This is a continuation of #60392

API-related changes

• Graduate API to stable upgrade Audit api version to stable #65891
• Integration with admission
  • Annotate audit logs in remote admission webhooks
    @CaoShuFeng is working on this in support annotations for admission webhook #58679
• Add user-agent to audit events Add user-agent to audit-logging #64791

Bugfixes and improvements

• Completely remove legacy audit logging Promote AdvancedAuditing to GA #65862
• [Optional] Always retry audit webhook
• [Optional] Dynamic audit configuration

Policy changes

• Add a setting in audit policy that will allow rejecting API request when audit logging fails Add option to k8s apiserver to reject incoming requests upon audit failure #65763
• [Optional] GCE audit policy should be made re-usable by other setups
• [Optional] Audit policy should be tested (e.g. that it includes all core resources, more context)

To discuss

• [Optional] Auditing federation setups

I mostly carried over the unfinished work from 1.11 issue. Two things added: the ability to reject apiserver requests when audit logging fails (configurable via audit policy) and - optionally - recent proposal for dynamic audit configuration.

/kind feature
/sig auth
/area audit

cc @loburm @tallclair @soltysh