47 lines
1.8 KiB
YAML
47 lines
1.8 KiB
YAML
apiVersion: helm.toolkit.fluxcd.io/v2
|
||
kind: HelmRelease
|
||
metadata:
|
||
name: istiod
|
||
namespace: istio-system
|
||
spec:
|
||
interval: 5m
|
||
timeout: 10m
|
||
dependsOn:
|
||
- name: istio-base
|
||
namespace: istio-system
|
||
values:
|
||
global:
|
||
imagePullSecrets:
|
||
- regcred
|
||
# Провайдер журнала доступа для security-audit (access-collector). Сам по себе ничего не включает:
|
||
# работает только для workload'ов, на которые ссылается Telemetry (infrastructure/security-audit/mesh).
|
||
meshConfig:
|
||
extensionProviders:
|
||
- name: audit-access
|
||
envoyOtelAls:
|
||
service: access-collector.security-audit.svc.cluster.local
|
||
port: 4317
|
||
logFormat:
|
||
labels:
|
||
sarex_kind: "mesh_access"
|
||
start_time: "%START_TIME%"
|
||
request_id: "%REQ(X-REQUEST-ID)%"
|
||
trace_id: "%TRACE_ID%"
|
||
authority: "%REQ(:AUTHORITY)%"
|
||
method: "%REQ(:METHOD)%"
|
||
path: "%REQ_WITHOUT_QUERY(:PATH)%"
|
||
protocol: "%PROTOCOL%"
|
||
response_code: "%RESPONSE_CODE%"
|
||
response_flags: "%RESPONSE_FLAGS%"
|
||
duration_ms: "%DURATION%"
|
||
bytes_in: "%BYTES_RECEIVED%"
|
||
bytes_out: "%BYTES_SENT%"
|
||
x_forwarded_for: "%REQ(X-FORWARDED-FOR)%"
|
||
downstream_ip: "%DOWNSTREAM_REMOTE_ADDRESS_WITHOUT_PORT%"
|
||
user_sub: "%REQ(X-SAREX-AUDIT-SUB)%"
|
||
user_org: "%REQ(X-SAREX-AUDIT-ORG)%"
|
||
user_agent: "%REQ(USER-AGENT)%"
|
||
route: "%ROUTE_NAME%"
|
||
upstream_cluster: "%UPSTREAM_CLUSTER%"
|
||
# Authorization, Cookie, Set-Cookie и query-строка не логируются (п.23)
|