From dc2769ad84470df0282ef7e0caa8110f66596159 Mon Sep 17 00:00:00 2001 From: Jordan Liggitt Date: Tue, 26 Apr 2022 08:50:41 -0400 Subject: [PATCH] Update demo policy and log to v1 --- testdata/demo-policy.yaml | 2 +- testdata/demo.log | 74 +++++++++++++++++++-------------------- 2 files changed, 38 insertions(+), 38 deletions(-) diff --git a/testdata/demo-policy.yaml b/testdata/demo-policy.yaml index eb2f7ed..2b744c3 100644 --- a/testdata/demo-policy.yaml +++ b/testdata/demo-policy.yaml @@ -1,5 +1,5 @@ kind: Policy -apiVersion: audit.k8s.io/v1beta1 +apiVersion: audit.k8s.io/v1 rules: - level: Metadata users: diff --git a/testdata/demo.log b/testdata/demo.log index 6a049b6..b8facd1 100644 --- a/testdata/demo.log +++ b/testdata/demo.log @@ -1,37 +1,37 @@ -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T19:55:05Z"},"level":"Metadata","timestamp":"2017-09-11T19:55:05Z","auditID":"033d17af-082d-4b24-aa22-627752e83d71","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T19:55:34Z"},"level":"Metadata","timestamp":"2017-09-11T19:55:34Z","auditID":"d857fef6-5a24-4889-9597-ffbcb6108444","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T19:58:37Z"},"level":"Metadata","timestamp":"2017-09-11T19:58:37Z","auditID":"719a5b90-e21b-44a2-94ec-67e16493dad6","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T19:59:03Z"},"level":"Metadata","timestamp":"2017-09-11T19:59:03Z","auditID":"0c0d86ba-4cbd-4e35-ba05-25df8e630bcb","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:00:59Z"},"level":"Metadata","timestamp":"2017-09-11T20:00:59Z","auditID":"60006562-ced6-4178-ac95-e1a50225b012","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:01:26Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:26Z","auditID":"d7cd2b04-940b-42cb-ad2a-b4b8f937aa0e","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:01:30Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:30Z","auditID":"25de0e17-3586-40d9-bbba-e7c3334b9cdf","stage":"ResponseComplete","requestURI":"/api/v1/nodes","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"nodes","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"nodes is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list nodes at the cluster scope","reason":"Forbidden","details":{"kind":"nodes"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:01:37Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:37Z","auditID":"524c5a19-63b0-4af8-acc7-bf75fdad18dc","stage":"ResponseComplete","requestURI":"/api/v1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods at the cluster scope","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:01:50Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:50Z","auditID":"07d17160-3e30-46a4-be6a-36e9d77acdac","stage":"ResponseComplete","requestURI":"/api/v1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"eed8aa73-fedf-46b2-88f6-92019cf5e06e","stage":"ResponseComplete","requestURI":"/api","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"a8114360-9700-4856-8017-91998f503510","stage":"ResponseComplete","requestURI":"/apis","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"58155446-232d-412e-ac34-728a61dd8041","stage":"ResponseComplete","requestURI":"/apis/apiregistration.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"fe945b0a-5b64-4118-b706-106dfb8a6931","stage":"ResponseComplete","requestURI":"/apis/extensions/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"6b08c9b1-434a-4acc-97fe-6af1e08d46a4","stage":"ResponseComplete","requestURI":"/apis/apps/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"1cdb714a-b138-4faf-a7b5-ae2e2767d3b9","stage":"ResponseComplete","requestURI":"/apis/apps/v1beta2","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"c62065cf-b803-4ec6-bf7e-d8087a58ad43","stage":"ResponseComplete","requestURI":"/apis/authentication.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"697d8d5d-ce48-437e-970e-7c4b9bd4e951","stage":"ResponseComplete","requestURI":"/apis/authentication.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"be8491df-39b2-4759-b463-e04a7e4f65f0","stage":"ResponseComplete","requestURI":"/apis/authorization.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"3f117525-2adf-40de-8ce7-65fc6082faf6","stage":"ResponseComplete","requestURI":"/apis/authorization.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"04f9897f-4918-4b59-a80a-52bc33292bdf","stage":"ResponseComplete","requestURI":"/apis/autoscaling/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"85f10efa-83c7-4e53-88e8-9d673d73218a","stage":"ResponseComplete","requestURI":"/apis/batch/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"978b1ab1-b468-4b31-94d8-50090984c606","stage":"ResponseComplete","requestURI":"/apis/batch/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"61d1cf81-ee67-4afd-8d59-b6cbbd877b0d","stage":"ResponseComplete","requestURI":"/apis/certificates.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"074dc0d2-c157-406c-a5e2-7e04f76409e6","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"eac6d009-0a37-4569-aa52-f22eac7858f2","stage":"ResponseComplete","requestURI":"/apis/policy/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"97c33898-a464-49a4-a583-7a7ff4ee4551","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"e76a4a71-44c5-4db4-ba9f-6d3aa26aff6b","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"49a9cd6d-8890-4e9b-a862-05581c6a993e","stage":"ResponseComplete","requestURI":"/apis/storage.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"fa122779-1350-4505-abaa-baf1e924da22","stage":"ResponseComplete","requestURI":"/apis/storage.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"444d79bf-6ab7-44b3-b84e-d9bc4ce33f12","stage":"ResponseComplete","requestURI":"/apis/admissionregistration.k8s.io/v1alpha1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"bdeb2cdb-d6f0-4213-adc2-73bd10776be6","stage":"ResponseComplete","requestURI":"/apis/apiextensions.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"62328cdf-ca17-40db-8749-850f636ce086","stage":"ResponseComplete","requestURI":"/api/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"05a27a91-fe57-4671-a182-3c9433be30b1","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:27:52Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:52Z","auditID":"62684124-32b1-4c41-962f-1d80531b9fc9","stage":"ResponseComplete","requestURI":"/api/v1/nodes?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"nodes","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"nodes is forbidden: User \"bob\" cannot list nodes at the cluster scope","reason":"Forbidden","details":{"kind":"nodes"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:28:54Z"},"level":"Metadata","timestamp":"2017-09-11T20:28:54Z","auditID":"3f81cdbb-a594-4f63-9501-54d1d33a8b14","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"alice\" cannot list pods in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:28:58Z"},"level":"Metadata","timestamp":"2017-09-11T20:28:58Z","auditID":"99356a22-4c41-41c0-a86c-5356e1e9fcff","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/configmaps","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"configmaps","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"configmaps is forbidden: User \"alice\" cannot list configmaps in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"configmaps"},"code":403}} -{"kind":"Event","apiVersion":"audit.k8s.io/v1beta1","metadata":{"creationTimestamp":"2017-09-11T20:29:04Z"},"level":"Metadata","timestamp":"2017-09-11T20:29:04Z","auditID":"4b814005-0bfa-4756-bf3e-3750de5b8769","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/secrets","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"secrets","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"secrets is forbidden: User \"alice\" cannot list secrets in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"secrets"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T19:55:05Z"},"level":"Metadata","timestamp":"2017-09-11T19:55:05Z","auditID":"033d17af-082d-4b24-aa22-627752e83d71","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T19:55:34Z"},"level":"Metadata","timestamp":"2017-09-11T19:55:34Z","auditID":"d857fef6-5a24-4889-9597-ffbcb6108444","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T19:58:37Z"},"level":"Metadata","timestamp":"2017-09-11T19:58:37Z","auditID":"719a5b90-e21b-44a2-94ec-67e16493dad6","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T19:59:03Z"},"level":"Metadata","timestamp":"2017-09-11T19:59:03Z","auditID":"0c0d86ba-4cbd-4e35-ba05-25df8e630bcb","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/pods?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"bob\" cannot list pods in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:00:59Z"},"level":"Metadata","timestamp":"2017-09-11T20:00:59Z","auditID":"60006562-ced6-4178-ac95-e1a50225b012","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:01:26Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:26Z","auditID":"d7cd2b04-940b-42cb-ad2a-b4b8f937aa0e","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods in the namespace \"default\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:01:30Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:30Z","auditID":"25de0e17-3586-40d9-bbba-e7c3334b9cdf","stage":"ResponseComplete","requestURI":"/api/v1/nodes","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"nodes","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"nodes is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list nodes at the cluster scope","reason":"Forbidden","details":{"kind":"nodes"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:01:37Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:37Z","auditID":"524c5a19-63b0-4af8-acc7-bf75fdad18dc","stage":"ResponseComplete","requestURI":"/api/v1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"system:serviceaccount:ns1:sa1\" cannot list pods at the cluster scope","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:01:50Z"},"level":"Metadata","timestamp":"2017-09-11T20:01:50Z","auditID":"07d17160-3e30-46a4-be6a-36e9d77acdac","stage":"ResponseComplete","requestURI":"/api/v1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"system:serviceaccount:ns1:sa1","groups":["system:serviceaccounts","system:serviceaccounts:ns1","system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"eed8aa73-fedf-46b2-88f6-92019cf5e06e","stage":"ResponseComplete","requestURI":"/api","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"a8114360-9700-4856-8017-91998f503510","stage":"ResponseComplete","requestURI":"/apis","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"58155446-232d-412e-ac34-728a61dd8041","stage":"ResponseComplete","requestURI":"/apis/apiregistration.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"fe945b0a-5b64-4118-b706-106dfb8a6931","stage":"ResponseComplete","requestURI":"/apis/extensions/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"6b08c9b1-434a-4acc-97fe-6af1e08d46a4","stage":"ResponseComplete","requestURI":"/apis/apps/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"1cdb714a-b138-4faf-a7b5-ae2e2767d3b9","stage":"ResponseComplete","requestURI":"/apis/apps/v1beta2","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"c62065cf-b803-4ec6-bf7e-d8087a58ad43","stage":"ResponseComplete","requestURI":"/apis/authentication.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"697d8d5d-ce48-437e-970e-7c4b9bd4e951","stage":"ResponseComplete","requestURI":"/apis/authentication.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"be8491df-39b2-4759-b463-e04a7e4f65f0","stage":"ResponseComplete","requestURI":"/apis/authorization.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"3f117525-2adf-40de-8ce7-65fc6082faf6","stage":"ResponseComplete","requestURI":"/apis/authorization.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"04f9897f-4918-4b59-a80a-52bc33292bdf","stage":"ResponseComplete","requestURI":"/apis/autoscaling/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"85f10efa-83c7-4e53-88e8-9d673d73218a","stage":"ResponseComplete","requestURI":"/apis/batch/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"978b1ab1-b468-4b31-94d8-50090984c606","stage":"ResponseComplete","requestURI":"/apis/batch/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"61d1cf81-ee67-4afd-8d59-b6cbbd877b0d","stage":"ResponseComplete","requestURI":"/apis/certificates.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"074dc0d2-c157-406c-a5e2-7e04f76409e6","stage":"ResponseComplete","requestURI":"/apis/networking.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"eac6d009-0a37-4569-aa52-f22eac7858f2","stage":"ResponseComplete","requestURI":"/apis/policy/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"97c33898-a464-49a4-a583-7a7ff4ee4551","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"e76a4a71-44c5-4db4-ba9f-6d3aa26aff6b","stage":"ResponseComplete","requestURI":"/apis/rbac.authorization.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"49a9cd6d-8890-4e9b-a862-05581c6a993e","stage":"ResponseComplete","requestURI":"/apis/storage.k8s.io/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"fa122779-1350-4505-abaa-baf1e924da22","stage":"ResponseComplete","requestURI":"/apis/storage.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"444d79bf-6ab7-44b3-b84e-d9bc4ce33f12","stage":"ResponseComplete","requestURI":"/apis/admissionregistration.k8s.io/v1alpha1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"bdeb2cdb-d6f0-4213-adc2-73bd10776be6","stage":"ResponseComplete","requestURI":"/apis/apiextensions.k8s.io/v1beta1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"62328cdf-ca17-40db-8749-850f636ce086","stage":"ResponseComplete","requestURI":"/api/v1","verb":"get","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:42Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:42Z","auditID":"05a27a91-fe57-4671-a182-3c9433be30b1","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"default","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:27:52Z"},"level":"Metadata","timestamp":"2017-09-11T20:27:52Z","auditID":"62684124-32b1-4c41-962f-1d80531b9fc9","stage":"ResponseComplete","requestURI":"/api/v1/nodes?includeUninitialized=true","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"bob","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"nodes","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"nodes is forbidden: User \"bob\" cannot list nodes at the cluster scope","reason":"Forbidden","details":{"kind":"nodes"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:28:54Z"},"level":"Metadata","timestamp":"2017-09-11T20:28:54Z","auditID":"3f81cdbb-a594-4f63-9501-54d1d33a8b14","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/pods","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"pods","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"pods is forbidden: User \"alice\" cannot list pods in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"pods"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:28:58Z"},"level":"Metadata","timestamp":"2017-09-11T20:28:58Z","auditID":"99356a22-4c41-41c0-a86c-5356e1e9fcff","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/configmaps","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"configmaps","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"configmaps is forbidden: User \"alice\" cannot list configmaps in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"configmaps"},"code":403}} +{"kind":"Event","apiVersion":"audit.k8s.io/v1","metadata":{"creationTimestamp":"2017-09-11T20:29:04Z"},"level":"Metadata","timestamp":"2017-09-11T20:29:04Z","auditID":"4b814005-0bfa-4756-bf3e-3750de5b8769","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/ns1/secrets","verb":"list","user":{"username":"system:admin","groups":["system:masters","system:authenticated"]},"impersonatedUser":{"username":"alice","groups":["system:authenticated"]},"sourceIPs":["::1"],"objectRef":{"resource":"secrets","namespace":"ns1","apiVersion":"v1"},"responseStatus":{"metadata":{},"status":"Failure","message":"secrets is forbidden: User \"alice\" cannot list secrets in the namespace \"ns1\"","reason":"Forbidden","details":{"kind":"secrets"},"code":403}}