Merge pull request #33313 from my-git9/debug-cluster-audit
[en] modify debug-cluster/audit
This commit is contained in:
@@ -1396,7 +1396,7 @@ monitoring mechanisms help cluster admins to answer questions like:
|
||||
Sometimes it's useful to know which mutating webhook mutated the object in a API request, and what change did the
|
||||
webhook apply.
|
||||
|
||||
In v1.16+, kube-apiserver performs [auditing](/docs/tasks/debug-application-cluster/audit/) on each mutating webhook
|
||||
In v1.16+, kube-apiserver performs [auditing](/docs/tasks/debug/debug-cluster/audit/) on each mutating webhook
|
||||
invocation. Each invocation generates an auditing annotation
|
||||
capturing if a request object is mutated by the invocation, and optionally generates an annotation capturing the applied
|
||||
patch from the webhook admission response. The annotations are set in the audit event for given request on given stage of
|
||||
|
||||
@@ -570,7 +570,7 @@ Each feature gate is designed for enabling/disabling a specific feature:
|
||||
Docker Engine; no longer available. See
|
||||
[Device Plugins](/docs/concepts/extend-kubernetes/compute-storage-net/device-plugins/) for
|
||||
an alternative.
|
||||
- `AdvancedAuditing`: Enable [advanced auditing](/docs/tasks/debug-application-cluster/audit/#advanced-audit)
|
||||
- `AdvancedAuditing`: Enable [advanced auditing](/docs/tasks/debug/debug-cluster/audit/#advanced-audit)
|
||||
- `AffinityInAnnotations`: Enable setting
|
||||
[Pod affinity or anti-affinity](/docs/concepts/scheduling-eviction/assign-pod-node/#affinity-and-anti-affinity).
|
||||
- `AllowExtTrafficLocalEndpoints`: Enable a service to route external requests to node local endpoints.
|
||||
|
||||
@@ -21,5 +21,5 @@ or the continued existence of events with that reason.
|
||||
|
||||
Events should be treated as informative, best-effort, supplemental data.
|
||||
|
||||
In Kubernetes, [auditing](/docs/tasks/debug-application-cluster/audit/) generates a different kind of
|
||||
In Kubernetes, [auditing](/docs/tasks/debug/debug-cluster/audit/) generates a different kind of
|
||||
Event record (API group `audit.k8s.io`).
|
||||
|
||||
@@ -11,7 +11,7 @@ namespace. These annotations apply to `Event` object from API group
|
||||
|
||||
{{< note >}}
|
||||
The following annotations are not used within the Kubernetes API. When you
|
||||
[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster,
|
||||
[enable auditing](/docs/tasks/debug/debug-cluster/audit/) in your cluster,
|
||||
audit event data is written using `Event` from API group `audit.k8s.io`.
|
||||
The annotations apply to audit events. Audit events are different from objects in the
|
||||
[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group
|
||||
@@ -64,7 +64,7 @@ Example: `authorization.k8s.io/decision: "forbid"`
|
||||
|
||||
This annotation indicates whether or not a request was authorized in Kubernetes audit logs.
|
||||
|
||||
See [Auditing](/docs/tasks/debug-application-cluster/audit/) for more information.
|
||||
See [Auditing](/docs/tasks/debug/debug-cluster/audit/) for more information.
|
||||
|
||||
## authorization.k8s.io/reason
|
||||
|
||||
@@ -72,4 +72,4 @@ Example: `authorization.k8s.io/reason: "Human-readable reason for the decision"`
|
||||
|
||||
This annotation gives reason for the [decision](#authorization-k8s-io-decision) in Kubernetes audit logs.
|
||||
|
||||
See [Auditing](/docs/tasks/debug-application-cluster/audit/) for more information.
|
||||
See [Auditing](/docs/tasks/debug/debug-cluster/audit/) for more information.
|
||||
|
||||
@@ -286,7 +286,7 @@ behavior get removed.
|
||||
Starting in Kubernetes v1.19, making an API request to a deprecated REST API endpoint:
|
||||
|
||||
1. Returns a `Warning` header (as defined in [RFC7234, Section 5.5](https://tools.ietf.org/html/rfc7234#section-5.5)) in the API response.
|
||||
2. Adds a `"k8s.io/deprecated":"true"` annotation to the [audit event](/docs/tasks/debug-application-cluster/audit/) recorded for the request.
|
||||
2. Adds a `"k8s.io/deprecated":"true"` annotation to the [audit event](/docs/tasks/debug/debug-cluster/audit/) recorded for the request.
|
||||
3. Sets an `apiserver_requested_deprecated_apis` gauge metric to `1` in the `kube-apiserver`
|
||||
process. The metric has labels for `group`, `version`, `resource`, `subresource` that can be joined
|
||||
to the `apiserver_request_total` metric, and a `removed_release` label that indicates the
|
||||
|
||||
Reference in New Issue
Block a user