events generated as soon as the audit handler receives the request, and before it is delegated down the handler chain.（簡單來說就是 apiserver 收到請求的階段）
ResponseStarted
Once the response headers are sent, but before the response body is sent. This stage is only generated for long-running requests (e.g. watch).(這個階段我不是非常了解，看起來像是 watch 之類的才會觸發這個階段)
ResponseComplete
The response body has been completed and no more bytes will be sent.（這個階段代表 apiserver 的回應）
Panic
Events generated when a panic occurred.(發生 panic 才會觸發)
apiVersion:audit.k8s.io/v1# This is required.kind:Policy# Don't generate audit events for all requests in RequestReceived stage.omitStages:- "RequestReceived"rules:# Log pod changes at RequestResponse level- level:RequestResponseresources:- group:""# Resource "pods" doesn't match requests to any subresource of pods,# which is consistent with the RBAC policy.resources:["pods"]# Log "pods/log", "pods/status" at Metadata level- level:Metadataresources:- group:""resources:["pods/log","pods/status"]# Don't log requests to a configmap called "controller-leader"- level:Noneresources:- group:""resources:["configmaps"]resourceNames:["controller-leader"]# Don't log watch requests by the "system:kube-proxy" on endpoints or services- level:Noneusers:["system:kube-proxy"]verbs:["watch"]resources:- group:""# core API groupresources:["endpoints","services"]# Don't log authenticated requests to certain non-resource URL paths.- level:NoneuserGroups:["system:authenticated"]nonResourceURLs:- "/api*"# Wildcard matching.- "/version"# Log the request body of configmap changes in kube-system.- level:Requestresources:- group:""# core API groupresources:["configmaps"]# This rule only applies to resources in the "kube-system" namespace.# The empty string "" can be used to select non-namespaced resources.namespaces:["kube-system"]# Log configmap and secret changes in all other namespaces at the Metadata level.- level:Metadataresources:- group:""# core API groupresources:["secrets","configmaps"]# Log all other resources in core and extensions at the Request level.- level:Requestresources:- group:""# core API group- group:"extensions"# Version of group should NOT be included.# A catch-all rule to log all other requests at the Metadata level.- level:Metadata# Long-running requests like watches that fall under this rule will not# generate an audit event in RequestReceived.omitStages:- "RequestReceived"
apiVersion:kubeadm.k8s.io/v1beta2kind:ClusterConfiguration#featureGates:# not support DynamicAuditing# DynamicAuditing: trueapiServer:extraArgs:audit-log-path:/home/ubuntu/audit.logaudit-policy-file:/etc/kubernetes/addon/audit-policy.yaml# not support DynamicAuditing# runtime-config=auditregistration.k8s.io/v1alpha1: "true"# audit-dynamic-configuration:extraVolumes:- name:audithostPath:/etc/kubernetes/addon/audit-policy.yamlmountPath:/etc/kubernetes/addon/audit-policy.yamlreadOnly:truepathType:File- name:audit-loghostPath:/home/ubuntumountPath:/home/ubuntupathType:DirectoryOrCreate
1
2
3
4
5
6
cat <<EOF | >/etc/kubernetes/addon/audit-policy.yaml
# Log all requests at the Metadata level.apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
tail-faudit.log{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"caa00b7a-e564-486c-837f-219eade633dd","stage":"RequestReceived","requestURI":"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-controller-manager?timeout=10s","verb":"get","user":{"username":"system:kube-controller-manager","groups":["system:authenticated"]},"sourceIPs":["10.0.2.4"],"userAgent":"kube-controller-manager/v1.18.5 (linux/amd64) kubernetes/e6503f8/leader-election","objectRef":{"resource":"leases","namespace":"kube-system","name":"kube-controller-manager","apiGroup":"coordination.k8s.io","apiVersion":"v1"},"requestReceivedTimestamp":"2020-07-04T15:19:21.083898Z","stageTimestamp":"2020-07-04T15:19:21.083898Z"}{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"caa00b7a-e564-486c-837f-219eade633dd","stage":"ResponseComplete","requestURI":"/apis/coordination.k8s.io/v1/namespaces/kube-system/leases/kube-controller-manager?timeout=10s","verb":"get","user":{"username":"system:kube-controller-manager","groups":["system:authenticated"]},"sourceIPs":["10.0.2.4"],"userAgent":"kube-controller-manager/v1.18.5 (linux/amd64) kubernetes/e6503f8/leader-election","objectRef":{"resource":"leases","namespace":"kube-system","name":"kube-controller-manager","apiGroup":"coordination.k8s.io","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2020-07-04T15:19:21.083898Z","stageTimestamp":"2020-07-04T15:19:21.085030Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":"RBAC: allowed by ClusterRoleBinding \"system:kube-controller-manager\" of ClusterRole \"system:kube-controller-manager\" to User \"system:kube-controller-manager\""}}...
k apply -f pod.yml -f service.yml
pod/webhook created
service/admissionwebhook created
...
k get pod,svc
NAME READY STATUS RESTARTS AGE
pod/webhook 1/1 Running 0 7s
NAME TYPE CLUSTER-IP EXTERNAL-IP PORT(S) AGE
service/admissionwebhook ClusterIP 10.97.173.35 <none> 443/TCP 7s
service/kubernetes ClusterIP 10.96.0.1 <none> 443/TCP 2d14h
建立好 webhook pod 後我們需要建立 AuditSink 物件讓 audit 事件把資料往這個 webhook 送，
1
2
kubectl apply -f auditSink.yml
auditsink.auditregistration.k8s.io/mysink created
