d0bed7033a
Config: pipelines security.k8s-audit (k8s_audit) + security.mesh-access (mesh_access); kafka.topic kept for rollback (pre-pipelines image ignores the pipelines key). Image pinned to digest sha256:56a23bec… (k8s-audit@05a186a, pipelines support) per repo policy п.38. Kafka ACL and MinIO policy need no changes (no ACLs; bucket user has s3:* on the whole bucket). Companion terraform change: ILM rule expire-mesh-access-90d.
75 lines
2.9 KiB
YAML
75 lines
2.9 KiB
YAML
apiVersion: apps/v1
|
||
kind: Deployment
|
||
metadata:
|
||
name: audit-processor
|
||
labels:
|
||
app.kubernetes.io/name: audit-processor
|
||
spec:
|
||
replicas: 1 # consumer group: партиция security.k8s-audit одна, вторая реплика была бы standby
|
||
selector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: audit-processor
|
||
template:
|
||
metadata:
|
||
labels:
|
||
app.kubernetes.io/name: audit-processor
|
||
# Без sidecar: в Kafka процессор ходит напрямую SASL_SSL (как audit-collector),
|
||
# во внешний MinIO — мимо mesh (ServiceEntry, HTTP).
|
||
sidecar.istio.io/inject: "false"
|
||
annotations:
|
||
sidecar.istio.io/inject: "false"
|
||
spec:
|
||
serviceAccountName: audit-processor
|
||
imagePullSecrets:
|
||
- name: regcred
|
||
securityContext:
|
||
seccompProfile: {type: RuntimeDefault}
|
||
containers:
|
||
- name: audit-processor
|
||
# Образ FROM scratch, USER 65534; CONFIG_PATH=/etc/k8s-audit/config.yaml — в ENTRYPOINT образа.
|
||
# Digest, а не тег (п.38): релиз с поддержкой pipelines (k8s-audit@05a186a).
|
||
image: cr.yandex/crp3ccidau046kdj8g9q/k8s-audit-processor@sha256:56a23bec64fe6abdabebbc67806c4d5677486dca5ad5aac01b17db09d768bc72
|
||
ports:
|
||
- {name: http, containerPort: 8000}
|
||
readinessProbe:
|
||
httpGet: {path: /readyz, port: http}
|
||
periodSeconds: 10
|
||
livenessProbe:
|
||
httpGet: {path: /healthz, port: http}
|
||
periodSeconds: 20
|
||
resources:
|
||
requests: {cpu: 50m, memory: 128Mi}
|
||
limits: {cpu: 500m, memory: 512Mi}
|
||
securityContext:
|
||
runAsNonRoot: true
|
||
runAsUser: 65534
|
||
runAsGroup: 65534
|
||
readOnlyRootFilesystem: true
|
||
allowPrivilegeEscalation: false
|
||
capabilities:
|
||
drop: [ALL]
|
||
volumeMounts:
|
||
- {name: config, mountPath: /etc/k8s-audit, readOnly: true}
|
||
# Те же Secret'ы и имена файлов, что у коллекторов (плюс ключи MinIO).
|
||
- {name: secrets, mountPath: /vault/secrets, readOnly: true}
|
||
volumes:
|
||
- name: config
|
||
configMap: {name: audit-processor-config}
|
||
- name: secrets
|
||
projected:
|
||
sources:
|
||
- secret:
|
||
name: security-audit-kafka
|
||
items:
|
||
- {key: username, path: kafka-username}
|
||
- {key: password, path: kafka-password}
|
||
- secret:
|
||
name: kafka-ca
|
||
items:
|
||
- {key: ca.crt, path: kafka-ca.crt}
|
||
- secret:
|
||
name: security-audit-minio
|
||
items:
|
||
- {key: access_key, path: minio-access-key}
|
||
- {key: secret_key, path: minio-secret-key}
|