kube-apiserver/audit: add API types
@@ -398,6 +398,91 @@ The profiles are translated into:
- level: RequestResponse
```
+### API Details
+
+The YAML of the new API should look like this:
+
+```yaml
+kind: APIServer
+apiVersion: config.openshift.io/v1
+spec:
+ ...
+ audit:
+ profile: None | Default | WriteRequestBodies | AllRequestBodies
+ customRules:
+ - group: system:authenticated:oauth
+ profile: None |Default | WriteRequestBodies | AllRequestBodies
+```
+
+In Golang this translates to:
+
+```go
+type Audit struct {
+ // profile specifies the name of the desired top-level audit profile to be applied to all requests
+ // sent to any of the OpenShift-provided API servers in the cluster (kube-apiserver,
+ // openshift-apiserver and oauth-apiserver), with the exception of those requests that match
+ // one or more of the customRules.
+ //
+ // The following profiles are provided:
+ // - Default: default policy which means MetaData level logging with the exception of events
+ // (not logged at all), oauthaccesstokens and oauthauthorizetokens (both logged at RequestBody
+ // level).
+ // - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ // write requests (create, update, patch).
+ // - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ // HTTP payloads for read requests (get, list).
+ // - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+ //
+ // Warning: to raise a Red Hat support request, it is required to set this to Default,
+ // WriteRequestBodies, or AllRequestBodies to generate audit log events that can be
+ // analyzed by support.
+ //
+ // If unset, the 'Default' profile is used as the default.
+ //
+ // +kubebuilder:default=Default
+ // +kubebuilder:Enum="",Default,WriteRequestBodies,AllRequestBodies,None
+ Profile AuditProfileType `json:"profile,omitempty"`
+
+ // customRules specify profiles per group. These profile take precedence over the
+ // top-level profile field if they apply. They are evaluation from top to bottom and
+ // the first one that matches, applies.
+ //
+ // +listType=map
+ // +listMapKey=group
+ // +optional
+ CustomRules AuditCustomRule `json:"customRules,omitempty"`
+}
+
+// AuditCustomRule describes a custom rule for an audit profile that takes precedence over
+// the top-level profile.
+type AuditCustomRule struct {
+ // group is a name of group a request user must be member of in order to this profile to apply.
+ //
+ // +kubebuilder:validation:Required
+ // +kubebuilder:validation:MinLength=1
+ // +required
+ Group string `json:"group"`
+
+ // profile specifies the name of the desired audit policy configuration to be deployed to
+ // all OpenShift-provided API servers in the cluster.
+ //
+ // The following profiles are provided:
+ // - Default: the existing default policy.
+ // - WriteRequestBodies: like 'Default', but logs request and response HTTP payloads for
+ // write requests (create, update, patch).
+ // - AllRequestBodies: like 'WriteRequestBodies', but also logs request and response
+ // HTTP payloads for read requests (get, list).
+ // - None: no requests are logged at all, not even oauthaccesstokens and oauthauthorizetokens.
+ //
+ // If unset, the 'Default' profile is used as the default.
+ //
+ // +kubebuilder:Enum=Default,WriteRequestBodies,AllRequestBodies,None
+ // +kubebuilder:validation:Required
+ // +required
+ Profile AuditProfileType `json:"profile,omitempty"`
+}
+```
+
### Library-go Implementation of CustomRules
The library-go interface for audit policies before addition of `customRules` in `github.com/openshift/library-go/pkg/operator/apiserver/audit` looked like this:
