1960ef495c
base/processor-*.yaml: Deployment (1 replica, image k8s-audit-processor:394b6f9d), ConfigMap with config.yaml, ServiceAccount, NetworkPolicy (DNS, kafka:9092, external MinIO 10.133.0.245:9000). Contour-specific values for uralkal are set via env patch in the overlay (K8S_AUDIT_*), same pattern as the collectors. Credentials reuse the static Secrets (security-audit-kafka, kafka-ca, security-audit-minio) via a projected volume at /vault/secrets. app.env=stand: the contour's external MinIO has no TLS, so strict validation (minio.secure) would fail. log.s3_echo=true is temporary for flow verification (per security req. 20: disable after debugging).
35 lines
1.4 KiB
YAML
35 lines
1.4 KiB
YAML
# Процессору нужны: Kafka (чтение топика), внешний MinIO (запись Parquet), DNS.
|
||
# Входящие — только пробы и метрики (:8000). Складывается с общей политикой audit-collector
|
||
# (podSelector {}): её правила DNS и Kafka дублировать не обязательно, но оставляем автономность.
|
||
apiVersion: networking.k8s.io/v1
|
||
kind: NetworkPolicy
|
||
metadata:
|
||
name: audit-processor
|
||
spec:
|
||
podSelector:
|
||
matchLabels:
|
||
app.kubernetes.io/name: audit-processor
|
||
policyTypes: [Ingress, Egress]
|
||
ingress:
|
||
- ports:
|
||
- {port: 8000, protocol: TCP} # /healthz, /readyz (kubelet), /metrics
|
||
egress:
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: kube-system}
|
||
podSelector:
|
||
matchLabels: {k8s-app: kube-dns}
|
||
- ipBlock: {cidr: 169.254.25.10/32} # nodelocaldns kubespray
|
||
ports:
|
||
- {port: 53, protocol: UDP}
|
||
- {port: 53, protocol: TCP}
|
||
- to:
|
||
- namespaceSelector:
|
||
matchLabels: {kubernetes.io/metadata.name: kafka}
|
||
ports:
|
||
- {port: 9092, protocol: TCP} # client-листенер SASL_SSL
|
||
- to:
|
||
- ipBlock: {cidr: 10.133.0.245/32} # внешний MinIO контура (minio.uralkal.external)
|
||
ports:
|
||
- {port: 9000, protocol: TCP}
|