Description
What happened?
In the Audit Policy file I've definded one rule with level "Request". In the audit-log I see RequestReceived and ResponseComplete Statges
What did you expect to happen?
Derived from the documentation (https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy) the audit log should not contain ResponseComplete Stage.
With the Policy below I receive two entries in the audit log as listed below
How can we reproduce it (as minimally and precisely as possible)?
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Request
resources:
- group: ""
resources: ["secrets"]
Anything else we need to know?
This is the (reduced recorded) output when i create a secret
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Request","auditID":"e9177848-c55c-4849-84d0-ccd43fde9abf","stage":"RequestReceived","requestURI":"/api/v1/namespaces/dafault/secrets" ...}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Request","auditID":"e9177848-c55c-4849-84d0-ccd43fde9abf","stage":"**ResponseComplete**","requestURI":"/api/v1/namespaces/27-audit/secrets" ...}
Kubernetes version
$ kubectl version
Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.0
</details>
### Cloud provider
on-prem
### OS version
<details>
```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.2 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
$ uname -a
Linux k8sm201 5.15.0-69-generic #76-Ubuntu SMP Fri Mar 17 17:19:29 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux
Install tools
Container runtime (CRI) and version (if applicable)
Related plugins (CNI, CSI, ...) and versions (if applicable)
Metadata
Metadata
Assignees
Labels
Type
Projects
Status