Azure / Azure/AKS

[Feedback] Documentation on AKSAuditAdmin and AKSAdmin should be improved

Open
#5,576 1 comment 0 reactions 1 assignee Assigned to @sjwaight View on GitHub
docs Feedback
Dominant language
TypeScript
Stars
2.1k
Forks
395
Avg merge
2d 22h
Merged PRs (30d)
13

Description

After having a lot of cost with audit logs, we changed to AKSAuditAdmin as per documentation it omits get and list operations.

From the wording, it can be understood that non mutating operations is omitted from logs.

We see two things that seems non-intuitive:

* Non-mutating dryruns are logged. This generates a lot of logging as we use GitOps and every reconciliation does a serverside apply with dryrun. Since this is a non-mutation operation we would expected it not to be logged
* We does not see logs for exec. Even if it is not a mutation operation from the Kubernetes-perspective, it is a operation that we did expected to be logged.

As an addtional feedback: It would be great to have the possibility to configure the Kubernetes Audit policy directly, as it makes it easier to tailor audit logging for different needs.

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.