Skip to content

Commit

Permalink
fix dynamic audit yaml
Browse files Browse the repository at this point in the history
  • Loading branch information
pbarker committed Nov 19, 2018
1 parent 9c9fddb commit f129519
Showing 1 changed file with 9 additions and 13 deletions.
22 changes: 9 additions & 13 deletions content/en/docs/tasks/debug-application-cluster/audit.md
Original file line number Diff line number Diff line change
Expand Up @@ -211,9 +211,9 @@ audit policies.

{{< feature-state for_k8s_version="v1.13" state="alpha" >}}

In Kubeernetes version 1.13, you can configure dynamic audit webhook backends AuditSink API objects.
In Kubernetes version 1.13, you can configure dynamic audit webhook backends AuditSink API objects.

To enable dynamic auditingm you must set the following apiserver flags:
To enable dynamic auditing you must set the following apiserver flags:

- `--audit-dynamic-configuration`: the primary switch. When the feature is at GA, the only required flag.
- `--feature-gates=DynamicAuditing=true`: feature gate at alpha and beta.
Expand All @@ -224,25 +224,21 @@ When enabled, an AuditSink object can be provisioned:
apiVersion: auditregistration.k8s.io/v1alpha1
kind: AuditSink
metadata:
name: <name>
name: mysink
spec:
policy:
level: <level>
level: Metadata
stages:
- <stage>
- RequestResponse
webhook:
throttle:
qps: <10>
burst: <15>
qps: 10
burst: 15
clientConfig:
url: <backend url>
service:
name: <service name>
namespace: <service namespace>
caBundle: <ca bundle>
url: "https://audit.app"
```

For the complete API definition, see [the godoc](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apiserver/pkg/apis/audit/v1alpha1/types.go). Multiple objects will exist as independent solutions.
For the complete API definition, see [the godoc](https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/api/auditregistration/v1alpha1/types.go). Multiple objects will exist as independent solutions.

Existing static backends that you configure with runtime flags are not affected by this feature. However, the dynamic backends share the truncate options of the static webhook. If webhook truncate options are set with runtime flags, they are applied to all dynamic backends.

Expand Down

0 comments on commit f129519

Please sign in to comment.