1960ef495c
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d), ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092, external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors. Credentials reuse the static Secrets (security-audit-kafka, kafka-ca, security-audit-minio) via a projected volume at /vault/secrets. app.env=stand: the contour's external MinIO has no TLS, so strict validation (minio.secure) would fail. log.s3_echo=true is temporary for flow verification (per security req. 20: disable after debugging).
74 lines
2.7 KiB
YAML
74 lines
2.7 KiB
YAML
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: audit-processor
|
||
labels:
|
||
app.kubernetes.io/name: audit-processor
|
||
spec:
|
||
replicas: 1 # consumer group: партиция security.k8s-audit одна, вторая реплика была бы standby
|
||
selector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: audit-processor
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app.kubernetes.io/name: audit-processor
|
||
# Без sidecar: в Kafka процессор ходит напрямую SASL_SSL (как audit-collector),
|
||
# во внешний MinIO — мимо mesh (ServiceEntry, HTTP).
|
||
sidecar.istio.io/inject: "false"
|
||
annotations:
|
||
sidecar.istio.io/inject: "false"
|
||
spec:
|
||
serviceAccountName: audit-processor
|
||
imagePullSecrets:
|
||
- name: regcred
|
||
securityContext:
|
||
seccompProfile: {type: RuntimeDefault}
|
||
containers:
|
||
- name: audit-processor
|
||
# Образ FROM scratch, USER 65534; CONFIG_PATH=/etc/k8s-audit/config.yaml — в ENTRYPOINT образа.
|
||
image: cr.yandex/crp3ccidau046kdj8g9q/k8s-audit-processor:394b6f9d
|
||
ports:
|
||
- {name: http, containerPort: 8000}
|
||
readinessProbe:
|
||
httpGet: {path: /readyz, port: http}
|
||
periodSeconds: 10
|
||
livenessProbe:
|
||
httpGet: {path: /healthz, port: http}
|
||
periodSeconds: 20
|
||
resources:
|
||
requests: {cpu: 50m, memory: 128Mi}
|
||
limits: {cpu: 500m, memory: 512Mi}
|
||
securityContext:
|
||
runAsNonRoot: true
|
||
runAsUser: 65534
|
||
runAsGroup: 65534
|
||
readOnlyRootFilesystem: true
|
||
allowPrivilegeEscalation: false
|
||
capabilities:
|
||
drop: [ALL]
|
||
volumeMounts:
|
||
- {name: config, mountPath: /etc/k8s-audit, readOnly: true}
|
||
# Те же Secret'ы и имена файлов, что у коллекторов (плюс ключи MinIO).
|
||
- {name: secrets, mountPath: /vault/secrets, readOnly: true}
|
||
volumes:
|
||
- name: config
|
||
configMap: {name: audit-processor-config}
|
||
- name: secrets
|
||
projected:
|
||
sources:
|
||
- secret:
|
||
name: security-audit-kafka
|
||
items:
|
||
- {key: username, path: kafka-username}
|
||
- {key: password, path: kafka-password}
|
||
- secret:
|
||
name: kafka-ca
|
||
items:
|
||
- {key: ca.crt, path: kafka-ca.crt}
|
||
- secret:
|
||
name: security-audit-minio
|
||
items:
|
||
- {key: access_key, path: minio-access-key}
|
||
- {key: secret_key, path: minio-secret-key}
|