apiVersion: helm.toolkit.fluxcd.io/v2
kind: HelmRelease
metadata:
  name: istiod
  namespace: istio-system
spec:
  interval: 5m
  timeout: 10m
  dependsOn:
    - name: istio-base
      namespace: istio-system
  values:
    global:
      imagePullSecrets:
        - regcred
    # Провайдер журнала доступа для security-audit (access-collector). Сам по себе ничего не включает:
    # работает только для workload'ов, на которые ссылается Telemetry (infrastructure/security-audit/mesh).
    meshConfig:
      extensionProviders:
        - name: audit-access
          envoyOtelAls:
            service: access-collector.security-audit.svc.cluster.local
            port: 4317
            logFormat:
              labels:
                sarex_kind: "mesh_access"
                start_time: "%START_TIME%"
                request_id: "%REQ(X-REQUEST-ID)%"
                trace_id: "%TRACE_ID%"
                authority: "%REQ(:AUTHORITY)%"
                method: "%REQ(:METHOD)%"
                path: "%REQ_WITHOUT_QUERY(:PATH)%"
                protocol: "%PROTOCOL%"
                response_code: "%RESPONSE_CODE%"
                response_flags: "%RESPONSE_FLAGS%"
                duration_ms: "%DURATION%"
                bytes_in: "%BYTES_RECEIVED%"
                bytes_out: "%BYTES_SENT%"
                x_forwarded_for: "%REQ(X-FORWARDED-FOR)%"
                downstream_ip: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
                user_sub: "%REQ(X-SAREX-AUDIT-SUB)%"
                user_org: "%REQ(X-SAREX-AUDIT-ORG)%"
                user_agent: "%REQ(USER-AGENT)%"
                route: "%ROUTE_NAME%"
                upstream_cluster: "%UPSTREAM_CLUSTER%"
                # Authorization, Cookie, Set-Cookie и query-строка не логируются (п.23)