audit

Documentation

Overview

+k8s:deepcopy-gen=package +groupName=audit.k8s.io

Index

• Constants
• Variables
• func DeepCopy_audit_Event(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_EventList(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_GroupResources(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_ObjectReference(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_Policy(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error
• func DeepCopy_audit_UserInfo(in interface{}, out interface{}, c *conversion.Cloner) error
• func GetGeneratedDeepCopyFuncs() []conversion.GeneratedDeepCopyFunc
• func Kind(kind string) schema.GroupKind
• func Resource(resource string) schema.GroupResource
• type Event
• type EventList
• type ExtraValue
• type GroupResources
• type Level
  • func (a Level) GreaterOrEqual(b Level) bool
  • func (a Level) Less(b Level) bool
• type ObjectReference
• type Policy
• type PolicyList
• type PolicyRule
• type Stage
• type UserInfo

Constants

const (
	// The stage for events generated as soon as the audit handler receives the request, and before it
	// is delegated down the handler chain.
	StageRequestReceived = "RequestReceived"
	// The stage for events generated once the response headers are sent, but before the response body
	// is sent. This stage is only generated for long-running requests (e.g. watch).
	StageResponseStarted = "ResponseStarted"
	// The stage for events generated once the response body has been completed, and no more bytes
	// will be sent.
	StageResponseComplete = "ResponseComplete"
	// The stage for events generated when a panic occured.
	StagePanic = "Panic"
)

Valid audit stages.

const GroupName = "audit.k8s.io"

GroupName is the group name use in this package

const (
	// Header to hold the audit ID as the request is propagated through the serving hierarchy. The
	// Audit-ID header should be set by the first server to receive the request (e.g. the federation
	// server or kube-aggregator).
	HeaderAuditID = "Audit-ID"
)

Header keys used by the audit system.

Variables

var (
	SchemeBuilder = runtime.NewSchemeBuilder(addKnownTypes)
	AddToScheme   = SchemeBuilder.AddToScheme
)

var SchemeGroupVersion = schema.GroupVersion{Group: GroupName, Version: runtime.APIVersionInternal}

SchemeGroupVersion is group version used to register these objects

Functions

func DeepCopy_audit_Event

func DeepCopy_audit_Event(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_Event is an autogenerated deepcopy function.

func DeepCopy_audit_EventList

func DeepCopy_audit_EventList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_EventList is an autogenerated deepcopy function.

func DeepCopy_audit_GroupResources

func DeepCopy_audit_GroupResources(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_GroupResources is an autogenerated deepcopy function.

func DeepCopy_audit_ObjectReference

func DeepCopy_audit_ObjectReference(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_ObjectReference is an autogenerated deepcopy function.

func DeepCopy_audit_Policy

func DeepCopy_audit_Policy(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_Policy is an autogenerated deepcopy function.

func DeepCopy_audit_PolicyList

func DeepCopy_audit_PolicyList(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_PolicyList is an autogenerated deepcopy function.

func DeepCopy_audit_PolicyRule

func DeepCopy_audit_PolicyRule(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_PolicyRule is an autogenerated deepcopy function.

func DeepCopy_audit_UserInfo

func DeepCopy_audit_UserInfo(in interface{}, out interface{}, c *conversion.Cloner) error

DeepCopy_audit_UserInfo is an autogenerated deepcopy function.

func GetGeneratedDeepCopyFuncs

func GetGeneratedDeepCopyFuncs() []conversion.GeneratedDeepCopyFunc

GetGeneratedDeepCopyFuncs returns the generated funcs, since we aren't registering them.

func Kind

func Kind(kind string) schema.GroupKind

Kind takes an unqualified kind and returns a Group qualified GroupKind

func Resource

func Resource(resource string) schema.GroupResource

Resource takes an unqualified resource and returns a Group qualified GroupResource

Types

type Event

type Event struct {
	metav1.TypeMeta
	// ObjectMeta is included for interoperability with API infrastructure.
	// +optional
	metav1.ObjectMeta

	// AuditLevel at which event was generated
	Level Level

	// Time the request reached the apiserver.
	Timestamp metav1.Time
	// Unique audit ID, generated for each request.
	AuditID types.UID
	// Stage of the request handling when this event instance was generated.
	Stage Stage

	// RequestURI is the request URI as sent by the client to a server.
	RequestURI string
	// Verb is the kubernetes verb associated with the request.
	// For non-resource requests, this is the lower-cased HTTP method.
	Verb string
	// Authenticated user information.
	User UserInfo
	// Impersonated user information.
	// +optional
	ImpersonatedUser *UserInfo
	// Source IPs, from where the request originated and intermediate proxies.
	// +optional
	SourceIPs []string
	// Object reference this request is targeted at.
	// Does not apply for List-type requests, or non-resource requests.
	// +optional
	ObjectRef *ObjectReference
	// The response status, populated even when the ResponseObject is not a Status type.
	// For successful responses, this will only include the Code. For non-status type
	// error responses, this will be auto-populated with the error Message.
	// +optional
	ResponseStatus *metav1.Status

	// API object from the request, in JSON format. The RequestObject is recorded as-is in the request
	// (possibly re-encoded as JSON), prior to version conversion, defaulting, admission or
	// merging. It is an external versioned object type, and may not be a valid object on its own.
	// Omitted for non-resource requests.  Only logged at Request Level and higher.
	// +optional
	RequestObject *runtime.Unknown
	// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
	// to the external type, and serialized as JSON.  Omitted for non-resource requests.  Only logged
	// at Response Level.
	// +optional
	ResponseObject *runtime.Unknown
}

Event captures all the information that can be included in an API audit log.

type EventList

type EventList struct {
	metav1.TypeMeta
	// +optional
	metav1.ListMeta

	Items []Event
}

EventList is a list of audit Events.

type ExtraValue

type ExtraValue []string

ExtraValue masks the value so protobuf can generate

type GroupResources

type GroupResources struct {
	// Group is the name of the API group that contains the resources.
	// The empty string represents the core API group.
	// +optional
	Group string
	// Resources is a list of resources within the API group.
	// Any empty list implies every resource kind in the API group.
	// +optional
	Resources []string
}

GroupResources represents resource kinds in an API group.

type Level

type Level string

Level defines the amount of information logged during auditing

const (
	// LevelNone disables auditing
	LevelNone Level = "None"
	// LevelMetadata provides the basic level of auditing.
	LevelMetadata Level = "Metadata"
	// LevelRequest provides Metadata level of auditing, and additionally
	// logs the request object (does not apply for non-resource requests).
	LevelRequest Level = "Request"
	// LevelRequestResponse provides Request level of auditing, and additionally
	// logs the response object (does not apply for non-resource requests).
	LevelRequestResponse Level = "RequestResponse"
)

Valid audit levels

func (Level) GreaterOrEqual

func (a Level) GreaterOrEqual(b Level) bool

func (Level) Less

func (a Level) Less(b Level) bool

type ObjectReference

type ObjectReference struct {
	// +optional
	Resource string
	// +optional
	Namespace string
	// +optional
	Name string
	// +optional
	UID types.UID
	// +optional
	APIVersion string
	// +optional
	ResourceVersion string
	// +optional
	Subresource string
}

ObjectReference contains enough information to let you inspect or modify the referred object.

type Policy

type Policy struct {
	metav1.TypeMeta
	// ObjectMeta is included for interoperability with API infrastructure.
	// +optional
	metav1.ObjectMeta

	// Rules specify the audit Level a request should be recorded at.
	// A request may match multiple rules, in which case the FIRST matching rule is used.
	// The default audit level is None, but can be overridden by a catch-all rule at the end of the list.
	// PolicyRules are strictly ordered.
	Rules []PolicyRule
}

Policy defines the configuration of audit logging, and the rules for how different request categories are logged.

type PolicyList

type PolicyList struct {
	metav1.TypeMeta
	// +optional
	metav1.ListMeta

	Items []Policy
}

PolicyList is a list of audit Policies.

type PolicyRule

type PolicyRule struct {
	// The Level that requests matching this rule are recorded at.
	Level Level

	// The users (by authenticated user name) this rule applies to.
	// An empty list implies every user.
	// +optional
	Users []string
	// The user groups this rule applies to. A user is considered matching
	// if it is a member of any of the UserGroups.
	// An empty list implies every user group.
	// +optional
	UserGroups []string

	// The verbs that match this rule.
	// An empty list implies every verb.
	// +optional
	Verbs []string

	// Resources that this rule matches. An empty list implies all kinds in all API groups.
	// +optional
	Resources []GroupResources
	// Namespaces that this rule matches.
	// The empty string "" matches non-namespaced resources.
	// An empty list implies every namespace.
	// +optional
	Namespaces []string

	// NonResourceURLs is a set of URL paths that should be audited.
	// *s are allowed, but only as the full, final step in the path.
	// Examples:
	//  "/metrics" - Log requests for apiserver metrics
	//  "/healthz*" - Log all health checks
	// +optional
	NonResourceURLs []string
}

PolicyRule maps requests based off metadata to an audit Level. Requests must match the rules of every field (an intersection of rules).

type Stage

type Stage string

Stage defines the stages in request handling that audit events may be generated.

type UserInfo

type UserInfo struct {
	// The name that uniquely identifies this user among all active users.
	Username string
	// A unique value that identifies this user across time. If this user is
	// deleted and another user by the same name is added, they will have
	// different UIDs.
	UID string
	// The names of groups this user is a part of.
	Groups []string
	// Any additional information provided by the authenticator.
	Extra map[string]ExtraValue
}

UserInfo holds the information about the user needed to implement the user.Info interface.