1960ef495c
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d), ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092, external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors. Credentials reuse the static Secrets (security-audit-kafka, kafka-ca, security-audit-minio) via a projected volume at /vault/secrets. app.env=stand: the contour's external MinIO has no TLS, so strict validation (minio.secure) would fail. log.s3_echo=true is temporary for flow verification (per security req. 20: disable after debugging).
63 lines
2.2 KiB
YAML
63 lines
2.2 KiB
YAML
# Конфиг audit-processor (образ k8s-audit-processor, CONFIG_PATH=/etc/k8s-audit/config.yaml).
|
|
# Контур-специфичные значения (contour, kafka.brokers, minio.endpoint, app.env, log.s3_echo)
|
|
# задаёт оверлей через env K8S_AUDIT_* — см. uralkal/kustomization.yaml.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-processor-config
|
|
labels:
|
|
app.kubernetes.io/name: audit-processor
|
|
data:
|
|
config.yaml: |
|
|
contour: "" # K8S_AUDIT_CONTOUR
|
|
|
|
app:
|
|
name: audit-processor
|
|
env: dev # K8S_AUDIT_APP_ENV
|
|
|
|
log:
|
|
level: info
|
|
output: stdout
|
|
add_source: false
|
|
access_log: true
|
|
audit_events: false # поток ИБ не идёт в прикладные логи (п.20)
|
|
s3_echo: false # K8S_AUDIT_LOG_S3_ECHO; только отладка (п.20)
|
|
|
|
kafka:
|
|
brokers: [] # K8S_AUDIT_KAFKA_BROKERS
|
|
topic: security.k8s-audit
|
|
group: security-audit-processor
|
|
start_from: earliest # latest перескочил бы события после разрыва offset'ов
|
|
session_timeout: 45s
|
|
rebalance_timeout: 60s
|
|
tls:
|
|
enabled: true
|
|
ca_file: /vault/secrets/kafka-ca.crt
|
|
sasl:
|
|
mechanism: SCRAM-SHA-512
|
|
username_file: /vault/secrets/kafka-username
|
|
password_file: /vault/secrets/kafka-password
|
|
|
|
minio:
|
|
endpoint: "" # K8S_AUDIT_MINIO_ENDPOINT
|
|
bucket: security-audit
|
|
secure: false # внешний MinIO контура — plain HTTP (ServiceEntry minio.uralkal.external)
|
|
access_key_file: /vault/secrets/minio-access-key
|
|
secret_key_file: /vault/secrets/minio-secret-key
|
|
|
|
# Срок хранения обеспечивает ILM бакета; processor только проверяет правила при старте.
|
|
retention:
|
|
days: 90
|
|
prefixes: [events/, changes/]
|
|
check_on_start: true
|
|
|
|
http:
|
|
host: 0.0.0.0
|
|
port: 8000 # /healthz, /readyz, /metrics
|
|
|
|
stream:
|
|
flush_interval: 5m
|
|
flush_max_rows: 10000
|
|
flush_timeout: 30s # меньше kafka.rebalance_timeout
|
|
max_flush_failures: 30
|