feat(hub): configurable hub-api session lifetime, hub-api v1.11.42 (0.186.0)

Add kerberoshub.api.session.{accessTokenTimeout,idleTimeout,maxLifetime}
(defaults 15m / 12h / 24h), passed to hub-api as ACCESS_TOKEN_TIMEOUT,
SESSION_IDLE_TIMEOUT and SESSION_MAX_LIFETIME, and default hub-api to
v1.11.42, which enforces them.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.185.1
+version: 0.186.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -862,11 +862,14 @@ kerberospipeline:
 | `kerberoshub.serviceAccount.labels` | Labels applied to `kerberoshub.serviceAccount` resources. | `""` |
 | `kerberoshub.api.repository` | The Docker registry where the Kerberos Hub API container is hosted. | `"ghcr.io/uug-ai/hub-api"` |
 | `kerberoshub.api.pullPolicy` | The Docker registry pull policy. | `"IfNotPresent"` |
-| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.41"` |
+| `kerberoshub.api.tag` | The Docker image tag/version. | `"v1.11.42"` |
 | `kerberoshub.api.replicas` | The number of pods/replicas running for the Kerberos Hub API deployment. | `2` |
 | `kerberoshub.api.audit.enabled` | Enable audit publishing from Hub API when global auditing is enabled. | `true` |
 | `kerberoshub.api.logLevel` | Log verbosity level for `kerberoshub.api`. | `"info"` |
 | `kerberoshub.api.jwtSecret` | A secret that is for generating JWT tokens. | `"this-is-a-secret-please-change-to-random-string"` |
+| `kerberoshub.api.session.accessTokenTimeout` | Lifetime of one access token (Go duration). The frontend renews it silently while the session is valid. | `"15m"` |
+| `kerberoshub.api.session.idleTimeout` | A session that is not used for this long ends (lifetime of the refresh token). | `"12h"` |
+| `kerberoshub.api.session.maxLifetime` | Hard session limit counted from login; refreshing never extends a session past it. | `"24h"` |
 | `kerberoshub.api.schema` | The protocol to serve the Kerberos Hub API, `'http'` or `'https'`. | `"https"` |
 | `kerberoshub.api.url` | The Kerberos Hub API ingress to access the API. | `"api.yourdomain.com"` |
 | `kerberoshub.api.corsAllowedOrigins` | Additional complete HTTP(S) origins allowed to call the Hub API. Configured frontend origins remain allowed automatically. | `[]` |

charts/hub/templates/kerberos-hub/hub-api.yaml

@@ -303,6 +303,12 @@ spec:
               value: "{{ .Values.kerberoshub.api.schema }}://{{ .Values.kerberoshub.api.url }}"
             - name: PUBLIC_URL
               value: "{{ .Values.kerberoshub.frontend.schema }}://{{ .Values.kerberoshub.frontend.url }}"
+            - name: ACCESS_TOKEN_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.accessTokenTimeout | quote }}
+            - name: SESSION_IDLE_TIMEOUT
+              value: {{ .Values.kerberoshub.api.session.idleTimeout | quote }}
+            - name: SESSION_MAX_LIFETIME
+              value: {{ .Values.kerberoshub.api.session.maxLifetime | quote }}
             - name: REFRESH_COOKIE_SECURE
               value: {{ eq .Values.kerberoshub.api.schema "https" | quote }}
             {{- $corsOrigins := list (printf "%s://%s" .Values.kerberoshub.frontend.schema .Values.kerberoshub.frontend.url) }}

charts/hub/values.yaml

@@ -381,7 +381,7 @@ kerberoshub:
   api:
     repository: ghcr.io/uug-ai/hub-api
     pullPolicy: IfNotPresent
-    tag: "v1.11.41"
+    tag: "v1.11.42"
     replicas: 2
     podSecurityContext:
       fsGroup: 65532
@@ -410,6 +410,11 @@ kerberoshub:
     serviceEnabled: true
     logLevel: "info" # possible values: trace, debug, info, warn, error
     jwtSecret: "this-is-a-secret-please-change-to-random-string" # change to a random value, this is for generating JWT tokens.
+    # How long a user stays signed in (Go durations, e.g. "15m", "12h").
+    session:
+      accessTokenTimeout: "15m" # Lifetime of one access token; the frontend renews it silently.
+      idleTimeout: "12h" # A session that is not used for this long ends.
+      maxLifetime: "24h" # Hard limit counted from login; the user must sign in again after it.
     schema: "https"
     url: "api.yourdomain.com"
     # Additional complete HTTP(S) origins allowed to call the Hub API.