Default Hub frontends to hardened images on port 8080

Release chart 0.170.0 with frontend v1.19.28, non-root read-only runtime and writable scratch. Preserve Admin legacy defaults and explicit frontend rollback support. Test real image health and generated configuration through Service routing in Kind.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

.github/workflows/http-port-migration.yaml

@@ -20,3 +20,8 @@ jobs:
           helm lint charts/hub
           bash scripts/check-admin-runtime.sh
           bash scripts/check-hardened-workers.sh
+          bash scripts/check-frontend-runtime.sh
+      - name: Smoke test hardened frontend images and Service routing
+        env:
+          CLUSTER_SMOKE: "true"
+        run: bash scripts/check-frontend-runtime.sh

charts/hub/Chart.yaml

@@ -16,7 +16,7 @@ type: application
 # This is the chart version. This version number should be incremented each time you make changes
 # to the chart and its templates, including the app version.
 # Versions are expected to follow Semantic Versioning (https://semver.org/)
-version: 0.169.1
+version: 0.170.0
 
 # This is the version number of the application being deployed. This version number should be
 # incremented each time you make changes to the application. Versions are not expected to

charts/hub/README.md

@@ -33,10 +33,15 @@ Uninstall the Kerberos Hub chart
 
 ### Hardened frontend images
 
-New shell-free frontend images run as `65532:65532` and listen on port `8080`.
-Before selecting such an image tag, set the following values together. Defaults
-remain compatible with legacy images on port `80`; this chart does not upgrade
-the frontend image automatically. The Service and ingress remain on port `80`.
+Starting with chart **`0.170.0`**, both frontends default to shell-free
+`ghcr.io/uug-ai/hub-frontend:v1.19.28`, running as `65532:65532` on port `8080`
+with a read-only root filesystem and writable `/tmp`. The Service and ingress
+remain on port `80`. Admin retains its legacy image and port `80`; its hardened
+runtime remains opt-in.
+
+The following frontend runtime settings are now the defaults. When upgrading,
+remove stale port `80` overrides and coordinate image/runtime values; Helm
+`--reuse-values` and GitOps overrides may retain the old settings.
 Use chart `0.167.2` or newer when the demo frontend is enabled; `0.167.1`
 supports these settings only on the primary frontend.
 
@@ -73,6 +78,26 @@ the primary and demo frontends, which share the frontend image tag. Update the
 live Argo CD Application's chart pin as well as its values: an image-only
 upgrade leaves older charts forwarding to port `80` and causes gateway errors.
 
+For legacy frontend images or a rollback, explicitly restore **all** runtime
+settings together (including removing inherited security defaults):
+
+```yaml
+kerberoshub:
+    frontend:
+        tag: v1.13.9
+        containerPort: 80
+        securityContext: null
+        volumes: []
+        volumeMounts: []
+```
+
+Keep any application-specific branding mounts when adjusting these lists.
+Chart upgrades do not rewrite separately managed NodePort Services: ensure they
+target the named `http` port, not numeric `80`. Follow the duplicate-port recovery
+instructions below if the existing Deployment cannot be patched to `8080`.
+Run `bash scripts/check-frontend-runtime.sh` for default, demo, legacy override,
+and deployment-values regression coverage.
+
 ### Hardened Admin image (opt-in, chart 0.167.3)
 
 `charts/hub` deploys Admin in `all` and `ui` modes. Shell-free Admin `v1.4.3`

charts/hub/templates/kerberos-hub/hub-frontend-demo.yaml

@@ -110,7 +110,7 @@ spec:
           {{- toYaml . | nindent 12 }}
         {{- end }}
         ports:
-        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 80 }}
+        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 8080 }}
           name: http
         {{- with .Values.kerberoshub.frontend.volumeMounts}}
         volumeMounts:

charts/hub/templates/kerberos-hub/hub-frontend.yaml

@@ -191,7 +191,7 @@ spec:
           {{- toYaml . | nindent 12 }}
         {{- end }}
         ports:
-        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 80 }}
+        - containerPort: {{ .Values.kerberoshub.frontend.containerPort | default 8080 }}
           name: http
         {{- with .Values.kerberoshub.frontend.volumeMounts}}
         volumeMounts:

charts/hub/values.yaml

@@ -482,11 +482,28 @@ kerberoshub:
   frontend:
     repository: ghcr.io/uug-ai/hub-frontend
     pullPolicy: IfNotPresent
-    tag: "v1.13.9"
+    tag: "v1.19.28"
     replicas: 2
-    # Hardened frontend images listen on 8080; retain 80 for existing images.
-    containerPort: 80
-    securityContext: {}
+    containerPort: 8080
+    securityContext:
+      runAsNonRoot: true
+      runAsUser: 65532
+      runAsGroup: 65532
+      readOnlyRootFilesystem: true
+      allowPrivilegeEscalation: false
+      capabilities:
+        drop: ["ALL"]
+      seccompProfile:
+        type: RuntimeDefault
+    # Keep these entries when adding custom branding/translation mounts.
+    volumes:
+      - name: frontend-tmp
+        emptyDir:
+          medium: Memory
+          sizeLimit: 16Mi
+    volumeMounts:
+      - name: frontend-tmp
+        mountPath: /tmp
     topologySpreadConstraints: [] # Optional pod topology spread constraints (empty = none).
     # Set to false to skip rendering the hub-frontend Service (e.g. when an
     # external/shared Service is managed elsewhere).

scripts/check-frontend-runtime.sh

@@ -0,0 +1,102 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+CHART_DIR="${1:-charts/hub}"
+values=()
+if [[ $# -ge 2 ]]; then values=(--values "$2"); fi
+
+resource() {
+  local kind="$1" name="$2"
+  awk -v kind="$kind" -v name="$name" '
+    function emit() { if (matchedKind && matchedName) printf "%s", block }
+    /^---$/ { emit(); block=""; matchedKind=0; matchedName=0 }
+    { block=block $0 "\n" }
+    $0 == "kind: " kind { matchedKind=1 }
+    $0 == "  name: " name { matchedName=1 }
+    END { emit() }
+  '
+}
+
+assert_contains() {
+  if ! grep -Eq -- "$2" <<< "$1"; then
+    printf 'Missing expected frontend setting: %s\n' "$2" >&2
+    exit 1
+  fi
+}
+
+for mode in all ui; do
+  rendered="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
+    --set kerberoshub.frontend.demoEnabled=true)"
+  for name in hub-frontend hub-frontend-demo; do
+    deployment="$(resource Deployment "$name" <<< "$rendered")"
+    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.19.28"$'
+    assert_contains "$deployment" 'containerPort: 8080$'
+    [[ "$(grep -c 'containerPort:' <<< "$deployment")" == 1 ]]
+    for setting in 'name: http' 'runAsNonRoot: true' 'runAsUser: 65532' \
+      'runAsGroup: 65532' 'readOnlyRootFilesystem: true' \
+      'allowPrivilegeEscalation: false' 'type: RuntimeDefault' 'drop:' '- ALL' \
+      'medium: Memory' 'sizeLimit: 16Mi' 'mountPath: /tmp' 'name: frontend-tmp'; do
+      assert_contains "$deployment" "^[[:space:]]*(- )?$setting$"
+    done
+    service="$(resource Service "$name-svc" <<< "$rendered")"
+    assert_contains "$service" 'port: 80$'
+    assert_contains "$service" 'targetPort: http$'
+    echo "OK ($mode): $name hardened image, security, scratch and named routing"
+  done
+  admin="$(resource Deployment admin <<< "$rendered")"
+  assert_contains "$admin" 'containerPort: 80$'
+
+  legacy="$(helm template hub "$CHART_DIR" "${values[@]}" --set "mode=$mode" \
+    --set kerberoshub.frontend.demoEnabled=true \
+    --set kerberoshub.frontend.tag=v1.13.9 \
+    --set kerberoshub.frontend.containerPort=80 \
+    --set kerberoshub.frontend.securityContext=null \
+    --set-json 'kerberoshub.frontend.volumes=[]' \
+    --set-json 'kerberoshub.frontend.volumeMounts=[]')"
+  for name in hub-frontend hub-frontend-demo; do
+    deployment="$(resource Deployment "$name" <<< "$legacy")"
+    assert_contains "$deployment" 'containerPort: 80$'
+    assert_contains "$deployment" 'image: "ghcr.io/uug-ai/hub-frontend:v1.13.9"$'
+    if grep -Eq 'securityContext:|mountPath: /tmp' <<< "$deployment"; then
+      echo "Legacy frontend retains incompatible hardened runtime settings" >&2
+      exit 1
+    fi
+  done
+done
+
+if [[ "${CLUSTER_SMOKE:-false}" == true ]]; then
+  namespace=frontend-runtime-test
+  kubectl create namespace "$namespace"
+  helm template runtime "$CHART_DIR" "${values[@]}" --namespace "$namespace" \
+    --set mode=ui --set ingress="" --set kerberoshub.frontend.demoEnabled=true \
+    --show-only templates/kerberos-hub/hub-frontend.yaml \
+    --show-only templates/kerberos-hub/hub-frontend-demo.yaml | kubectl apply -f -
+  pid=""
+  cleanup() {
+    if [[ -n "$pid" ]]; then kill "$pid"; fi
+    if [[ "$1" != 0 ]]; then
+      kubectl -n "$namespace" get pods
+      kubectl -n "$namespace" describe pods
+      kubectl -n "$namespace" logs -l app=hub-frontend --all-containers=true
+      kubectl -n "$namespace" logs -l app=hub-frontend-demo --all-containers=true
+    fi
+  }
+  trap 'cleanup "$?"' EXIT
+  for name in hub-frontend hub-frontend-demo; do
+    kubectl -n "$namespace" rollout status "deployment/$name" --timeout=180s
+    kubectl -n "$namespace" port-forward "service/$name-svc" 18080:80 &
+    pid=$!
+    for attempt in {1..30}; do
+      if curl --fail --silent http://127.0.0.1:18080/healthz > /dev/null; then break; fi
+      sleep 1
+    done
+    [[ "$(curl --fail --silent http://127.0.0.1:18080/healthz)" == ok ]]
+    curl --fail --silent http://127.0.0.1:18080/assets/env.js | grep 'window' > /dev/null
+    kill "$pid"
+    wait "$pid" || [[ "$?" == 143 ]]
+    pid=""
+    echo "OK: $name serves health and generated runtime configuration through Service port 80"
+  done
+fi
+
+echo "Frontend runtime checks passed."

scripts/check-hardened-workers.sh

@@ -60,10 +60,19 @@ assert_line() {
   fi
 }
 
+without_frontends() {
+  awk '
+    /^---$/ { skip=0 }
+    /^# Source: hub\/templates\/kerberos-hub\/hub-frontend(-demo)?\.yaml$/ { skip=1 }
+    !skip { print }
+  '
+}
+
 for mode in all pipeline ui; do
   defaults="$(helm template hub "$CHART_DIR" --set "mode=$mode")"
-  if grep -q 'securityContext:' <<< "$defaults"; then
-    echo "Default $mode mode unexpectedly enables security settings" >&2
+  worker_defaults="$(without_frontends <<< "$defaults")"
+  if grep -q 'securityContext:' <<< "$worker_defaults"; then
+    echo "Default $mode mode unexpectedly enables worker security settings" >&2
     exit 1
   fi
 
@@ -111,7 +120,7 @@ for mode in all pipeline ui; do
     fi
   done
   expected="${#names[@]}"
-  [[ "$(grep -c 'runAsUser: 65532' <<< "$hardened")" == "$expected" ]]
+  [[ "$(without_frontends <<< "$hardened" | grep -c 'runAsUser: 65532')" == "$expected" ]]
   [[ "$(grep -c 'fsGroup: 65532' <<< "$hardened")" == "$expected" ]]
 
   # Image selection, Services, env and TLS mounts must not change.
@@ -179,7 +188,7 @@ for mode in all ui pipeline; do
   [[ "$(resource Service oauth2-proxy-admin <<< "$legacy")" == "$(resource Service oauth2-proxy-admin <<< "$configured")" ]]
   [[ "$(grep 'image:' <<< "$legacy")" == "$(grep 'image:' <<< "$configured")" ]]
   # No other workload inherits Admin's container port or security settings.
-  [[ "$(grep -c 'runAsUser: 65532' <<< "$configured")" == 1 ]]
+  [[ "$(without_frontends <<< "$configured" | grep -c 'runAsUser: 65532')" == 1 ]]
   echo "OK ($mode): Admin opt-in port/security/tmpfs; legacy image, Service port, ingress and OAuth2-proxy preserved"
 done
 echo "All hardened Admin checks passed."