From a60b171bea1a0ef5fe3445a6df77f740169bb764 Mon Sep 17 00:00:00 2001
From: emelinda <emelin_d_a@mail.ru>
Date: Sat, 7 Nov 2026 16:23:46 +0300
Subject: [PATCH] security-audit: IsMap guards in transform/audit delete_key
 statements
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Some events (e.g. deletecollection) carry requestObject as a slice, not a map:
indexing it with "metadata" failed with "unable to resolve an integer index in
slice" and spammed the collector log (error_mode: ignore — events were not lost).
IsMap chains rely on OTTL short-circuit `and` evaluation (verified against
v0.121 sources).
---
 .../security-audit/base/helmrelease-collector.yaml    | 11 ++++++-----
 1 file changed, 6 insertions(+), 5 deletions(-)

diff --git a/infrastructure/security-audit/base/helmrelease-collector.yaml b/infrastructure/security-audit/base/helmrelease-collector.yaml
index a1ffa7f..9d8d1bc 100644
--- a/infrastructure/security-audit/base/helmrelease-collector.yaml
+++ b/infrastructure/security-audit/base/helmrelease-collector.yaml
@@ -168,11 +168,12 @@ spec:
           log_statements:
             - context: log
               statements:
-                # --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) ---
-                - delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil
-                - delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil
-                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil
-                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil
+                # --- объём и шум (guard'ы IsMap: у части событий requestObject — массив или без metadata/annotations;
+                # and в OTTL short-circuit, поэтому индексация вглубь выполняется только для map) ---
+                - delete_key(body["requestObject"]["metadata"], "managedFields") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"])
+                - delete_key(body["responseObject"]["metadata"], "managedFields") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"])
+                - delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"]) and IsMap(body["requestObject"]["metadata"]["annotations"])
+                - delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"]) and IsMap(body["responseObject"]["metadata"]["annotations"])
                 # --- маскирование (п.23): значения, а не сама команда exec ---
                 - replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***")
                 # --- обогащение ---