f0014c5d00
DaemonSet audit-collector на control-plane (журнал kube-apiserver → security.k8s-audit), Deployment access-collector (OTLP :4317 — журнал доступа ingress-шлюза → security.mesh-access, webhookevent :8088 — события Zitadel Actions v2 → security.idp-events, otlp :4319 — журнал аудита Vault → security.vault-audit), Job idp-actions-bootstrap (Target + Execution'ы в Zitadel), NetworkPolicy/AuthorizationPolicy, EnvoyFilter strip-audit-headers и Telemetry шлюза на провайдер audit-access (уже раскатан в istio-pilot/uralkal). Предусловия выполнены вне репозитория: аудит apiserver на мастерах (INFRA-3057), топики security.* и SCRAM-пользователь в Kafka, бакет security-audit в MinIO, секреты и роли Vault (terraform, vault-platform-secrets).
85 lines
2.4 KiB
YAML
85 lines
2.4 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
|
kind: Kustomization
|
|
resources:
|
|
- ./flux-system
|
|
- ./helm-repositories.yaml
|
|
|
|
- ../../infrastructure/vault/uralkal
|
|
- ../../infrastructure/istio-base/uralkal
|
|
- ../../infrastructure/istio-pilot/uralkal
|
|
- ../../infrastructure/istio-gateway/uralkal
|
|
- ../../infrastructure/rabbitmq/uralkal
|
|
- ../../infrastructure/kafka/uralkal
|
|
- ../../infrastructure/postgresql/uralkal
|
|
- ../../infrastructure/zitadel/uralkal
|
|
- ../../infrastructure/camunda/uralkal
|
|
- ../../infrastructure/superset/uralkal
|
|
- ../../infrastructure/trino/uralkal
|
|
- ../../infrastructure/istio-config/uralkal
|
|
- ../../infrastructure/s3-proxy/uralkal
|
|
- ../../infrastructure/security-audit/uralkal
|
|
|
|
- ../../apps/reviews/uralkal
|
|
- ../../apps/remarks/uralkal
|
|
- ../../apps/auth-flow/uralkal
|
|
- ../../apps/control-interface/uralkal
|
|
- ../../apps/workspaces/uralkal
|
|
- ../../apps/eav/uralkal
|
|
- ../../apps/notes/uralkal
|
|
- ../../apps/rfi/uralkal
|
|
- ../../apps/checklists/uralkal
|
|
- ../../apps/contracts/uralkal
|
|
- ../../apps/django/uralkal
|
|
- ../../apps/documentations/uralkal
|
|
- ../../apps/processing/uralkal
|
|
- ../../apps/flows/uralkal
|
|
- ../../apps/issues/uralkal
|
|
- ../../apps/bim/uralkal
|
|
- ../../apps/attachments/uralkal
|
|
- ../../apps/bi/uralkal
|
|
- ../../apps/comparisons/uralkal
|
|
- ../../apps/drawings/uralkal
|
|
- ../../apps/inspections/uralkal
|
|
- ../../apps/mapper/uralkal
|
|
- ../../apps/measurements/uralkal
|
|
- ../../apps/subscriptions/uralkal
|
|
- ../../apps/system-log/uralkal
|
|
- ../../apps/transmittal/uralkal
|
|
- ../../apps/cross-section/uralkal
|
|
- ../../apps/document-link/uralkal
|
|
- ../../apps/prescriptions/uralkal
|
|
- ../../apps/projects/uralkal
|
|
- ../../apps/stamp-verification/uralkal
|
|
- ../../apps/faas/uralkal
|
|
- ../../apps/iam/uralkal
|
|
- ../../apps/pm/uralkal
|
|
- ../../apps/message-hub/uralkal
|
|
- ../../apps/cde/uralkal
|
|
|
|
patches:
|
|
- target:
|
|
kind: HelmRelease
|
|
patch: |
|
|
- op: add
|
|
path: /spec/driftDetection
|
|
value:
|
|
mode: enabled
|
|
ignore:
|
|
- paths: ["/webhooks"]
|
|
target:
|
|
kind: MutatingWebhookConfiguration
|
|
- paths: ["/webhooks"]
|
|
target:
|
|
kind: ValidatingWebhookConfiguration
|
|
- target:
|
|
kind: HelmRelease
|
|
name: istiod
|
|
patch: |
|
|
- op: add
|
|
path: /spec/driftDetection/ignore/-
|
|
value:
|
|
paths: ["/spec/replicas"]
|
|
target:
|
|
kind: Deployment
|
|
|