feat(observe): ingest k8s audit-log secret GETs as a corroborating runtime signal (JEF-269)

[thejefflarson]

Closes JEF-269

What & why

A pod reads a secret two ways: a mounted-file read the eBPF agent sees directly (Behavior::SecretRead), or an API GET via its ServiceAccount RBAC — a TLS call to the apiserver eBPF can't attribute as a secret read. protector already models the API path as reachability (an RBAC CanRead [RBAC-GRANTED] chain) but couldn't observe it live. The apiserver's own audit log records every secret GET/LIST/WATCH, so this ingests it as the missing corroborated-now signal (ADR-0016).

Design — native audit-webhook ingest

• observe::audit — an authenticated in-cluster HTTP endpoint the apiserver's audit webhook POSTs to, mirroring observe::runtime: bearer auth (reuses ingest_guard), per-peer rate limit, body-size cap, a TTL'd store on the same 300s window as the runtime feed, and wake-the-engine only on a new observation. parse_audit_event normalizes verb ∈ {get,list,watch} on secrets (core group) that was allowed and attributed to a ServiceAccount. Accepts the apiserver's EventList batch or a bare event.
• AuditSecretReadAdapter — the SA→workload attribution is engine-side. For each read it finds the Identity for the requesting SA and attaches a SecretRead{Api} signal to every Workload that RunsAs it. Where an SA backs multiple pods the ambiguity is represented honestly (attach to all), never falsely narrowed to one. That flips corroboration on the RBAC-granted credential-access chain exactly as a Falco alert / mounted read does (the JEF-117 pattern). Shadow-gated: sets corroborated, never actuates.

SecretRead source discriminator (decision)

Added a SecretReadSource {Mounted, Api} enum + source field on Behavior::SecretRead (chose the field over a new variant to keep one secret-read concept). It defaults to Mounted and is omitted on the wire, so the eBPF agent's {"kind":"secret_read","secret":"..."} contract is byte-for-byte unchanged and the behavior crate stays cluster-agnostic. Summary + verdict-cache fingerprint distinguish the two; the metric label stays the coarse shared token.

Security / zero-egress

• Inbound only (apiserver → protector, in-cluster) — no outbound call (ADR-0015).
• Endpoint authenticated (shared-secret bearer, PROTECTOR_INGEST_TOKEN[_FILE]), rate-limited, body-capped.
• All event fields untrusted: size-bounded (MAX_FIELD_LEN / MAX_EVENTS_PER_BODY), malformed/denied/non-SA/non-secret payloads dropped without panic. Audit events carry secret names/refs only, never values — nothing logs or stores a value (only counts are logged).

Wiring

Behind PROTECTOR_AUDIT_ADDR (unset = off); run_loop.rs change is minimal/additive (mirrors the runtime ingest).

Follow-up (deploy repo)

The apiserver audit-policy + audit-webhook config (a policy that logs secret get/list/watch at the Metadata/RequestResponse level, and the webhook backend pointing at PROTECTOR_AUDIT_ADDR with the bearer secret) is a deploy-repo change, out of scope here — this PR is the in-cluster ingest + parsing + corroboration.

Tests

• behavior: source discriminator wire compat (mounted omitted, api explicit, legacy → mounted), summary/fingerprint distinction.
• observe::audit: allowed get parses; list/watch + cluster-wide covered; denied / non-read verbs / non-secret / non-SA / malformed dropped (no panic); untrusted fields size-bounded; EventList batch; TTL expiry + dedup.
• AuditSecretReadAdapter: API read attaches to the SA's workload; corroborates the RBAC-granted chain end-to-end; unmodeled SA corroborates nothing; an SA backing many pods corroborates all of them.

Checks

cargo fmt · cargo build · cargo clippy --all-targets (engine + behavior, warns=errors) · cargo test — all green (behavior 9, engine 465 + integration/file-size-guard).

🤖 Generated with Claude Code