From cc64e7cc981aafc693204b6e6f124ba036a837d2 Mon Sep 17 00:00:00 2001 From: mtardy Date: Wed, 2 Mar 2022 20:14:14 +0100 Subject: [PATCH] Add a separate subpage for audit annotations and add reference to it on the main page --- .../_index.md} | 182 ++++++------------ .../audit-annotations.md | 59 ++++++ 2 files changed, 122 insertions(+), 119 deletions(-) rename content/en/docs/reference/{labels-annotations-taints.md => labels-annotations-taints/_index.md} (77%) create mode 100644 content/en/docs/reference/labels-annotations-taints/audit-annotations.md diff --git a/content/en/docs/reference/labels-annotations-taints.md b/content/en/docs/reference/labels-annotations-taints/_index.md similarity index 77% rename from content/en/docs/reference/labels-annotations-taints.md rename to content/en/docs/reference/labels-annotations-taints/_index.md index 18e599e12e..9d4b342ed6 100644 --- a/content/en/docs/reference/labels-annotations-taints.md +++ b/content/en/docs/reference/labels-annotations-taints/_index.md @@ -2,6 +2,7 @@ title: Well-Known Labels, Annotations and Taints content_type: concept weight: 20 +no_list: true --- @@ -10,11 +11,11 @@ Kubernetes reserves all labels and annotations in the kubernetes.io namespace. This document serves both as a reference to the values and as a coordination point for assigning values. - - -## kubernetes.io/arch +## Labels, annotations and taints used on API objects + +### kubernetes.io/arch Example: `kubernetes.io/arch=amd64` @@ -22,7 +23,7 @@ Used on: Node The Kubelet populates this with `runtime.GOARCH` as defined by Go. This can be handy if you are mixing arm and x86 nodes. -## kubernetes.io/os +### kubernetes.io/os Example: `kubernetes.io/os=linux` @@ -30,7 +31,7 @@ Used on: Node The Kubelet populates this with `runtime.GOOS` as defined by Go. This can be handy if you are mixing operating systems in your cluster (for example: mixing Linux and Windows nodes). -## kubernetes.io/metadata.name +### kubernetes.io/metadata.name Example: `kubernetes.io/metadata.name=mynamespace` @@ -43,15 +44,15 @@ to the name of the namespace. You can't change this label's value. This is useful if you want to target a specific namespace with a label {{< glossary_tooltip text="selector" term_id="selector" >}}. -## beta.kubernetes.io/arch (deprecated) +### beta.kubernetes.io/arch (deprecated) This label has been deprecated. Please use `kubernetes.io/arch` instead. -## beta.kubernetes.io/os (deprecated) +### beta.kubernetes.io/os (deprecated) This label has been deprecated. Please use `kubernetes.io/os` instead. -## kubernetes.io/hostname {#kubernetesiohostname} +### kubernetes.io/hostname {#kubernetesiohostname} Example: `kubernetes.io/hostname=ip-172-20-114-199.ec2.internal` @@ -62,7 +63,7 @@ The Kubelet populates this label with the hostname. Note that the hostname can b This label is also used as part of the topology hierarchy. See [topology.kubernetes.io/zone](#topologykubernetesiozone) for more information. -## kubernetes.io/change-cause {#change-cause} +### kubernetes.io/change-cause {#change-cause} Example: `kubernetes.io/change-cause=kubectl edit --record deployment foo` @@ -72,7 +73,7 @@ This annotation is a best guess at why something was changed. It is populated when adding `--record` to a `kubectl` command that may change an object. -## kubernetes.io/description {#description} +### kubernetes.io/description {#description} Example: `kubernetes.io/description: "Description of K8s object."` @@ -80,7 +81,7 @@ Used on: All Objects This annotation is used for describing specific behaviour of given object. -## kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets} +### kubernetes.io/enforce-mountable-secrets {#enforce-mountable-secrets} Example: `kubernetes.io/enforce-mountable-secrets: "true"` @@ -88,7 +89,7 @@ Used on: ServiceAccount The value for this annotation must be **true** to take effect. This annotation indicates that pods running as this service account may only reference Secret API objects specified in the service account's `secrets` field. -## controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} +### controller.kubernetes.io/pod-deletion-cost {#pod-deletion-cost} Example: `controller.kubernetes.io/pod-deletion-cost=10` @@ -97,11 +98,11 @@ Used on: Pod This annotation is used to set [Pod Deletion Cost](/docs/concepts/workloads/controllers/replicaset/#pod-deletion-cost) which allows users to influence ReplicaSet downscaling order. The annotation parses into an `int32` type. -## beta.kubernetes.io/instance-type (deprecated) +### beta.kubernetes.io/instance-type (deprecated) {{< note >}} Starting in v1.17, this label is deprecated in favor of [node.kubernetes.io/instance-type](#nodekubernetesioinstance-type). {{< /note >}} -## node.kubernetes.io/instance-type {#nodekubernetesioinstance-type} +### node.kubernetes.io/instance-type {#nodekubernetesioinstance-type} Example: `node.kubernetes.io/instance-type=m3.medium` @@ -112,19 +113,19 @@ This will be set only if you are using a `cloudprovider`. This setting is handy if you want to target certain workloads to certain instance types, but typically you want to rely on the Kubernetes scheduler to perform resource-based scheduling. You should aim to schedule based on properties rather than on instance types (for example: require a GPU, instead of requiring a `g2.2xlarge`). -## failure-domain.beta.kubernetes.io/region (deprecated) {#failure-domainbetakubernetesioregion} +### failure-domain.beta.kubernetes.io/region (deprecated) {#failure-domainbetakubernetesioregion} See [topology.kubernetes.io/region](#topologykubernetesioregion). {{< note >}} Starting in v1.17, this label is deprecated in favor of [topology.kubernetes.io/region](#topologykubernetesioregion). {{< /note >}} -## failure-domain.beta.kubernetes.io/zone (deprecated) {#failure-domainbetakubernetesiozone} +### failure-domain.beta.kubernetes.io/zone (deprecated) {#failure-domainbetakubernetesiozone} See [topology.kubernetes.io/zone](#topologykubernetesiozone). {{< note >}} Starting in v1.17, this label is deprecated in favor of [topology.kubernetes.io/zone](#topologykubernetesiozone). {{< /note >}} -## statefulset.kubernetes.io/pod-name {#statefulsetkubernetesiopod-name} +### statefulset.kubernetes.io/pod-name {#statefulsetkubernetesiopod-name} Example: @@ -136,7 +137,7 @@ sets this label on that Pod. The value of the label is the name of the Pod being See [Pod Name Label](/docs/concepts/workloads/controllers/statefulset/#pod-name-label) in the StatefulSet topic for more details. -## topology.kubernetes.io/region {#topologykubernetesioregion} +### topology.kubernetes.io/region {#topologykubernetesioregion} Example: @@ -144,7 +145,7 @@ Example: See [topology.kubernetes.io/zone](#topologykubernetesiozone). -## topology.kubernetes.io/zone {#topologykubernetesiozone} +### topology.kubernetes.io/zone {#topologykubernetesiozone} Example: @@ -175,7 +176,7 @@ The scheduler (through the _VolumeZonePredicate_ predicate) also will ensure tha If `PersistentVolumeLabel` does not support automatic labeling of your PersistentVolumes, you should consider adding the labels manually (or adding support for `PersistentVolumeLabel`). With `PersistentVolumeLabel`, the scheduler prevents Pods from mounting volumes in a different zone. If your infrastructure doesn't have this constraint, you don't need to add the zone labels to the volumes at all. -## volume.beta.kubernetes.io/storage-provisioner (deprecated) +### volume.beta.kubernetes.io/storage-provisioner (deprecated) Example: `volume.beta.kubernetes.io/storage-provisioner: k8s.io/minikube-hostpath` @@ -183,13 +184,13 @@ Used on: PersistentVolumeClaim This annotation has been deprecated. -## volume.kubernetes.io/storage-provisioner +### volume.kubernetes.io/storage-provisioner Used on: PersistentVolumeClaim This annotation will be added to dynamic provisioning required PVC. -## node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} +### node.kubernetes.io/windows-build {#nodekubernetesiowindows-build} Example: `node.kubernetes.io/windows-build=10.0.17763` @@ -199,7 +200,7 @@ When the kubelet is running on Microsoft Windows, it automatically labels its no The label's value is in the format "MajorVersion.MinorVersion.BuildNumber". -## service.kubernetes.io/headless {#servicekubernetesioheadless} +### service.kubernetes.io/headless {#servicekubernetesioheadless} Example: `service.kubernetes.io/headless=""` @@ -207,7 +208,7 @@ Used on: Service The control plane adds this label to an Endpoints object when the owning Service is headless. -## kubernetes.io/service-name {#kubernetesioservice-name} +### kubernetes.io/service-name {#kubernetesioservice-name} Example: `kubernetes.io/service-name="nginx"` @@ -215,7 +216,7 @@ Used on: Service Kubernetes uses this label to differentiate multiple Services. Used currently for `ELB`(Elastic Load Balancer) only. -## endpointslice.kubernetes.io/managed-by {#endpointslicekubernetesiomanaged-by} +### endpointslice.kubernetes.io/managed-by {#endpointslicekubernetesiomanaged-by} Example: `endpointslice.kubernetes.io/managed-by="controller"` @@ -223,7 +224,7 @@ Used on: EndpointSlices The label is used to indicate the controller or entity that manages an EndpointSlice. This label aims to enable different EndpointSlice objects to be managed by different controllers or entities within the same cluster. -## endpointslice.kubernetes.io/skip-mirror {#endpointslicekubernetesioskip-mirror} +### endpointslice.kubernetes.io/skip-mirror {#endpointslicekubernetesioskip-mirror} Example: `endpointslice.kubernetes.io/skip-mirror="true"` @@ -231,7 +232,7 @@ Used on: Endpoints The label can be set to `"true"` on an Endpoints resource to indicate that the EndpointSliceMirroring controller should not mirror this resource with EndpointSlices. -## service.kubernetes.io/service-proxy-name {#servicekubernetesioservice-proxy-name} +### service.kubernetes.io/service-proxy-name {#servicekubernetesioservice-proxy-name} Example: `service.kubernetes.io/service-proxy-name="foo-bar"` @@ -239,7 +240,7 @@ Used on: Service The kube-proxy has this label for custom proxy, which delegates service control to custom proxy. -## experimental.windows.kubernetes.io/isolation-type (deprecated) {#experimental-windows-kubernetes-io-isolation-type} +### experimental.windows.kubernetes.io/isolation-type (deprecated) {#experimental-windows-kubernetes-io-isolation-type} Example: `experimental.windows.kubernetes.io/isolation-type: "hyperv"` @@ -252,7 +253,7 @@ You can only set this annotation on Pods that have a single container. Starting from v1.20, this annotation is deprecated. Experimental Hyper-V support was removed in 1.21. {{< /note >}} -## ingressclass.kubernetes.io/is-default-class +### ingressclass.kubernetes.io/is-default-class Example: `ingressclass.kubernetes.io/is-default-class: "true"` @@ -260,13 +261,13 @@ Used on: IngressClass When a single IngressClass resource has this annotation set to `"true"`, new Ingress resource without a class specified will be assigned this default class. -## kubernetes.io/ingress.class (deprecated) +### kubernetes.io/ingress.class (deprecated) {{< note >}} Starting in v1.18, this annotation is deprecated in favor of `spec.ingressClassName`. {{< /note >}} -## storageclass.kubernetes.io/is-default-class +### storageclass.kubernetes.io/is-default-class Example: `storageclass.kubernetes.io/is-default-class=true` @@ -275,7 +276,7 @@ Used on: StorageClass When a single StorageClass resource has this annotation set to `"true"`, new PersistentVolumeClaim resource without a class specified will be assigned this default class. -## alpha.kubernetes.io/provided-node-ip +### alpha.kubernetes.io/provided-node-ip Example: `alpha.kubernetes.io/provided-node-ip: "10.0.0.1"` @@ -285,7 +286,7 @@ The kubelet can set this annotation on a Node to denote its configured IPv4 addr When kubelet is started with the "external" cloud provider, it sets this annotation on the Node to denote an IP address set from the command line flag (`--node-ip`). This IP is verified with the cloud provider as valid by the cloud-controller-manager. -## batch.kubernetes.io/job-completion-index +### batch.kubernetes.io/job-completion-index Example: `batch.kubernetes.io/job-completion-index: "3"` @@ -294,13 +295,13 @@ Used on: Pod The Job controller in the kube-controller-manager sets this annotation for Pods created with Indexed [completion mode](/docs/concepts/workloads/controllers/job/#completion-mode). -## kubectl.kubernetes.io/default-container +### kubectl.kubernetes.io/default-container Example: `kubectl.kubernetes.io/default-container: "front-end-app"` The value of the annotation is the container name that is default for this Pod. For example, `kubectl logs` or `kubectl exec` without `-c` or `--container` flag will use this default container. -## endpoints.kubernetes.io/over-capacity +### endpoints.kubernetes.io/over-capacity Example: `endpoints.kubernetes.io/over-capacity:truncated` @@ -308,7 +309,7 @@ Used on: Endpoints In Kubernetes clusters v1.22 (or later), the Endpoints controller adds this annotation to an Endpoints resource if it has more than 1000 endpoints. The annotation indicates that the Endpoints resource is over capacity and the number of endpoints has been truncated to 1000. -## batch.kubernetes.io/job-tracking +### batch.kubernetes.io/job-tracking Example: `batch.kubernetes.io/job-tracking: ""` @@ -318,7 +319,7 @@ The presence of this annotation on a Job indicates that the control plane is [tracking the Job status using finalizers](/docs/concepts/workloads/controllers/job/#job-tracking-with-finalizers). You should **not** manually add or remove this annotation. -## scheduler.alpha.kubernetes.io/preferAvoidPods (deprecated) {#scheduleralphakubernetesio-preferavoidpods} +### scheduler.alpha.kubernetes.io/preferAvoidPods (deprecated) {#scheduleralphakubernetesio-preferavoidpods} Used on: Nodes @@ -328,61 +329,61 @@ Use [Taints and Tolerations](/docs/concepts/scheduling-eviction/taint-and-tolera **The taints listed below are always used on Nodes** -## node.kubernetes.io/not-ready +### node.kubernetes.io/not-ready Example: `node.kubernetes.io/not-ready:NoExecute` The node controller detects whether a node is ready by monitoring its health and adds or removes this taint accordingly. -## node.kubernetes.io/unreachable +### node.kubernetes.io/unreachable Example: `node.kubernetes.io/unreachable:NoExecute` The node controller adds the taint to a node corresponding to the [NodeCondition](/docs/concepts/architecture/nodes/#condition) `Ready` being `Unknown`. -## node.kubernetes.io/unschedulable +### node.kubernetes.io/unschedulable Example: `node.kubernetes.io/unschedulable:NoSchedule` The taint will be added to a node when initializing the node to avoid race condition. -## node.kubernetes.io/memory-pressure +### node.kubernetes.io/memory-pressure Example: `node.kubernetes.io/memory-pressure:NoSchedule` The kubelet detects memory pressure based on `memory.available` and `allocatableMemory.available` observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. -## node.kubernetes.io/disk-pressure +### node.kubernetes.io/disk-pressure Example: `node.kubernetes.io/disk-pressure:NoSchedule` The kubelet detects disk pressure based on `imagefs.available`, `imagefs.inodesFree`, `nodefs.available` and `nodefs.inodesFree`(Linux only) observed on a Node. The observed values are then compared to the corresponding thresholds that can be set on the kubelet to determine if the Node condition and taint should be added/removed. -## node.kubernetes.io/network-unavailable +### node.kubernetes.io/network-unavailable Example: `node.kubernetes.io/network-unavailable:NoSchedule` This is initially set by the kubelet when the cloud provider used indicates a requirement for additional network configuration. Only when the route on the cloud is configured properly will the taint be removed by the cloud provider. -## node.kubernetes.io/pid-pressure +### node.kubernetes.io/pid-pressure Example: `node.kubernetes.io/pid-pressure:NoSchedule` The kubelet checks D-value of the size of `/proc/sys/kernel/pid_max` and the PIDs consumed by Kubernetes on a node to get the number of available PIDs that referred to as the `pid.available` metric. The metric is then compared to the corresponding threshold that can be set on the kubelet to determine if the node condition and taint should be added/removed. -## node.cloudprovider.kubernetes.io/uninitialized +### node.cloudprovider.kubernetes.io/uninitialized Example: `node.cloudprovider.kubernetes.io/uninitialized:NoSchedule` Sets this taint on a node to mark it as unusable, when kubelet is started with the "external" cloud provider, until a controller from the cloud-controller-manager initializes this node, and then removes the taint. -## node.cloudprovider.kubernetes.io/shutdown +### node.cloudprovider.kubernetes.io/shutdown Example: `node.cloudprovider.kubernetes.io/shutdown:NoSchedule` If a Node is in a cloud provider specified shutdown state, the Node gets tainted accordingly with `node.cloudprovider.kubernetes.io/shutdown` and the taint effect of `NoSchedule`. -## pod-security.kubernetes.io/enforce +### pod-security.kubernetes.io/enforce Example: `pod-security.kubernetes.io/enforce: baseline` @@ -396,7 +397,7 @@ the requirements outlined in the indicated level. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/enforce-version +### pod-security.kubernetes.io/enforce-version Example: `pod-security.kubernetes.io/enforce-version: {{< skew latestVersion >}}` @@ -409,7 +410,7 @@ policies to apply when validating a submitted Pod. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/audit +### pod-security.kubernetes.io/audit Example: `pod-security.kubernetes.io/audit: baseline` @@ -423,7 +424,7 @@ the requirements outlined in the indicated level, but adds an audit annotation t See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/audit-version +### pod-security.kubernetes.io/audit-version Example: `pod-security.kubernetes.io/audit-version: {{< skew latestVersion >}}` @@ -436,7 +437,7 @@ policies to apply when validating a submitted Pod. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/warn +### pod-security.kubernetes.io/warn Example: `pod-security.kubernetes.io/warn: baseline` @@ -452,7 +453,7 @@ such as Deployments, Jobs, StatefulSets, etc. See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/warn-version +### pod-security.kubernetes.io/warn-version Example: `pod-security.kubernetes.io/warn-version: {{< skew latestVersion >}}` @@ -466,72 +467,7 @@ or updating objects that contain Pod templates, such as Deployments, Jobs, State See [Enforcing Pod Security at the Namespace Level](/docs/concepts/security/pod-security-admission) for more information. -## pod-security.kubernetes.io/exempt - - -Example: `pod-security.kubernetes.io/exempt: namespace` - -Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to -[Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) -dimensions. This annotation indicates on which dimension was based the exemption -from the PodSecurity enforcement. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## pod-security.kubernetes.io/enforce-policy - -Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` - -Value **must** be `privileged:`, `baseline:`, -`restricted:` which correspond to [Pod Security -Standard](/docs/concepts/security/pod-security-standards) levels accompanied by -a version which **must** be `latest` or a valid Kubernetes version in the format -`v.`. This annotations informs about the enforcement level that -allowed or denied the pod during PodSecurity admission. - -See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -for more information. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## pod-security.kubernetes.io/audit-violations - -Example: `pod-security.kubernetes.io/audit-violations: would violate -PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container -"example" must set securityContext.allowPrivilegeEscalation=false), ...` - -Value details an audit policy violation, it contains the -[Pod Security Standard](/docs/concepts/security/pod-security-standards/) level -that was transgressed as well as the specific policies on the fields that were -violated from the PodSecurity enforcement. - -See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) -for more information. - -{{< note >}} -This annotation is not used within the Kubernetes API. When you -[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, -audit event data is written using `Event` from API group `audit.k8s.io`. -The annotation applies to audit events. Audit events are different from objects in the -[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group -`events.k8s.io`). -{{< /note >}} - -## seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} +### seccomp.security.alpha.kubernetes.io/pod (deprecated) {#seccomp-security-alpha-kubernetes-io-pod} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. To specify security settings for a Pod, include the `securityContext` field in the Pod specification. @@ -539,10 +475,18 @@ The [`securityContext`](/docs/reference/kubernetes-api/workload-resources/pod-v1 When you [specify the security context for a Pod](/docs/tasks/configure-pod-container/security-context/#set-the-security-context-for-a-pod), the settings you specify apply to all containers in that Pod. -## container.seccomp.security.alpha.kubernetes.io/[NAME] {#container-seccomp-security-alpha-kubernetes-io} +### container.seccomp.security.alpha.kubernetes.io/[NAME] {#container-seccomp-security-alpha-kubernetes-io} This annotation has been deprecated since Kubernetes v1.19 and will become non-functional in v1.25. The tutorial [Restrict a Container's Syscalls with seccomp](/docs/tutorials/clusters/seccomp/) takes you through the steps you follow to apply a seccomp profile to a Pod or to one of its containers. That tutorial covers the supported mechanism for configuring seccomp in Kubernetes, based on setting `securityContext` within the Pod's `.spec`. + +## Annotations used for audit + +- [`pod-security.kubernetes.io/exempt`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-exempt) +- [`pod-security.kubernetes.io/enforce-policy`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-enforce-policy) +- [`pod-security.kubernetes.io/audit-violations`](/docs/reference/labels-annotations-taints/audit-annotations/#pod-security-kubernetes-io-audit-violations) + +See more details on the [Audit Annotations](/docs/reference/labels-annotations-taints/audit-annotations/) page. \ No newline at end of file diff --git a/content/en/docs/reference/labels-annotations-taints/audit-annotations.md b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md new file mode 100644 index 0000000000..5dabbcbdb1 --- /dev/null +++ b/content/en/docs/reference/labels-annotations-taints/audit-annotations.md @@ -0,0 +1,59 @@ +--- +title: "Audit Annotations" +weight: 1 +--- + + + +This page serves as a reference for the audit annotations of the kubernetes.io +namespace. These annotations apply to `Event` object from API group +`audit.k8s.io`. + +{{< note >}} +The following annotations are not used within the Kubernetes API. When you +[enable auditing](/docs/tasks/debug-application-cluster/audit/) in your cluster, +audit event data is written using `Event` from API group `audit.k8s.io`. +The annotations apply to audit events. Audit events are different from objects in the +[Event API](/docs/reference/kubernetes-api/cluster-resources/event-v1/) (API group +`events.k8s.io`). +{{< /note >}} + + + +## pod-security.kubernetes.io/exempt + +Example: `pod-security.kubernetes.io/exempt: namespace` + +Value **must** be one of `user`, `namespace`, or `runtimeClass` which correspond to +[Pod Security Exemption](/docs/concepts/security/pod-security-admission/#exemptions) +dimensions. This annotation indicates on which dimension was based the exemption +from the PodSecurity enforcement. + + +## pod-security.kubernetes.io/enforce-policy + +Example: `pod-security.kubernetes.io/enforce-policy: restricted:latest` + +Value **must** be `privileged:`, `baseline:`, +`restricted:` which correspond to [Pod Security +Standard](/docs/concepts/security/pod-security-standards) levels accompanied by +a version which **must** be `latest` or a valid Kubernetes version in the format +`v.`. This annotations informs about the enforcement level that +allowed or denied the pod during PodSecurity admission. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. + +## pod-security.kubernetes.io/audit-violations + +Example: `pod-security.kubernetes.io/audit-violations: would violate +PodSecurity "restricted:latest": allowPrivilegeEscalation != false (container +"example" must set securityContext.allowPrivilegeEscalation=false), ...` + +Value details an audit policy violation, it contains the +[Pod Security Standard](/docs/concepts/security/pod-security-standards/) level +that was transgressed as well as the specific policies on the fields that were +violated from the PodSecurity enforcement. + +See [Pod Security Standards](/docs/concepts/security/pod-security-standards/) +for more information. \ No newline at end of file