tsb-sentinel-telemetry.yaml

apiVersion: telemetry.tsb.tetrate.io/v2
kind: TelemetrySetting
metadata:
  name: sentinel-log-export
  tenant: devsecops
  workspace: security-ops
spec:
  # Export Envoy access logs to Sentinel AI
  accessLogging:
    - providers:
        - name: envoy-sentinel-file-log
          file:
            path: /dev/stdout
            format: |
              {
                "timestamp": "%START_TIME%",
                "source_workload": "%SOURCE_WORKLOAD%",
                "source_namespace": "%SOURCE_NAMESPACE%",
                "destination_workload": "%DESTINATION_WORKLOAD%",
                "destination_namespace": "%DESTINATION_NAMESPACE%",
                "response_code": "%RESPONSE_CODE%",
                "request_path": "%REQ(:PATH)%",
                "request_method": "%REQ(:METHOD)%",
                "request_size": "%BYTES_RECEIVED%",
                "response_size": "%BYTES_SENT%",
                "duration": "%DURATION%",
                "mtls": "%DOWNSTREAM_PEER_URI_SAN%",
                "user_agent": "%REQ(USER-AGENT)%",
                "jwt_claims": "%DYNAMIC_METADATA(envoy.filters.http.jwt_authn:payload)%"
              }
      match:
        - mode: CLIENT_AND_SERVER
      # Send to Sentinel via WASM extension or external service
      filter:
        providers:
          - name: sentinel-webhook
            wasm:
              service: sentinel-ai.sentinel-ns.svc.cluster.local
              port: 3000
              path: /api/tetrate/ingest
              timeout: 5s
              fail_open: false  # Block traffic if Sentinel is down (fail secure)

  # Metrics export for anomaly detection
  metrics:
    - providers:
        - name: sentinel-prometheus
          prometheus:
            port: 9090
      tags:
        - name: threat_detected
          valueFrom:
            literal: "false"  # Sentinel updates this via API