Documentation ¶
Overview ¶
+k8s:deepcopy-gen=package,register +groupName=audit.k8s.io
Index ¶
- Constants
- Variables
- func DeepCopy_audit_Event(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_EventList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_GroupResources(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_ObjectReference(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_Policy(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error
- func DeepCopy_audit_UserInfo(in interface{}, out interface{}, c *conversion.Cloner) error
- func Kind(kind string) schema.GroupKind
- func RegisterDeepCopies(scheme *runtime.Scheme) error
- func Resource(resource string) schema.GroupResource
- type Event
- type EventList
- type ExtraValue
- type GroupResources
- type Level
- type ObjectReference
- type Policy
- type PolicyList
- type PolicyRule
- type Stage
- type UserInfo
Constants ¶
const ( // The stage for events generated as soon as the audit handler receives the request, and before it // is delegated down the handler chain. StageRequestReceived = "RequestReceived" // The stage for events generated once the response headers are sent, but before the response body // is sent. This stage is only generated for long-running requests (e.g. watch). StageResponseStarted = "ResponseStarted" // The stage for events generated once the response body has been completed, and no more bytes // will be sent. StageResponseComplete = "ResponseComplete" // The stage for events generated when a panic occured. StagePanic = "Panic" )
Valid audit stages.
const GroupName = "audit.k8s.io"
GroupName is the group name use in this package
const ( // Header to hold the audit ID as the request is propagated through the serving hierarchy. The // Audit-ID header should be set by the first server to receive the request (e.g. the federation // server or kube-aggregator). HeaderAuditID = "Audit-ID" )
Header keys used by the audit system.
Variables ¶
var ( SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes) AddToScheme = SchemeBuilder.AddToScheme )
var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}
SchemeGroupVersion is group version used to register these objects
Functions ¶
func DeepCopy_audit_Event ¶
func DeepCopy_audit_Event(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_Event is an autogenerated deepcopy function.
func DeepCopy_audit_EventList ¶
func DeepCopy_audit_EventList(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_EventList is an autogenerated deepcopy function.
func DeepCopy_audit_GroupResources ¶
func DeepCopy_audit_GroupResources(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_GroupResources is an autogenerated deepcopy function.
func DeepCopy_audit_ObjectReference ¶
func DeepCopy_audit_ObjectReference(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_ObjectReference is an autogenerated deepcopy function.
func DeepCopy_audit_Policy ¶
func DeepCopy_audit_Policy(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_Policy is an autogenerated deepcopy function.
func DeepCopy_audit_PolicyList ¶
func DeepCopy_audit_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_PolicyList is an autogenerated deepcopy function.
func DeepCopy_audit_PolicyRule ¶
func DeepCopy_audit_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_PolicyRule is an autogenerated deepcopy function.
func DeepCopy_audit_UserInfo ¶
func DeepCopy_audit_UserInfo(in interface{}, out interface{}, c *conversion.Cloner) error
DeepCopy_audit_UserInfo is an autogenerated deepcopy function.
func RegisterDeepCopies ¶
RegisterDeepCopies adds deep-copy functions to the given scheme. Public to allow building arbitrary schemes.
func Resource ¶
func Resource(resource string) schema.GroupResource
Resource takes an unqualified resource and returns a Group qualified GroupResource
Types ¶
type Event ¶
type Event struct { metav1.TypeMeta // ObjectMeta is included for interoperability with API infrastructure. // +optional metav1.ObjectMeta // AuditLevel at which event was generated Level Level // Time the request reached the apiserver. Timestamp metav1.Time // Unique audit ID, generated for each request. AuditID types.UID // Stage of the request handling when this event instance was generated. Stage Stage // RequestURI is the request URI as sent by the client to a server. RequestURI string // Verb is the kubernetes verb associated with the request. // For non-resource requests, this is the lower-cased HTTP method. Verb string // Authenticated user information. User UserInfo // Impersonated user information. // +optional ImpersonatedUser *UserInfo // Source IPs, from where the request originated and intermediate proxies. // +optional SourceIPs []string // Object reference this request is targeted at. // Does not apply for List-type requests, or non-resource requests. // +optional ObjectRef *ObjectReference // The response status, populated even when the ResponseObject is not a Status type. // For successful responses, this will only include the Code and StatusSuccess. // For non-status type error responses, this will be auto-populated with the error Message. // +optional ResponseStatus *metav1.Status // API object from the request, in JSON format. The RequestObject is recorded as-is in the request // (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or // merging. It is an external versioned object type, and may not be a valid object on its own. // Omitted for non-resource requests. Only logged at Request Level and higher. // +optional RequestObject *runtime.Unknown // API object returned in the response, in JSON. The ResponseObject is recorded after conversion // to the external type, and serialized as JSON. Omitted for non-resource requests. Only logged // at Response Level. // +optional ResponseObject *runtime.Unknown }
Event captures all the information that can be included in an API audit log.
type GroupResources ¶
type GroupResources struct { // Group is the name of the API group that contains the resources. // The empty string represents the core API group. // +optional Group string // Resources is a list of resources within the API group. // Any empty list implies every resource kind in the API group. // +optional Resources []string }
GroupResources represents resource kinds in an API group.
type Level ¶
type Level string
Level defines the amount of information logged during auditing
const ( // LevelNone disables auditing LevelNone Level = "None" // LevelMetadata provides the basic level of auditing. LevelMetadata Level = "Metadata" // LevelRequest provides Metadata level of auditing, and additionally // logs the request object (does not apply for non-resource requests). LevelRequest Level = "Request" // LevelRequestResponse provides Request level of auditing, and additionally // logs the response object (does not apply for non-resource requests). LevelRequestResponse Level = "RequestResponse" )
Valid audit levels
func (Level) GreaterOrEqual ¶
type ObjectReference ¶
type ObjectReference struct { // +optional Resource string // +optional Namespace string // +optional Name string // +optional UID types.UID // +optional APIVersion string // +optional ResourceVersion string // +optional Subresource string }
ObjectReference contains enough information to let you inspect or modify the referred object.
type Policy ¶
type Policy struct { metav1.TypeMeta // ObjectMeta is included for interoperability with API infrastructure. // +optional metav1.ObjectMeta // Rules specify the audit Level a request should be recorded at. // A request may match multiple rules, in which case the FIRST matching rule is used. // The default audit level is None, but can be overridden by a catch-all rule at the end of the list. // PolicyRules are strictly ordered. Rules []PolicyRule }
Policy defines the configuration of audit logging, and the rules for how different request categories are logged.
type PolicyList ¶
PolicyList is a list of audit Policies.
type PolicyRule ¶
type PolicyRule struct { // The Level that requests matching this rule are recorded at. Level Level // The users (by authenticated user name) this rule applies to. // An empty list implies every user. // +optional Users []string // The user groups this rule applies to. A user is considered matching // if it is a member of any of the UserGroups. // An empty list implies every user group. // +optional UserGroups []string // The verbs that match this rule. // An empty list implies every verb. // +optional Verbs []string // Resources that this rule matches. An empty list implies all kinds in all API groups. // +optional Resources []GroupResources // Namespaces that this rule matches. // The empty string "" matches non-namespaced resources. // An empty list implies every namespace. // +optional Namespaces []string // NonResourceURLs is a set of URL paths that should be audited. // *s are allowed, but only as the full, final step in the path. // Examples: // "/metrics" - Log requests for apiserver metrics // "/healthz*" - Log all health checks // +optional NonResourceURLs []string }
PolicyRule maps requests based off metadata to an audit Level. Requests must match the rules of every field (an intersection of rules).
type Stage ¶
type Stage string
Stage defines the stages in request handling that audit events may be generated.
type UserInfo ¶
type UserInfo struct { // The name that uniquely identifies this user among all active users. Username string // A unique value that identifies this user across time. If this user is // deleted and another user by the same name is added, they will have // different UIDs. UID string // The names of groups this user is a part of. Groups []string // Any additional information provided by the authenticator. Extra map[string]ExtraValue }
UserInfo holds the information about the user needed to implement the user.Info interface.
Source Files ¶
Directories ¶
Path | Synopsis |
---|---|
Package install installs the experimental API group, making it available as an option to all of the API encoding/decoding machinery.
|
Package install installs the experimental API group, making it available as an option to all of the API encoding/decoding machinery. |
+groupName=audit.k8s.io
|
+groupName=audit.k8s.io |