S3 Connector Secrets and ConfigMap Values

Secrets

S3 Connection Secrets

Custom Name	Default Name	Type	Description
global.s3Connections.<connection_name>.secrets.credentials.customSecretName	<Release.Name>-secret-conn-<connection_name>	Required	Authentication secret used to connect to AWS S3 or any S3-compatible storage system.

Values

Connection Configuration

Key	Type	Default	Description
certificate	string	""	Used when SSL verification is enabled. Note: Only certificate should be provided, do not include the private key.
endpointUrl	string	""	Only required in non-AWS setups in order to store files to an S3-compatible server. When this parameter is left blank, the default is https://aws.amazonaws.com. Supported pattern(s): https?://.+.
maxReattempts	int	5	Maximum number of retries when uploading to an S3-compatible server.
payloadSigningEnabled	bool	false	Specifies whether to include an SHA-256 checksum with Amazon Signature Version 4 payloads.
region	string	"us-east-1"	Specify the correct AWS geographical region where the S3 bucket is located. Required parameter, ignored for non-AWS setups.
secrets.credentials	object	-	Configuration values for the credentials secret.
secrets.credentials.awsS3AccessKeyId	string	""	AWS S3 access key ID. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.credentials.awsS3SecretAccessKey	string	""	AWS S3 secret access key. Only used if 'createUserSecret' is set to 'true'. WARNING: Use this for convenience/testing only. Do not store sensitive credentials in configuration files that are committed to Git. Consider using a dedicated secret management solution (e.g., Sealed Secrets, External Secrets, or Vault) for production environments.
secrets.credentials.createUserSecret	bool	false	If true, the chart creates a Kubernetes Secret using the awsS3AccessKeyId and awsS3SecretAccessKey parameters. WARNING: Use this for convenience/testing only.
secrets.credentials.customSecretName	string	""	Custom secret name. If not set, default secret name will be used.
serverSideEncryption	string	""	Specify the encryption algorithm used on the target S3 bucket (e.g. aws:kms or AES256).
sslVerify	bool	false	Enable/disable SSL verification.
useAssignedCredentials	boolean	false	Use AWS provided credentials. When enabled, application uses credentials assigned by AWS rather than authenticating with its own. This is used in combination with AWS Pod Identity and similar to avoid less safe long-term tokens. If enabled, secrets.credentials.createUserSecret must be set to false.

ARN Profile Configuration

Key	Type	Default	Description
enableArn	bool	false	Enables or disables the AWS Role Assumption.
externalRoleId	string	""	The external ID of the role that will be assumed. This can be any string. Usually, it’s an ID provided by the entity which uses (but doesn’t own) an S3 bucket. The owner of that bucket takes that external ID and builds an ARN with it.
refreshBuffer	int	5	Number of seconds to fetch a new ARN token before the token timeout is reached.
roleArn	string	""	The role ARN created using the external role ID and an Amazon ID. In other words, the ARN which allows a Worker to obtain a temporary token, which then allows it to save to S3 buckets without a secret access key.
roleSessionName	string	"AssumeRoleSession"	Name of the session visible in AWS logs. Can be any string.
tokenDuration	int	900	How long before the authentication token expires and is refreshed. The minimum value is 900 seconds.

Kubernetes Settings

Key	Type	Default	Description
affinity	object	{}	Affinity for pod scheduling. Allows to constrain which nodes your pod can be scheduled on based on node labels or ensure pods are co-located (or isolated) from other pods.
fullNameOverride	string	""	Overrides connector-s3 chart full name.
imagePullSecrets	list	["rl-registry-key"]	Set of stored credentials (authentication tokens) that allows Kubernetes node to "log in" to a private container registry to pull restricted images.
monitoring.enabled	bool	false	Enable/disable monitoring with Prometheus.
monitoring.prometheusReleaseName	string	"kube-prometheus-stack"	Prometheus release name.
nameOverride	string	""	Overrides connector-s3 chart name.
nodeSelector	object	{}	Node labels for pod assignment. Pods will only be scheduled to nodes that match all labels defined here.
podAnnotations	object	-	Pod annotations. Additional custom annotations for authentication proxy pods. Note: checksum annotation is automatically added in the deployment when Reloader is disabled.
serviceAccount	object	-	ServiceAccount configuration.
serviceAccount.create	bool	true	Specifies whether a ServiceAccount will be created. If set to false, pre-create ServiceAccount named "name".
serviceAccount.name	string	""	The name of the ServiceAccount to use. If not set, the name of the ServiceAccount will equal the name of the workload.
tolerations	list	[]	Tolerations for pod assignment. Allows pods to be scheduled onto "tainted" nodes that would otherwise repel them. Used for dedicated hardware (GPUs) or specialized node pools.
useReloader	string	nil	Whether to enable Reloader annotations. When defined, this value takes precedence over global.useReloader.

Application Configuration

Key	Type	Default	Description
configuration	object	-	Connector S3 configuration values.
configuration.dbCleanupPollInterval	int	7200	Specifies time in seconds, in which the database cleanup will be run.
configuration.dbCleanupSampleThresholdInDays	int	21	Number of previous days that the data will be preserved.
configuration.inputs	list	[]	Configuration for S3 File Storage Input. S3 input.
configuration.maxFileSize	int	0	The maximum sample size in bytes that will be transmitted from the connector to the appliance for analysis. Setting it to 0 will disable the option.
configuration.maxUploadDelayTime	int	10000	Delay in milliseconds. In case the Worker cluster is under high load, this parameter is used to delay any new upload to the Worker cluster. The delay parameter will be multiplied by the internal factor determined by the load on the Worker cluster.
configuration.maxUploadRetries	int	100	Number of times the connector will attempt to upload the file to the processing appliance. Upon reaching the number of retries it will be discarded.
configuration.systemInfo	object	-	Configuration for S3 System Info. S3 System Info.
configuration.uploadTimeout	int	10000	Period (in milliseconds) between upload attempts of the sample being re-uploaded.
configuration.uploadTimeoutAlgorithm	string	"exponential"	The algorithm used for managing delays between re-uploading the samples into the processing appliance. In exponential, the delay is defined by multiplying the max upload timeout parameter by 2, until max value of 5 minutes. Linear backoff will always use the Max upload timeout value for the timeout period between re-uploads. Allowed values: exponential, linear.

Application Configuration - S3 File Storage Input

Key	Type	Default	Description
arnProfileName	string	""	Reference to the ARN profile that should be used as default for S3 operations. ARN profiles can be defined in global.arnProfiles. If not defined, default values defined in ARN Profile Configuration section. will be used.
bucket	string	""	Name of an existing S3 bucket which contains the samples to process.
connectionName	string	""	Reference to the connection that should be used as default for S3 operations. Connections can be defined in global.connections. Must be defined.
deleteSourceFile	bool	false	Selecting the checkbox will allow the connector to delete source files on S3 storage after they have been processed. Required if 'requireAnalyze' or 'postActionsEnabled' is set to true.
folder	string	""	The input folder inside the specified bucket which contains the samples to process. All other samples (except those classified as unknown) will be ignored.
identifier	string	""	Unique name of S3 connection. Must contain only lowercase alphanumeric characters or hyphen (-). Must start and end with an alphanumeric character. Identifier length must be between 3 and 49 characters.
knownBucket	string	""	Specify the bucket into which the connector will store files classified as 'Goodware'. If empty, the input bucket will be used.
knownDestination	string	"goodware"	The folder into which the connector will store files classified as 'Goodware'. The folder is contained within the specified bucket field.
maliciousBucket	string	""	Specify the bucket into which the connector will store files classified as 'Malicious'. If empty, the input bucket will be used.
maliciousDestination	string	"malware"	The folder into which the connector will store files classified as 'Malicious'. The folder is contained within the specified bucket field.
objectMetadataFilter.classification	list	[]	Classification.
objectMetadataFilter.enabled	bool	false	Enable/disable selection criteria using metadata.
objectMetadataFilter.threatName	list	[]	Threat name.
paused	bool	false	Temporarily pause the continuous scanning of this Storage Input. This setting must be set to true to enable retro hunting.
postActionsEnabled	bool	false	Disable/enable post actions for S3 connectors.
priority	int	5	A higher Priority makes it more likely that files from this bucket will be processed first. The supported range is from 1 (highest) to 5 (lowest). Values outside of those minimum and maximum values will be replaced by the minimum or maximum, respectively. Multiple buckets may share the same priority.
requireAnalyze	bool	false	Disable/enable the requirement for analysis of data processed by connector.
serverSideEncryptionCustomerAlgorithm	string	""	Customer provided encryption algorithm.
serverSideEncryptionCustomerKey	string	""	Customer provided encryption key.
suspiciousBucket	string	""	Specify the bucket into which the connector will store files classified as 'Suspicious'. If empty, the input bucket will be used.
suspiciousDestination	string	"suspicious"	The folder into which the connector will store files classified as 'Suspicious'. The folder is contained within the specified bucket field.
unknownBucket	string	""	Specify the bucket into which the connector will store files classified as 'Unknown'. If empty, the input bucket will be used.
unknownDestination	string	"unknown"	The folder into which the connector will store files classified as 'Unknown'. The folder is contained within the specified bucket field.

Application Configuration - System Info

Key	Type	Default	Description
configuration.systemInfo.diskHighPercent	int	0	Dish high percent.
configuration.systemInfo.fetchChannelSize	int	40	Fetch channel size.
configuration.systemInfo.hostUUID	string	""	Host UUID.
configuration.systemInfo.maxConnections	int	10	Max number of connections.
configuration.systemInfo.maxSlowFetches	int	12	Max slow fetches.
configuration.systemInfo.numberOfRetries	int	300	Number of retries.
configuration.systemInfo.requestTimeout	int	43200	Timeout for requests.
configuration.systemInfo.slowFetchChannelSize	int	100	Slow fetch channel size.
configuration.systemInfo.slowFetchPause	int	5	Slow fetch pause.
configuration.systemInfo.type	string	"tiscale"	Type.
configuration.systemInfo.verifyCert	bool	false	Verify SSL certificate.
configuration.systemInfo.version	string	"5.6.0"	Version.
configuration.systemInfo.waitTimeout	int	1000	Wait timeout.

Pod Settings

Key	Type	Default	Description
boltdb.claimName	string	nil	PVC name. If empty, default pvc name will be used.
enabled	bool	false	Enable or disable the S3 connector deployment.
image	object	-	Configuration values of the connector s3 image.
image.pullPolicy	string	"Always"	Image pull policy. Options: Always, IfNotPresent, Never.
image.tag	string	"0.40.7-1"	Image tag.
persistence	object	-	Data storage configuration (BoltDB).
persistence.accessModes	list	["ReadWriteOnce"]	Specifies the access modes for the volume.
persistence.requestStorage	string	"10Gi"	The amount of storage to request.
persistence.storageClassName	string	nil	Name of the StorageClass to use.
resources	object	-	Resource requests and limits for the container.
resources.limits	object	-	The maximum amount of resources the container is allowed to consume.
resources.limits.cpu	string	nil	CPU limit. Throttling occurs if the container exceeds this value.
resources.limits.memory	string	"6Gi"	Memory limit. If exceeded, the container may be terminated with an OOMKilled error.
resources.requests	object	-	The minimum amount of resources the container is guaranteed.
resources.requests.cpu	string	"4000m"	CPU request.
resources.requests.memory	string	"2Gi"	Memory request.
sdmPortal	object	-	Reference to the SDM portal service for central logging. Required if SDM Portal is deployed.
sdmPortal.namespace	string	""	The namespace where SDM Portal is deployed. Defaults to the Connector's namespace if left empty.
sdmPortal.port	string	nil	The port used to access the SDM Portal. Defaults to 8080 if not specified.
sdmPortal.releaseName	string	""	The release name of the SDM Portal. Fill this out if systemInfo.queueLoggingEnabled is true and SDM is deployed without an umbrella chart.
sdmPortal.urlOverride	string	""	Full URL of the SDM Portal (e.g., http://sdm.example.com). If provided, releaseName and namespace are ignored. Use this if SDM is outside the cluster.
sharedStorage	object	{"enabled":true,"mode":"moving"}	Configuration for shared storage between connector and receiver/worker.
sharedStorage.enabled	bool	true	Enables shared storage between connector and receiver/worker.
sharedStorage.mode	string	"moving"	Defines if files are downloaded directly to the shared storage ('direct') or first to tmp and then moved ('moving'). Only applicable when sharedStorage is enabled.
tmp	object	-	Configuration values for generic ephemeral volume for the connectors' /data/connectors/connector-s3/tmp directory.
tmp.accessModes	list	["ReadWriteOnce"]	Specifies the access modes for the volume.
tmp.requestStorage	string	"100Gi"	Requested storage size for the ephemeral volume.
tmp.storageClassName	string	nil	Name of the StorageClass to use for the ephemeral volume. If not set, emptyDir is used instead of an ephemeral volume.
utilitiesImage	object	-	Configuration values of the utilities image used for init containers.
utilitiesImage.pullPolicy	string	"Always"	Image pull policy. Options: Always, IfNotPresent, Never.
utilitiesImage.tag	string	"7.0.0-2"	Image tag.