sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-audit: nil-guards в transform/audit — удаление managedFields/annotations

Browse Source 
У части событий requestObject есть, а metadata/annotations в нём nil —
statement падал с "expected pcommon.Map but got nil" и засорял лог
(error_mode: ignore, события не терялись).
This commit is contained in:
emelinda 2026-11-06 18:03:30 +03:00
parent d4bbc5fd14
commit 9cb62ea9f0
1 changed files with 5 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

10
infrastructure/security-audit/base/helmrelease-collector.yaml
View File

@ -157,11 +157,11 @@ spec:
log_statements: log_statements:
- context: log - context: log
statements: statements:
# --- объём и шум --- # --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) ---
- delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil
- delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil
- delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil
- delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil
# --- маскирование (п.23): значения, а не сама команда exec --- # --- маскирование (п.23): значения, а не сама команда exec ---
- replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***") - replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***")
# --- обогащение --- # --- обогащение ---