Detect Platform Secrets and ConfigMap Values
Secrets
| Custom Name | Default Name | Type | Description |
|---|---|---|---|
rl-registry-key | rl-registry-key | Required | Secret of type kubernetes.io/dockerconfigjson used for pulling images from a Docker registry. Secret is either created by umbrella chart (registry.createRegistrySecret) or already exists. |
<global.registryCredentialsCustomSecretName> | rl-registry-credentials | Required in Write Mode | Basic authentication secret which contains registry credentials. Secret is either created by umbrella chart (registry.createRegistryCredentialsSecret) or already exists. Required when Detect is deployed in Write Mode (global.appliance.configMode set to STANDARD). |
Values
Global Settings
| Key | Type | Default | Description |
|---|---|---|---|
| global.appliance | object | - | Global appliances configuration. |
| global.appliance.configMode | string | "CONFIGMAP" | Configuration mode of the appliance. Allowed values: CONFIGMAP (Configuration is provided with configmap), STANDARD (configuration is provided over UI). |
| global.applyRestrictedPolicy | bool | false | Apply needed parts of the restricted policy to all sub-charts. When enabled, Alloy should be disabled, as it is not currently supported under the restricted policy. |
| global.centralLoggingEnabled | bool | false | When set to true, all sub-charts enable central logging. When set to false, all sub-charts disable it. If SDM is not enabled (global.sdmEnabled: false), central logging is automatically disabled. |
| global.clusterDomainName | string | "cluster.local" | Cluster Domain Name |
| global.postgresCustomSecretName | string | nil | Postgres custom secret name. If not set, default secret name will be used. |
| global.quishingAnalysis | object | - | Configures quishing-analysis integration for extracting network addresses from media files (QR codes, OCR). Shared between Worker and SDM Portal. |
| global.quishingAnalysis.enabled | bool | false | Enable/disable quishing-analysis integration. |
| global.quishingAnalysis.maxPdfPages | int | 10 | Maximum number of PDF pages to process per file. |
| global.quishingAnalysis.timeout | int | 300 | Timeout in seconds for waiting for quishing-analysis results. |
| global.quishingAnalysis.topContainerOnly | bool | false | Process only top container (true) or also process children (false). |
| global.rabbitmqAdminCustomSecretName | string | nil | RabbitMQ custom admin secret name. If not set, default secret name will be used. |
| global.rabbitmqCustomSecretName | string | nil | RabbitMQ custom secret name. If not set, default secret name will be used. |
| global.registryCredentialsCustomSecretName | string | nil | Custom secret name for the basic-auth secret containing registry credentials. If not set, the default secret name rl-registry-credentials will be used. |
| global.riskToleranceMode | int | 2 | Configures the Risk Tolerance mode override applied to threat classification reports. low (1) escalates to Malicious on a confirmed network IOC; default (2) applies no override; high (3) de-escalates low-confidence verdicts to Goodware. Shared between Worker and SDM Portal. |
| global.sdmEnabled | bool | false | Controls whether Spectra Detect Manager chart will be deployed. When false, central logging is automatically disabled in sub-charts even if global.centralLoggingEnabled is true. |
| global.umbrella | bool | true | Notifies dependency charts that they are being used from the umbrella chart. Must always be set to true. |
| global.useReloader | bool | true | Whether to enable Reloader annotations. |
Secret Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| registry.authSecretName | string | "rl-registry-key" | The name of a Kubernetes secret resource used for pulling images from a Docker registry. |
| registry.authSecretPassword | string | nil | The password used for authenticating with the registry. |
| registry.authSecretUsername | string | nil | The username used for authenticating with the registry. |
| registry.createRegistryCredentialsSecret | bool | false | If enabled, a Kubernetes basic-auth secret containing registry credentials will be created. If disabled, the secret must be created manually in the namespace. |
| registry.createRegistrySecret | bool | true | If enabled, a Kubernetes secret for pulling images will be created. If disabled, the secret must be created manually in the namespace. |
| registry.imageRegistry | string | "registry.reversinglabs.com" | The image registry address. |
Kubernetes Settings
| Key | Type | Default | Description |
|---|---|---|---|
| imagePullSecrets | list | ["rl-registry-key"] | Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images. |
Pod Settings
| Key | Type | Default | Description |
|---|---|---|---|
| utilitiesImage | object | - | Configuration values of the utilities image used for pre upgrade job. |
| utilitiesImage.pullPolicy | string | "Always" | Image pull policy. Options: Always, IfNotPresent, Never. |
| utilitiesImage.tag | string | "6.4.0-14" | Image tag. |
Component Settings
| Key | Type | Default | Description |
|---|---|---|---|
| connectorIcap.enabled | bool | false | If enabled, connector-icap chart will be used and ICAP connector pods will be deployed. |
| connectorS3.enabled | bool | false | If enabled, connector-s3 chart will be used and S3 connector pods will be deployed. |
| logging.enabled | bool | false | If enabled, logging stack (Alloy + Loki + Grafana) will be deployed for log collection and visualization. |
| prometheus.enabled | bool | true | Has to be enabled when Prometheus is used. It creates a secret containing the Prometheus configuration, enabling other charts to connect. |
| reloader.enabled | bool | true | If enabled, reloader will be deployed. Reloader ensures that latest configuration is applied at all time. |
| worker.enabled | bool | true | If enabled, worker chart will be used and Worker service pods will be deployed. |