diff --git a/pkg/apiserver/auditing/policy.go b/pkg/apiserver/auditing/policy.go index e88acf7c4cc..ed053ca205d 100644 --- a/pkg/apiserver/auditing/policy.go +++ b/pkg/apiserver/auditing/policy.go @@ -46,14 +46,23 @@ func (defaultGrafanaPolicyRuleEvaluator) EvaluatePolicyRule(attrs authorizer.Att } } + // Logging the response object allows us to get the resource name for create requests. + level := auditinternal.LevelMetadata + if attrs.GetVerb() == utils.VerbCreate { + level = auditinternal.LevelRequestResponse + } + return audit.RequestAuditConfig{ - Level: auditinternal.LevelMetadata, + Level: level, + + // Only log on StageResponseComplete, to avoid noisy logs. OmitStages: []auditinternal.Stage{ - // Only log on StageResponseComplete auditinternal.StageRequestReceived, auditinternal.StageResponseStarted, auditinternal.StagePanic, }, - OmitManagedFields: false, // Setting it to true causes extra copying/unmarshalling. + + // Setting it to true causes extra copying/unmarshalling. + OmitManagedFields: false, } } diff --git a/pkg/apiserver/auditing/policy_test.go b/pkg/apiserver/auditing/policy_test.go index af18f9110fd..ccabaa5e6e2 100644 --- a/pkg/apiserver/auditing/policy_test.go +++ b/pkg/apiserver/auditing/policy_test.go @@ -55,7 +55,7 @@ func TestDefaultGrafanaPolicyRuleEvaluator(t *testing.T) { require.Equal(t, auditinternal.LevelNone, config.Level) }) - t.Run("return audit level metadata for other resource requests", func(t *testing.T) { + t.Run("return audit level request+response for create requests", func(t *testing.T) { t.Parallel() attrs := authorizer.AttributesRecord{ @@ -67,6 +67,22 @@ func TestDefaultGrafanaPolicyRuleEvaluator(t *testing.T) { }, } + config := evaluator.EvaluatePolicyRule(attrs) + require.Equal(t, auditinternal.LevelRequestResponse, config.Level) + }) + + t.Run("return audit level metadata for other resource requests", func(t *testing.T) { + t.Parallel() + + attrs := authorizer.AttributesRecord{ + ResourceRequest: true, + Verb: utils.VerbGet, + User: &user.DefaultInfo{ + Name: "test-user", + Groups: []string{"test-group"}, + }, + } + config := evaluator.EvaluatePolicyRule(attrs) require.Equal(t, auditinternal.LevelMetadata, config.Level) })