From 9cb62ea9f05d50d015e7b557e989ebe7dbfc23a1 Mon Sep 17 00:00:00 2001 From: emelinda Date: Fri, 6 Nov 2026 18:03:30 +0300 Subject: [PATCH] =?UTF-8?q?security-audit:=20nil-guards=20=D0=B2=20transfo?= =?UTF-8?q?rm/audit=20=E2=80=94=20=D1=83=D0=B4=D0=B0=D0=BB=D0=B5=D0=BD?= =?UTF-8?q?=D0=B8=D0=B5=20managedFields/annotations?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit У части событий requestObject есть, а metadata/annotations в нём nil — statement падал с "expected pcommon.Map but got nil" и засорял лог (error_mode: ignore, события не терялись). --- .../security-audit/base/helmrelease-collector.yaml | 10 +++++----- 1 file changed, 5 insertions(+), 5 deletions(-) diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml index 380d53b..4dd91be 100644 --- a/infrastructure/security-audit/base/helmrelease-collector.yaml +++ b/infrastructure/security-audit/base/helmrelease-collector.yaml @@ -157,11 +157,11 @@ spec: log_statements: - context: log statements: - # --- объём и шум --- - - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil - - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil - - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil - - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil + # --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) --- + - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil + - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil + - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil + - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil # --- маскирование (п.23): значения, а не сама команда exec --- - replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***") # --- обогащение ---