审计日志：记录、过滤与分析 API Server 上发生的一切

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "8b1a3d1c-6d6f-4b5e-9c1e-7f0e2a1b3c4d",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/namespaces/prod/secrets/db-password",
  "verb": "get",
  "user": { "username": "alice", "groups": ["dev-team", "system:authenticated"] },
  "impersonatedUser": null,
  "sourceIPs": ["10.0.3.17"],
  "userAgent": "kubectl/v1.37.0 (linux/amd64)",
  "objectRef": { "resource": "secrets", "namespace": "prod", "name": "db-password", "apiVersion": "v1" },
  "responseStatus": { "code": 200 },
  "requestReceivedTimestamp": "2026-11-01T02:15:04.120000Z",
  "stageTimestamp": "2026-11-01T02:15:04.123456Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"dev-read\" of ClusterRole \"view\" to Group \"dev-team\""
  }
}

apiVersion: audit.k8s.io/v1
kind: Policy
# 省略 RequestReceived 阶段，避免每个请求产生两条事件
omitStages:
- RequestReceived
# 省略 managedFields，可显著缩小 Request/RequestResponse 级别的事件体积
omitManagedFields: true
rules:
# 1. 高频只读心跳类请求不记录
- level: None
  users: ["system:kube-proxy"]
  verbs: ["watch"]
  resources:
  - group: ""
    resources: ["endpoints", "services", "services/status"]
- level: None
  userGroups: ["system:nodes"]
  verbs: ["get"]
  resources:
  - group: ""
    resources: ["nodes", "nodes/status"]
- level: None
  users: ["system:kube-controller-manager", "system:kube-scheduler", "system:serviceaccount:kube-system:endpoint-controller"]
  verbs: ["get", "update"]
  namespaces: ["kube-system"]
  resources:
  - group: ""
    resources: ["endpoints"]
  - group: "coordination.k8s.io"
    resources: ["leases"]
- level: None
  nonResourceURLs: ["/healthz*", "/livez*", "/readyz*", "/version", "/metrics", "/openapi*"]
# 2. Secret、ConfigMap、TokenRequest 等敏感资源只记录元数据，避免把密文写入日志
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets", "configmaps", "serviceaccounts/token"]
  - group: "authentication.k8s.io"
    resources: ["tokenreviews"]
# 3. RBAC、准入策略、PSA 等安全配置的变更记录完整请求与响应
- level: RequestResponse
  verbs: ["create", "update", "patch", "delete", "deletecollection"]
  resources:
  - group: "rbac.authorization.k8s.io"
  - group: "admissionregistration.k8s.io"
  - group: "policy"
  - group: "certificates.k8s.io"
  - group: "authentication.k8s.io"
  - group: "authorization.k8s.io"
  - group: "node.k8s.io"
# 4. Pod exec/attach/portforward 这类"进入容器"的操作记录请求体
- level: Request
  resources:
  - group: ""
    resources: ["pods/exec", "pods/attach", "pods/portforward", "pods/proxy", "nodes/proxy", "services/proxy"]
# 5. 其他工作负载的写操作记录请求体
- level: Request
  verbs: ["create", "update", "patch", "delete", "deletecollection"]
  resources:
  - group: ""
  - group: "apps"
  - group: "batch"
  - group: "networking.k8s.io"
  - group: "gateway.networking.k8s.io"
  - group: "storage.k8s.io"
  - group: "resource.k8s.io"
# 6. 兜底：其余所有请求记录元数据
- level: Metadata
  omitStages:
  - RequestReceived

# kubeadm ClusterConfiguration 片段
apiServer:
  extraArgs:
  - name: audit-policy-file
    value: /etc/kubernetes/audit/policy.yaml
  - name: audit-log-path
    value: /var/log/kubernetes/audit/audit.log
  - name: audit-log-maxage
    value: "30"          # 保留天数
  - name: audit-log-maxbackup
    value: "10"          # 保留的轮转文件数
  - name: audit-log-maxsize
    value: "100"         # 单文件 MB，超过即轮转
  - name: audit-log-mode
    value: blocking-strict   # 写入失败则请求失败，适用于强合规场景；默认 batch
  extraVolumes:
  - name: audit-policy
    hostPath: /etc/kubernetes/audit
    mountPath: /etc/kubernetes/audit
    readOnly: true
    pathType: DirectoryOrCreate
  - name: audit-log
    hostPath: /var/log/kubernetes/audit
    mountPath: /var/log/kubernetes/audit
    pathType: DirectoryOrCreate

apiServer:
  extraArgs:
  - name: audit-webhook-config-file
    value: /etc/kubernetes/audit/webhook.kubeconfig
  - name: audit-webhook-batch-max-size
    value: "400"
  - name: audit-webhook-batch-buffer-size
    value: "10000"
  - name: audit-webhook-initial-backoff
    value: 10s