Detect Platform Secrets and ConfigMap Values
Secrets
| Custom Name | Default Name | Type | Description |
|---|---|---|---|
registry.authSecretName | rl-registry-key | Required | Secret of type kubernetes.io/dockerconfigjson used for pulling images and Helm charts from a Docker registry. Secret is either created by umbrella chart (registry.createRegistrySecret) or already exists. |
global.s3Connections.<connection_name>.secrets.credentials.customSecretName | <Release.Name>-secret-conn-<connection_name> | Required when related feature is enabled | Authentication secret used to connect to AWS S3 or any S3-compatible storage system. Required when S3 connector is enabled (connectorS3.enabled) or when any type of S3 storage (File, SNS, Report, Unpacked) is enabled on Worker (worker.configuration.s3.enabled or worker.configuration.reportS3.enabled or worker.configuration.unpackedS3.enabled or worker.configuration.sns.enabled). |
Values
Global Settings
| Key | Type | Default | Description |
|---|---|---|---|
| global.appliance | object | - | Global appliances configuration. |
| global.appliance.configMode | string | "CONFIGMAP" | Configuration mode of the appliance. Allowed values: CONFIGMAP (Configuration is provided with configmap), STANDARD (configuration is provided over UI). |
| global.applyRestrictedPolicy | bool | false | Apply needed parts of the restricted policy to all sub-charts. When enabled, Alloy should be disabled, as it is not currently supported under the restricted policy. |
| global.arnProfiles | object | - | ARN profiles configurations. Each ARN profile should have a unique identifier as the key. The identifier will be used to reference the ARN profile in the application configuration. Structure of the ARN profile object can be found in ARN Profile Configuration section. |
| global.centralLoggingEnabled | bool | false | When set to true, all sub-charts enable central logging. When set to false, all sub-charts disable it. If SDM is not enabled (global.sdmEnabled: false), central logging is automatically disabled. |
| global.clusterDomainName | string | "cluster.local" | Cluster Domain Name |
| global.postgresCustomSecretName | string | nil | Postgres custom secret name. If not set, default secret name will be used. |
| global.quishingAnalysis | object | - | Configures quishing-analysis integration for extracting network addresses from media files (QR codes, OCR). Shared between Worker and SDM Portal. |
| global.quishingAnalysis.enabled | bool | false | Enable/disable quishing-analysis integration. |
| global.quishingAnalysis.maxPdfPages | int | 10 | Maximum number of PDF pages to process per file. |
| global.quishingAnalysis.timeout | int | 300 | Timeout in seconds for waiting for quishing-analysis results. |
| global.quishingAnalysis.topContainerOnly | bool | false | Process only top container (true) or also process children (false). |
| global.rabbitmqAdminCustomSecretName | string | nil | RabbitMQ custom admin secret name. If not set, default secret name will be used. |
| global.rabbitmqCustomSecretName | string | nil | RabbitMQ custom secret name. If not set, default secret name will be used. |
| global.riskToleranceMode | int | 2 | Configures the Risk Tolerance mode override applied to threat classification reports. low (1) escalates to Malicious on a confirmed network IOC; default (2) applies no override; high (3) de-escalates low-confidence verdicts to Goodware. Shared between Worker and SDM Portal. |
| global.s3Connections | object | - | S3 connection configurations. Each connection should have a unique identifier as the key. The identifier will be used to reference the connection in the application configuration. Structure of the connection object can be found in S3 Connection Configuration section. |
| global.sdmEnabled | bool | false | Controls whether Spectra Detect Manager chart will be deployed. When false, central logging is automatically disabled in sub-charts even if global.centralLoggingEnabled is true. |
| global.umbrella | bool | true | Notifies dependency charts that they are being used from the umbrella chart. Must always be set to true. |
| global.useReloader | bool | true | Whether to enable Reloader annotations. |
Secret Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| registry.authSecretName | string | "rl-registry-key" | The name of a Kubernetes secret resource used for pulling images from a Docker registry. |
| registry.authSecretPassword | string | nil | The password used for authenticating with the registry. |
| registry.authSecretUsername | string | nil | The username used for authenticating with the registry. |
| registry.createRegistrySecret | bool | true | If enabled, a Kubernetes secret for pulling images will be created. If disabled, the secret must be created manually in the namespace. |
| registry.imageRegistry | string | "registry.reversinglabs.com" | The image registry address. |
S3 Connection Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| certificate | string | "" | Used when SSL verification is enabled. Note: Only certificate should be provided, do not include the private key. |
| endpointUrl | string | "" | Only required in non-AWS setups in order to store files to an S3-compatible server. When this parameter is left blank, the default is https://aws.amazonaws.com. Supported pattern(s): https?://.+. |
| maxReattempts | int | 5 | Maximum number of retries when uploading to an S3-compatible server. |
| payloadSigningEnabled | bool | false | Specifies whether to include an SHA-256 checksum with Amazon Signature Version 4 payloads. |
| region | string | "us-east-1" | Specify the correct AWS geographical region where the S3 bucket is located. Required parameter, ignored for non-AWS setups. |
| secrets.credentials | object | - | Configuration values for the credentials secret. |
| secrets.credentials.awsS3AccessKeyId | string | "" | AWS S3 access key ID. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments. |
| secrets.credentials.awsS3SecretAccessKey | string | "" | AWS S3 secret access key. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments. |
| secrets.credentials.createUserSecret | bool | false | If true, the chart creates a Kubernetes Secret using the awsS3AccessKeyId and awsS3SecretAccessKey parameters. WARNING: Use this for convenience/testing only. |
| secrets.credentials.customSecretName | string | "" | Custom secret name. If not set, default secret name will be used. |
| serverSideEncryption | string | "" | Specify the encryption algorithm used on the target S3 bucket (e.g. aws:kms or AES256). |
| sslVerify | bool | false | Enable/disable SSL verification. |
| useAssignedCredentials | boolean | false | Use AWS provided credentials. When enabled, application uses credentials assigned by AWS rather than authenticating with its own. This is used in combination with AWS Pod Identity and similar to avoid less safe long-term tokens. If enabled, secrets.credentials.createUserSecret must be set to false. |
ARN Profile Configuration
| Key | Type | Default | Description |
|---|---|---|---|
| enableArn | bool | false | Enables or disables the AWS Role Assumption. |
| externalRoleId | string | "" | The external ID of the role that will be assumed. This can be any string. Usually, it’s an ID provided by the entity which uses (but doesn’t own) an S3 bucket. The owner of that bucket takes that external ID and builds an ARN with it. |
| refreshBuffer | int | 5 | Number of seconds to fetch a new ARN token before the token timeout is reached. |
| roleArn | string | "" | The role ARN created using the external role ID and an Amazon ID. In other words, the ARN which allows a Worker to obtain a temporary token, which then allows it to save to S3 buckets without a secret access key. |
| roleSessionName | string | "AssumeRoleSession" | Name of the session visible in AWS logs. Can be any string. |
| tokenDuration | int | 900 | How long before the authentication token expires and is refreshed. The minimum value is 900 seconds. |
Kubernetes Settings
| Key | Type | Default | Description |
|---|---|---|---|
| imagePullSecrets | list | ["rl-registry-key"] | Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images. |
Pod Settings
| Key | Type | Default | Description |
|---|---|---|---|
| utilitiesImage | object | - | Configuration values of the utilities image used for pre upgrade job. |
| utilitiesImage.pullPolicy | string | "Always" | Image pull policy. Options: Always, IfNotPresent, Never. |
| utilitiesImage.tag | string | "7.0.0-2" | Image tag. |
Component Settings
| Key | Type | Default | Description |
|---|---|---|---|
| connectorIcap.enabled | bool | false | If enabled, connector-icap chart will be used and ICAP connector pods will be deployed. |
| connectorS3.enabled | bool | false | If enabled, connector-s3 chart will be used and S3 connector pods will be deployed. |
| logging.enabled | bool | false | If enabled, logging stack (Alloy + Loki + Grafana) will be deployed for log collection and visualization. |
| prometheus.enabled | bool | true | Has to be enabled when Prometheus is used. It creates a secret containing the Prometheus configuration, enabling other charts to connect. |
| reloader.enabled | bool | true | If enabled, reloader will be deployed. Reloader ensures that latest configuration is applied at all time. |
| worker.enabled | bool | true | If enabled, worker chart will be used and Worker service pods will be deployed. |