Skip to main content

Object storage

Holds generated report artifacts: PDFs, radar images, exports. Not provisioned by the chart.

Native GCS​

On GKE, the cleanest option. Reads through Application Default Credentials, which resolve to the pod's Workload Identity. No endpoint, no HMAC key, no static credentials.

app:
  config:
    STORAGE_BACKEND: "gcs"
    GCS_SIGNER_SERVICE_ACCOUNT: presponsieve@<PROJECT>.iam.gserviceaccount.com

externalObjectStore:
  endpointUrl: ""
  bucket: <PROJECT>-presponsieve-artifacts
  region: <REGION>
  accessKeyId: ""
  secretAccessKey: ""
warning

GCS_SIGNER_SERVICE_ACCOUNT must equal the service account in serviceAccount.annotations, and that account needs roles/iam.serviceAccountTokenCreator on itself.

Workload Identity credentials carry no private key, so signing V4 download URLs goes through IAM signBlob. Miss this binding and everything works except report downloads, which fail with a signing error that does not obviously point at IAM.

S3 and S3-compatible​

externalObjectStore:
  endpointUrl: ""            # empty for real S3
  bucket: acme-presponsieve-artifacts
  region: us-east-1
  accessKeyId: ""            # empty: IRSA supplies credentials
  secretAccessKey: ""

app:
  config:
    S3_FORCE_PATH_STYLE: "false"   # true for MinIO and most compatible targets
    S3_PREFIX: "reports"

On EKS, annotate the service account for IRSA and leave the keys empty. The role needs s3:GetObject, s3:PutObject, s3:DeleteObject, and s3:ListBucket on that bucket and nothing else.

For MinIO or another S3-compatible target, set endpointUrl and S3_FORCE_PATH_STYLE: "true".

In-cluster MinIO​

minio.enabled: true does not install MinIO. It wires the app to a service named <release>-minio, which you install separately.

Lifecycle​

Artifacts are regenerable from the database, so retention is a cost decision rather than a compliance one. A 90 day expiry with 30 days on non-current versions is a reasonable default; set it on the bucket, not in the chart.

Private endpoints​

Keep this traffic inside your network. Use a VPC gateway endpoint on AWS, Private Google Access on GCP, or a service endpoint on Azure.

If you run a default-deny egress policy without a rule for the storage endpoint, uploads hang rather than failing cleanly, which is a confusing symptom to debug. See Network.

Last updated on