Store and serve workflow results¶

Provide an existing S3-compatible bucket, its endpoint, and credentials for workflow outputs, logs, and static STAC files. AntFlow does not provision object storage or create the bucket. Application state is stored separately in the application database.

Configure the result bucket¶

Replace the example endpoint, region, bucket, paths, and Secret references with your storage settings. The bucket must be writable by the result publication step.

configs:
  s3:
    endpoint_url: https://s3.example.com
    region_name: us-east-1
    bucket_name: antflow-data
    root_dir: antflow
    job_outputs_dir: outputs
    job_stac_dir: stac
    credentials:
      existingSecret: antflow-s3
      existingSecretAccessKeyIdKey: s3_access_key_id
      existingSecretSecretAccessKeyKey: s3_secret_access_key

The Secret must contain the named credential keys in the release namespace. Keep storage credentials in server-side Secrets, not in browser configuration. Set the region to the value required by your storage provider. AntFlow Server must be able to read result objects, and workflow publication must be able to write them. Preserve the bucket and prefixes when restoring existing job data. For local runners, use a storage endpoint reachable from both Kubernetes and the runner host; a Kubernetes-only service name or localhost is not sufficient.

Result delivery¶

The authenticated data API serves logs, outputs, and static STAC files in one of two ways. Paths matching configs.s3.presigned_regex redirect to a temporary S3 URL; other paths are streamed through the server. The regex matches the file path within the job, not the full bucket key.

configs:
  s3:
    presigned_regex: '^outputs/.*$'
    presigned_expiration: 600

With this default, outputs/ files use presigned URLs while logs and static STAC files are proxied. To proxy all reads, use a regex that never matches, such as '(?!)'. To redirect all reads, use '.*'. Expiration is in seconds; renew access through the data API when a URL expires. Treat presigned URLs as temporary access credentials.

Proxying avoids browser-to-bucket CORS requirements for those reads, but increases server bandwidth and still requires server-to-storage connectivity. Redirected reads require browser or client access to the storage endpoint. For browser scripts, follow Configure cross-origin access.

Publish result metadata¶

Uploading outputs does not require STAC cataloging. To publish result metadata to static catalogs or a transactional STAC API, follow Publish results to STAC.

For the user-facing output contract, see Results and publication. For S3 settings and credential references, see the Helm chart reference.