Merge pull request #52998 from liggitt/audit-scale

Automatic merge from submit-queue (batch tested with PRs 52721, 53057, 52493, 52998, 52896). If you want to cherry-pick this change to another branch, please follow the instructions <a href="https://github.com/kubernetes/community/blob/master/contributors/devel/cherry-picks.md">here</a>. Adjust audit policy to omit high-volume or large responses from expected actors Builds on https://github.com/kubernetes/kubernetes/pull/52960 Possibly related to density test failures https://github.com/kubernetes/kubernetes/issues/51899#issuecomment-331924016

Merge pull request #52998 from liggitt/audit-scale
bafe4fb4 · Kubernetes Submit Queue · GitHub · 65a2f15e · 20453f9e · bafe4fb4
Commit bafe4fb4 authored Sep 26, 2017 by Kubernetes Submit Queue Committed by GitHub Sep 26, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 25 additions and 0 deletions

configure-helper.sh cluster/gce/gci/configure-helper.sh +25 -0

No files found.
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -577,6 +577,31 @@ rules:
      - group: "" # core
        resources: ["events"]

+  # node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes
+  - level: Request
+    users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"]
+    verbs: ["update","patch"]
+    resources:
+      - group: "" # core
+        resources: ["nodes/status", "pods/status"]
+    omitStages:
+      - "RequestReceived"
+  - level: Request
+    userGroups: ["system:nodes"]
+    verbs: ["update","patch"]
+    resources:
+      - group: "" # core
+        resources: ["nodes/status", "pods/status"]
+    omitStages:
+      - "RequestReceived"
+
+  # deletecollection calls can be large, don't log responses for expected namespace deletions
+  - level: Request
+    users: ["system:serviceaccount:kube-system:namespace-controller"]
+    verbs: ["deletecollection"]
+    omitStages:
+      - "RequestReceived"
+
  # Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
  # so only log at the Metadata level.
  - level: Metadata