Skip to main content

​
Required services

Integration workflows require both background services:
  • workflow-processor owns durable workflow state and publishes connector jobs.
  • connector-worker is the only consumer of outbound connector jobs and publishes results back to the workflow processor.
Both services must use the same PostgreSQL database, Redis instance, CONNECTOR_ACTION_QUEUE_NAME, and CONNECTOR_ACTION_RESULT_QUEUE_NAME. Deploy at least one connector worker. It must be always-on; CPU throttling or scale-to-zero prevents queue consumption.

​
Container image

Official releases publish a separate signed casebender/connector-worker:<version> image with SBOM and provenance attestations. The on-premises Compose bundle starts it automatically. Mirror the exact release-manifest digest for air-gapped deployments.

​
Required secrets

Configure these values in the deployment secret manager:
  • CREDENTIAL_ENCRYPTION_KEY — at least 32 random characters
  • FIELD_ENCRYPTION_KEY — at least 32 random characters
  • WEBHOOK_KEY_PEPPER — at least 32 random characters
  • CONNECTOR_BUNDLE_SIGNING_KEY — at least 32 random characters
  • OAUTH_BROKER_SECRET — at least 32 random characters
  • POSTGRES_PRISMA_URL
  • REDIS_URL
Keep these keys stable across rolling deployments. Losing the credential encryption key makes existing credential versions unreadable. Rotating it requires an explicit re-encryption procedure. Bind CREDENTIAL_ENCRYPTION_KEY (and the FIELD_ENCRYPTION_KEY fallback) to both connector-worker and misp-processor. The connector worker resolves credentials for on-demand actions; the MISP processor also hosts scheduled pull ingestion for Defender, Splunk, CrowdStrike, and the other polling connectors. The web application alone is not sufficient for polling. Set CASEBENDER_PRIVATE_EGRESS_ALLOWLIST to a comma-separated list only when workers must reach approved private or on-prem endpoints. Private destinations remain blocked when the value is empty. Set OAUTH_BROKER_BASE_URL only when an external managed broker is deployed. Leave it empty for direct vendor OAuth.

​
Google Cloud Run

The repository’s Google Cloud deployment creates casebender-connector-worker as a private Cloud Run service with:
  • Minimum one instance
  • CPU always allocated
  • Private VPC access to Cloud SQL and Redis
  • No unauthenticated ingress
  • Port 3015 for liveness and readiness checks
Run deploy/gcloud/setup-infrastructure.sh to create the integration secrets, then deploy all services with deploy/gcloud/deploy.sh fast. To deploy only the worker, run:

​
Kubernetes

The base Kustomize configuration includes connector-worker-deployment.yaml. The enterprise overlay permits DNS, PostgreSQL, Redis, and HTTPS egress. Application-level connector and credential host allowlists provide the destination policy within that network boundary.

​
Health checks

  • /health/live confirms the process is running.
  • /health/ready confirms the worker is accepting work.
  • /health returns queue names, active concurrency, and local circuit state.
Alert when no connector-worker instance is ready, the action queue grows continuously, result delivery fails, or circuits remain open.