Audit Annotations [page]deterministic

This page serves as a reference for the audit annotations of the kubernetes.io namespace. These annotations apply to `Event` object from API group `audit.k8s.io`.

> Note: The following annotations are not used within the Kubernetes API. When you [enable auditing](/docs/tasks/debug/debug-cluster/audit/) in your cluster, audit event data is written using `Event` from API group `audit.k8s.io`. The annotations apply to audit events. Audit events are different from objects in the [Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group `events.k8s.io`).

## k8s.io/deprecated

Example: `k8s.io/deprecated: "true"`

Value must be "true" or "false". The value "true" indicates that the request used a deprecated API version.

## k8s.io/removed-release

Example: `k8s.io/removed-release: "1.22"`

Value must be in the format "\<MAJOR>\.\<MINOR>\". It is set to target the removal release on requests made to deprecated API versions with a target removal release.

## pod-security.kubernetes.io/exempt

Example: `pod-security.kubernetes.io/exempt: namespace`

Value must be one of `user`, `namespace`, or `runtimeClass` which correspond to [Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) dimensions. This annotation indicates on which dimension was based the exemption from the PodSecurity enforcement.

## pod-security.kubernetes.io/enforce-policy

Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest`

Value must be `privileged:<version>`, `baseline:<version>`, `restricted:<version>` which correspond to [Pod Security Standard](/docs/concepts/security/pod-security-standards) levels accompanied by a version which must be `latest` or a valid Kubernetes version in the format `v<MAJOR>.<MINOR>`. This annotations informs about the enforcement level that allowed or denied the pod during PodSecurity admission.

See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information.

## pod-security.kubernetes.io/audit-violations

Example: `pod-security.kubernetes.io/audit-violations: would violate PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container "example" must set securityContext.allowPrivilegeEscalation=false), ...`

Value details an audit policy violation, it contains the [Pod Security Standard](/docs/concepts/security/pod-security-standards/) level that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement.

See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) for more information.

## audit.k8s.io/truncated

Example: `audit.k8s.io/truncated: "true"`

Value is always "true". This annotation indicates that the audit event has been truncated because the event size exceeded the configured maximum. Truncation is disabled by default and must be explicitly enabled via the API server flags.

See [Auditing](/docs/tasks/debug/debug-cluster/audit/) for more information.

## apiserver.latency.k8s.io/etcd

Example: `apiserver.latency.k8s.io/etcd: "4.730661757s"`

This annotation indicates the measure of latency incurred inside the storage layer, it accounts for the time it takes to send data to the etcd and get the complete response back.

The value of this audit annotation does not include the time incurred in admission, or validation.

## apiserver.latency.k8s.io/decode-response-object

Example: `apiserver.latency.k8s.io/decode-response-object: "450.6649ns"`

This annotation records the time taken to decode the response received from the storage layer (etcd)

## apiserver.latency.k8s.io/apf-queue-wait

Example: `apiserver.latency.k8s.io/apf-queue-wait: "100ns"`

This annotation records the time that a request spent queued due to API server priorities.

See [API Priority and Fairness](/docs/concepts/cluster-administration/flow-control/) (APF) for more information about this mechanism.

## authorization.k8s.io/dec …(trimmed)