# Apiserver audit policy. Mounted into the control plane at creation when a
# profile sets AUDIT=on — an apiserver flag, so it cannot be added to a running
# cluster without recreating it.
#
# Deliberately modest: enough to make "who changed what, and when" answerable
# during onboarding without filling the disk. Read the log with:
#   docker exec <cluster>-control-plane cat /var/log/kubernetes/audit.log
apiVersion: audit.k8s.io/v1
kind: Policy

# Never log the request body for these — they contain credentials.
omitStages:
  - RequestReceived

rules:
  # Secrets/configmaps: record that access happened, never the contents.
  - level: Metadata
    resources:
      - group: ""
        resources: ["secrets", "configmaps"]

  # Authn/authz decisions — the part an auditor actually asks about.
  - level: Metadata
    nonResourceURLs:
      - /apis*
      - /api*

  # Mutations to workloads and policy: full request, so a diff is reconstructable.
  - level: Request
    verbs: ["create", "update", "patch", "delete"]
    resources:
      - group: ""
        resources: ["pods", "services", "serviceaccounts", "namespaces"]
      - group: "apps"
      - group: "networking.k8s.io"
      - group: "rbac.authorization.k8s.io"

  # Everything else that changes state: metadata only.
  - level: Metadata
    verbs: ["create", "update", "patch", "delete"]

  # Reads are dropped entirely — otherwise controller polling drowns the log.
  - level: None
    verbs: ["get", "list", "watch"]