From 0b8318f5472509bbe625b63ac6b8e99b8fb4328c Mon Sep 17 00:00:00 2001 From: emelinda Date: Sat, 7 Nov 2026 15:45:37 +0300 Subject: [PATCH] security-audit: drop flux-system read polling from apiserver audit pipeline MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit filter/audit in audit-collector drops get/list/watch events from system:serviceaccount:flux-system:* (helm/kustomize/source controllers polling fluxcd resources every few seconds — the bulk of the topic volume). GitOps mutations are kept: they are the actual trail of cluster changes. --- .../security-audit/base/helmrelease-collector.yaml | 11 ++++++++++- 1 file changed, 10 insertions(+), 1 deletion(-) diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml index 4dd91be..061f592 100644 --- a/infrastructure/security-audit/base/helmrelease-collector.yaml +++ b/infrastructure/security-audit/base/helmrelease-collector.yaml @@ -152,6 +152,15 @@ spec: check_interval: 1s limit_mib: 400 spike_limit_mib: 100 + # Отрезание шума до transform и Kafka: бесконечные опросы Flux-контроллеров + # (helm/kustomize/source: get/list/watch на ресурсах fluxcd). Мутации GitOps + # (create/update/patch/delete) остаются — они и есть след изменений через GitOps. + # Фильтр намеренно узкий: чтения других акторов (kube-system, операторы) не трогаем. + filter/audit: + error_mode: ignore + logs: + log_records: + - 'IsMatch(body["user"]["username"], "^system:serviceaccount:flux-system:") and (body["verb"] == "get" or body["verb"] == "list" or body["verb"] == "watch")' transform/audit: error_mode: ignore log_statements: @@ -228,7 +237,7 @@ spec: pipelines: logs/audit: receivers: [filelog/audit] - processors: [memory_limiter, transform/audit, batch] + processors: [memory_limiter, filter/audit, transform/audit, batch] exporters: [kafka/audit] telemetry: logs: