33 lines
1.1 KiB
YAML
33 lines
1.1 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
||
kind: Kustomization
|
||
resources:
|
||
- ../base
|
||
- ../mesh # istio-system; применять после раскатки провайдера audit-access в istio-pilot/uralkal
|
||
patches:
|
||
- path: audit-collector.yaml
|
||
- path: access-collector.yaml
|
||
- path: idp-actions-bootstrap.yaml
|
||
# Селектор ingress-шлюза (HelmRelease istio-system/ingressgateway): replace, а не merge —
|
||
# merge-patch CRD оставил бы и заглушку security-audit/gateway.
|
||
- target:
|
||
kind: EnvoyFilter
|
||
name: strip-audit-headers
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/workloadSelector/labels
|
||
value: {istio: ingressgateway}
|
||
- target:
|
||
kind: Telemetry
|
||
name: gateway-audit-access
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/selector/matchLabels
|
||
value: {istio: ingressgateway}
|
||
- target:
|
||
kind: NetworkPolicy
|
||
name: access-collector
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/ingress/0/from/0/podSelector/matchLabels
|
||
value: {istio: ingressgateway}
|