apiVersion: kustomize.config.k8s.io/v1beta1
kind: Kustomization
resources:
  - ../base
  - ../mesh     # istio-system; применять после раскатки провайдера audit-access в istio-pilot/uralkal
patches:
  - path: audit-collector.yaml
  - path: access-collector.yaml
  - path: idp-actions-bootstrap.yaml
  # Селектор ingress-шлюза (HelmRelease istio-system/ingressgateway): replace, а не merge —
  # merge-patch CRD оставил бы и заглушку security-audit/gateway.
  - target:
      kind: EnvoyFilter
      name: strip-audit-headers
    patch: |-
      - op: replace
        path: /spec/workloadSelector/labels
        value: {istio: ingressgateway}
  - target:
      kind: Telemetry
      name: gateway-audit-access
    patch: |-
      - op: replace
        path: /spec/selector/matchLabels
        value: {istio: ingressgateway}
  - target:
      kind: NetworkPolicy
      name: access-collector
    patch: |-
      - op: replace
        path: /spec/ingress/0/from/0/podSelector/matchLabels
        value: {istio: ingressgateway}