1960ef495c
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d), ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092, external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors. Credentials reuse the static Secrets (security-audit-kafka, kafka-ca, security-audit-minio) via a projected volume at /vault/secrets. app.env=stand: the contour's external MinIO has no TLS, so strict validation (minio.secure) would fail. log.s3_echo=true is temporary for flow verification (per security req. 20: disable after debugging).
20 lines
970 B
YAML
20 lines
970 B
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
||
kind: Kustomization
|
||
namespace: security-audit
|
||
resources:
|
||
- namespace.yaml
|
||
- networkpolicy.yaml
|
||
- networkpolicy-access-collector.yaml
|
||
- authorizationpolicy-access-collector.yaml
|
||
- helmrelease-collector.yaml
|
||
- helmrelease-access-collector.yaml
|
||
- processor-serviceaccount.yaml
|
||
- processor-configmap.yaml
|
||
- processor-deployment.yaml
|
||
- processor-networkpolicy.yaml
|
||
# События Zitadel отложены: нет PAT machine user'а security-audit-bootstrap (роли в Vault нет,
|
||
# статический Secret не заведён). Обратное включение: раскомментировать здесь и патч
|
||
# idp-actions-bootstrap.yaml в оверлее uralkal, добавить ключ zitadel_pat в Secret.
|
||
# Пайплайн logs/idp в access-collector при этом инертен: без Job Target в Zitadel не создаётся.
|
||
# - idp-actions-bootstrap
|