From d0bed7033aa5c390a3e92c3324b425c847e598dd Mon Sep 17 00:00:00 2001 From: emelinda Date: Sat, 7 Nov 2026 20:12:54 +0300 Subject: [PATCH] security-audit: enable mesh-access pipeline, audit-processor pinned by digest MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Config: pipelines security.k8s-audit (k8s_audit) + security.mesh-access (mesh_access); kafka.topic kept for rollback (pre-pipelines image ignores the pipelines key). Image pinned to digest sha256:56a23bec… (k8s-audit@05a186a, pipelines support) per repo policy п.38. Kafka ACL and MinIO policy need no changes (no ACLs; bucket user has s3:* on the whole bucket). Companion terraform change: ILM rule expire-mesh-access-90d. --- infrastructure/security-audit/base/processor-configmap.yaml | 6 ++++++ .../security-audit/base/processor-deployment.yaml | 3 ++- 2 files changed, 8 insertions(+), 1 deletion(-) diff --git a/infrastructure/security-audit/base/processor-configmap.yaml b/infrastructure/security-audit/base/processor-configmap.yaml index 92be3c6..4dea0f7 100644 --- a/infrastructure/security-audit/base/processor-configmap.yaml +++ b/infrastructure/security-audit/base/processor-configmap.yaml @@ -25,6 +25,12 @@ data: kafka: brokers: [] # K8S_AUDIT_KAFKA_BROKERS + # Пайплайны чтения: один consumer group вычитывает все топики списка. + # kafka.topic НЕ удалять — старый образ (без поддержки pipelines) читает его, + # это путь отката. Новый образ при наличии pipelines игнорирует kafka.topic. + pipelines: + - {topic: security.k8s-audit, kind: k8s_audit} + - {topic: security.mesh-access, kind: mesh_access} topic: security.k8s-audit group: security-audit-processor start_from: earliest # latest перескочил бы события после разрыва offset'ов diff --git a/infrastructure/security-audit/base/processor-deployment.yaml b/infrastructure/security-audit/base/processor-deployment.yaml index c654c03..9c59a72 100644 --- a/infrastructure/security-audit/base/processor-deployment.yaml +++ b/infrastructure/security-audit/base/processor-deployment.yaml @@ -27,7 +27,8 @@ spec: containers: - name: audit-processor # Образ FROM scratch, USER 65534; CONFIG_PATH=/etc/k8s-audit/config.yaml — в ENTRYPOINT образа. - image: cr.yandex/crp3ccidau046kdj8g9q/k8s-audit-processor:47297469 + # Digest, а не тег (п.38): релиз с поддержкой pipelines (k8s-audit@05a186a). + image: cr.yandex/crp3ccidau046kdj8g9q/k8s-audit-processor@sha256:56a23bec64fe6abdabebbc67806c4d5677486dca5ad5aac01b17db09d768bc72 ports: - {name: http, containerPort: 8000} readinessProbe: