> ## Documentation Index
> Fetch the complete documentation index at: https://docs.casebender.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Integration Execution Plane

> Deploy and operate the credential control plane and dedicated connector workers.

## Required services

Integration workflows require both background services:

* `workflow-processor` owns durable workflow state and publishes connector jobs.
* `connector-worker` is the only consumer of outbound connector jobs and
  publishes results back to the workflow processor.

Both services must use the same PostgreSQL database, Redis instance,
`CONNECTOR_ACTION_QUEUE_NAME`, and `CONNECTOR_ACTION_RESULT_QUEUE_NAME`.
Deploy at least one connector worker. It must be always-on; CPU throttling or
scale-to-zero prevents queue consumption.

## Container image

Official releases publish a separate signed
`casebender/connector-worker:<version>` image with SBOM and provenance
attestations. The on-premises Compose bundle starts it automatically. Mirror the
exact release-manifest digest for air-gapped deployments.

## Required secrets

Configure these values in the deployment secret manager:

* `CREDENTIAL_ENCRYPTION_KEY` — at least 32 random characters
* `FIELD_ENCRYPTION_KEY` — at least 32 random characters
* `WEBHOOK_KEY_PEPPER` — at least 32 random characters
* `CONNECTOR_BUNDLE_SIGNING_KEY` — at least 32 random characters
* `OAUTH_BROKER_SECRET` — at least 32 random characters
* `POSTGRES_PRISMA_URL`
* `REDIS_URL`

Keep these keys stable across rolling deployments. Losing the credential
encryption key makes existing credential versions unreadable. Rotating it
requires an explicit re-encryption procedure.

Bind `CREDENTIAL_ENCRYPTION_KEY` (and the `FIELD_ENCRYPTION_KEY` fallback) to
both `connector-worker` and `misp-processor`. The connector worker resolves
credentials for on-demand actions; the MISP processor also hosts scheduled
pull ingestion for Defender, Splunk, CrowdStrike, and the other polling
connectors. The web application alone is not sufficient for polling.

Set `CASEBENDER_PRIVATE_EGRESS_ALLOWLIST` to a comma-separated list only when
workers must reach approved private or on-prem endpoints. Private destinations
remain blocked when the value is empty.

Set `OAUTH_BROKER_BASE_URL` only when an external managed broker is deployed.
Leave it empty for direct vendor OAuth.

## Google Cloud Run

The repository's Google Cloud deployment creates
`casebender-connector-worker` as a private Cloud Run service with:

* Minimum one instance
* CPU always allocated
* Private VPC access to Cloud SQL and Redis
* No unauthenticated ingress
* Port `3015` for liveness and readiness checks

Run `deploy/gcloud/setup-infrastructure.sh` to create the integration secrets,
then deploy all services with `deploy/gcloud/deploy.sh fast`. To deploy only the
worker, run:

```bash theme={null}
deploy/gcloud/deploy.sh connector-worker
```

## Kubernetes

The base Kustomize configuration includes `connector-worker-deployment.yaml`.
The enterprise overlay permits DNS, PostgreSQL, Redis, and HTTPS egress.
Application-level connector and credential host allowlists provide the
destination policy within that network boundary.

## Health checks

* `/health/live` confirms the process is running.
* `/health/ready` confirms the worker is accepting work.
* `/health` returns queue names, active concurrency, and local circuit state.

Alert when no connector-worker instance is ready, the action queue grows
continuously, result delivery fails, or circuits remain open.