sarex/iac
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

security-audit: IsMap guards in transform/audit delete_key statements

Browse Source 
Some events (e.g. deletecollection) carry requestObject as a slice, not a map:
indexing it with "metadata" failed with "unable to resolve an integer index in
slice" and spammed the collector log (error_mode: ignore — events were not lost).
IsMap chains rely on OTTL short-circuit `and` evaluation (verified against
v0.121 sources).
This commit is contained in:
emelinda 2026-11-07 16:23:46 +03:00
parent cf2689aea0
commit a60b171bea
1 changed files with 6 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

11
infrastructure/security-audit/base/helmrelease-collector.yaml
View File

@ -168,11 +168,12 @@ spec:
log_statements:
- context: log
statements:
# --- объём и шум (guard'ы на nil: у части событий requestObject есть, а metadata/annotations — nil) ---
- delete_key(body["requestObject"]["metadata"], "managedFields") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil
- delete_key(body["responseObject"]["metadata"], "managedFields") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil
- delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["requestObject"] != nil and body["requestObject"]["metadata"] != nil and body["requestObject"]["metadata"]["annotations"] != nil
- delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where body["responseObject"] != nil and body["responseObject"]["metadata"] != nil and body["responseObject"]["metadata"]["annotations"] != nil
# --- объём и шум (guard'ы IsMap: у части событий requestObject — массив или без metadata/annotations;
# and в OTTL short-circuit, поэтому индексация вглубь выполняется только для map) ---
- delete_key(body["requestObject"]["metadata"], "managedFields") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"])
- delete_key(body["responseObject"]["metadata"], "managedFields") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"])
- delete_key(body["requestObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["requestObject"]) and IsMap(body["requestObject"]["metadata"]) and IsMap(body["requestObject"]["metadata"]["annotations"])
- delete_key(body["responseObject"]["metadata"]["annotations"], "kubectl.kubernetes.io/last-applied-configuration") where IsMap(body["responseObject"]) and IsMap(body["responseObject"]["metadata"]) and IsMap(body["responseObject"]["metadata"]["annotations"])
# --- маскирование (п.23): значения, а не сама команда exec ---
- replace_pattern(body["requestURI"], "(?i)(password|passwd|pwd|token|secret|api[_-]?key)(=|%3D)[^&]*", "$$1$$2***")
# --- обогащение ---