Config: pipelines security.k8s-audit (k8s_audit) + security.mesh-access
(mesh_access); kafka.topic kept for rollback (pre-pipelines image ignores
the pipelines key). Image pinned to digest sha256:56a23bec… (k8s-audit@05a186a,
pipelines support) per repo policy п.38. Kafka ACL and MinIO policy need no
changes (no ACLs; bucket user has s3:* on the whole bucket). Companion
terraform change: ILM rule expire-mesh-access-90d.
Deliver audit events to MinIO within a minute for near-real-time
investigation; trade-off is more small parquet files (compaction
is planned in stage 3 of k8s-audit).
New image removes the bucket lifecycle check (retention is owned by terraform
minio-buckets lifecycle_rules), so the retention section is dropped from the
processor config map.
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d),
ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092,
external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set
via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors.
Credentials reuse the static Secrets (security-audit-kafka, kafka-ca,
security-audit-minio) via a projected volume at /vault/secrets.
app.env=stand: the contour's external MinIO has no TLS, so strict validation
(minio.secure) would fail. log.s3_echo=true is temporary for flow verification
(per security req. 20: disable after debugging).
