Some events (e.g. deletecollection) carry requestObject as a slice, not a map:
indexing it with "metadata" failed with "unable to resolve an integer index in
slice" and spammed the collector log (error_mode: ignore — events were not lost).
IsMap chains rely on OTTL short-circuit `and` evaluation (verified against
v0.121 sources).
The processor rejected "log_records": LogFilters.LogConditions is mapstructure
"log_record" in v0.121 (collector failed to start: failed to get config).
filter/audit in audit-collector drops get/list/watch events from
system:serviceaccount:flux-system:* (helm/kustomize/source controllers polling
fluxcd resources every few seconds — the bulk of the topic volume). GitOps
mutations are kept: they are the actual trail of cluster changes.
У части событий requestObject есть, а metadata/annotations в нём nil —
statement падал с "expected pcommon.Map but got nil" и засорял лог
(error_mode: ignore, события не терялись).
В контуре uralkal роли Vault (security-audit, security-audit-bootstrap) не заведены.
Коллекторы и Job idp-actions-bootstrap монтируют Secret'ы namespace (security-audit-kafka,
kafka-ca) projected volume'ом в /vault/secrets под теми же именами файлов — конфиг
коллекторов (${file:...}, ca_file) не меняется. Из NetworkPolicy убран egress в Vault,
из оверлея uralkal — dependsOn на HelmRelease vault.
