Deliver audit events to MinIO within a minute for near-real-time
investigation; trade-off is more small parquet files (compaction
is planned in stage 3 of k8s-audit).
New image removes the bucket lifecycle check (retention is owned by terraform
minio-buckets lifecycle_rules), so the retention section is dropped from the
processor config map.
Some events (e.g. deletecollection) carry requestObject as a slice, not a map:
indexing it with "metadata" failed with "unable to resolve an integer index in
slice" and spammed the collector log (error_mode: ignore — events were not lost).
IsMap chains rely on OTTL short-circuit `and` evaluation (verified against
v0.121 sources).
The processor rejected "log_records": LogFilters.LogConditions is mapstructure
"log_record" in v0.121 (collector failed to start: failed to get config).
filter/audit in audit-collector drops get/list/watch events from
system:serviceaccount:flux-system:* (helm/kustomize/source controllers polling
fluxcd resources every few seconds — the bulk of the topic volume). GitOps
mutations are kept: they are the actual trail of cluster changes.
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d),
ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092,
external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set
via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors.
Credentials reuse the static Secrets (security-audit-kafka, kafka-ca,
security-audit-minio) via a projected volume at /vault/secrets.
app.env=stand: the contour's external MinIO has no TLS, so strict validation
(minio.secure) would fail. log.s3_echo=true is temporary for flow verification
(per security req. 20: disable after debugging).
У части событий requestObject есть, а metadata/annotations в нём nil —
statement падал с "expected pcommon.Map but got nil" и засорял лог
(error_mode: ignore, события не терялись).
PAT machine user'а security-audit-bootstrap не заведён (ни Vault-роль, ни статический
Secret), Job не сможет настроить Target/Execution'ы. Пайплайн logs/idp в access-collector
оставлен и инертен: без Target'а Zitadel ничего не отправляет. Обратное включение:
раскомментировать idp-actions-bootstrap в base/kustomization.yaml и его патч в оверлее
uralkal, добавить ключ zitadel_pat в Secret security-audit-kafka.
В контуре uralkal роли Vault (security-audit, security-audit-bootstrap) не заведены.
Коллекторы и Job idp-actions-bootstrap монтируют Secret'ы namespace (security-audit-kafka,
kafka-ca) projected volume'ом в /vault/secrets под теми же именами файлов — конфиг
коллекторов (${file:...}, ca_file) не меняется. Из NetworkPolicy убран egress в Vault,
из оверлея uralkal — dependsOn на HelmRelease vault.
