Skip to content

Kubernetes Audit - Log Level "Request" #123317

Closed
@itarch

Description

@itarch

What happened?

In the Audit Policy file I've definded one rule with level "Request". In the audit-log I see RequestReceived and ResponseComplete Statges

What did you expect to happen?

Derived from the documentation (https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy) the audit log should not contain ResponseComplete Stage.

With the Policy below I receive two entries in the audit log as listed below

How can we reproduce it (as minimally and precisely as possible)?

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Request
  resources:
  - group: "" 
    resources: ["secrets"]

Anything else we need to know?

This is the (reduced recorded) output when i create a secret

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Request","auditID":"e9177848-c55c-4849-84d0-ccd43fde9abf","stage":"RequestReceived","requestURI":"/api/v1/namespaces/dafault/secrets" ...}

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Request","auditID":"e9177848-c55c-4849-84d0-ccd43fde9abf","stage":"**ResponseComplete**","requestURI":"/api/v1/namespaces/27-audit/secrets" ...}

Kubernetes version

$ kubectl version
Client Version: v1.29.0
Kustomize Version: v5.0.4-0.20230601165947-6ce0bf390ce3
Server Version: v1.29.0

</details>


### Cloud provider

on-prem

### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
PRETTY_NAME="Ubuntu 22.04.2 LTS"
NAME="Ubuntu"
VERSION_ID="22.04"
VERSION="22.04.2 LTS (Jammy Jellyfish)"
VERSION_CODENAME=jammy
ID=ubuntu
ID_LIKE=debian
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
UBUNTU_CODENAME=jammy
$ uname -a
Linux k8sm201 5.15.0-69-generic #76-Ubuntu SMP Fri Mar 17 17:19:29 UTC 2023 x86_64 x86_64 x86_64 GNU/Linux

Install tools

Container runtime (CRI) and version (if applicable)

Related plugins (CNI, CSI, ...) and versions (if applicable)

Metadata

Metadata

Assignees

No one assigned

    Labels

    kind/supportCategorizes issue or PR as a support question.needs-triageIndicates an issue or PR lacks a `triage/foo` label and requires one.sig/authCategorizes an issue or PR as relevant to SIG Auth.sig/securityCategorizes an issue or PR as relevant to SIG Security.

    Type

    No type

    Projects

    Status

    Closed / Done

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions