apiVersion: apps/v1
kind: Deployment
metadata:
  name: audit-processor
  labels:
    app.kubernetes.io/name: audit-processor
spec:
  replicas: 1   # consumer group: партиция security.k8s-audit одна, вторая реплика была бы standby
  selector:
    matchLabels:
      app.kubernetes.io/name: audit-processor
  template:
    metadata:
      labels:
        app.kubernetes.io/name: audit-processor
        # Без sidecar: в Kafka процессор ходит напрямую SASL_SSL (как audit-collector),
        # во внешний MinIO — мимо mesh (ServiceEntry, HTTP).
        sidecar.istio.io/inject: "false"
      annotations:
        sidecar.istio.io/inject: "false"
    spec:
      serviceAccountName: audit-processor
      imagePullSecrets:
        - name: regcred
      securityContext:
        seccompProfile: {type: RuntimeDefault}
      containers:
        - name: audit-processor
          # Образ FROM scratch, USER 65534; CONFIG_PATH=/etc/k8s-audit/config.yaml — в ENTRYPOINT образа.
          image: cr.yandex/crp3ccidau046kdj8g9q/k8s-audit-processor:47297469
          ports:
            - {name: http, containerPort: 8000}
          readinessProbe:
            httpGet: {path: /readyz, port: http}
            periodSeconds: 10
          livenessProbe:
            httpGet: {path: /healthz, port: http}
            periodSeconds: 20
          resources:
            requests: {cpu: 50m, memory: 128Mi}
            limits: {cpu: 500m, memory: 512Mi}
          securityContext:
            runAsNonRoot: true
            runAsUser: 65534
            runAsGroup: 65534
            readOnlyRootFilesystem: true
            allowPrivilegeEscalation: false
            capabilities:
              drop: [ALL]
          volumeMounts:
            - {name: config, mountPath: /etc/k8s-audit, readOnly: true}
            # Те же Secret'ы и имена файлов, что у коллекторов (плюс ключи MinIO).
            - {name: secrets, mountPath: /vault/secrets, readOnly: true}
      volumes:
        - name: config
          configMap: {name: audit-processor-config}
        - name: secrets
          projected:
            sources:
              - secret:
                  name: security-audit-kafka
                  items:
                    - {key: username, path: kafka-username}
                    - {key: password, path: kafka-password}
              - secret:
                  name: kafka-ca
                  items:
                    - {key: ca.crt, path: kafka-ca.crt}
              - secret:
                  name: security-audit-minio
                  items:
                    - {key: access_key, path: minio-access-key}
                    - {key: secret_key, path: minio-secret-key}