ClusterTrustBundle

Operation	Description	Sample	Rule
get-clustertrustbundles		Y	N
list-clustertrustbundles		Y	N
watch-clustertrustbundles		Y	N
create-clustertrustbundles		Y	N
update-clustertrustbundles		Y	N
patch-clustertrustbundles		Y	N
delete-clustertrustbundles		Y	N
deletecollection-clustertrustbundles		Y	N
any-clustertrustbundles	Synthetic aggregation for rules that filter the clustertrustbundles resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles/dw-harn-clustertrustbundles",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:24.350273Z",
  "stageTimestamp": "2026-07-02T22:48:24.352154Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles?fieldSelector=metadata.name%3Ddw-harn-clustertrustbundles",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:27.780998Z",
  "stageTimestamp": "2026-07-02T22:48:27.782527Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles?resourceVersion=1262&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:24.497721Z",
  "stageTimestamp": "2026-07-02T22:48:27.502521Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "ClusterTrustBundle",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "name": "dw-harn-clustertrustbundles"
    },
    "spec": {
      "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
    }
  },
  "responseObject": {
    "kind": "ClusterTrustBundle",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "name": "dw-harn-clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1262",
      "creationTimestamp": "2026-07-02T22:48:24Z"
    },
    "spec": {
      "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:24.276320Z",
  "stageTimestamp": "2026-07-02T22:48:24.280116Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles/dw-harn-clustertrustbundles?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1",
    "resourceVersion": "1269"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "ClusterTrustBundle",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "name": "dw-harn-clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1269",
      "creationTimestamp": "2026-07-02T22:48:24Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
    }
  },
  "responseObject": {
    "kind": "ClusterTrustBundle",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "name": "dw-harn-clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1269",
      "creationTimestamp": "2026-07-02T22:48:24Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:27.714443Z",
  "stageTimestamp": "2026-07-02T22:48:27.716753Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles/dw-harn-clustertrustbundles?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "ClusterTrustBundle",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "name": "dw-harn-clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1269",
      "creationTimestamp": "2026-07-02T22:48:24Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:27.574513Z",
  "stageTimestamp": "2026-07-02T22:48:27.578667Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles/dw-harn-clustertrustbundles",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "name": "dw-harn-clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-clustertrustbundles",
      "group": "certificates.k8s.io",
      "kind": "clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-clustertrustbundles",
      "group": "certificates.k8s.io",
      "kind": "clustertrustbundles",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:27.783662Z",
  "stageTimestamp": "2026-07-02T22:48:27.787104Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection clustertrustbundles

Resource: clustertrustbundles

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/certificates.k8s.io/v1beta1/clustertrustbundles?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "clustertrustbundles",
    "apiGroup": "certificates.k8s.io",
    "apiVersion": "v1beta1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "ClusterTrustBundleList",
    "apiVersion": "certificates.k8s.io/v1beta1",
    "metadata": {
      "resourceVersion": "1266"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-clustertrustbundles",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1265",
          "creationTimestamp": "2026-07-02T23:15:14Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "trustBundle": "-----BEGIN CERTIFICATE-----\nMIIDCzCCAfOgAwIBAgIUKQpeTncwJKCFbz6k+F7/lwIbMH4wDQYJKoZIhvcNAQEL\nBQAwFTETMBEGA1UEAwwKZHctaGFybi1jYTAeFw0yNjA3MDIyMjMzNDlaFw0zNjA2\nMjkyMjMzNDlaMBUxEzARBgNVBAMMCmR3LWhhcm4tY2EwggEiMA0GCSqGSIb3DQEB\nAQUAA4IBDwAwggEKAoIBAQC2Luqndh0DCRL9LDdEJJwCKIH+BkjY7cWoXLRqT1kC\ng+FSX0pT4HVTVu6VOzSsFiS2iTKfcV+Nf26o0vHQF8+3P+iA6V9q9wdeoFCwYVhm\n4LZ1zs/LVQ+BBhxi6YzKfoYQyKdjOyueWwDNhV7RAez92kk8t9mkw7redCYg4sMZ\nHh5BXnhvEfhdO7+9iWWUNYVD8NfIrr5uxYHJr7XM4VtbgnuqA9g/8yHTQqZz1K9y\nn062oJ7+eHxeQxYhaxsT6E4+cauE0SZRWhdCIa/SKwGo7eiujyyRPGPii+Tjzwf9\nFDg/FYlbE2ebTYRdhIP741so+0t7IwFJrhGJQ38MXFk5AgMBAAGjUzBRMB0GA1Ud\nDgQWBBSFy2Q8v5+y4eAnB5q8CpFiFyLsBTAfBgNVHSMEGDAWgBSFy2Q8v5+y4eAn\nB5q8CpFiFyLsBTAPBgNVHRMBAf8EBTADAQH/MA0GCSqGSIb3DQEBCwUAA4IBAQCX\nvSlX0R+ghk/NA/eSq20uKobfiQr2RkwS9vYMoJauRlkymJlPHl90FCQfm/e1GJaB\nqL4qBbhLocY+pa1a1aTs4ghaSuuJE/5zPcbDGhS068vxpiMlcXxeTcfuDMpQr0vr\ns163h3ZrCr3FHmIz7CxXUCpsswpTRYYYkqDqikzMzXbjE2mcK4w/xPJ5upSUlrEJ\np5/BYkQMkE8dG+bLs11sN5WqDX1PgLFEXYKXzqRpbj51KktsCxidqEMtR0e355cm\nprlhUDDekrd2gO/DwP5VXd+JWhVpfklweDAIc1fv/t4fimTOtglVJSA/NcrDJMBp\neTx47PdEpQJviZFd5aBM\n-----END CERTIFICATE-----\n"
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:15:17.574433Z",
  "stageTimestamp": "2026-07-02T23:15:17.580093Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on clustertrustbundles (synthetic aggregation)

Resource: clustertrustbundles

Description

Synthetic aggregation for rules that filter the clustertrustbundles resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.