From 8f8d9b215e60af9d0d48b6b43ad7da2c2c9fc758 Mon Sep 17 00:00:00 2001 From: Manish Kumar Date: Sat, 26 Mar 2022 05:55:58 +0530 Subject: [PATCH] Register and document some authz-related audit annotations (#32200) * Registered audit annotation * Update content/en/docs/reference/labels-annotations-taints/audit-annotations.md Co-authored-by: Qiming Teng * fix. Co-authored-by: Qiming Teng --- .../labels-annotations-taints/_index.md | 6 ++++-- .../audit-annotations.md | 18 +++++++++++++++++- 2 files changed, 21 insertions(+), 3 deletions(-) diff --git a/content/en/docs/reference/labels-annotations-taints/_index.md b/content/en/docs/reference/labels-annotations-taints/_index.md index b1eefe7df5..c47dd5b03f 100644 --- a/content/en/docs/reference/labels-annotations-taints/_index.md +++ b/content/en/docs/reference/labels-annotations-taints/_index.md @@ -495,8 +495,10 @@ based on setting `securityContext` within the Pod's `.spec`. ## Annotations used for audit -- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) -- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`authorization.k8s.io/decision`](/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-decision) +- [`authorization.k8s.io/reason`](/docs/reference/labels-annotations-taints/audit-annotations/#authorization-k8s-io-reason) - [`pod-security.kubernetes.io/audit-violations`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations) +- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) See more details on the [Audit Annotations](/docs/reference/labels-annotations-taints/audit-annotations/) page. diff --git a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md index 5dabbcbdb1..a0ef3a1531 100644 --- a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md +++ b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md @@ -56,4 +56,20 @@ that was transgressed as well as the specific policies on the fields that were violated from the PodSecurity enforcement. See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -for more information. \ No newline at end of file +for more information. + +## authorization.k8s.io/decision + +Example: `authorization.k8s.io/decision: "forbid"` + +This annotation indicates whether or not a request was authorized in Kubernetes audit logs. + +See [Auditing](/docs/tasks/debug-application-cluster/audit/) for more information. + +## authorization.k8s.io/reason + +Example: `authorization.k8s.io/decision: "Human-readable reason for the decision"` + +This annotation gives reason for the [decision](#authorization-k8s-io-decision) in Kubernetes audit logs. + +See [Auditing](/docs/tasks/debug-application-cluster/audit/) for more information.