Advanced Auditing 1.11 umbrella bug

[crassirostris]

This is a continuation of the work on the Advanced Auditing feature

It's planned to release Audit Logging API to stable in 1.11. Here's the list of tasks:

API-related changes

• Graduate API to stable
• Integration with admission
  • Add RBAC information to audit logs by @CaoShuFeng
  • Add PodSecurityPolicy admission information to audit logs
    • @CaoShuFeng is working on this in Add PodSecurityPolicy information to audit logs #58143
  • Annotate audit logs in remote admission webhooks
    • @CaoShuFeng is working on this in support annotations for admission webhook #58679

Bugfixes and improvements

• Limit the batch physical size in batching audit backend
• Don't duplicate ResponseStatus
• Let a user choose an output API version
  • @crassirostris is taking over this work from @soltysh in Make audit output version configurable. #60056
• Completely remove legacy audit logging
• [Optional] Invalid api group for delete operations
• [Optional] Always retry audit webhook

Policy changes

• [Optional] GCE audit policy should be made re-usable by other setups
• [Optional] Audit policy should be tested (e.g. that it includes all core resources, more context)

To discuss

• [Optional] Auditing federation setups

[ericchiang]

/sig auth
/kind feature
/milestone v1.11
/priority important-longterm
/status approved-for-milestone

[ericchiang]

/priority important-longterm

[loburm]

/milestone v1.11
/priority important-soon

[k8s-ci-robot]

@loburm: You must be a member of the kubernetes-milestone-maintainers github team to set the milestone.

In response to this:

/milestone v1.11
/priority important-soon

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[loburm]

@timstclair @sttts
Considering that Mik doesn't work on it anymore, should we open a new issue for tracking work that is left?

[loburm]

@timstclair @sttts @soltysh
I would like to discuss possible blockers of graduating API to stable. Below inserting the list of tasks from Mik, but with recent updates:

API-related changes

• Graduate API to stable
• Integration with admission
  • Add RBAC information to audit logs by @CaoShuFeng
  • Add PodSecurityPolicy admission information to audit logs
    • @CaoShuFeng is working on this in Add PodSecurityPolicy information to audit logs #58143
  • Annotate audit logs in remote admission webhooks
    • @CaoShuFeng is working on this in support annotations for admission webhook #58679

Bugfixes and improvements

• Limit the batch physical size in batching audit backend
• Don't duplicate ResponseStatus
• Let a user choose an output API version
• Completely remove legacy audit logging
• [Optional] Invalid api group for delete operations
• [Optional] Always retry audit webhook

Policy changes

• [Optional] GCE audit policy should be made re-usable by other setups
• [Optional] Audit policy should be tested (e.g. that it includes all core resources, more context)

To discuss

• [Optional] Auditing federation setups

It looks that Audit Logging in a pretty good shape. From required work that has to be done I see only two PR that are not merged and still we need to perform final cleanups (removing legacy audit logging and graduating api).

Code freeze starts in 5th June, I think we should manage to finish this work. WDYT?

[tallclair]

@loburm I merged your updates into the original issue (I couldn't find a way to grant you edit access). I think we should remove the checklists from your comment to reduce confusion. I'm not sure about the GA graduation, but we should be able to get a lot of the other pieces in on time.

[soltysh]

Get as much as possible and we can consider graduating in the next release.

[k8s-github-robot]

[MILESTONENOTIFIER] Milestone Removed From Issue

@crassirostris @loburm @kubernetes/sig-api-machinery-misc @kubernetes/sig-auth-misc

Important: Code freeze is in effect and only issues with priority/critical-urgent may remain in the v1.11 milestone.

Help

• Additional instructions
• Commands for setting labels

[tallclair]

Closing as we're passed the 1.11 milestone. 1.12 tracking issue coming soon...