Skip to content
Snippets Groups Projects
Unverified Commit d66da217 authored by Kasakaze's avatar Kasakaze Committed by GitHub
Browse files

make sure serviceaccounts/token is only in the metadata stage (#7679)

parent 1069b05e
No related branches found
No related tags found
No related merge requests found
Show whitespace changes
Inline Side-by-side
roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2
+ 2
− 2
View file @ d66da217
...@@ -67,12 +67,12 @@ rules: ...@@ -67,12 +67,12 @@ rules:
resources: resources:
- group: "" # core - group: "" # core
resources: ["events"] resources: ["events"]
# Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data, # Secrets, ConfigMaps, TokenRequest and TokenReviews can contain sensitive & binary data,
# so only log at the Metadata level. # so only log at the Metadata level.
- level: Metadata - level: Metadata
resources: resources:
- group: "" # core - group: "" # core
resources: ["secrets", "configmaps"] resources: ["secrets", "configmaps", "serviceaccounts/token"]
- group: authentication.k8s.io - group: authentication.k8s.io
resources: ["tokenreviews"] resources: ["tokenreviews"]
omitStages: omitStages:
......
0% or .
You are about to add 0 people to the discussion. Proceed with caution.
Please register or to comment