{"action":"created","issue":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71230","repository_url":"https://api.github.com/repos/kubernetes/kubernetes","labels_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71230/labels{/name}","comments_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71230/comments","events_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71230/events","html_url":"https://github.com/kubernetes/kubernetes/pull/71230","id":382374826,"node_id":"MDExOlB1bGxSZXF1ZXN0MjMyMDk3NTky","number":71230,"title":"Dynamic Audit Policy","user":{"login":"pbarker","id":5533189,"node_id":"MDQ6VXNlcjU1MzMxODk=","avatar_url":"https://avatars3.githubusercontent.com/u/5533189?v=4","gravatar_id":"","url":"https://api.github.com/users/pbarker","html_url":"https://github.com/pbarker","followers_url":"https://api.github.com/users/pbarker/followers","following_url":"https://api.github.com/users/pbarker/following{/other_user}","gists_url":"https://api.github.com/users/pbarker/gists{/gist_id}","starred_url":"https://api.github.com/users/pbarker/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/pbarker/subscriptions","organizations_url":"https://api.github.com/users/pbarker/orgs","repos_url":"https://api.github.com/users/pbarker/repos","events_url":"https://api.github.com/users/pbarker/events{/privacy}","received_events_url":"https://api.github.com/users/pbarker/received_events","type":"User","site_admin":false},"labels":[{"id":477397086,"node_id":"MDU6TGFiZWw0NzczOTcwODY=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/cncf-cla:%20yes","name":"cncf-cla: yes","color":"bfe5bf","default":false},{"id":261005360,"node_id":"MDU6TGFiZWwyNjEwMDUzNjA=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/api-change","name":"kind/api-change","color":"e11d21","default":false},{"id":267761362,"node_id":"MDU6TGFiZWwyNjc3NjEzNjI=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/kind/feature","name":"kind/feature","color":"c7def8","default":false},{"id":1111992057,"node_id":"MDU6TGFiZWwxMTExOTkyMDU3","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/needs-priority","name":"needs-priority","color":"ededed","default":false},{"id":1086787260,"node_id":"MDU6TGFiZWwxMDg2Nzg3MjYw","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/ok-to-test","name":"ok-to-test","color":"15dd18","default":false},{"id":200149833,"node_id":"MDU6TGFiZWwyMDAxNDk4MzM=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/release-note","name":"release-note","color":"c2e0c6","default":false},{"id":636152047,"node_id":"MDU6TGFiZWw2MzYxNTIwNDc=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/architecture","name":"sig/architecture","color":"d2b48c","default":false},{"id":357119284,"node_id":"MDU6TGFiZWwzNTcxMTkyODQ=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/sig/auth","name":"sig/auth","color":"d2b48c","default":false},{"id":253450978,"node_id":"MDU6TGFiZWwyNTM0NTA5Nzg=","url":"https://api.github.com/repos/kubernetes/kubernetes/labels/size/L","name":"size/L","color":"ee9900","default":false}],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":13,"created_at":"2018-11-19T20:11:43Z","updated_at":"2018-12-18T03:36:45Z","closed_at":null,"author_association":"CONTRIBUTOR","pull_request":{"url":"https://api.github.com/repos/kubernetes/kubernetes/pulls/71230","html_url":"https://github.com/kubernetes/kubernetes/pull/71230","diff_url":"https://github.com/kubernetes/kubernetes/pull/71230.diff","patch_url":"https://github.com/kubernetes/kubernetes/pull/71230.patch"},"body":"**What type of PR is this?**\r\n/kind feature\r\n\r\n**What this PR does / why we need it**:\r\nAdds policy rules to the AuditSink API object https://github.com/kubernetes/kubernetes/issues/70818\r\n\r\n**Special notes for your reviewer**:\r\nThis PR is based off discussions with @lavalamp and @tallclair to make the audit policy more composable and readable for the API objects.\r\n\r\n**Does this PR introduce a user-facing change?**:\r\n```release-note\r\nAdd AuditClass object that allows for fine grained filtering of audit events for AuditSink API objects\r\n```\r\n"},"comment":{"url":"https://api.github.com/repos/kubernetes/kubernetes/issues/comments/448085162","html_url":"https://github.com/kubernetes/kubernetes/pull/71230#issuecomment-448085162","issue_url":"https://api.github.com/repos/kubernetes/kubernetes/issues/71230","id":448085162,"node_id":"MDEyOklzc3VlQ29tbWVudDQ0ODA4NTE2Mg==","user":{"login":"tallclair","id":29742491,"node_id":"MDQ6VXNlcjI5NzQyNDkx","avatar_url":"https://avatars1.githubusercontent.com/u/29742491?v=4","gravatar_id":"","url":"https://api.github.com/users/tallclair","html_url":"https://github.com/tallclair","followers_url":"https://api.github.com/users/tallclair/followers","following_url":"https://api.github.com/users/tallclair/following{/other_user}","gists_url":"https://api.github.com/users/tallclair/gists{/gist_id}","starred_url":"https://api.github.com/users/tallclair/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/tallclair/subscriptions","organizations_url":"https://api.github.com/users/tallclair/orgs","repos_url":"https://api.github.com/users/tallclair/repos","events_url":"https://api.github.com/users/tallclair/events{/privacy}","received_events_url":"https://api.github.com/users/tallclair/received_events","type":"User","site_admin":false},"created_at":"2018-12-18T03:36:45Z","updated_at":"2018-12-18T03:36:45Z","author_association":"MEMBER","body":"WRT overapping classes - My understanding of @lavalamp 's proposal was to have cluster-scoped (maybe also namespace scoped?) classifiers that add a class to a request (a request can have multiple), but then still have a per-backend _policy_. The difference from the static policy though is that you only need to apply it to a class, rather than specifying all the classifiers in the policy.\r\n\r\nI haven't had a chance to review this yet, so I apologize if \r\n\r\nFor example, a snippet of our current policy is:\r\n```yaml\r\n  # Don't log HPA fetching metrics.\r\n  - level: None\r\n    users:\r\n      - system:kube-controller-manager\r\n    verbs: [\"get\", \"list\"]\r\n    resources:\r\n      - group: \"metrics.k8s.io\"\r\n\r\n  # Don't log these read-only URLs.\r\n  - level: None\r\n    nonResourceURLs:\r\n      - /healthz*\r\n      - /version\r\n      - /swagger*\r\n\r\n  # Don't log events requests.\r\n  - level: None\r\n    resources:\r\n      - group: \"\" # core\r\n        resources: [\"events\"]\r\n\r\n  # node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes\r\n  - level: Request\r\n    users: [\"kubelet\", \"system:node-problem-detector\", \"system:serviceaccount:kube-system:node-problem-detector\"]\r\n    verbs: [\"update\",\"patch\"]\r\n    resources:\r\n      - group: \"\" # core\r\n        resources: [\"nodes/status\", \"pods/status\"]\r\n    omitStages:\r\n      - \"RequestReceived\"\r\n  - level: Request\r\n    userGroups: [\"system:nodes\"]\r\n    verbs: [\"update\",\"patch\"]\r\n    resources:\r\n      - group: \"\" # core\r\n        resources: [\"nodes/status\", \"pods/status\"]\r\n```\r\n\r\nWhich would translate to something like:\r\n```yaml\r\nkind: AuditClass\r\nmetadata:\r\n  name: noisy\r\nrules:\r\n  # HPA fetching metrics.\r\n  - users:\r\n      - system:kube-controller-manager\r\n    verbs: [\"get\", \"list\"]\r\n    resources:\r\n      - group: \"metrics.k8s.io\"\r\n  # Read-only URLs.\r\n  - nonResourceURLs:\r\n      - /healthz*\r\n      - /version\r\n      - /swagger*\r\n  - resources:\r\n      - group: \"\" # core\r\n        resources: [\"events\"]\r\n---\r\nkind: AuditClass\r\nmetadata:\r\n  name: node-update\r\nrules:\r\n  - users: [\"kubelet\", \"system:node-problem-detector\", \"system:serviceaccount:kube-system:node-problem-detector\"]\r\n    verbs: [\"update\",\"patch\"]\r\n    resources:\r\n      - group: \"\" # core\r\n        resources: [\"nodes/status\", \"pods/status\"]\r\n  - userGroups: [\"system:nodes\"]\r\n    verbs: [\"update\",\"patch\"]\r\n    resources:\r\n      - group: \"\" # core\r\n        resources: [\"nodes/status\", \"pods/status\"]\r\n```\r\nAnd then the policy itself just becomes:\r\n```yaml\r\n- class: noisy\r\n  level: None\r\n- class: node-update\r\n  level: Request\r\n  omitStages:\r\n      - \"RequestReceived\"\r\n```\r\nThe policy is still resolved in-order to resolve overlaps, but is much simpler and easier to be reused.\r\n\r\n_Aside: If we go this route, we should record the classes with the audit event, as that could be a useful mechanism for flagging requests for audit reviews_"}}
{"actor":{"display_login":"tallclair"}}