What is objectstore in UiPath Automation Suite? How is it installed? How are the secrets for objectstore configured in AS?
1. What objectstore is, and why it matters
Automation Suite stores data in two places. SQL Server holds metadata — names, IDs, owners, settings. Objectstore holds the actual files. It is an S3-compatible blob store.
Almost every product writes to it: Orchestrator (NuGet packages, Storage Bucket files, execution media), AI Center (datasets, ML packages, pipeline output), Document Understanding, Task Mining, Data Service (file attachments), Process Mining (plus Airflow logs), Apps and Action Center, Test Manager, Insights, Maestro, Integration Service. Platform components use it too — the support bundle, Fluentd logs (sf-logs bucket), Prometheus/Thanos metrics, and MongoDB backups.
The most important thing to understand: when objectstore breaks, the customer almost never reports a storage error. They report "I can't upload a package", "my dataset is empty", "the pipeline failed", or "Insights has no data". Several unrelated products failing to upload or download at the same time is a strong signal to start here.
2. The two flavours
Objectstore runs in one of two ways, and they share almost no failure modes. Identify the flavour before troubleshooting anything.
| In-cluster (Rook / Ceph) | External | |
|---|---|---|
| What it is | Ceph object gateway (RGW) inside the cluster | Customer's AWS S3, Azure Blob, or S3-compatible store (MinIO is tested) |
| Namespace | rook-ceph | lives outside the cluster |
| Endpoint inside | rook-ceph-rgw-rook-ceph.rook-ceph.svc | customer's endpoint |
| Endpoint outside | objectstore.<cluster-fqdn> via Istio | customer's endpoint |
| Storage | Raw disks at /dev/uipath/ceph, or PVCs | the provider's |
| Buckets | Fixed set (uipath, train-data, …) | uipath-as-* per product |
| Since | Always | 2022.10 |
How to tell which one you have:
# in-cluster Ceph present? kubectl get cephobjectstore rook-ceph -n rook-cephexternal storage switched on? read it from the live ArgoCD app
kubectl -n argocd get application UiPath -o yaml | grep -i "useExternalStorage|storageType"
If cephobjectstore exists, the cluster has in-cluster Ceph. If useExternalStorage is true, products point at an external store. A cluster part-way through a migration can have both.
Multi-site / active-active cannot use in-cluster storage. The prereq check mentions this: "In-Cluster Storage is not supported for multisite deployment model".
3. How objectstore is configured at install
3.1 The external_object_storage block
This lives in input.json (also called cluster_config.json). It can be set once for the whole cluster and overridden per product.
"external_object_storage": {
"enabled": true,
"create_bucket": true,
"storage_type": "s3",
"fqdn": "s3.us-east-2.amazonaws.com",
"port": 443,
"region": "us-east-2",
"access_key": "<redacted>",
"secret_key": "<redacted>",
"use_instance_profile": false,
"bucket_name_prefix": "",
"bucket_name_suffix": ""
}
Which keys are used depends on the provider:
- AWS S3, keys —
fqdn,region,access_key,secret_key - AWS S3, IAM role —
use_instance_profile: true,region - Azure Blob, keys —
account_name,account_key,azure_fqdn_suffix - Azure Blob, Managed Identity —
account_name,client_id,use_managed_identity: true - S3-compatible / MinIO —
fqdn,port,access_key,secret_key
Also accepted: arn, client_secret, tenant_id, auth_mode, subscription_id, cloud_name, resource_group.
There is no setting to skip TLS verification. If the objectstore uses a private CA, the only supported route is additional_ca_certs.
3.2 Bucket names
<prefix>-<bucket_name>-<suffix>. Defaults:-
uipath-as-platform— infra, platform, Studio Web, Insights, Automation Hub, Automation Ops, Action Center, AS Robots, Integration Service, Automation Solutions -
uipath-as-orchestrator,uipath-as-aicenter,uipath-as-du,uipath-as-taskmining,uipath-as-testmanager,uipath-as-apps,uipath-as-dataservice,uipath-as-processmining,uipath-as-ixp,uipath-as-llmobservability— the matching product -
taas— Maestro (note it does not follow theuipath-as-*pattern)
uipath, aifabric-staging, ml-model-files, train-data, ai-storage, dataservice, processmining, airflow-logs, maestro, mongodb-backup, sf-logs, support-bundles.3.3 Which S3 permissions the customer actually needs
When a customer insists their IAM policy is fine, this is your evidence. The installer validates a specific list of S3 operations per product, so read-only or narrow policies fail.
- Every product needs
GET_OBJECT,PUT_OBJECT,DELETE_OBJECT,GET_BUCKET_LIST_OBJECTS. - Orchestrator and Process Mining also need the full multipart set (
CREATE_MULTIPART_UPLOAD,UPLOAD_PART,UPLOAD_PART_COPY,COMPLETE_MULTIPART_UPLOAD,LIST_MULTIPART_UPLOADS), plusDELETE_MULTIPLE_OBJECTS, andPUT_BUCKET_CORSas good-to-have. - Test Manager needs the multipart upload set.
- Apps, Process Mining, AI Center, DU also need
HEAD_OBJECTandPUT_OBJECT_COPY. - AI Center and Task Mining need
PUT_BUCKET,HEAD_BUCKETandLIST_BUCKETS— these two are the reasoncreate_bucket: truematters.
The full matrix is in the installer at Prerequisite_Checks/scripts/object-storage-validation.json, split into must and gth (good to have).
3.4 Certificates and other install-time choices
additional_ca_certs— path to the CA chain for any objectstore with a private or self-signed certificate. The number one external-objectstore problem; see issues 3.1 and 3.2 in How to Debug Objectstore Issues.disable_presigned_url— install-time only; it can never be changed afterwards. When set, traffic is proxied through theaistorageservice instead of the browser talking to objectstore directly. Task Mining and Apps do not support it.- In-cluster sizing —
objectstore.pvc_size(default25Gi) andsubdomain.rook_ceph(defaultobjectstore, producingobjectstore.<fqdn>). Refer to the hardware requirements docs.
4. Where the credentials live
4.1 In-cluster Ceph: the chain
Level 1 — Admin credentials. A configure job creates the Ceph objectstore admin user and writes secret ceph-object-store-secret in namespace rook-ceph. Keys inside: OBJECT_STORAGE_ACCESSKEY, OBJECT_STORAGE_SECRETKEY, OBJECT_STORAGE_INTERNAL_SERVICE, OBJECT_STORAGE_HOST, OBJECT_STORAGE_PORT, OBJECT_STORAGE_EXTERNAL_HOST, OBJECT_STORAGE_EXTERNAL_PORT. This is the secret the s3cmd recipe in Exploring Objectstore Using s3cmd reads from.
The job name and namespace differ by version, so probe:
kubectl -n rook-ceph get job rook-ceph-configure-job 2>/dev/null \ || kubectl -n uipath-infra get job rook-ceph-configure-script-job 2>/dev/null \ || kubectl get jobs -A | grep -i ceph
Jobs you will see alongside it: early-configure-ceph-job, ceph-post-upgrade-job, active-active-job, plus the rook-ceph-tools toolbox deployment you exec into for radosgw-admin and ceph.
Level 2 — Per-product credentials. The credential-manager-job creates one Ceph user per product group, creates its buckets, applies CORS and lifecycle policies, and writes one secret per group. It runs as a Helm pre-install and pre-upgrade hook, so it runs again on every upgrade — this is also the mechanism that repairs missing credentials.
| Ceph user / secret | Buckets | Used by |
|---|---|---|
uipath-service → uipath-service-rook-ceph-secret | uipath | Orchestrator, DU, Task Mining, Apps, platform, Automation Solutions |
aicenter-service → aicenter-service-rook-ceph-secret | aifabric-staging, ml-model-files, train-data, ai-storage | AI Center, AI Storage |
processmining-service → processmining-service-rook-ceph-secret | processmining | Process Mining |
airflow-service → airflow-rook-ceph-secret | airflow-logs | Process Mining (Airflow) |
dataservice → dataservice-rook-ceph-secret | dataservice | Data Service |
maestro → maestro-service-rook-ceph-secret | maestro | Maestro |
mongodb-service → mongodb-service-rook-ceph-secret | mongodb-backup | Apps |
4.2 External objectstore: the chain
The same credential-manager-job writes one secret per product in the uipath namespace, named <product>-external-storage-secret — orchestrator-, aicenter-, documentunderstanding-, platform-, taskmining-, testmanager-, dataservice-, processmining-, ba-, maestro-.
Keys inside each: STORAGE_TYPE, BUCKET, FQDN, PORT, REGION, ACCESSKEY, SECRETKEY, USE_INSTANCE_PROFILE, ACCOUNTNAME, ACCOUNTKEY, AZURE_FQDN_SUFFIX, CLIENT_ID, USE_MANAGED_IDENTITY, USE_WORKLOAD_IDENTITY.
Products read these as mounted files or environment variables. Orchestrator, for example, turns them into a Storage.Type / Storage.Location connection string.