SDM Portal Secrets and ConfigMap values

Secrets

Custom Name	Default Name	Type	Description	Used in Components (Pods)
<global.secrets.tiCloud.customSecretName>	<release_name>-secret-sdm-cloud	Required when related feature is enabled	Basic authentication secret which contains username and password for Spectra Intelligence authentication. Required when Spectra Intelligence is enabled (config.ticloud.enabled). Secret is either created manually (sdm-portal chart) or already exists.	Portal, Celery, DCS
<global.secrets.tiCloudProxy.customSecretName>	<release_name>-secret-sdm-cloud-proxy	Optional	Basic authentication secret which contains username and password for Spectra Intelligence proxy authentication. Secret is either created manually (sdm-portal chart) or already exists.	Portal, Celery
<global.secrets.oidc.customSecretName>	<release_name>-secret-sdm-oidc	Required when related feature is enabled (config.oidc.enabled)	Opaque secret which contains rp_client_id and rp_client_secret for OIDC authentication. Required when OIDC authentication is enabled (config.oidc.enabled). Secret is either created manually (sdm-portal chart) or already exists.	Portal, Celery
<global.secrets.ldap.credentials.customSecretName>	<release_name>-secret-sdm-ldap	Required when related feature is enabled	Opaque secret which contains bind_dn and bind_password for LDAP authentication. Required when LDAP authentication is enabled (config.ldap.enabled). Secret is either created manually (sdm-portal chart) or already exists.	Portal
<global.secrets.ldap.cacert.customSecretName>	<release_name>-secret-sdm-ldap-cacert	Required when related feature is enabled	Opaque secret which contains CA certificate for LDAP authentication. Required when LDAP authentication is enabled, and TLS features are enabled (config.ldap.enabled and config.ldap.tls and config.ldap.tlsRequireCert). Secret is either created manually (sdm-portal chart) or already exists.	Portal
<global.secrets.ldap.cert.customSecretName>	<release_name>-secret-sdm-ldap-cert	Required when related feature is enabled	Opaque secret which contains TLS certificate for LDAP server. Required when LDAP authentication is enabled and TLS features are enabled (config.ldap.enabled and config.ldap.tls and config.ldap.tlsRequireCert). Secret is either created manually (sdm-portal chart) or already exists.	Portal
<global.secrets.saml.customSecretName>	<release_name>-secret-sdm-saml-metadata	Required when related feature is enabled	Opaque secret which contains SAML federation metadata. Required when SAML authentication is enabled (config.saml.enabled). Secret is either created manually (sdm-portal chart) or already exists.	Portal

Values

Secret Configuration

Key	Type	Default	Description
secrets	object	-	Secret configuration values for Spectra Detect Portal
secrets.ldap	object	-	LDAP secret configuration values
secrets.ldap.cacert	object	-	Secret containing PEM encoded file with CA certificate under the ca.pem key.
secrets.ldap.cacert.caCertificate	string	nil	LDAP CA certificate in PEM format. Creates a Secret with the ca.pem key. Can be set with --set-file secrets.ldap.cacert.caCertificate=/path/to/file/ca_certificate.pem.
secrets.ldap.cacert.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the caCertificate value parameters. WARNING: Use this for convenience/testing only.
secrets.ldap.cert	object	-	Secret containing PEM encoded certificate for client authentication PEM under the cert.pem key.
secrets.ldap.cert.certificate	string	nil	LDAP client certificate in PEM format. Creates a Secret with the cert.pem key. Can be set with --set-file secrets.ldap.cert.certificate=/path/to/file/certificate.pem.
secrets.ldap.cert.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the certificate value parameters. WARNING: Use this for convenience/testing only.
secrets.ldap.credentials	object	-	Secret containing LDAP bind (bindDn and bindPassword) credentials.
secrets.ldap.credentials.bindDn	string	""	LDAP Bind DN. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.ldap.credentials.bindPassword	string	""	LDAP Bind Password. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.ldap.credentials.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the bindDn and bindPassword parameters. WARNING: Use this for convenience/testing only.
secrets.oidc	object	-	Secret configuration values for setting the OIDC client credentials.
secrets.oidc.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the rpClientId and rpClientSecret parameters. WARNING: Use this for convenience/testing only.
secrets.oidc.rpClientId	string	""	OpenID Connect client ID provided by OpenID Connect provider. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.oidc.rpClientSecret	string	""	OpenID Connect client secret provided by OpenID Connect provider. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.saml	object	-	Secret configuration values for setting the SAML integration.
secrets.saml.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the metadata value. WARNING: Use this for convenience/testing only.
secrets.saml.metadata	string	nil	SAML federation metadata XML. Creates a Secret with the metadata.xml key. Can be set with --set-file secrets.saml.metadata=/path/to/file/metadata.xml.
secrets.tiCloud	object	-	Secret configuration values for setting the Spectra Intelligence.
secrets.tiCloud.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the username and password parameters. WARNING: Use this for convenience/testing only.
secrets.tiCloud.password	string	""	Spectra Intelligence password. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.tiCloud.username	string	""	Spectra Intelligence username. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.tiCloudProxy	object	-	Secret configuration values for setting the Spectra Intelligence credentials when proxy is used.
secrets.tiCloudProxy.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the username and password parameters. WARNING: Use this for convenience/testing only.
secrets.tiCloudProxy.password	string	""	Cloud proxy password. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.tiCloudProxy.username	string	""	Cloud proxy username. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.

Kubernetes Settings

Key	Type	Default	Description
affinity	object	{}	Affinity for pod scheduling. Allows to constrain which nodes your pod can be scheduled on based on node labels or ensure pods are co-located (or isolated) from other pods.
imagePullSecrets	list	[{"name":"rl-registry-key"}]	Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images. Each item must be an object with a 'name' key.
ingress	object	-	Ingress configuration values.
ingress.annotations	object	{}	Custom annotations to fine-tune the Ingress Controller behavior.
ingress.className	string	"nginx"	IngressClass that will handle this resource. Must match an existing 'IngressClass' in the cluster.
ingress.enabled	bool	true	Enable/disable the creation of the Ingress resource.
ingress.host	string	""	The Fully Qualified Domain Name (FQDN) for the application. Required if 'enabled' is true.
ingress.paths[n]	object	-	A list of paths for this host. Each path must have a path and a pathType. For the root path, use "/" with pathType "Prefix".
ingress.paths[n].path	string	"/"	The URL path that this rule applies to. A single forward slash (/) represents the root or "catch-all" path.
ingress.paths[n].pathType	string	"Prefix"	Determines how the Ingress controller matches the URL path. 'Prefix' matches based on a URL path prefix split by '/'. This is the most common and flexible setting for web applications.
ingress.tls	object	-	TLS / SSL Configuration.
ingress.tls.certificateArn	string	""	The Amazon Resource Name (ARN) of the certificate for AWS Load Balancer Controller. Only applicable when 'className' is 'alb'.
ingress.tls.issuer	string	""	The name of the cert-manager ClusterIssuer or Issuer to request certificates from.
ingress.tls.issuerKind	string	"Issuer"	The resource type of the issuer. Typically, 'Issuer' (namespace-scoped) or 'ClusterIssuer' (cluster-wide).
nodeSelector	object	{}	Node labels for pod assignment. Pods will only be scheduled to nodes that match all labels defined here.
rbac	object	-	RBAC resource configuration values.
rbac.create	bool	true	Specifies whether Role and RoleBinding resources should be created.
serviceAccount	object	-	Service Account configuration values.
serviceAccount.annotations	object	{}	Additional annotations to add to the ServiceAccount.
serviceAccount.create	bool	true	Specifies whether a ServiceAccount should be created. If false, an existing ServiceAccount name should be provided in name variable.
serviceAccount.name	string	nil	The name of the ServiceAccount to use. If not set and create is true, default account name is used.
useReloader	string	nil	Whether to enable Reloader annotations. When defined, this value takes precedence over global.useReloader.

Application Configuration

Key	Type	Default	Description
config	object	-	SDM Portal configuration values.
config.centralConfig	object	-	Configure Central Configuration.
config.centralConfig.enabled	boolean	true	Enable/disable central configuration feature.
config.centralFileStorage	object	-	Configure file storage in Spectra Detect Manager, allowing connected Workers to store samples for pivoting to and reprocessing in Spectra Analyze.
config.centralFileStorage.enabled	boolean	false	Enable/disable file storage.
config.centralFileStorage.fileSizeLimit	int	400	File size limit in MiB. Samples larger than the set threshold will not be stored. Minimum: 1. Maximum: 400.
config.centralFileStorage.ttl	int	24	Sample retention period in hours after which the uploaded samples will be removed from the Central File Storage. Minimum: 1. Maximum: 2160.
config.centralLogging	object	-	Configure Central Logging, which is used to collect and display information about all events happening on connected Workers and Integrations.
config.centralLogging.enabled	bool	false	Enable/disable central logging.
config.centralLogging.retentionPeriod	int	90	Retention period in days. Minimum: 1. Maximum: 540.
config.classificationChanges	object	-	Monitor classification changes from Spectra Intelligence directly on the Spectra Detect Dashboard.
config.classificationChanges.enabled	bool	false	Subscribe to classification changes.
config.deepCloudAnalysis	object	-	Configure Deep Cloud Analysis. This uploads files to Spectra Intelligence for scanning with multiple AV engines, refining the final verdict (classification), risk score, and threat name. Depending on the configuration, this may increase processing load and require additional resources.
config.deepCloudAnalysis.enabled	bool	false	Enable/disable Deep Cloud Analysis.
config.deepCloudAnalysis.scanner1	string	""	AV scanner results to display in the Detections Overview preview.
config.deepCloudAnalysis.scanner2	string	""	AV scanner results to display in the Detections Overview preview.
config.deepCloudAnalysis.scanner3	string	""	AV scanner results to display in the Detections Overview preview.
config.deepCloudAnalysis.scanner4	string	""	AV scanner results to display in the Detections Overview preview.
config.deepCloudAnalysis.scanner5	string	""	AV scanner results to display in the Detections Overview preview.
config.rlapp	object	-	General SDM Portal configuration.
config.rlapp.allowedHosts	list	[]	A list of host/domain names that this application site can serve.
config.rlapp.sessionCookieAge	int	604800	Duration of the login session, in seconds. Minimum: 60 (1 minute). Maximum: 7776000 (90 days).
config.rlapp.sessionTimeoutAutomaticallyLogout	bool	false	If true, automatically log out inactive users.
config.rlapp.sessionTimeoutPeriod	int	600	Period of inactivity before sign out, in seconds. Minimum: 60 (1 minute). Maximum: 2592000 (30 days).
config.smtp	object	-	SMTP Settings.
config.smtp.defaultFromEmail	string	"online@reversinglabs.com"	Default email address to use for automated correspondence.
config.sync	object	-	Synchronization settings.
config.sync.yaraRulesetsEnabled	boolean	false	Allow connected appliances to synchronize YARA rulesets.
config.ticloud	object	-	Spectra Intelligence settings.
config.ticloud.enabled	boolean	false	Enable Spectra Intelligence.
config.ticloud.proxyHost	string	""	Proxy hostname for routing requests from the appliance to Spectra Intelligence.
config.ticloud.proxyPort	integer	25	Proxy port number. Minimum: 0. Maximum: 65535.
config.ticloud.timeout	integer	60	Specifies how long to wait before the Spectra Intelligence connection times out. Minimum: 1. Maximum: 1000.

Application Configuration - LDAP

Key	Type	Default	Description
config.ldap	object	-	Settings for LDAP authentication.
config.ldap.denyGroup	string	""	Authentication will fail for any user that belongs to this group.
config.ldap.enabled	boolean	false	Enable/disable LDAP authentication.
config.ldap.groupSchemaClass	string	"group"	The objectClass value used when searching for groups.
config.ldap.groupSchemaNameAttr	string	"cn"	The group name field.
config.ldap.groupSchemaType	string	"member"	Group schema type. Allowed values: uniqueMember and member.
config.ldap.groupSearchBaseDn	string	""	Root node in LDAP from which to search for groups. Example: 'cn=users,dc=example,dc=com'.
config.ldap.groupSearchScope	integer	2	Scope. Allowed values: 0 (Base), 1 (One level), 2 (Subtree), 3 (Subordinate).
config.ldap.host	string	""	Hostname or IP of the server running LDAP.
config.ldap.port	integer	389	LDAP server port. Minimum: 0. Maximum: 65535.
config.ldap.requireGroup	string	""	Authentication will fail for any user that does not belong to this group. Example: 'cn=enabled,ou=groups,dc=example,dc=com'
config.ldap.tls	boolean	true	If true, use Transport Layer Security (TLS) connection.
config.ldap.tlsRequireCert	boolean	false	If true, TLS certificate is required.
config.ldap.userAttrMapEmail	string	"mail"	Field to map to the email address.
config.ldap.userAttrMapFirstName	string	"givenName"	Field to map to the first name.
config.ldap.userAttrMapLastName	string	"sn"	Field to map to the last name.
config.ldap.userFlagsByGroupIsActive	string	""	Users will be marked as active only if they belong to this group. Example: 'cn=active,ou=users,dc=example,dc=com'.
config.ldap.userFlagsByGroupIsSuperuser	string	""	Users will be marked as superusers only if they belong to this group. Example: 'cn=admins,ou=groups,dc=example,dc=com'.
config.ldap.userSchemaClass	string	"user"	The objectClass value used when searching for users.
config.ldap.userSchemaNameAttr	string	"sAMAccountName"	The username field. Examples: 'sAMAccountName' or 'cn'.
config.ldap.userSearchBaseDn	string	""	Root node in LDAP from which to search for users. Example: 'cn=users,dc=example,dc=com.'
config.ldap.userSearchScope	integer	2	Scope. Allowed values: 0 (Base), 1 (One level), 2 (Subtree), 3 (Subordinate).

Application Configuration - OIDC

Key	Type	Default	Description
config.oidc	object	-	Configure authentication with an OpenID Connect client.
config.oidc.accessDenyGroup	string	""	Authentication will fail for any user that belongs to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.oidc.accessRequireGroup	string	""	Authentication will fail for any user that does not belong to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.oidc.audience	string	""	Identifies the intended recipient of the token.
config.oidc.claimsSource	string	"ID_TOKEN"	Source used to extract user claims. Allowed values: ID_TOKEN, USER_INFO_ENDPOINT, ACCESS_TOKEN.
config.oidc.clientType	string	"CONFIDENTIAL"	Authenticate with client secret (CONFIDENTIAL) or without (PUBLIC).
config.oidc.enabled	boolean	false	Enable/disable authentication with OIDC.
config.oidc.issuer	string	""	Issuer.
config.oidc.mapClaimAccessGroupsDelimiter	string	""	Character to split the User Access Groups on. Optional. The maximum length of the delimiter is 2 characters. These characters must not be used in any access group name.
config.oidc.mapClaimEmail	string	"email"	The claim containing the unique email address.
config.oidc.mapClaimFirstName	string	"given_name"	The claim containing the user's first name.
config.oidc.mapClaimGroups	string	"group"	The claim containing the list of user's groups.
config.oidc.mapClaimGroupsDelimiter	string	""	Character to split the Groups string on. Optional.
config.oidc.mapClaimLastName	string	"family_name"	The claim containing the user's last name.
config.oidc.mapClaimUsername	string	"unique_name"	The claim containing the unique username.
config.oidc.opAuthorizationEndpoint	string	""	URL of your OpenID Connect provider authorization endpoint.
config.oidc.opJwksEndpoint	string	""	URL of your OpenID Connect provider JWKS endpoint.
config.oidc.opTokenEndpoint	string	""	URL of your OpenID Connect provider token endpoint.
config.oidc.opUserEndpoint	string	""	URL of your OpenID Connect provider userinfo endpoint.
config.oidc.pkceEnabled	boolean	false	If true, use PKCE (Proof Key of Code Exchange) to prevent auth code interception.
config.oidc.promptLogin	boolean	false	If true, require the authorization server to reauthenticate the user even if the user is already authenticated.
config.oidc.relyingPartId	string	""	Relying Party ID.
config.oidc.rpIdpSignKey	string	""	The key used to sign ID tokens when using an RSA sign algorithm.
config.oidc.rpScopes	string	"openid allatclaims"	The OpenID Connect scopes to request during login.
config.oidc.rpSignAlgo	string	"RS256"	Signature algorithm. Allowed values: RS256 and HS256.
config.oidc.timeout	int	30	Timeout in seconds for OIDC HTTP requests. Should be less than uwsgi harakiri timeout (default 60s).
config.oidc.userFlagsByGroupIsActive	string	""	Users will be marked as active only if they belong to one or more of the provided group(s). Use the access group delimiter to separate multiple group names.
config.oidc.userFlagsByGroupIsSuperuser	string	""	Users will be marked as superusers only if they belong to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.oidc.verifySsl	boolean	true	Controls whether the OpenID Connect client verifies the SSL certificate of the OP responses.

Application Configuration - SAML

Key	Type	Default	Description
config.saml	object	-	Configure authentication with SAML.
config.saml.accessDenyGroup	string	""	Authentication will fail for any user that belongs to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.saml.accessRequireGroup	string	""	Authentication will fail for any user that does not belong to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.saml.allowUnsolicited	bool	false	Allow unsolicited responses from IdP.
config.saml.enabled	boolean	false	Enable/disable SAML authentication.
config.saml.entityId	string	""	Entity ID.
config.saml.mapClaimAccessGroupsDelimiter	string	""	Character to split the User Access Groups on. Optional. The maximum length of the delimiter is 2 characters. These characters must not be used in any access group name.
config.saml.mapClaimEmail	string	"email"	The claim containing the unique email address.
config.saml.mapClaimFirstName	string	"given_name"	The claim containing the user's first name.
config.saml.mapClaimGroups	string	"group"	The claim that contains the list of user's groups.
config.saml.mapClaimGroupsDelimiter	string	""	Character to split the Groups string on. Optional.
config.saml.mapClaimLastName	string	"family_name"	The claim containing the user's last name.
config.saml.mapClaimUsername	string	"unique_name"	The claim containing the unique username.
config.saml.userFlagsByGroupIsActive	string	""	Users will be marked as active only if they belong to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.
config.saml.userFlagsByGroupIsSuperuser	string	""	Users will be marked as superusers only if they belong to one or more of the provided group(s). Use the access groups delimiter to separate multiple group names.

Pod Settings

Key	Type	Default	Description
autoscaling	object	-	Autoscaling configuration values.
autoscaling.cooldownPeriod	int	180	The period to wait after the last trigger reported active before scaling the resource back to 0, in seconds.
autoscaling.enabled	bool	false	Enable/disable autoscaling.
autoscaling.maxReplicas	int	8	Maximum number of replicas that can be deployed when scaling in enabled.
autoscaling.minReplicas	int	1	Minimum number of replicas that need to be deployed.
autoscaling.pollingInterval	int	10	Interval to check each trigger, in seconds.
autoscaling.scaleDown	object	-	ScaleDown configuration values.
autoscaling.scaleDown.stabilizationWindow	int	180	Number of continuous seconds in which the scaling condition is not met. When this is reached, scale down is started.
autoscaling.scaleUp	object	-	ScaleUp configuration values.
autoscaling.scaleUp.numberOfPods	int	1	Number of pods that can be scaled in the defined period.
autoscaling.scaleUp.period	int	30	Interval in which the numberOfPods value is applied.
autoscaling.scaleUp.stabilizationWindow	int	15	Number of continuous seconds in which the scaling condition is met. When this is reached, scale up is started.
autoscaling.triggerCPUValue	int	75	CPU value (in percentage), which will cause scaling when reached. The percentage is taken from the resource.limits.cpu value. Limits have to be set up.
image	object	-	Configuration values of the SDM Portal image.
image.pullPolicy	string	"Always"	Image pull policy. Options: Always, IfNotPresent, Never.
image.tag	string	"6.2.0-34"	Image tag.
registry	object	-	Registry configuration values used by SDM Portal.
registry.customSecretName	string	nil	Custom secret name for the registry credentials secret. When deployed with an umbrella chart, this value is ignored, and global.registryCredentialsCustomSecretName value is used. If not set, the default secret name rl-registry-credentials will be used.
replicaCount	int	1	Number of desired pod instances. Ignored when autoscaling is enabled.
resources	object	-	Resource requests and limits for the container.
resources.limits	object	-	The maximum amount of resources the container is allowed to consume.
resources.limits.cpu	string	"3000m"	CPU limit. Throttling occurs if the container exceeds this value.
resources.limits.memory	string	"4Gi"	Memory limit. If exceeded, the container may be terminated with an OOMKilled error.
resources.requests	object	-	The minimum amount of resources the container is guaranteed.
resources.requests.cpu	string	"2000m"	CPU request.
resources.requests.memory	string	"2Gi"	Memory request.
utilitiesImage	object	-	Configuration values of the utilities image used by SDM Portal.
utilitiesImage.pullPolicy	string	"Always"	Image pull policy. Options: Always, IfNotPresent, Never.
utilitiesImage.tag	string	"6.2.0-14"	Image tag.