ICAP Connector Secrets and ConfigMap Values
Secrets
| Custom Name | Default Name | Type | Description |
|---|---|---|---|
<ssl.customSecretName> | <Release.Name>-connector-icap-ssl | Required when SSL is enabled | TLS secret (kubernetes.io/tls) used for SSL/TLS termination on ICAP NLB. |
Values
Secret Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| ssl.createUserSecret | bool | false | If true, the chart creates a Kubernetes Secret using the crtFile and keyFile parameters. Intended EXCLUSIVELY for development and QA environments. For production, set this to false and provide your own secret via customSecretName. |
| ssl.crtFile | string | "" | SSL certificate (PEM format). Provide the full certificate chain. Only used if createUserSecret is set to true. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. |
| ssl.customSecretName | string | nil | Name of the user-provided secret containing SSL certificate and key. The secret must be of type kubernetes.io/tls (with tls.crt and tls.key keys). If not set, the default secret name will be used. |
| ssl.keyFile | string | "" | SSL private key (PEM format). Only used if createUserSecret is set to true. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. |
Kubernetes Settings
| Key | Type | Default | Description |
|---|---|---|---|
| affinity | object | {} | Affinity for pod scheduling. |
| imagePullSecrets | list | ["rl-registry-key"] | Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images. |
| nodeSelector | object | {} | Node labels for pod assignment. Pods will only be scheduled to nodes that match all labels defined here. |
| podAnnotations | object | - | Pod annotations. Additional custom annotations for ICAP connector pods. Note: checksum annotation is automatically added in the deployment when Reloader is disabled. |
| tolerations | list | [] | Tolerations for pod assignment. Allows pods to be scheduled onto "tainted" nodes that would otherwise repel them. |
| useReloader | string | nil | Whether to enable Reloader annotations. When defined, this value takes precedence over global.useReloader. |
Application Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| configuration | object | - | ICAP server configuration values (rendered into TOML config). |
| configuration.allowClassifications | list | ["unknown","goodware"] | Select which classifications to allow: unknown, goodware, suspicious, malicious. Other classifications will be blocked. |
| configuration.customRESPMODBlockPage | string | "" | Upload a page to replace the content of the HTTP response. The uploaded file will be served to the client instead of the original response from the web server. The file size must not exceed 0.5 MB. |
| configuration.maxFilesize | int | 0 | Specify the maximum file size (in MB) to process. Files exceeding this size will not be analyzed. Default: 0 (unlimited). |
| configuration.reqmodBlockPageUrl | string | "" | For default block-page, set to http://{EXTERNAL_DNS_HOSTNAME}:8080/icap-block-page or https://{EXTERNAL_DNS_HOSTNAME}:8443/icap-block-page. HTTP port 8080 is always available. HTTPS port 8443 requires SSL certificates to be provided. |
| configuration.scanRawReqmodBody | bool | false | Extract the raw HTTP message body, and send it to RL scan as is. |
| configuration.services | list | [] | A list of service aliases on ICAP. Valid characters: lowercase a–z, digits 0–9, and hyphen (-). |
| configuration.timeout | int | 300 | Set the timeout period (in seconds) for processing requests. Default: 300. Valid range: 1 – 86400. |
Pod Settings - General
| Key | Type | Default | Description |
|---|---|---|---|
| enabled | bool | false | Enable or disable the ICAP connector deployment. |
| ssl | object | - | SSL/TLS configuration for ICAP traffic. Uses SSL Passthrough with nginx reverse proxy. NLB forwards raw TCP, nginx handles TLS termination and proxies plain to ICAP server. |
| ssl.enabled | bool | false | Enable or disable SSL/TLS for ICAP. |
Pod Settings - ICAP Server
| Key | Type | Default | Description |
|---|---|---|---|
| image | object | - | Configuration values of the ICAP server image. |
| image.imagePullPolicy | string | "Always" | Image pull policy. Options: Always, IfNotPresent, Never. |
| image.tag | string | "1.6.1-1" | Image tag. |
| replicaCount | int | 1 | Replicas count for the ICAP connector deployment. |
| resources | object | - | Resource requests and limits for the ICAP server container. |
| resources.limits | object | - | The maximum amount of resources the container is allowed to consume. |
| resources.limits.cpu | string | nil | CPU limit. Throttling occurs if the container exceeds this value. |
| resources.limits.memory | string | "4Gi" | Memory limit. If exceeded, the container may be terminated with an OOMKilled error. |
| resources.requests | object | - | The minimum amount of resources the container is guaranteed. |
| resources.requests.cpu | string | "500m" | CPU request. |
| resources.requests.memory | string | "2Gi" | Memory request. |
| service | object | - | Layer 4 LoadBalancer (NLB) service configuration. This is the entry-point for ICAP client traffic into the K8s cluster. |
| service.annotations | object | {} | Additional annotations to add to the Service metadata. For AWS NLB, use annotations like: service.beta.kubernetes.io/aws-load-balancer-type: external and service.beta.kubernetes.io/aws-load-balancer-scheme: internal |
| service.icapHostname | string | "" | DNS hostname for ICAP service (e.g., icap-connector.example.com). If set, ExternalDNS will create a DNS record pointing to the NLB. |
| service.loadBalancerSourceRanges | list | [] | List of CIDR blocks allowed to access the LoadBalancer. |
| service.plainPort | int | 1344 | Port for plain HTTP ICAP traffic on the load balancer. |
| service.securePort | int | 11344 | Port for HTTPS ICAP traffic on the load balancer. |
| service.type | string | "LoadBalancer" | Type of Kubernetes service to create. |
Pod Settings - Nginx
| Key | Type | Default | Description |
|---|---|---|---|
| nginx | object | - | Configuration values of the nginx reverse proxy sidecar. |
| nginx.image | object | - | Configuration values of the NGINX image. |
| nginx.image.imagePullPolicy | string | "Always" | Image pull policy. |
| nginx.image.tag | string | "1.6.1-1" | Image tag. |
| nginx.resources | object | - | Resource requests and limits for the nginx container. |
| nginx.resources.limits | object | - | The maximum amount of resources the container is allowed to consume. |
| nginx.resources.limits.cpu | string | nil | CPU limit. |
| nginx.resources.limits.memory | string | "256Mi" | Memory limit. |
| nginx.resources.requests | object | - | The minimum amount of resources the container is guaranteed. |
| nginx.resources.requests.cpu | string | "100m" | CPU request. |
| nginx.resources.requests.memory | string | "128Mi" | Memory request. |