Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Document well-known audit annotations #29479

Open
5 of 16 tasks
tallclair opened this issue Aug 19, 2021 · 29 comments · Fixed by #47268 · 4 remaining pull requests
Open
5 of 16 tasks

Document well-known audit annotations #29479

tallclair opened this issue Aug 19, 2021 · 29 comments · Fixed by #47268 · 4 remaining pull requests
Labels
help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/backlog Higher priority than priority/awaiting-more-evidence. sig/auth Categorizes an issue or PR as relevant to SIG Auth. triage/accepted Indicates an issue or PR is ready to be actively worked on.

Comments

@tallclair
Copy link
Member

tallclair commented Aug 19, 2021 •
edited
Loading

Similar to https://kubernetes.io/docs/reference/labels-annotations-taints/ (should probably be a separate page though).

The current (2023-02-08) list of well-known audit annotations is:

  • authorization.k8s.io/decision
  • authorization.k8s.io/reason
  • podsecuritypolicy.policy.k8s.io/admit-policy
  • podsecuritypolicy.policy.k8s.io/validate-policy
  • [PodSecurity] Extra audit annotations kubernetes#103923
  • authentication.k8s.io/stale-token
  • authentication.k8s.io/legacy-token
  • apiserver.latency.k8s.io/transform-response-object
  • apiserver.latency.k8s.io/etcd
  • apiserver.latency.k8s.io/serialize-response-object
  • apiserver.latency.k8s.io/response-write
  • apiserver.latency.k8s.io/mutating-webhook
  • apiserver.latency.k8s.io/validating-webhook
  • apiserver.latency.k8s.io/total
  • k8s.io/deprecated
  • k8s.io/removed-release
@tallclair tallclair added the kind/feature Categorizes issue or PR as related to a new feature. label Aug 19, 2021
@k8s-ci-robot k8s-ci-robot added the needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. label Aug 19, 2021
@tallclair tallclair mentioned this issue Aug 19, 2021
Closed
7 tasks
@tallclair
Copy link
Member Author

/help

@k8s-ci-robot
Copy link
Contributor

@tallclair:
This request has been marked as needing help from a contributor.

Please ensure the request meets the requirements listed here.

If this request no longer meets these requirements, the label can be removed
by commenting with the /remove-help command.

In response to this:

/help

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

@k8s-ci-robot k8s-ci-robot added the help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. label Aug 19, 2021
@sftim
Copy link
Contributor

sftim commented Aug 20, 2021

/sig auth
(I think)

@k8s-ci-robot k8s-ci-robot added the sig/auth Categorizes an issue or PR as relevant to SIG Auth. label Aug 20, 2021
@borkod
Copy link

borkod commented Aug 30, 2021

@sftim @tallclair Is the idea to create a new reference page or just add the annotations to the above page? I guess I am trying to understand the reasoning for creating a new page vs adding the annotations to the page references above. In either case, I would love to help with this and take a first attempt at it 😃

@tallclair
Copy link
Member Author

I think that page (https://kubernetes.io/docs/reference/labels-annotations-taints/) would be more useful if it were reorganized with headings for each of the resources the annotations apply to, and then we could just add a section for audit events.

topology.kubernetes.io/zone looks like the only one that's used on multiple resources, but it already has a separate description for each - so I think it would be preferable to split it into 2 separate sections (one under node, and one under PVs)

@borkod
Copy link

borkod commented Sep 1, 2021

I like that idea. I'll work on implementing something along those lines 😃

@borkod
Copy link

borkod commented Sep 1, 2021

/assign

@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle stale
  • Mark this issue or PR as rotten with /lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle stale

@k8s-ci-robot k8s-ci-robot added the lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. label Nov 30, 2021
@k8s-triage-robot
Copy link

The Kubernetes project currently lacks enough active contributors to adequately respond to all issues and PRs.

This bot triages issues and PRs according to the following rules:

  • After 90d of inactivity, lifecycle/stale is applied
  • After 30d of inactivity since lifecycle/stale was applied, lifecycle/rotten is applied
  • After 30d of inactivity since lifecycle/rotten was applied, the issue is closed

You can:

  • Mark this issue or PR as fresh with /remove-lifecycle rotten
  • Close this issue or PR with /close
  • Offer to help out with Issue Triage

Please send feedback to sig-contributor-experience at kubernetes/community.

/lifecycle rotten

@k8s-ci-robot k8s-ci-robot added lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. and removed lifecycle/stale Denotes an issue or PR has remained open with no activity and has become stale. labels Dec 30, 2021
@sftim
Copy link
Contributor

sftim commented Jan 2, 2022

/lifecycle frozen
/triage accepted

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. and removed lifecycle/rotten Denotes an issue or PR that has aged beyond stale and will be auto-closed. needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Jan 2, 2022
@enj
Copy link
Member

enj commented Jan 10, 2022

@borkod are you working on this? If not, please unassign yourself?

@sftim
Copy link
Contributor

sftim commented Jan 10, 2022

BTW, SIG Docs has a “no cookie licking” convention - anyone is welcome to work on any issue. If you're planning to start, it's still polite to get in touch with anyone who has expressed an intent to help or who has opened an existing PR.

@enj enj moved this to Backlog in SIG Auth Dec 5, 2022
@enj enj added this to SIG Auth Dec 5, 2022
@k8s-triage-robot
Copy link

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

  • Confirm that this issue is still relevant with /triage accepted (org members only)
  • Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

@sftim
Copy link
Contributor

sftim commented Feb 9, 2023

/triage accepted
Thanks @tallclair

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Feb 9, 2023
@k8s-triage-robot
Copy link

This issue has not been updated in over 1 year, and should be re-triaged.

You can:

  • Confirm that this issue is still relevant with /triage accepted (org members only)
  • Close this issue with /close

For more details on the triage process, see https://www.kubernetes.dev/docs/guide/issue-triage/

/remove-triage accepted

@k8s-ci-robot k8s-ci-robot added needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. and removed triage/accepted Indicates an issue or PR is ready to be actively worked on. labels Feb 9, 2024
@a-mccarthy
Copy link
Contributor

/triage accepted
/priority backlog

Looking at the page, the annotations listed in the issue description still need to be added to https://kubernetes.io/docs/reference/labels-annotations-taints/.

It might be helpful for someone looking to take on this work if there were some suggestions on how to get more information about these annotations for documenting.

@k8s-ci-robot k8s-ci-robot added triage/accepted Indicates an issue or PR is ready to be actively worked on. priority/backlog Higher priority than priority/awaiting-more-evidence. and removed needs-triage Indicates an issue or PR lacks a `triage/foo` label and requires one. labels Mar 26, 2024
@sftim
Copy link
Contributor

sftim commented Mar 26, 2024

If anyone knows how to learn more about the missing details (beyond “look in the source code”), please comment here.

@Ritikaa96 Ritikaa96 mentioned this issue Jul 25, 2024
Merged
@Ritikaa96
Copy link
Contributor

Hi @tallclair , PTAL at the PR #47268 . I've documented k8s.io/deprecated & k8s.io/removed-release

@github-project-automation github-project-automation bot moved this from Backlog to Closed / Done in SIG Auth Jul 26, 2024
@Ritikaa96
Copy link
Contributor

The Pr: #47268 only added 2 annotations , there are still 14 remaining. so reopening this.
/reopen

@k8s-ci-robot
Copy link
Contributor

@Ritikaa96: Reopened this issue.

In response to this:

The Pr: #47268 only added 2 annotations , there are still 14 remaining. so reopening this.
/reopen

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes-sigs/prow repository.

@k8s-ci-robot k8s-ci-robot reopened this Jul 29, 2024
@github-project-automation github-project-automation bot moved this from Closed / Done to Needs Triage in SIG Auth Jul 29, 2024
@Ritikaa96
Copy link
Contributor

FYI k8s.io/deprecated , k8s.io/removed-release are registered now, we can tick mark them in the task list.

@nilekhc
Copy link
Contributor

nilekhc commented Jul 29, 2024

/triage accepted

@nilekhc nilekhc moved this from Needs Triage to Backlog in SIG Auth Jul 29, 2024
@Ritikaa96 Ritikaa96 linked a pull request Aug 12, 2024 that will close this issue
Open
@Ritikaa96
Copy link
Contributor

Raised a PR for apiserver-latency-k8s.io/total here PTAL

@Ritikaa96
Copy link
Contributor

Hi , As per kubernetes/kubernetes#123919 , one more audit annotation is to be recorded: apiserver.latency.k8s.io/apf-queue-wait
can we put that on the list. I'll be happy to add them.

This was referenced Aug 12, 2024
Open
Open
@Ritikaa96
Copy link
Contributor

Added annotation :

PTAL

@Ritikaa96
Copy link
Contributor

Ritikaa96 commented Aug 12, 2024 •
edited
Loading

Hi seems like there is one more annotation logged in audit entry : see Reference apiserver.latency.k8s.io/decode-response-object
This annotation seems to be added in v1.30 only so its right time to record it : kubernetes/kubernetes#121512

@Ritikaa96 Ritikaa96 linked a pull request Aug 12, 2024 that will close this issue
Open
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
help wanted Denotes an issue that needs help from a contributor. Must meet "help wanted" guidelines. kind/feature Categorizes issue or PR as related to a new feature. lifecycle/frozen Indicates that an issue or PR should not be auto-closed due to staleness. priority/backlog Higher priority than priority/awaiting-more-evidence. sig/auth Categorizes an issue or PR as relevant to SIG Auth. triage/accepted Indicates an issue or PR is ready to be actively worked on.
Projects
SIG Auth
Status: Backlog
Milestone
No milestone
10 participants
@nilekhc @tengqm @enj @borkod @k8s-ci-robot @a-mccarthy @sftim @tallclair @Ritikaa96 @k8s-triage-robot