DeviceTaintRule

Operation	Description	Sample	Rule
get-devicetaintrules		Y	N
list-devicetaintrules		Y	N
watch-devicetaintrules		Y	N
create-devicetaintrules		Y	N
update-devicetaintrules		Y	N
patch-devicetaintrules		Y	N
delete-devicetaintrules		Y	N
deletecollection-devicetaintrules		Y	N
get-devicetaintrules-status		Y	N
update-devicetaintrules-status		Y	N
patch-devicetaintrules-status		Y	N
any-devicetaintrules	Synthetic aggregation for rules that filter the devicetaintrules resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:16.734133Z",
  "stageTimestamp": "2026-07-02T22:48:16.736693Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules?fieldSelector=metadata.name%3Ddw-harn-devicetaintrules",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.432359Z",
  "stageTimestamp": "2026-07-02T22:48:20.434793Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules?resourceVersion=1241&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:16.876631Z",
  "stageTimestamp": "2026-07-02T22:48:19.877020Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1alpha3/devicetaintrules?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1alpha3"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1alpha3",
    "metadata": {
      "name": "dw-harn-devicetaintrules"
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1alpha3",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1240",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z"
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:16.663146Z",
  "stageTimestamp": "2026-07-02T22:48:16.666767Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\"",
    "k8s.io/deprecated": "true",
    "k8s.io/removed-release": "1.39"
  }
}

References #

Sample log: detection.wiki first-party kind capture

update devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2",
    "resourceVersion": "1247"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.114457Z",
  "stageTimestamp": "2026-07-02T22:48:20.117442Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:19.947594Z",
  "stageTimestamp": "2026-07-02T22:48:19.954625Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1249",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.436661Z",
  "stageTimestamp": "2026-07-02T22:48:20.440476Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection devicetaintrules

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1alpha3/devicetaintrules?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1alpha3"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "DeviceTaintRuleList",
    "apiVersion": "resource.k8s.io/v1alpha3",
    "metadata": {
      "resourceVersion": "1245"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-devicetaintrules",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1244",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:15:06Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "taint": {
            "key": "dw.example/harn",
            "effect": "NoSchedule",
            "timeAdded": "2026-07-02T23:15:06Z"
          }
        },
        "status": {}
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:15:10.178647Z",
  "stageTimestamp": "2026-07-02T23:15:10.184504Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\"",
    "k8s.io/deprecated": "true",
    "k8s.io/removed-release": "1.39"
  }
}

References #

Sample log: detection.wiki first-party kind capture

get devicetaintrules/status

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.192534Z",
  "stageTimestamp": "2026-07-02T22:48:20.194363Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update devicetaintrules/status

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2",
    "resourceVersion": "1247",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.283770Z",
  "stageTimestamp": "2026-07-02T22:48:20.286405Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch devicetaintrules/status

Resource: devicetaintrules

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/resource.k8s.io/v1beta2/devicetaintrules/dw-harn-devicetaintrules/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=97ca5ec05d5b7c1923d58d85f4449a4c26b2df61defa2a59b4045149ffed589e"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "devicetaintrules",
    "name": "dw-harn-devicetaintrules",
    "apiGroup": "resource.k8s.io",
    "apiVersion": "v1beta2",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "DeviceTaintRule",
    "apiVersion": "resource.k8s.io/v1beta2",
    "metadata": {
      "name": "dw-harn-devicetaintrules",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1247",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:48:16Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "taint": {
        "key": "dw.example/harn",
        "effect": "NoSchedule",
        "timeAdded": "2026-07-02T22:48:16Z"
      }
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T22:48:20.359370Z",
  "stageTimestamp": "2026-07-02T22:48:20.361991Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on devicetaintrules (synthetic aggregation)

Resource: devicetaintrules

Description

Synthetic aggregation for rules that filter the devicetaintrules resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.