[audit-logs] merge chart with sapcc/helm-chart/system/audit-logs-otel

[Kuckkuck]

Summary

Merge the sapcc/helm-charts/system/audit-logs-otel chart into the Greenhouse audit-logs plugin as a single source for OTEL-based audit log collection.

Changes

Architecture

• Replace forward connector with routing connector (default_pipelines + empty table) for future content-based routing without pipeline restructuring
• Always-on dual-credential failover (removed failover.enabled toggle)
• Kafka or OpenSearch output (mutually exclusive, controlled by logsCollector.kafka.enabled)

Collector

• Auditd receiver with PCI-DSS v3.1 compliant rules (conditional hostPID/privileged only when auditd.enabled)
• Audit-poller filelog receiver for IAS audit log ingestion
• Containerd receiver with keystone/vault/falco transform processors
• Journald, kube-apiserver audit, and k8s_events receivers
• Configurable scheduling: podAnnotations, affinity, terminationGracePeriodSeconds

Audit-Poller Subchart

• Vendored audit-poller subchart with deployment, configmap, secrets, PVC, PodMonitor, and PrometheusRule
• Parent chart (auditPoller.*) is single source of truth for all configuration
• Image config via auditPoller.image.repository / auditPoller.image.tag
• Configurable playbook base path for alert URLs (auditPoller.playbook.basePath)
• PrometheusRule inlined as proper Helm template (replaces .Files.Get)
• global.* values (prometheus, region, clusterType, cluster) propagated to subchart

Bug Fixes

• Fix lifesaver condition: use dotted-key otel.scope.name instead of nested map access
• Add missing logs/k8sevents pipeline
• Fix configmap namespace: use {{ .Release.Namespace }} instead of undefined .Values.namespace
• Fix deployment image reference to use .Values.image.repository/.Values.image.tag

Cleanup

• Remove dead _audit-config.tpl (defined but never included)
• Remove updateStrategy (OTel Operator default applies)
• Remove sapcc-specific global values from vendor subchart
• Remove unused scheduling-values.yaml CI test

[Copilot]

Pull request overview

This PR migrates the OTEL-based audit-logs Helm chart setup into Greenhouse, introduces a vendored audit-poller subchart, and extends the collector configuration to ingest additional audit log sources and support OpenSearch/Kafka-style output flows.

Changes:

• Add audit-poller as a vendored dependency (with its own templates/alerts/CI values).
• Extend the audit-logs OpenTelemetryCollector config with new receivers/processors/pipelines (notably audit-poller log ingestion and additional containerd transforms).
• Expand audit-logs chart values to expose scheduling/rollout knobs (affinity, updateStrategy, podAnnotations, terminationGracePeriodSeconds) and add top-level auditPoller values.

Reviewed changes

Copilot reviewed 7 out of 18 changed files in this pull request and generated 4 comments.

Show a summary per file

File	Description
audit-logs/charts/vendor/audit-poller/Chart.yaml	Adds vendored audit-poller chart metadata.
audit-logs/charts/vendor/audit-poller/values.yaml	Adds default values for audit-poller.
audit-logs/charts/vendor/audit-poller/templates/configmap.yaml	Adds poller configuration ConfigMap (currently with a namespace templating issue).
audit-logs/charts/vendor/audit-poller/templates/deployment.yaml	Adds poller Deployment (imageTag handling can render invalid image).
audit-logs/charts/vendor/audit-poller/templates/secrets.yaml	Adds Secret for IAS credentials.
audit-logs/charts/vendor/audit-poller/templates/podmonitor.yaml	Adds PodMonitor (selector currently too broad for multi-release scenarios).
audit-logs/charts/vendor/audit-poller/templates/prometheus-alerts.yaml	Adds PrometheusRule including vendored alerts file.
audit-logs/charts/vendor/audit-poller/templates/pvc.yaml	Adds optional PVC.
audit-logs/charts/vendor/audit-poller/alerts/_ias-poller.alerts	Adds poller alert rules.
audit-logs/charts/vendor/audit-poller/ci/test-values.yaml	Adds CI values for subchart.
audit-logs/charts/Chart.yaml	Adds the audit-poller dependency (alias auditPoller) behind auditPoller.enabled.
audit-logs/charts/values.yaml	Adds new collector knobs + auditPoller values; modifies OpenSearch failover values (currently inconsistent/missing).
audit-logs/charts/templates/audit-logs-collector.yaml	Adds audit-poller receiver/processor/pipeline wiring; expands containerd transform chain; changes failover inclusion behavior; adds new spec knobs.
audit-logs/charts/templates/_auditpoller-config.tpl	New audit-poller receiver/processor/pipeline snippets for the collector.
audit-logs/charts/templates/_auditd-config.tpl	Updates auditd rules (PCI-DSS keyed rules).
audit-logs/charts/templates/secret.yaml	Removes conditional around failover B credentials (currently fails templating with default/null values).
audit-logs/charts/ci/test-values.yaml	Removes audit-logs CI test values file.

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 23 changed files in this pull request and generated 2 comments.

[Copilot]

Pull request overview

Copilot reviewed 12 out of 23 changed files in this pull request and generated 3 comments.