Skip to content

Getting started with the services in the cluster

Install audit with every service in the cluster: NATS carries the stream, PostgreSQL holds the deduplication table and the index, and credentials arrive as Kubernetes Secrets. There is no Pulumi program and no Lambda. To keep the bucket, key and identity on AWS and only run the chart, use Kubernetes with AWS storage. The other shape is AWS Lambda.

What you need

The chart takes references to all of these and refuses to render when one is missing.

You need How
NATS the pods can reach JetStream enabled; the example uses nats://nats.nats.svc:4222
PostgreSQL, an owner and a role per part prepare the database
An S3 bucket and a prefix AWS S3 or Cloudflare R2; attested needs AWS S3; prepare the bucket
A key for the seals AWS KMS or OpenBao transit (key custody); pseudonymising under KMS also needs keys.conceal, a symmetric KMS key
The secrets Kubernetes Secrets named in the values, delivered by an operator such as External Secrets
A reference clock an NTP address, for example pool.ntp.org, or 169.254.169.123 on AWS
The images ghcr.io/truvity/audit/, one tag that also stamps the chart

1. Add the dependency

# the application's Chart.yaml
dependencies:
  - name: audit
    version: <version>
    repository: oci://ghcr.io/truvity/charts

2. Write the values

The chart's tests render charts/audit/examples/in-cluster-services.yaml. Its shape:

audit:
  mode: stream
  replicas: 2
  presets:
    standard: {bucket: audit-eu-example-1, region: eu-example-1, prefix: audit/}
  receiver:
    config:
      mode: receiver
      stream: {nats: {url: "nats://nats.nats.svc:4222"}, name: AUDIT}
  writer:
    consumers: 3
  jobs:
    notary:
      enabled: true
      config:
        keys: {adapter: kms, seal: {key: alias/sluis-example-audit-seal}}
    clockSync:
      enabled: true
      config:
        ntp: ["pool.ntp.org"]

Replace the hosts and Secret names. For R2, set the preset's endpoint and give each pod that touches the archive its access key from a Secret. For OpenBao transit, set the notary's keys.adapter to transit. The example file shows both.

3. Install

helm dependency build ./charts/<application>
helm upgrade --install <application> ./charts/<application> -n <app> -f values.yaml

4. Check it works

  1. Run kubectl -n <app> rollout status for deploy/<release>-audit (the receiver) and deploy/<release>-audit-consumer (the writers). A 503 on /readyz names the failed check.
  2. Perform an action the catalogue declares (connect an application).
  3. List the archive. Omit --endpoint-url on AWS S3:
aws s3 ls s3://audit-eu-example-1/audit/ --recursive --endpoint-url https://ACCOUNT.r2.cloudflarestorage.com
# or, with the MinIO client
mc ls --recursive archive/audit-eu-example-1/audit/
  1. Run audit verify --profile security --last 24h --bucket audit-eu-example-1 --prefix audit.

Next

Recover from an outage, verify the trail, configure OpenBAO keys.