1+ apiVersion : audit.k8s.io/v1beta1 # This is required.
2+ kind : Policy
3+ # Don't generate audit events for all requests in RequestReceived stage.
4+ omitStages :
5+ - " RequestReceived"
6+ rules :
7+ # Log pod changes at RequestResponse level
8+ - level : RequestResponse
9+ resources :
10+ - group : " "
11+ # Resource "pods" doesn't match requests to any subresource of pods,
12+ # which is consistent with the RBAC policy.
13+ resources : ["pods"]
14+ # Log "pods/log", "pods/status" at Metadata level
15+ - level : Metadata
16+ resources :
17+ - group : " "
18+ resources : ["pods/log", "pods/status"]
19+
20+ # Don't log requests to a configmap called "controller-leader"
21+ - level : None
22+ resources :
23+ - group : " "
24+ resources : ["configmaps"]
25+ resourceNames : ["controller-leader"]
26+
27+ # Don't log watch requests by the "system:kube-proxy" on endpoints or services
28+ - level : None
29+ users : ["system:kube-proxy"]
30+ verbs : ["watch"]
31+ resources :
32+ - group : " " # core API group
33+ resources : ["endpoints", "services"]
34+
35+ # Don't log authenticated requests to certain non-resource URL paths.
36+ - level : None
37+ userGroups : ["system:authenticated"]
38+ nonResourceURLs :
39+ - " /api*" # Wildcard matching.
40+ - " /version"
41+
42+ # Log the request body of configmap changes in kube-system.
43+ - level : Request
44+ resources :
45+ - group : " " # core API group
46+ resources : ["configmaps"]
47+ # This rule only applies to resources in the "kube-system" namespace.
48+ # The empty string "" can be used to select non-namespaced resources.
49+ namespaces : ["kube-system"]
50+
51+ # Log configmap and secret changes in all other namespaces at the Metadata level.
52+ - level : Metadata
53+ resources :
54+ - group : " " # core API group
55+ resources : ["secrets", "configmaps"]
56+
57+ # Log all other resources in core and extensions at the Request level.
58+ - level : Request
59+ resources :
60+ - group : " " # core API group
61+ - group : " extensions" # Version of group should NOT be included.
62+
63+ # A catch-all rule to log all other requests at the Metadata level.
64+ - level : Metadata
65+ # Long-running requests like watches that fall under this rule will not
66+ # generate an audit event in RequestReceived.
67+ omitStages :
68+ - " RequestReceived"
0 commit comments