[Feature] RequestResponse level audit logs in AKSAuditAdmin
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
**Is your feature request related to a problem? Please describe.**
As an AKS Administrator, I want to see RequestResponse level audit logs of custom resources in the AKSAuditAdmin Log Analytics table. Currently, the built-in Kubernetes objects have this level of logs, but other resources (eg. ArgoCD Application objects) only have Metadata level logs. This makes many high-level objects hard if not impossible to properly audit.
**Describe the solution you'd like**
I want to be able to configure the API server's audit logging policy, so that I can get RequestResponse level logs about my custom resources. I think for this, I only need a portion of the logging Policy configuration exposed, specifically, the [rules](https://kubernetes.io/docs/reference/config-api/apiserver-audit.v1/#audit-k8s-io-v1-PolicyRule) list of the audit.k8s.io/v1/Policy object.
*Technical suggestion*
My insight about this exposure is that there are already similar configurations exposed. For example, on the AKS (nodepool) object, there is an [`agentpoolProfiles[].kubeletConfig`](https://learn.microsoft.com/en-us/azure/aks/custom-node-configuration?tabs=linux-node-pools#kubelet-configuration) object, which enables configuring parameters of the kubelet. I think, this is essentialy the same approach as what we need: The exposure of configuration options of a component that is otherwise managed by Azure.
So, my suggestion is to do something similar for the API server. Let's say, there'd be an `apiServerConfigobject` on the AKS resource, at first only containing the object which is relevant for my request: `auditLogPolicyExtraRules[]` which would let me provide the list of rules additional to what AKS currently has.
**Describe alternatives you've considered**
I haven't found any satisfying alternative. In a specific case, I was able to correlate the CRD Metadata logs with a RequestResponse Deployment log based on their time and the change in the Deployment, but this approach does not always work.
**Additional context**
I have discussed this issue with a Microsoft Support Engineer in support ticket 2501090050001193. Also, the problem this issue requests to solve is the same as for #2684, #3919, #2145 and #1873.
Contributor guide
Assessment
This issue has not been assessed yet.