1960ef495c
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d), ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092, external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors. Credentials reuse the static Secrets (security-audit-kafka, kafka-ca, security-audit-minio) via a projected volume at /vault/secrets. app.env=stand: the contour's external MinIO has no TLS, so strict validation (minio.secure) would fail. log.s3_echo=true is temporary for flow verification (per security req. 20: disable after debugging).
59 lines
2.6 KiB
YAML
59 lines
2.6 KiB
YAML
apiVersion: kustomize.config.k8s.io/v1beta1
|
||
kind: Kustomization
|
||
resources:
|
||
- ../base
|
||
- ../mesh # istio-system; применять после раскатки провайдера audit-access в istio-pilot/uralkal
|
||
patches:
|
||
- path: audit-collector.yaml
|
||
- path: access-collector.yaml
|
||
# События Zitadel отложены (нет PAT); включать вместе с idp-actions-bootstrap в base/kustomization.yaml.
|
||
# - path: idp-actions-bootstrap.yaml
|
||
# Селектор ingress-шлюза (HelmRelease istio-system/ingressgateway): replace, а не merge —
|
||
# merge-patch CRD оставил бы и заглушку security-audit/gateway.
|
||
- target:
|
||
kind: EnvoyFilter
|
||
name: strip-audit-headers
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/workloadSelector/labels
|
||
value: {istio: ingressgateway}
|
||
- target:
|
||
kind: Telemetry
|
||
name: gateway-audit-access
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/selector/matchLabels
|
||
value: {istio: ingressgateway}
|
||
- target:
|
||
kind: NetworkPolicy
|
||
name: access-collector
|
||
patch: |-
|
||
- op: replace
|
||
path: /spec/ingress/0/from/0/podSelector/matchLabels
|
||
value: {istio: ingressgateway}
|
||
# Контур-специфика audit-processor (Kafka → MinIO/Parquet).
|
||
- target:
|
||
kind: Deployment
|
||
name: audit-processor
|
||
patch: |-
|
||
- op: add
|
||
path: /spec/template/spec/containers/0/env
|
||
value:
|
||
- name: K8S_AUDIT_CONTOUR
|
||
value: uralkal
|
||
# MinIO контура — внешний, без TLS: strict-валидация (app.env ∉ dev/local/stand)
|
||
# не пройдёт по minio.secure. Послабления стенда при этом используются только здесь:
|
||
# Kafka по-прежнему TLS+SASL, start_from earliest.
|
||
- name: K8S_AUDIT_APP_ENV
|
||
value: stand
|
||
# Отладочное эхо записанных в S3 событий в stdout. Только на время запуска (п.20):
|
||
# после проверки потока выключить (false) и убрать комментарий.
|
||
- name: K8S_AUDIT_LOG_S3_ECHO
|
||
value: "true"
|
||
# Service чарта kafka-contour; тот же адрес у коллекторов и приложений.
|
||
- name: K8S_AUDIT_KAFKA_BROKERS
|
||
value: kafka-kafka-contour.kafka.svc.cluster.local:9092
|
||
# Внешний MinIO (ServiceEntry minio.uralkal.external в istio-config).
|
||
- name: K8S_AUDIT_MINIO_ENDPOINT
|
||
value: 10.133.0.245:9000
|