S3 Connector Secrets and ConfigMap Values

Secrets

Custom Name	Default Name	Type	Description
<input.customSecretName>	<Release.Name>-connector-s3-secret-<input.identifier>	Required	Authentication secret used to connect to AWS S3 or any S3-compatible storage system.

Values

Kubernetes Settings

Key	Type	Default	Description
affinity	object	{}	Affinity for pod scheduling. Allows to constrain which nodes your pod can be scheduled on based on node labels or ensure pods are co-located (or isolated) from other pods.
fullNameOverride	string	""	Overrides connector-s3 chart full name.
imagePullSecrets	list	["rl-registry-key"]	Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images.
monitoring.enabled	bool	false	Enable/disable monitoring with Prometheus.
monitoring.prometheusReleaseName	string	"kube-prometheus-stack"	Prometheus release name.
nameOverride	string	""	Overrides connector-s3 chart name.
nodeSelector	object	{}	Node labels for pod assignment. Pods will only be scheduled to nodes that match all labels defined here.
podAnnotations	object	-	Pod annotations. Additional custom annotations for authentication proxy pods. Note: checksum annotation is automatically added in the deployment when Reloader is disabled.
serviceAccount	object	-	ServiceAccount configuration.
serviceAccount.create	bool	true	Specifies whether a ServiceAccount will be created. If set to false, pre-create ServiceAccount named "name".
serviceAccount.name	string	""	The name of the ServiceAccount to use. If not set, the name of the ServiceAccount will equal the name of the workload.
tolerations	list	[]	Tolerations for pod assignment. Allows pods to be scheduled onto "tainted" nodes that would otherwise repel them. Used for dedicated hardware (GPUs) or specialized node pools.
useReloader	string	nil	Whether to enable Reloader annotations. When defined, this value takes precedence over global.useReloader.

Application Configuration

Key	Type	Default	Description
configuration	object	-	Connector S3 configuration values.
configuration.dbCleanupPollInterval	int	7200	Specifies time in seconds, in which the database cleanup will be run.
configuration.dbCleanupSampleThresholdInDays	int	21	Number of previous days that the data will be preserved.
configuration.diskHighPercent	int	0	Disk High Percent
configuration.inputs	list	[]	Configuration for S3 File Storage Input. S3 input.
configuration.maxFileSize	int	0	The maximum sample size in bytes that will be transmitted from the connector to the appliance for analysis. Setting it to 0 will disable the option.
configuration.maxUploadDelayTime	int	10000	Delay in milliseconds. In case the Worker cluster is under high load, this parameter is used to delay any new upload to the Worker cluster. The delay parameter will be multiplied by the internal factor determined by the load on the Worker cluster.
configuration.maxUploadRetries	int	100	Number of times the connector will attempt to upload the file to the processing appliance. Upon reaching the number of retries it will be discarded.
configuration.systemInfo	object	-	Configuration for S3 System Info. S3 System Info.
configuration.uploadTimeout	int	10000	Period (in milliseconds) between upload attempts of the sample being re-uploaded.
configuration.uploadTimeoutAlgorithm	string	"exponential"	The algorithm used for managing delays between re-uploading the samples into the processing appliance. In exponential, the delay is defined by multiplying the max upload timeout parameter by 2, until max value of 5 minutes. Linear backoff will always use the Max upload timeout value for the timeout period between re-uploads. Allowed values: exponential, linear.

Application Configuration - S3 File Storage Input

Key	Type	Default	Description
awsEnableArn	bool	false	Enable/disable the usage of AWS IAM roles to access S3 buckets without sharing secret keys.
awsExternalRoleId	string	""	The external ID of the role that will be assumed. This can be any string.
awsRoleArn	string	""	The role ARN created using the external role ID and an Amazon ID. In other words, the ARN which allows a Worker to obtain a temporary token, which then allows it to save to S3 buckets without a secret access key.
awsRoleSessionName	string	"ARNRoleSession"	Name of the session visible in AWS logs. This can be any string.
awsS3AccessKeyId	string	""	AWS S3 access key ID. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
awsS3SecretAccessKey	string	""	AWS S3 secret access key. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
bucket	string	""	Name of an existing S3 bucket which contains the samples to process.
createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the awsS3AccessKeyId and awsS3SecretAccessKey parameters. WARNING: Use this for convenience/testing only.
customSecretName	string	nil	Name of the secret in which the S3 storage credentials can be found. If no value is set, default secret name will be used.
deleteSourceFile	bool	false	Selecting the checkbox will allow the connector to delete source files on S3 storage after they have been processed. Required if 'requireAnalyze' or 'postActionsEnabled' is set to true.
endpoint	string	""	Custom S3 endpoint URL. Leave empty if using standard AWS S3.
folder	string	""	The input folder inside the specified bucket which contains the samples to process. All other samples (except those classified as unknown) will be ignored.
identifier	string	""	Unique name of S3 connection. Must contain only lowercase alphanumeric characters or hyphen (-). Must start and end with an alphanumeric character. Identifier length must be between 3 and 49 characters.
knownBucket	string	""	Specify the bucket into which the connector will store files classified as 'Goodware'. If empty, the input bucket will be used.
knownDestination	string	"goodware"	The folder into which the connector will store files classified as 'Goodware'. The folder is contained within the specified bucket field.
maliciousBucket	string	""	Specify the bucket into which the connector will store files classified as 'Malicious'. If empty, the input bucket will be used.
maliciousDestination	string	"malware"	The folder into which the connector will store files classified as 'Malicious'. The folder is contained within the specified bucket field.
objectMetadataFilter.classification	list	[]	Classification.
objectMetadataFilter.enabled	bool	false	Enable/disable selection criteria using metadata.
objectMetadataFilter.threatName	list	[]	Threat name.
paused	bool	false	Temporarily pause the continuous scanning of this Storage Input. This setting must be set to true to enable retro hunting.
postActionsEnabled	bool	false	Disable/enable post actions for S3 connectors.
priority	int	5	A higher Priority makes it more likely that files from this bucket will be processed first. The supported range is from 1 (highest) to 5 (lowest). Values outside of those minimum and maximum values will be replaced by the minimum or maximum, respectively. Multiple buckets may share the same priority.
requireAnalyze	bool	false	Disable/enable the requirement for analysis of data processed by connector.
serverSideEncryptionCustomerAlgorithm	string	""	Customer provided encryption algorithm.
serverSideEncryptionCustomerKey	string	""	Customer provided encryption key.
suspiciousBucket	string	""	Specify the bucket into which the connector will store files classified as 'Suspicious'. If empty, the input bucket will be used.
suspiciousDestination	string	"suspicious"	The folder into which the connector will store files classified as 'Suspicious'. The folder is contained within the specified bucket field.
unknownBucket	string	""	Specify the bucket into which the connector will store files classified as 'Unknown'. If empty, the input bucket will be used.
unknownDestination	string	"unknown"	The folder into which the connector will store files classified as 'Unknown'. The folder is contained within the specified bucket field.
useAssignedCredentials	boolean	false	Use AWS provided credentials. When enabled, application uses credentials assigned by AWS rather than authenticating with its own. This is used in combination with AWS Pod Identity and similar to avoid less safe long-term tokens.
verifySslCertificate	bool	true	Connect securely to the custom S3 instance. Deselect this to accept untrusted certificates. Applicable only when using a custom S3 endpoint.
zone	string	"us-east-1"	AWS S3 region.

Application Configuration - System Info

Key	Type	Default	Description
configuration.systemInfo.diskHighPercent	int	0	Dish high percent.
configuration.systemInfo.fetchChannelSize	int	40	Fetch channel size.
configuration.systemInfo.hostUUID	string	""	Host UUID.
configuration.systemInfo.maxConnections	int	10	Max number of connections.
configuration.systemInfo.maxSlowFetches	int	12	Max slow fetches.
configuration.systemInfo.numberOfRetries	int	300	Number of retries.
configuration.systemInfo.queueLoggingEnabled	bool	false	Enables central logging to rabbitmq. IMPORTANT: For events to be processed, central logging must also be enabled on the SDM-portal. This requires SDM-portal to be deployed with the umbrella chart or explicitly referenced in the sdmPortal section. If no reference is found, this will be automatically disabled to prevent RabbitMQ overflow.
configuration.systemInfo.requestTimeout	int	43200	Timeout for requests.
configuration.systemInfo.slowFetchChannelSize	int	100	Slow fetch channel size.
configuration.systemInfo.slowFetchPause	int	5	Slow fetch pause.
configuration.systemInfo.type	string	"tiscale"	Type.
configuration.systemInfo.verifyCert	bool	false	Verify SSL certificate.
configuration.systemInfo.waitTimeout	int	1000	Wait timeout.

Pod Settings

Key	Type	Default	Description
boltdb.claimName	string	nil	PVC name. If empty, default pvc name will be used.
enabled	bool	false	Enable or disable the S3 connector deployment.
image	object	-	Configuration values of the connector s3 image.
image.imagePullPolicy	string	"Always"	Image pull policy. Options: Always, IfNotPresent, Never.
image.tag	string	"0.40.6-1"	Image tag.
persistence	object	-	Data storage configuration (BoltDB).
persistence.accessModes	list	["ReadWriteOnce"]	Specifies the access modes for the volume.
persistence.requestStorage	string	"10Gi"	The amount of storage to request.
persistence.storageClassName	string	nil	Name of the StorageClass to use.
resources	object	-	Resource requests and limits for the container.
resources.limits	object	-	The maximum amount of resources the container is allowed to consume.
resources.limits.cpu	string	nil	CPU limit. Throttling occurs if the container exceeds this value.
resources.limits.memory	string	"6Gi"	Memory limit. If exceeded, the container may be terminated with an OOMKilled error.
resources.requests	object	-	The minimum amount of resources the container is guaranteed.
resources.requests.cpu	string	"4000m"	CPU request.
resources.requests.memory	string	"2Gi"	Memory request.
sdmPortal	object	-	Reference to the SDM portal service for central logging. Required if SDM Portal is deployed.
sdmPortal.namespace	string	""	The namespace where SDM Portal is deployed. Defaults to the Connector's namespace if left empty.
sdmPortal.port	string	nil	The port used to access the SDM Portal. Defaults to 8080 if not specified.
sdmPortal.releaseName	string	""	The release name of the SDM Portal. Fill this out if systemInfo.queueLoggingEnabled is true and SDM is deployed without an umbrella chart.
sdmPortal.urlOverride	string	""	Full URL of the SDM Portal (e.g., http://sdm.example.com). If provided, releaseName and namespace are ignored. Use this if SDM is outside the cluster.
sharedStorage	object	{"enabled":true,"mode":"moving"}	Configuration for shared storage between connector and receiver/worker.
sharedStorage.enabled	bool	true	Enables shared storage between connector and receiver/worker.
sharedStorage.mode	string	"moving"	Defines if files are downloaded directly to the shared storage ('direct') or first to tmp and then moved ('moving'). Only applicable when sharedStorage is enabled.
tmp	object	-	Configuration values for generic ephemeral volume for the connectors' /data/connectors/connector-s3/tmp directory.
tmp.accessModes	list	["ReadWriteOnce"]	Specifies the access modes for the volume.
tmp.requestStorage	string	"100Gi"	Requested storage size for the ephemeral volume.
tmp.storageClassName	string	nil	Name of the StorageClass to use for the ephemeral volume. If not set, emptyDir is used instead of an ephemeral volume.