG.AI images (uugai/, uug-ai/) not pulled from ghcr.io/uug-ai. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 09:03:47 +00:00
Cédric Verstraeten	f2d462e95e	Merge pull request #241 from kerberos-io/feat/hub-reactivate-ghcr feat(hub): hardened defaults for every UUG.AI image, reactivate on GHCR (0.185.0)	2026-11-12 09:56:12 +01:00
Cédric VerstraetenandClaude Opus 5.5	6730f5c756	feat(hub): hardened defaults for every UUG.AI image, reactivate on GHCR (0.185.0) Default to the signed, hardened releases of admin, hub-audit and the dominantcolors, event, export, notification, notification-test, sprite and thumbnail pipelines; run hub-reactivatesubscriptions from ghcr.io/uug-ai (v1.0.3). Their policies now follow the configured validationFailureAction; only hub-objecttracking (unsigned -gpu image) and trusted-registry stay in Audit. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>	2026-11-12 08:50:09 +00:00