[Feedback] Documentation on AKSAuditAdmin and AKSAdmin should be improved
- Dominant language
- TypeScript
- Stars
- 2.1k
- Forks
- 395
- Avg merge
- 2d 22h
- Merged PRs (30d)
- 13
Description
After having a lot of cost with audit logs, we changed to AKSAuditAdmin as per documentation it omits get and list operations.
From the wording, it can be understood that non mutating operations is omitted from logs.
We see two things that seems non-intuitive:
* Non-mutating dryruns are logged. This generates a lot of logging as we use GitOps and every reconciliation does a serverside apply with dryrun. Since this is a non-mutation operation we would expected it not to be logged
* We does not see logs for exec. Even if it is not a mutation operation from the Kubernetes-perspective, it is a operation that we did expected to be logged.
As an addtional feedback: It would be great to have the possibility to configure the Kubernetes Audit policy directly, as it makes it easier to tailor audit logging for different needs.
Contributor guide
Assessment
This issue has not been assessed yet.