From f0014c5d0063498138929dced9bfd84500990ce3 Mon Sep 17 00:00:00 2001 From: emelinda Date: Fri, 6 Nov 2026 16:47:32 +0300 Subject: [PATCH] =?UTF-8?q?uralkal:=20=D0=BF=D0=BE=D0=B4=D0=BA=D0=BB=D1=8E?= =?UTF-8?q?=D1=87=D0=B8=D1=82=D1=8C=20security-audit=20=E2=80=94=20=D0=B0?= =?UTF-8?q?=D1=83=D0=B4=D0=B8=D1=82=20apiserver,=20=D0=B6=D1=83=D1=80?= =?UTF-8?q?=D0=BD=D0=B0=D0=BB=20=D0=B4=D0=BE=D1=81=D1=82=D1=83=D0=BF=D0=B0?= =?UTF-8?q?=20=D1=88=D0=BB=D1=8E=D0=B7=D0=B0,=20=D1=81=D0=BE=D0=B1=D1=8B?= =?UTF-8?q?=D1=82=D0=B8=D1=8F=20Zitadel?= MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit DaemonSet audit-collector на control-plane (журнал kube-apiserver → security.k8s-audit), Deployment access-collector (OTLP :4317 — журнал доступа ingress-шлюза → security.mesh-access, webhookevent :8088 — события Zitadel Actions v2 → security.idp-events, otlp :4319 — журнал аудита Vault → security.vault-audit), Job idp-actions-bootstrap (Target + Execution'ы в Zitadel), NetworkPolicy/AuthorizationPolicy, EnvoyFilter strip-audit-headers и Telemetry шлюза на провайдер audit-access (уже раскатан в istio-pilot/uralkal). Предусловия выполнены вне репозитория: аудит apiserver на мастерах (INFRA-3057), топики security.* и SCRAM-пользователь в Kafka, бакет security-audit в MinIO, секреты и роли Vault (terraform, vault-platform-secrets). --- clusters/uralkal/kustomization.yaml | 1 + 1 file changed, 1 insertion(+) diff --git a/clusters/uralkal/kustomization.yaml b/clusters/uralkal/kustomization.yaml index 6755dd4..44832c1 100644 --- a/clusters/uralkal/kustomization.yaml +++ b/clusters/uralkal/kustomization.yaml @@ -17,6 +17,7 @@ resources: - ../../infrastructure/trino/uralkal - ../../infrastructure/istio-config/uralkal - ../../infrastructure/s3-proxy/uralkal + - ../../infrastructure/security-audit/uralkal - ../../apps/reviews/uralkal - ../../apps/remarks/uralkal