Merge pull request #47921 from timstclair/audit-policy

Automatic merge from submit-queue Don't audit log tokens in TokenReviews We don't want to leak auth tokens in the audit logs, so only log TokenReview requests at the metadata level. Issue: kubernetes/features#22

Merge pull request #47921 from timstclair/audit-policy
f35f5ef4 · Kubernetes Submit Queue · GitHub · 4e1b6083 · dcdcb19c · f35f5ef4
Commit f35f5ef4 authored Jun 22, 2017 by Kubernetes Submit Queue Committed by GitHub Jun 22, 2017
Hide whitespace changes
Inline Side-by-side

Showing with 3 additions and 1 deletion

configure-helper.sh cluster/gce/gci/configure-helper.sh +3 -1

No files found.
--- a/cluster/gce/gci/configure-helper.sh
+++ b/cluster/gce/gci/configure-helper.sh
@@ -568,12 +568,14 @@ rules:
      - group: "" # core
        resources: ["events"]

-  # Secrets & ConfigMaps can contain sensitive & binary data,
+  # Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
  # so only log at the Metadata level.
  - level: Metadata
    resources:
      - group: "" # core
        resources: ["secrets", "configmaps"]
+      - group: authentication.k8s.io
+        resources: ["tokenreviews"]
  # Get repsonses can be large; skip them.
  - level: Request
    verbs: ["get", "list", "watch"]