a6a176d6c5
New image removes the bucket lifecycle check (retention is owned by terraform minio-buckets lifecycle_rules), so the retention section is dropped from the processor config map.
57 lines
2.0 KiB
YAML
57 lines
2.0 KiB
YAML
# Конфиг audit-processor (образ k8s-audit-processor, CONFIG_PATH=/etc/k8s-audit/config.yaml).
|
|
# Контур-специфичные значения (contour, kafka.brokers, minio.endpoint, app.env, log.s3_echo)
|
|
# задаёт оверлей через env K8S_AUDIT_* — см. uralkal/kustomization.yaml.
|
|
apiVersion: v1
|
|
kind: ConfigMap
|
|
metadata:
|
|
name: audit-processor-config
|
|
labels:
|
|
app.kubernetes.io/name: audit-processor
|
|
data:
|
|
config.yaml: |
|
|
contour: "" # K8S_AUDIT_CONTOUR
|
|
|
|
app:
|
|
name: audit-processor
|
|
env: dev # K8S_AUDIT_APP_ENV
|
|
|
|
log:
|
|
level: info
|
|
output: stdout
|
|
add_source: false
|
|
access_log: true
|
|
audit_events: false # поток ИБ не идёт в прикладные логи (п.20)
|
|
s3_echo: false # K8S_AUDIT_LOG_S3_ECHO; только отладка (п.20)
|
|
|
|
kafka:
|
|
brokers: [] # K8S_AUDIT_KAFKA_BROKERS
|
|
topic: security.k8s-audit
|
|
group: security-audit-processor
|
|
start_from: earliest # latest перескочил бы события после разрыва offset'ов
|
|
session_timeout: 45s
|
|
rebalance_timeout: 60s
|
|
tls:
|
|
enabled: true
|
|
ca_file: /vault/secrets/kafka-ca.crt
|
|
sasl:
|
|
mechanism: SCRAM-SHA-512
|
|
username_file: /vault/secrets/kafka-username
|
|
password_file: /vault/secrets/kafka-password
|
|
|
|
minio:
|
|
endpoint: "" # K8S_AUDIT_MINIO_ENDPOINT
|
|
bucket: security-audit
|
|
secure: false # внешний MinIO контура — plain HTTP (ServiceEntry minio.uralkal.external)
|
|
access_key_file: /vault/secrets/minio-access-key
|
|
secret_key_file: /vault/secrets/minio-secret-key
|
|
|
|
http:
|
|
host: 0.0.0.0
|
|
port: 8000 # /healthz, /readyz, /metrics
|
|
|
|
stream:
|
|
flush_interval: 5m
|
|
flush_max_rows: 10000
|
|
flush_timeout: 30s # меньше kafka.rebalance_timeout
|
|
max_flush_failures: 30
|