Last active
October 1, 2018 20:27
-
-
Save soltysh/091792423b67b0855ed221facc785406 to your computer and use it in GitHub Desktop.
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
apiVersion: audit.k8s.io/v1beta1 | |
kind: Policy | |
rules: | |
# noisy system stuff | |
# the system aggregator hits this non-resource URL | |
- level: None | |
nonResourceURLs: | |
- /openapi/v2* | |
# do we really care about GETs to / with 200s? | |
- level: None | |
users: ["system:anonymous"] | |
userGroups: ["system:unauthenticated"] | |
verbs: ["get"] | |
nonResourceURLs: | |
- / | |
# controllers fetching most objects | |
- level: None | |
users: | |
- system:serviceaccount:openshift-controller-manager:openshift-controller-manager | |
- system:serviceaccount:kube-system:resourcequota-controller | |
- system:serviceaccount:kube-system:namespace-controller | |
verbs: ["get", "watch"] | |
# system:masters group | |
- level: None | |
userGroups: ["system:masters"] | |
# garbage collection | |
- level: None | |
users: | |
- system:serviceaccount:kube-system:generic-garbage-collector | |
# The following requests were manually identified as high-volume and low-risk, | |
# so drop them. | |
- level: None | |
users: ["system:kube-proxy"] | |
verbs: ["watch"] | |
resources: | |
- group: "" # core | |
resources: ["endpoints", "services", "services/status"] | |
- level: None | |
# Ingress controller reads 'configmaps/ingress-uid' through the unsecured port. | |
# TODO(#46983): Change this to the ingress controller service account. | |
users: ["system:unsecured"] | |
namespaces: ["kube-system"] | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["configmaps"] | |
- level: None | |
users: ["kubelet"] # legacy kubelet identity | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["nodes", "nodes/status"] | |
- level: None | |
userGroups: ["system:nodes"] | |
resources: | |
- group: "" # core | |
resources: ["nodes", "nodes/status"] | |
- level: None | |
users: | |
- system:kube-controller-manager | |
- system:kube-scheduler | |
- system:serviceaccount:kube-system:endpoint-controller | |
verbs: ["get", "update"] | |
namespaces: ["kube-system"] | |
resources: | |
- group: "" # core | |
resources: ["endpoints"] | |
- level: None | |
users: ["system:apiserver"] | |
verbs: ["get"] | |
resources: | |
- group: "" # core | |
resources: ["namespaces", "namespaces/status", "namespaces/finalize"] | |
# Don't log HPA fetching metrics. | |
- level: None | |
users: | |
- system:kube-controller-manager | |
verbs: ["get", "list"] | |
resources: | |
- group: "metrics.k8s.io" | |
# Don't log these read-only URLs. | |
- level: None | |
nonResourceURLs: | |
- /healthz* | |
- /version | |
- /swagger* | |
# Don't log events requests. | |
- level: None | |
resources: | |
- group: "" # core | |
resources: ["events"] | |
# node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes | |
- level: Request | |
users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"] | |
verbs: ["update","patch"] | |
resources: | |
- group: "" # core | |
resources: ["nodes/status", "pods/status"] | |
omitStages: | |
- "RequestReceived" | |
- level: Request | |
userGroups: ["system:nodes"] | |
verbs: ["update","patch"] | |
resources: | |
- group: "" # core | |
resources: ["nodes/status", "pods/status"] | |
omitStages: | |
- "RequestReceived" | |
# deletecollection calls can be large, don't log responses for expected namespace deletions | |
- level: Request | |
users: ["system:serviceaccount:kube-system:namespace-controller"] | |
verbs: ["deletecollection"] | |
omitStages: | |
- "RequestReceived" | |
# Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data, | |
# so only log at the Metadata level. | |
- level: Metadata | |
resources: | |
- group: "" # core | |
resources: ["secrets", "configmaps"] | |
- group: authentication.k8s.io | |
resources: ["tokenreviews"] | |
omitStages: | |
- "RequestReceived" | |
# Get repsonses can be large; skip them. | |
- level: Request | |
verbs: ["get", "list", "watch"] | |
resources: | |
# k8s groups | |
- group: "" # core | |
- group: "admissionregistration.k8s.io" | |
- group: "apiextensions.k8s.io" | |
- group: "apiregistration.k8s.io" | |
- group: "apps" | |
- group: "authentication.k8s.io" | |
- group: "authorization.k8s.io" | |
- group: "autoscaling" | |
- group: "batch" | |
- group: "certificates.k8s.io" | |
- group: "extensions" | |
- group: "metrics.k8s.io" | |
- group: "networking.k8s.io" | |
- group: "policy" | |
- group: "rbac.authorization.k8s.io" | |
- group: "scheduling.k8s.io" | |
- group: "settings.k8s.io" | |
- group: "storage.k8s.io" | |
# openshift groups | |
- group: "apps.openshift.io" | |
- group: "build.openshift.io" | |
- group: "image.openshift.io" | |
- group: "network.openshift.io" | |
- group: "oauth.openshift.io" | |
- group: "project.openshift.io" | |
- group: "quota.openshift.io" | |
- group: "route.openshift.io" | |
- group: "security.openshift.io" | |
- group: "servicecertsigner.config.openshift.io" | |
- group: "template.openshift.io" | |
- group: "user.openshift.io" | |
- group: "webconsole.operator.openshift.io" | |
omitStages: | |
- "RequestReceived" | |
# Default level for known APIs | |
- level: RequestResponse | |
resources: | |
# k8s groups | |
- group: "" # core | |
- group: "admissionregistration.k8s.io" | |
- group: "apiextensions.k8s.io" | |
- group: "apiregistration.k8s.io" | |
- group: "apps" | |
- group: "authentication.k8s.io" | |
- group: "authorization.k8s.io" | |
- group: "autoscaling" | |
- group: "batch" | |
- group: "certificates.k8s.io" | |
- group: "extensions" | |
- group: "metrics.k8s.io" | |
- group: "networking.k8s.io" | |
- group: "policy" | |
- group: "rbac.authorization.k8s.io" | |
- group: "scheduling.k8s.io" | |
- group: "settings.k8s.io" | |
- group: "storage.k8s.io" | |
# openshift groups | |
- group: "apps.openshift.io" | |
- group: "build.openshift.io" | |
- group: "image.openshift.io" | |
- group: "network.openshift.io" | |
- group: "oauth.openshift.io" | |
- group: "project.openshift.io" | |
- group: "quota.openshift.io" | |
- group: "route.openshift.io" | |
- group: "security.openshift.io" | |
- group: "servicecertsigner.config.openshift.io" | |
- group: "template.openshift.io" | |
- group: "user.openshift.io" | |
- group: "webconsole.operator.openshift.io" | |
omitStages: | |
- "RequestReceived" | |
# Default level for all other requests. | |
- level: Metadata | |
omitStages: | |
- "RequestReceived" |
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment