Browse Source
make sure serviceaccounts/token is only in the metadata stage (#7679)
pull/7684/head
Kasakaze
3 years ago
committed by
GitHub
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
1 changed files with
2 additions and
2 deletions
-
roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2
|
|
|
@ -67,12 +67,12 @@ rules: |
|
|
|
resources: |
|
|
|
- group: "" # core |
|
|
|
resources: ["events"] |
|
|
|
# Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data, |
|
|
|
# Secrets, ConfigMaps, TokenRequest and TokenReviews can contain sensitive & binary data, |
|
|
|
# so only log at the Metadata level. |
|
|
|
- level: Metadata |
|
|
|
resources: |
|
|
|
- group: "" # core |
|
|
|
resources: ["secrets", "configmaps"] |
|
|
|
resources: ["secrets", "configmaps", "serviceaccounts/token"] |
|
|
|
- group: authentication.k8s.io |
|
|
|
resources: ["tokenreviews"] |
|
|
|
omitStages: |
|
|
|
|
