kube-apiserver Audit Configuration (v1) [page]deterministic

reference

## Resource Types

[Event](#audit-k8s-io-v1-Event)
[EventList](#audit-k8s-io-v1-EventList)
[Policy](#audit-k8s-io-v1-Policy)
[PolicyList](#audit-k8s-io-v1-PolicyList)

## `Event` {#audit-k8s-io-v1-Event}

Appears in:

[EventList](#audit-k8s-io-v1-EventList)

Event captures all the information that can be included in an API audit log.

<table class="table"> <thead><tr><th width="30%">Field</th><th>Description</th></tr></thead> <tbody> <tr><td><code>apiVersion</code> string</td><td><code>audit.k8s.io/v1</code></td></tr> <tr><td><code>kind</code> string</td><td><code>Event</code></td></tr> <tr><td><code>level</code> [Required] <a href="#audit-k8s-io-v1-Level"><code>Level</code></a> </td> <td> AuditLevel at which event was generated </td> </tr> <tr><td><code>auditID</code> [Required] <a href="https://pkg.go.dev/k8s.io/apimachinery/pkg/types#UID"><code>k8s.io/apimachinery/pkg/types.UID</code></a> </td> <td> Unique audit ID, generated for each request. </td> </tr> <tr><td><code>stage</code> [Required] <a href="#audit-k8s-io-v1-Stage"><code>Stage</code></a> </td> <td> Stage of the request handling when this event instance was generated. </td> </tr> <tr><td><code>requestURI</code> [Required] <code>string</code> </td> <td> RequestURI is the request URI as sent by the client to a server. </td> </tr> <tr><td><code>verb</code> [Required] <code>string</code> </td> <td> Verb is the kubernetes verb associated with the request. For non-resource requests, this is the lower-cased HTTP method. </td> </tr> <tr><td><code>user</code> [Required] <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#userinfo-v1-authentication-k8s-io"><code>authentication/v1.UserInfo</code></a> </td> <td> Authenticated user information. </td> </tr> <tr><td><code>impersonatedUser</code> <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#userinfo-v1-authentication-k8s-io"><code>authentication/v1.UserInfo</code></a> </td> <td> Impersonated user information. </td> </tr> <tr><td><code>authenticationMetadata</code> <a href="#audit-k8s-io-v1-AuthenticationMetadata"><code>AuthenticationMetadata</code></a> </td> <td> AuthenticationMetadata contains details about how the request was authenticated. </td> </tr> <tr><td><code>sourceIPs</code> <code>[]string</code> </td> <td> Source IPs, from where the request originated and intermediate proxies. The source IPs are listed from (in order): <ol> <li>X-Forwarded-For request header IPs</li> <li>X-Real-Ip header, if not present in the X-Forwarded-For list</li> <li>The remote address for the connection, if it doesn't match the last IP in the list up to here (X-Forwarded-For or X-Real-Ip). Note: All but the last IP can be arbitrarily set by the client.</li> </ol> </td> </tr> <tr><td><code>userAgent</code> <code>string</code> </td> <td> UserAgent records the user agent string reported by the client. Note that the UserAgent is provided by the client, and must not be trusted. </td> </tr> <tr><td><code>objectRef</code> <a href="#audit-k8s-io-v1-ObjectReference"><code>ObjectReference</code></a> </td> <td> Object reference this request is targeted at. Does not apply for List-type requests, or non-resource requests. </td> </tr> <tr><td><code>responseStatus</code> <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#status-v1-meta"><code>meta/v1.Status</code></a> </td> <td> The response status, populated even when the ResponseObject is not a Status type. For successful responses, this will only include the Code and StatusSuccess. For non-status type error responses, this will be auto-populated with the error Message. </td> </tr> <tr><td><code>requestObject</code> <a href="https://pkg.go.dev/k …(trimmed)