From a25edfdf1383b7863a62f3a61ad922fda9467aaf Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?St=C3=A9phane=20Tailland?= <stephane.tailland@ibm.com>
Date: Fri, 21 Aug 2026 13:34:12 +0200
Subject: [PATCH] Add audit-log-collector (Fluent Bit) in observability
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

Receives the http-log plugin's POSTs and dumps each record as a JSON
line to a PVC-backed file. Applied directly (kubectl), same as Jaeger
in this namespace — not Flux-managed yet.
---
 .../audit-log-collector-configmap.yaml        | 22 +++++++++++++
 .../audit-log-collector-deployment.yaml       | 33 +++++++++++++++++++
 observability/audit-log-collector-pvc.yaml    | 11 +++++++
 .../audit-log-collector-service.yaml          | 11 +++++++
 4 files changed, 77 insertions(+)
 create mode 100644 observability/audit-log-collector-configmap.yaml
 create mode 100644 observability/audit-log-collector-deployment.yaml
 create mode 100644 observability/audit-log-collector-pvc.yaml
 create mode 100644 observability/audit-log-collector-service.yaml

diff --git a/observability/audit-log-collector-configmap.yaml b/observability/audit-log-collector-configmap.yaml
new file mode 100644
index 0000000..669a20e
--- /dev/null
+++ b/observability/audit-log-collector-configmap.yaml
@@ -0,0 +1,22 @@
+apiVersion: v1
+kind: ConfigMap
+metadata:
+  name: audit-log-collector-config
+  namespace: observability
+data:
+  fluent-bit.conf: |
+    [SERVICE]
+        Flush        1
+        Log_Level    info
+
+    [INPUT]
+        Name         http
+        Listen       0.0.0.0
+        Port         8888
+
+    [OUTPUT]
+        Name         file
+        Match        *
+        Path         /data
+        File         audit.jsonl
+        Format       plain
diff --git a/observability/audit-log-collector-deployment.yaml b/observability/audit-log-collector-deployment.yaml
new file mode 100644
index 0000000..bcac06b
--- /dev/null
+++ b/observability/audit-log-collector-deployment.yaml
@@ -0,0 +1,33 @@
+apiVersion: apps/v1
+kind: Deployment
+metadata:
+  name: audit-log-collector
+  namespace: observability
+spec:
+  replicas: 1
+  selector:
+    matchLabels:
+      app: audit-log-collector
+  template:
+    metadata:
+      labels:
+        app: audit-log-collector
+    spec:
+      containers:
+        - name: fluent-bit
+          image: fluent/fluent-bit:3.2
+          ports:
+            - containerPort: 8888
+          volumeMounts:
+            - name: config
+              mountPath: /fluent-bit/etc/fluent-bit.conf
+              subPath: fluent-bit.conf
+            - name: data
+              mountPath: /data
+      volumes:
+        - name: config
+          configMap:
+            name: audit-log-collector-config
+        - name: data
+          persistentVolumeClaim:
+            claimName: audit-log-collector-data
diff --git a/observability/audit-log-collector-pvc.yaml b/observability/audit-log-collector-pvc.yaml
new file mode 100644
index 0000000..c834961
--- /dev/null
+++ b/observability/audit-log-collector-pvc.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: PersistentVolumeClaim
+metadata:
+  name: audit-log-collector-data
+  namespace: observability
+spec:
+  accessModes:
+    - ReadWriteOnce
+  resources:
+    requests:
+      storage: 1Gi
diff --git a/observability/audit-log-collector-service.yaml b/observability/audit-log-collector-service.yaml
new file mode 100644
index 0000000..a21b8f7
--- /dev/null
+++ b/observability/audit-log-collector-service.yaml
@@ -0,0 +1,11 @@
+apiVersion: v1
+kind: Service
+metadata:
+  name: audit-log-collector
+  namespace: observability
+spec:
+  selector:
+    app: audit-log-collector
+  ports:
+    - port: 80
+      targetPort: 8888