Merge pull request #52981 from CaoShuFeng/audit_v1beta2

staging/src/k8s.io/apiserver/pkg/apis/audit/types.go

@@ -77,15 +77,10 @@ const (
 // Event captures all the information that can be included in an API audit log.
 type Event struct {
 	metav1.TypeMeta
-	// ObjectMeta is included for interoperability with API infrastructure.
-	// +optional
-	metav1.ObjectMeta
 
 	// AuditLevel at which event was generated
 	Level Level
 
-	// Time the request reached the apiserver.
-	Timestamp metav1.Time
 	// Unique audit ID, generated for each request.
 	AuditID types.UID
 	// Stage of the request handling when this event instance was generated.
@@ -121,10 +116,15 @@ type Event struct {
 	// +optional
 	RequestObject *runtime.Unknown
 	// API object returned in the response, in JSON. The ResponseObject is recorded after conversion
-	// to the external type, and serialized as JSON.  Omitted for non-resource requests.  Only logged
+	// to the external type, and serialized as JSON. Omitted for non-resource requests.  Only logged
 	// at Response Level.
 	// +optional
 	ResponseObject *runtime.Unknown
+
+	// Time the request reached the apiserver.
+	RequestReceivedTimestamp metav1.MicroTime
+	// Time the request reached current audit stage.
+	StageTimestamp metav1.MicroTime
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/BUILD

@@ -54,6 +54,7 @@ go_test(
     srcs = ["conversion_test.go"],
     library = ":go_default_library",
     deps = [
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
         "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
         "//vendor/k8s.io/apiserver/pkg/apis/audit:go_default_library",

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/conversion.go

@@ -19,6 +19,7 @@ package v1alpha1
 import (
 	"strings"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/conversion"
 	"k8s.io/apiserver/pkg/apis/audit"
 )
@@ -52,3 +53,26 @@ func Convert_v1alpha1_ObjectReference_To_audit_ObjectReference(in *ObjectReferen
 	}
 	return nil
 }
+
+func Convert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
+	if err := autoConvert_v1alpha1_Event_To_audit_Event(in, out, s); err != nil {
+		return err
+	}
+	if out.StageTimestamp.IsZero() {
+		out.StageTimestamp = metav1.NewMicroTime(in.CreationTimestamp.Time)
+	}
+	if out.RequestReceivedTimestamp.IsZero() {
+		out.RequestReceivedTimestamp = metav1.NewMicroTime(in.Timestamp.Time)
+	}
+	return nil
+}
+
+func Convert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
+	if err := autoConvert_audit_Event_To_v1alpha1_Event(in, out, s); err != nil {
+		return err
+	}
+	out.CreationTimestamp = metav1.NewTime(in.StageTimestamp.Time)
+	out.Timestamp = metav1.NewTime(in.RequestReceivedTimestamp.Time)
+	return nil
+
+}

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/conversion_test.go

@@ -19,7 +19,9 @@ package v1alpha1
 import (
 	"reflect"
 	"testing"
+	"time"
 
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
 	"k8s.io/apimachinery/pkg/runtime"
 	"k8s.io/apimachinery/pkg/runtime/schema"
 	auditinternal "k8s.io/apiserver/pkg/apis/audit"
@@ -36,7 +38,7 @@ func init() {
 	RegisterConversions(scheme)
 }
 
-func TestConversion(t *testing.T) {
+func TestConversionObjectReference(t *testing.T) {
 	scheme.Log(t)
 
 	testcases := []struct {
@@ -92,3 +94,114 @@ func TestConversion(t *testing.T) {
 		})
 	}
 }
+
+func TestConversionEventToInternal(t *testing.T) {
+	scheme.Log(t)
+
+	time1 := time.Now()
+	time2 := time.Now()
+	testcases := []struct {
+		desc     string
+		old      *Event
+		expected *auditinternal.Event
+	}{
+		{
+			"StageTimestamp is empty",
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(time1),
+				},
+			},
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(time1),
+			},
+		},
+		{
+			"StageTimestamp is not empty",
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(time1),
+				},
+				StageTimestamp: metav1.NewMicroTime(time2),
+			},
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(time2),
+			},
+		},
+		{
+			"RequestReceivedTimestamp is empty",
+			&Event{
+				Timestamp: metav1.NewTime(time1),
+			},
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(time1),
+			},
+		},
+		{
+			"RequestReceivedTimestamp is not empty",
+			&Event{
+				Timestamp:                metav1.NewTime(time1),
+				RequestReceivedTimestamp: metav1.NewMicroTime(time2),
+			},
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(time2),
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			internal := &auditinternal.Event{}
+			if err := scheme.Convert(tc.old, internal, nil); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if !reflect.DeepEqual(internal, tc.expected) {
+				t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, internal)
+			}
+		})
+	}
+}
+
+func TestConversionInternalToEvent(t *testing.T) {
+	scheme.Log(t)
+
+	now := time.Now()
+	testcases := []struct {
+		desc     string
+		old      *auditinternal.Event
+		expected *Event
+	}{
+		{
+			"convert stageTimestamp",
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(now),
+			},
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(now),
+				},
+				StageTimestamp: metav1.NewMicroTime(now),
+			},
+		},
+		{
+			"convert RequestReceivedTimestamp",
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(now),
+			},
+			&Event{
+				Timestamp:                metav1.NewTime(now),
+				RequestReceivedTimestamp: metav1.NewMicroTime(now),
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			event := &Event{}
+			if err := scheme.Convert(tc.old, event, nil); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if !reflect.DeepEqual(event, tc.expected) {
+				t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, event)
+			}
+		})
+	}
+}

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/generated.proto

@@ -89,6 +89,14 @@ message Event {
   // at Response Level.
   // +optional
   optional k8s.io.apimachinery.pkg.runtime.Unknown responseObject = 14;
+
+  // Time the request reached the apiserver.
+  // +optional
+  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime requestReceivedTimestamp = 15;
+
+  // Time the request reached current audit stage.
+  // +optional
+  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime stageTimestamp = 16;
 }
 
 // EventList is a list of audit Events.

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/types.go

@@ -126,6 +126,12 @@ type Event struct {
 	// at Response Level.
 	// +optional
 	ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,14,opt,name=responseObject"`
+	// Time the request reached the apiserver.
+	// +optional
+	RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,15,opt,name=requestReceivedTimestamp"`
+	// Time the request reached current audit stage.
+	// +optional
+	StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,16,opt,name=stageTimestamp"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/zz_generated.conversion.go

@@ -56,9 +56,9 @@ func RegisterConversions(scheme *runtime.Scheme) error {
 }
 
 func autoConvert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
+	// WARNING: in.ObjectMeta requires manual conversion: does not exist in peer-type
 	out.Level = audit.Level(in.Level)
-	out.Timestamp = in.Timestamp
+	// WARNING: in.Timestamp requires manual conversion: does not exist in peer-type
 	out.AuditID = types.UID(in.AuditID)
 	out.Stage = audit.Stage(in.Stage)
 	out.RequestURI = in.RequestURI
@@ -81,18 +81,13 @@ func autoConvert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s co
 	out.ResponseStatus = (*v1.Status)(unsafe.Pointer(in.ResponseStatus))
 	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
 	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
+	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
+	out.StageTimestamp = in.StageTimestamp
 	return nil
 }
 
-// Convert_v1alpha1_Event_To_audit_Event is an autogenerated conversion function.
-func Convert_v1alpha1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	return autoConvert_v1alpha1_Event_To_audit_Event(in, out, s)
-}
-
 func autoConvert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
 	out.Level = Level(in.Level)
-	out.Timestamp = in.Timestamp
 	out.AuditID = types.UID(in.AuditID)
 	out.Stage = Stage(in.Stage)
 	out.RequestURI = in.RequestURI
@@ -115,14 +110,11 @@ func autoConvert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s co
 	out.ResponseStatus = (*v1.Status)(unsafe.Pointer(in.ResponseStatus))
 	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
 	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
+	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
+	out.StageTimestamp = in.StageTimestamp
 	return nil
 }
 
-// Convert_audit_Event_To_v1alpha1_Event is an autogenerated conversion function.
-func Convert_audit_Event_To_v1alpha1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	return autoConvert_audit_Event_To_v1alpha1_Event(in, out, s)
-}
-
 func autoConvert_v1alpha1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
 	if in.Items != nil {

staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/zz_generated.deepcopy.go

@@ -126,6 +126,8 @@ func (in *Event) DeepCopyInto(out *Event) {
 			(*in).DeepCopyInto(*out)
 		}
 	}
+	in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
+	in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
 	return
 }
 

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/BUILD

@@ -3,11 +3,13 @@ package(default_visibility = ["//visibility:public"])
 load(
     "@io_bazel_rules_go//go:def.bzl",
     "go_library",
+    "go_test",
 )
 
 go_library(
     name = "go_default_library",
     srcs = [
+        "conversion.go",
         "doc.go",
         "generated.pb.go",
         "register.go",
@@ -47,3 +49,15 @@ filegroup(
     srcs = ["generated.proto"],
     visibility = ["//visibility:public"],
 )
+
+go_test(
+    name = "go_default_test",
+    srcs = ["conversion_test.go"],
+    library = ":go_default_library",
+    deps = [
+        "//vendor/k8s.io/apimachinery/pkg/apis/meta/v1:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime:go_default_library",
+        "//vendor/k8s.io/apimachinery/pkg/runtime/schema:go_default_library",
+        "//vendor/k8s.io/apiserver/pkg/apis/audit:go_default_library",
+    ],
+)

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/conversion.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/conversion"
+	"k8s.io/apiserver/pkg/apis/audit"
+)
+
+func Convert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
+	if err := autoConvert_v1beta1_Event_To_audit_Event(in, out, s); err != nil {
+		return err
+	}
+	if out.StageTimestamp.IsZero() {
+		out.StageTimestamp = metav1.NewMicroTime(in.CreationTimestamp.Time)
+	}
+	if out.RequestReceivedTimestamp.IsZero() {
+		out.RequestReceivedTimestamp = metav1.NewMicroTime(in.Timestamp.Time)
+	}
+	return nil
+}
+
+func Convert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
+	if err := autoConvert_audit_Event_To_v1beta1_Event(in, out, s); err != nil {
+		return err
+	}
+	out.CreationTimestamp = metav1.NewTime(in.StageTimestamp.Time)
+	out.Timestamp = metav1.NewTime(in.RequestReceivedTimestamp.Time)
+	return nil
+}

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/conversion_test.go

+/*
+Copyright 2017 The Kubernetes Authors.
+
+Licensed under the Apache License, Version 2.0 (the "License");
+you may not use this file except in compliance with the License.
+You may obtain a copy of the License at
+
+    http://www.apache.org/licenses/LICENSE-2.0
+
+Unless required by applicable law or agreed to in writing, software
+distributed under the License is distributed on an "AS IS" BASIS,
+WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+See the License for the specific language governing permissions and
+limitations under the License.
+*/
+
+package v1beta1
+
+import (
+	"reflect"
+	"testing"
+	"time"
+
+	metav1 "k8s.io/apimachinery/pkg/apis/meta/v1"
+	"k8s.io/apimachinery/pkg/runtime"
+	"k8s.io/apimachinery/pkg/runtime/schema"
+	auditinternal "k8s.io/apiserver/pkg/apis/audit"
+)
+
+var scheme = runtime.NewScheme()
+
+func init() {
+	addKnownTypes(scheme)
+	internalGV := schema.GroupVersion{Group: auditinternal.GroupName, Version: runtime.APIVersionInternal}
+	scheme.AddKnownTypes(internalGV,
+		&auditinternal.Event{},
+	)
+	RegisterConversions(scheme)
+}
+
+func TestConversionEventToInternal(t *testing.T) {
+	scheme.Log(t)
+
+	time1 := time.Now()
+	time2 := time.Now()
+	testcases := []struct {
+		desc     string
+		old      *Event
+		expected *auditinternal.Event
+	}{
+		{
+			"StageTimestamp is empty",
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(time1),
+				},
+			},
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(time1),
+			},
+		},
+		{
+			"StageTimestamp is not empty",
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(time1),
+				},
+				StageTimestamp: metav1.NewMicroTime(time2),
+			},
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(time2),
+			},
+		},
+		{
+			"RequestReceivedTimestamp is empty",
+			&Event{
+				Timestamp: metav1.NewTime(time1),
+			},
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(time1),
+			},
+		},
+		{
+			"RequestReceivedTimestamp is not empty",
+			&Event{
+				Timestamp:                metav1.NewTime(time1),
+				RequestReceivedTimestamp: metav1.NewMicroTime(time2),
+			},
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(time2),
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			internal := &auditinternal.Event{}
+			if err := scheme.Convert(tc.old, internal, nil); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if !reflect.DeepEqual(internal, tc.expected) {
+				t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, internal)
+			}
+		})
+	}
+}
+
+func TestConversionInternalToEvent(t *testing.T) {
+	scheme.Log(t)
+
+	now := time.Now()
+	testcases := []struct {
+		desc     string
+		old      *auditinternal.Event
+		expected *Event
+	}{
+		{
+			"convert stageTimestamp",
+			&auditinternal.Event{
+				StageTimestamp: metav1.NewMicroTime(now),
+			},
+			&Event{
+				ObjectMeta: metav1.ObjectMeta{
+					CreationTimestamp: metav1.NewTime(now),
+				},
+				StageTimestamp: metav1.NewMicroTime(now),
+			},
+		},
+		{
+			"convert RequestReceivedTimestamp",
+			&auditinternal.Event{
+				RequestReceivedTimestamp: metav1.NewMicroTime(now),
+			},
+			&Event{
+				Timestamp:                metav1.NewTime(now),
+				RequestReceivedTimestamp: metav1.NewMicroTime(now),
+			},
+		},
+	}
+	for _, tc := range testcases {
+		t.Run(tc.desc, func(t *testing.T) {
+			event := &Event{}
+			if err := scheme.Convert(tc.old, event, nil); err != nil {
+				t.Errorf("unexpected error: %v", err)
+			}
+			if !reflect.DeepEqual(event, tc.expected) {
+				t.Errorf("expected\n\t%#v, got \n\t%#v", tc.expected, event)
+			}
+		})
+	}
+}

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/generated.proto

@@ -35,12 +35,15 @@ option go_package = "v1beta1";
 message Event {
   // ObjectMeta is included for interoperability with API infrastructure.
   // +optional
+  // DEPRECATED: Use StageTimestamp which supports micro second instead of ObjectMeta.CreateTimestamp
+  // and the rest of the object is not used
   optional k8s.io.apimachinery.pkg.apis.meta.v1.ObjectMeta metadata = 1;
 
   // AuditLevel at which event was generated
   optional string level = 2;
 
   // Time the request reached the apiserver.
+  // DEPRECATED: Use RequestReceivedTimestamp which supports micro second instead.
   optional k8s.io.apimachinery.pkg.apis.meta.v1.Time timestamp = 3;
 
   // Unique audit ID, generated for each request.
@@ -90,6 +93,14 @@ message Event {
   // at Response Level.
   // +optional
   optional k8s.io.apimachinery.pkg.runtime.Unknown responseObject = 14;
+
+  // Time the request reached the apiserver.
+  // +optional
+  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime requestReceivedTimestamp = 15;
+
+  // Time the request reached current audit stage.
+  // +optional
+  optional k8s.io.apimachinery.pkg.apis.meta.v1.MicroTime stageTimestamp = 16;
 }
 
 // EventList is a list of audit Events.

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/types.go

@@ -73,12 +73,15 @@ type Event struct {
 	metav1.TypeMeta `json:",inline"`
 	// ObjectMeta is included for interoperability with API infrastructure.
 	// +optional
+	// DEPRECATED: Use StageTimestamp which supports micro second instead of ObjectMeta.CreateTimestamp
+	// and the rest of the object is not used
 	metav1.ObjectMeta `json:"metadata,omitempty" protobuf:"bytes,1,opt,name=metadata"`
 
 	// AuditLevel at which event was generated
 	Level Level `json:"level" protobuf:"bytes,2,opt,name=level,casttype=Level"`
 
 	// Time the request reached the apiserver.
+	// DEPRECATED: Use RequestReceivedTimestamp which supports micro second instead.
 	Timestamp metav1.Time `json:"timestamp" protobuf:"bytes,3,opt,name=timestamp"`
 	// Unique audit ID, generated for each request.
 	AuditID types.UID `json:"auditID" protobuf:"bytes,4,opt,name=auditID,casttype=k8s.io/apimachinery/pkg/types.UID"`
@@ -119,6 +122,12 @@ type Event struct {
 	// at Response Level.
 	// +optional
 	ResponseObject *runtime.Unknown `json:"responseObject,omitempty" protobuf:"bytes,14,opt,name=responseObject"`
+	// Time the request reached the apiserver.
+	// +optional
+	RequestReceivedTimestamp metav1.MicroTime `json:"requestReceivedTimestamp" protobuf:"bytes,15,opt,name=requestReceivedTimestamp"`
+	// Time the request reached current audit stage.
+	// +optional
+	StageTimestamp metav1.MicroTime `json:"stageTimestamp" protobuf:"bytes,16,opt,name=stageTimestamp"`
 }
 
 // +k8s:deepcopy-gen:interfaces=k8s.io/apimachinery/pkg/runtime.Object

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/zz_generated.conversion.go

@@ -56,9 +56,9 @@ func RegisterConversions(scheme *runtime.Scheme) error {
 }
 
 func autoConvert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
+	// WARNING: in.ObjectMeta requires manual conversion: does not exist in peer-type
 	out.Level = audit.Level(in.Level)
-	out.Timestamp = in.Timestamp
+	// WARNING: in.Timestamp requires manual conversion: does not exist in peer-type
 	out.AuditID = types.UID(in.AuditID)
 	out.Stage = audit.Stage(in.Stage)
 	out.RequestURI = in.RequestURI
@@ -73,18 +73,13 @@ func autoConvert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s con
 	out.ResponseStatus = (*v1.Status)(unsafe.Pointer(in.ResponseStatus))
 	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
 	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
+	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
+	out.StageTimestamp = in.StageTimestamp
 	return nil
 }
 
-// Convert_v1beta1_Event_To_audit_Event is an autogenerated conversion function.
-func Convert_v1beta1_Event_To_audit_Event(in *Event, out *audit.Event, s conversion.Scope) error {
-	return autoConvert_v1beta1_Event_To_audit_Event(in, out, s)
-}
-
 func autoConvert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	out.ObjectMeta = in.ObjectMeta
 	out.Level = Level(in.Level)
-	out.Timestamp = in.Timestamp
 	out.AuditID = types.UID(in.AuditID)
 	out.Stage = Stage(in.Stage)
 	out.RequestURI = in.RequestURI
@@ -99,17 +94,24 @@ func autoConvert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s con
 	out.ResponseStatus = (*v1.Status)(unsafe.Pointer(in.ResponseStatus))
 	out.RequestObject = (*runtime.Unknown)(unsafe.Pointer(in.RequestObject))
 	out.ResponseObject = (*runtime.Unknown)(unsafe.Pointer(in.ResponseObject))
+	out.RequestReceivedTimestamp = in.RequestReceivedTimestamp
+	out.StageTimestamp = in.StageTimestamp
 	return nil
 }
 
-// Convert_audit_Event_To_v1beta1_Event is an autogenerated conversion function.
-func Convert_audit_Event_To_v1beta1_Event(in *audit.Event, out *Event, s conversion.Scope) error {
-	return autoConvert_audit_Event_To_v1beta1_Event(in, out, s)
-}
-
 func autoConvert_v1beta1_EventList_To_audit_EventList(in *EventList, out *audit.EventList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
-	out.Items = *(*[]audit.Event)(unsafe.Pointer(&in.Items))
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]audit.Event, len(*in))
+		for i := range *in {
+			if err := Convert_v1beta1_Event_To_audit_Event(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
 	return nil
 }
 
@@ -120,7 +122,17 @@ func Convert_v1beta1_EventList_To_audit_EventList(in *EventList, out *audit.Even
 
 func autoConvert_audit_EventList_To_v1beta1_EventList(in *audit.EventList, out *EventList, s conversion.Scope) error {
 	out.ListMeta = in.ListMeta
-	out.Items = *(*[]Event)(unsafe.Pointer(&in.Items))
+	if in.Items != nil {
+		in, out := &in.Items, &out.Items
+		*out = make([]Event, len(*in))
+		for i := range *in {
+			if err := Convert_audit_Event_To_v1beta1_Event(&(*in)[i], &(*out)[i], s); err != nil {
+				return err
+			}
+		}
+	} else {
+		out.Items = nil
+	}
 	return nil
 }
 

staging/src/k8s.io/apiserver/pkg/apis/audit/v1beta1/zz_generated.deepcopy.go

@@ -126,6 +126,8 @@ func (in *Event) DeepCopyInto(out *Event) {
 			(*in).DeepCopyInto(*out)
 		}
 	}
+	in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
+	in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
 	return
 }
 

staging/src/k8s.io/apiserver/pkg/apis/audit/zz_generated.deepcopy.go

@@ -71,8 +71,6 @@ func GetGeneratedDeepCopyFuncs() []conversion.GeneratedDeepCopyFunc {
 func (in *Event) DeepCopyInto(out *Event) {
 	*out = *in
 	out.TypeMeta = in.TypeMeta
-	in.ObjectMeta.DeepCopyInto(&out.ObjectMeta)
-	in.Timestamp.DeepCopyInto(&out.Timestamp)
 	in.User.DeepCopyInto(&out.User)
 	if in.ImpersonatedUser != nil {
 		in, out := &in.ImpersonatedUser, &out.ImpersonatedUser
@@ -124,6 +122,8 @@ func (in *Event) DeepCopyInto(out *Event) {
 			(*in).DeepCopyInto(*out)
 		}
 	}
+	in.RequestReceivedTimestamp.DeepCopyInto(&out.RequestReceivedTimestamp)
+	in.StageTimestamp.DeepCopyInto(&out.StageTimestamp)
 	return
 }
 

staging/src/k8s.io/apiserver/pkg/audit/format.go

@@ -61,7 +61,7 @@ func EventString(ev *auditinternal.Event) string {
 	}
 
 	return fmt.Sprintf("%s AUDIT: id=%q stage=%q ip=%q method=%q user=%q groups=%q as=%q asgroups=%q namespace=%q uri=%q response=\"%s\"",
-		ev.Timestamp.Format(time.RFC3339Nano), ev.AuditID, ev.Stage, ip, ev.Verb, username, groups, asuser, asgroups, namespace, ev.RequestURI, response)
+		ev.RequestReceivedTimestamp.Format(time.RFC3339Nano), ev.AuditID, ev.Stage, ip, ev.Verb, username, groups, asuser, asgroups, namespace, ev.RequestURI, response)
 }
 
 func auditStringSlice(inList []string) string {

staging/src/k8s.io/apiserver/pkg/audit/request.go

@@ -40,7 +40,7 @@ import (
 
 func NewEventFromRequest(req *http.Request, level auditinternal.Level, attribs authorizer.Attributes) (*auditinternal.Event, error) {
 	ev := &auditinternal.Event{
-		Timestamp:  metav1.NewTime(time.Now()),
+		RequestReceivedTimestamp: metav1.NewMicroTime(time.Now()),
 		Verb:       attribs.GetVerb(),
 		RequestURI: req.URL.RequestURI(),
 	}

staging/src/k8s.io/apiserver/pkg/endpoints/filters/audit.go

@@ -148,7 +148,12 @@ func processAuditEvent(sink audit.Sink, ev *auditinternal.Event, omitStages []au
 			return
 		}
 	}
-	ev.CreationTimestamp = metav1.NewTime(time.Now())
+
+	if ev.Stage == auditinternal.StageRequestReceived {
+		ev.StageTimestamp = metav1.NewMicroTime(ev.RequestReceivedTimestamp.Time)
+	} else {
+		ev.StageTimestamp = metav1.NewMicroTime(time.Now())
+	}
 	audit.ObserveEvent()
 	sink.ProcessEvents(ev)
 }

staging/src/k8s.io/apiserver/plugin/pkg/audit/log/backend_test.go

@@ -73,10 +73,10 @@ func TestLogEventsLegacy(t *testing.T) {
 				SourceIPs: []string{
 					"127.0.0.1",
 				},
-				Timestamp: metav1.NewTime(time.Now()),
-				AuditID:   types.UID(uuid.NewRandom().String()),
-				Stage:     auditinternal.StageRequestReceived,
-				Verb:      "get",
+				RequestReceivedTimestamp: metav1.NewMicroTime(time.Now()),
+				AuditID:                  types.UID(uuid.NewRandom().String()),
+				Stage:                    auditinternal.StageRequestReceived,
+				Verb:                     "get",
 				User: auditinternal.UserInfo{
 					Username: "admin",
 					Groups: []string{
@@ -130,13 +130,11 @@ func TestLogEventsJson(t *testing.T) {
 			SourceIPs: []string{
 				"127.0.0.1",
 			},
-			// When encoding to json format, the nanosecond part of timestamp is
-			// lost and it will become zero when we decode event back, so we rounding
-			// timestamp down to a multiple of second.
-			Timestamp: metav1.NewTime(time.Now().Truncate(time.Second)),
-			AuditID:   types.UID(uuid.NewRandom().String()),
-			Stage:     auditinternal.StageRequestReceived,
-			Verb:      "get",
+			RequestReceivedTimestamp: metav1.NewMicroTime(time.Now().Truncate(time.Microsecond)),
+			StageTimestamp:           metav1.NewMicroTime(time.Now().Truncate(time.Microsecond)),
+			AuditID:                  types.UID(uuid.NewRandom().String()),
+			Stage:                    auditinternal.StageRequestReceived,
+			Verb:                     "get",
 			User: auditinternal.UserInfo{
 				Username: "admin",
 				Groups: []string{