Created
October 10, 2019 06:37
-
-
Save ikurni/91a1469b0231ca1b63f7f608069088d0 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: audit.k8s.io/v1 | |
kind: Policy | |
rules: | |
# The following requests were manually identified as high-volume and low-risk, | |
# so drop them. | |
- level: None | |
users: ["system:kube-proxy"] | |
verbs: ["watch"] | |
resources: | |
- group: "" # core | |
resources: ["endpoints", "services", "services/status"] | |
- level: None | |
# Ingress controller reads 'configmaps/ingress-uid' through the unsecured port. | |
# TODO(#46983): Change this to the ingress controller service account. | |
users: ["system:unsecured"] | |
namespaces: ["kube-system"] | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["configmaps"] | |
- level: None | |
users: ["kubelet"] # legacy kubelet identity | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["nodes", "nodes/status"] | |
- level: None | |
userGroups: ["system:nodes"] | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["nodes", "nodes/status"] | |
- level: None | |
users: | |
- system:kube-controller-manager | |
- system:kube-scheduler | |
- system:serviceaccount:kube-system:endpoint-controller | |
verbs: ["get", "update"] | |
namespaces: ["kube-system"] | |
resources: | |
- group: "" # core | |
resources: ["endpoints"] | |
- level: None | |
users: ["system:apiserver"] | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["namespaces", "namespaces/status", "namespaces/finalize"] | |
- level: None | |
users: ["cluster-autoscaler"] | |
verbs: ["get", "update"] | |
namespaces: ["kube-system"] | |
resources: | |
- group: "" # core | |
resources: ["configmaps", "endpoints"] | |
# Don't log HPA fetching metrics. | |
- level: None | |
users: | |
- system:kube-controller-manager | |
verbs: ["get", "list"] | |
resources: | |
- group: "metrics.k8s.io" | |
# Don't log these read-only URLs. | |
- level: None | |
nonResourceURLs: | |
- /healthz* | |
- /version | |
- /swagger* | |
# Don't log events requests. | |
- level: None | |
resources: | |
- group: "" # core | |
resources: ["events"] | |
# node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes | |
- level: Request | |
users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"] | |
verbs: ["update","patch"] | |
resources: | |
- group: "" # core | |
resources: ["nodes/status", "pods/status"] | |
omitStages: | |
- "RequestReceived" | |
- level: Request | |
userGroups: ["system:nodes"] | |
verbs: ["update","patch"] | |
resources: | |
- group: "" # core | |
resources: ["nodes/status", "pods/status"] | |
omitStages: | |
- "RequestReceived" | |
# deletecollection calls can be large, don't log responses for expected namespace deletions | |
- level: Request | |
users: ["system:serviceaccount:kube-system:namespace-controller"] | |
verbs: ["deletecollection"] | |
omitStages: | |
- "RequestReceived" | |
# Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data, | |
# so only log at the Metadata level. | |
- level: Metadata | |
resources: | |
- group: "" # core | |
resources: ["secrets", "configmaps"] | |
- group: authentication.k8s.io | |
resources: ["tokenreviews"] | |
omitStages: | |
- "RequestReceived" | |
# Get repsonses can be large; skip them. | |
- level: Request | |
verbs: ["get", "list", "watch"] | |
resources: ${known_apis} | |
omitStages: | |
- "RequestReceived" | |
# Default level for known APIs | |
- level: RequestResponse | |
resources: ${known_apis} | |
omitStages: | |
- "RequestReceived" | |
# Default level for all other requests. | |
- level: Metadata | |
omitStages: | |
- "RequestReceived" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment