base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d),
ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092,
external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set
via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors.
Credentials reuse the static Secrets (security-audit-kafka, kafka-ca,
security-audit-minio) via a projected volume at /vault/secrets.
app.env=stand: the contour's external MinIO has no TLS, so strict validation
(minio.secure) would fail. log.s3_echo=true is temporary for flow verification
(per security req. 20: disable after debugging).
PAT machine user'а security-audit-bootstrap не заведён (ни Vault-роль, ни статический
Secret), Job не сможет настроить Target/Execution'ы. Пайплайн logs/idp в access-collector
оставлен и инертен: без Target'а Zitadel ничего не отправляет. Обратное включение:
раскомментировать idp-actions-bootstrap в base/kustomization.yaml и его патч в оверлее
uralkal, добавить ключ zitadel_pat в Secret security-audit-kafka.
