Skip to main content

Upload settings

Configure where the edge controller uploads recordings when you import them to your Primary Site. Set the upload mode explicitly to match your Primary Site.

Choose an upload destination​

For a Foxglove-hosted Primary Site, set:

PRIMARY_SITE_MODE=hosted

For Kubernetes, set this in values.yaml:

globals:
  upload:
    primarySiteMode: hosted

No cloud credentials are needed. Foxglove provides the upload destination.

Self-hosted and BYOS credentials​

Use the following provider settings for either upload destination. Set INBOX_BUCKET_NAME (or globals.upload.bucketName for Kubernetes) to the self-hosted inbox bucket or the BYOS indexed bucket, excluding any scheme such as s3:// or gs://.

  • Debian package, executable, or Docker image: add the variables where you configure the edge controller, such as /etc/foxglove/edge-controller/envfile or the file passed to docker run --env-file.
  • Kubernetes: create the provider's Secret in the foxglove namespace and add its provider and bucket values to values.yaml. The chart loads cloud-credentials and any Secrets listed in globals.secrets as environment variables, and mounts gcp-cloud-credential as a file. Values set by the chart take precedence over Secret environment variables.

Google Cloud Storage​

The credentials need storage.objects.create and storage.multipartUploads.create on the upload bucket. Failed-upload cleanup also needs storage.multipartUploads.abort. Uploads at or above MULTIPART_PART_SIZE (8 MiB by default) use XML multipart uploads; an existing custom role that allows ordinary object creation may need updating. See Cloud Storage multipart upload permissions.

Credential files with "type": "external_account" aren't supported. When upgrading an existing site, check the credential file's type as well as its permissions.

Install a service account key file (credentials.json) that authorizes writes to your upload bucket, and configure the following environment variables:

PRIMARY_SITE_MODE=self-managed
INBOX_STORAGE_PROVIDER=google_cloud
# Must be set to a valid bucket name, excluding any `gs://` scheme
INBOX_BUCKET_NAME=...
# Set this to the absolute path of the credentials.json file
# If using Docker, use the path inside the container, not the host filesystem path
GOOGLE_APPLICATION_CREDENTIALS=...

When using the .deb package, the foxglove user must be able to read the file. When using the Docker image, mount the file into the container, and set GOOGLE_APPLICATION_CREDENTIALS to its path inside the container.

AWS​

Configure the following environment variables:

PRIMARY_SITE_MODE=self-managed
INBOX_STORAGE_PROVIDER=aws
# Must be set to a valid bucket name
INBOX_BUCKET_NAME=...
# Set these according to your AWS deployment
AWS_ACCESS_KEY_ID=...
AWS_SECRET_ACCESS_KEY=...
# AWS_REGION also works, and takes precedence when set.
AWS_DEFAULT_REGION=...
# Optional: Only required when using temporary credentials (for example, from AWS STS or IAM Identity Center).
#AWS_SESSION_TOKEN=...
# Optional: Enable SHA-256 checksum-on-upload.
#AWS_UPLOAD_CHECKSUM=sha256

Instead of static keys, you can set AWS_CREDENTIAL_PROCESS to a command that prints temporary credentials in the AWS credential_process format, such as the AWS Identity and Access Management (IAM) Roles Anywhere credential helper. AWS_CREDENTIAL_PROCESS takes precedence over static keys. The edge controller Docker image includes the helper at /usr/local/bin/aws_signing_helper. The edge controller handles this variable the same way Foxlet does; see Foxlet upload settings for a full example, under the "Self-hosted" and "AWS" tabs.

If you set neither static keys nor AWS_CREDENTIAL_PROCESS, the edge controller uses default credential discovery, such as EC2 instance roles or IAM roles for Kubernetes service accounts.

At startup, the edge controller logs which kind of AWS credentials it's configured with: Using static credentials for AWS, Using credential_process for AWS credentials, or Using default credential chain for AWS. This line doesn't mean the credentials work. The edge controller first uses them when it uploads a recording, so a wrong key, secret, region, or permission shows up only then.

Azure​

Configure the following environment variables:

PRIMARY_SITE_MODE=self-managed
INBOX_STORAGE_PROVIDER=azure
# Must be set to a valid bucket name
INBOX_BUCKET_NAME=...
# The storage account that holds the container
STORAGE_AZURE_STORAGE_ACCOUNT_NAME=...
# Set these according to your Azure deployment
AZURE_TENANT_ID=...
AZURE_CLIENT_ID=...
AZURE_CLIENT_SECRET=...
# Optional: Override for storage endpoint.
#AZURE_STORAGE_ENDPOINT=https://{account}.blob.core.windows.net

Instead of setting STORAGE_AZURE_STORAGE_ACCOUNT_NAME, you can set the bucket name to <account>/<container>.

S3-compatible​

For a self-hosted Primary Site whose inbox bucket uses an S3-compatible service like MinIO, configure the edge controller as follows.

Configure the following environment variables:

PRIMARY_SITE_MODE=self-managed
INBOX_STORAGE_PROVIDER=s3_compatible
# Must be set to a valid bucket name
INBOX_BUCKET_NAME=...
# Set these according to your S3-compatible service deployment
S3_COMPATIBLE_ACCESS_KEY_ID=...
S3_COMPATIBLE_SECRET_ACCESS_KEY=...
S3_COMPATIBLE_SERVICE_REGION=...
S3_COMPATIBLE_SERVICE_URL=...

Object storage upload options​

For self-hosted and BYOS uploads, MULTIPART_PART_SIZE controls the size of multipart upload parts, in bytes. Files smaller than this size use a single upload request; files at or above it use multipart uploads.

MULTIPART_PART_SIZE=8388608

On Kubernetes, add this variable to edgeController.env, using the quoting shown in the installation guide.

Upload connection options​

These settings control keepalive pings when an upload connection uses HTTP/2:

UPLOAD_HTTP2_KEEP_ALIVE_INTERVAL=10s
UPLOAD_HTTP2_KEEP_ALIVE_TIMEOUT=30s