Merge pull request #52343 from crassirostris/audit-policy-switch-to-beta

Automatic merge from submit-queue (batch tested with PRs 52339, 52343, 52125, 52360, 52301) Switch default audit policy to beta and omit RequestReceived stage Related to https://github.com/kubernetes/kubernetes/issues/52265 ```release-note By default, clusters on GCE no longer sends RequestReceived audit event, if advanced audit is configured. ```

Merge pull request #52343 from crassirostris/audit-policy-switch-to-beta
e81aeb59 · Kubernetes Submit Queue · GitHub · 5bc9d7b4 · 0933f5c8 · e81aeb59
Commit e81aeb59 authored Sep 12, 2017 by Kubernetes Submit Queue Committed by GitHub Sep 12, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 13 additions and 5 deletions

configure-helper.sh cluster/gce/gci/configure-helper.sh +13 -5

No files found.
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -499,7 +499,7 @@ function create-master-audit-policy {
      - group: "storage.k8s.io"'

  cat <<EOF >"${path}"
-apiVersion: audit.k8s.io/v1alpha1
+apiVersion: audit.k8s.io/v1beta1
 kind: Policy
 rules:
  # The following requests were manually identified as high-volume and low-risk,
@@ -509,7 +509,7 @@ rules:
    verbs: ["watch"]
    resources:
      - group: "" # core
-        resources: ["endpoints", "services"]
+        resources: ["endpoints", "services", "services/status"]
  - level: None
    # Ingress controller reads `configmaps/ingress-uid` through the unsecured port.
    # TODO(#46983): Change this to the ingress controller service account.
@@ -524,13 +524,13 @@ rules:
    verbs: ["get"]
    resources:
      - group: "" # core
-        resources: ["nodes"]
+        resources: ["nodes", "nodes/status"]
  - level: None
    userGroups: ["system:nodes"]
    verbs: ["get"]
    resources:
      - group: "" # core
-        resources: ["nodes"]
+        resources: ["nodes", "nodes/status"]
  - level: None
    users:
      - system:kube-controller-manager
@@ -546,7 +546,7 @@ rules:
    verbs: ["get"]
    resources:
      - group: "" # core
-        resources: ["namespaces"]
+        resources: ["namespaces", "namespaces/status", "namespaces/finalize"]

  # Don't log these read-only URLs.
  - level: None
@@ -569,15 +569,23 @@ rules:
        resources: ["secrets", "configmaps"]
      - group: authentication.k8s.io
        resources: ["tokenreviews"]
+    omitStages:
+      - "RequestReceived"
  # Get repsonses can be large; skip them.
  - level: Request
    verbs: ["get", "list", "watch"]
    resources: ${known_apis}
+    omitStages:
+      - "RequestReceived"
  # Default level for known APIs
  - level: RequestResponse
    resources: ${known_apis}
+    omitStages:
+      - "RequestReceived"
  # Default level for all other requests.
  - level: Metadata
+    omitStages:
+      - "RequestReceived"
 EOF
 }