FlowSchema

Operation	Description	Sample	Rule
get-flowschemas		Y	N
list-flowschemas		Y	N
watch-flowschemas		Y	N
create-flowschemas		Y	N
update-flowschemas		Y	N
patch-flowschemas		Y	N
delete-flowschemas		Y	N
deletecollection-flowschemas		Y	N
get-flowschemas-status		Y	N
update-flowschemas-status		Y	N
patch-flowschemas-status		Y	N
any-flowschemas	Synthetic aggregation for rules that filter the flowschemas resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:45.117865Z",
  "stageTimestamp": "2026-07-02T04:48:45.119411Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas?limit=500&timeout=3s",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:45.247977Z",
  "stageTimestamp": "2026-07-02T04:48:45.250130Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas?resourceVersion=1753&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:45.253789Z",
  "stageTimestamp": "2026-07-02T04:48:48.254990Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas"
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {}
  },
  "responseObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1750",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:45Z"
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {}
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:45.048750Z",
  "stageTimestamp": "2026-07-02T04:48:45.051883Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "952"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "952",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T21:32:25Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "responseObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "952",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T21:32:25Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:28.556059Z",
  "stageTimestamp": "2026-07-02T21:32:28.558891Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1757",
      "generation": 1,
      "creationTimestamp": "2026-07-02T04:48:45Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T04:48:45Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:48.327524Z",
  "stageTimestamp": "2026-07-02T04:48:48.331490Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-flowschemas",
      "group": "flowcontrol.apiserver.k8s.io",
      "kind": "flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000"
    },
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "Status",
    "apiVersion": "v1",
    "metadata": {},
    "status": "Success",
    "details": {
      "name": "dw-harn-flowschemas",
      "group": "flowcontrol.apiserver.k8s.io",
      "kind": "flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:48.395951Z",
  "stageTimestamp": "2026-07-02T04:48:48.399464Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection flowschemas

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "FlowSchemaList",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "resourceVersion": "1169"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-flowschemas",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1169",
          "generation": 1,
          "creationTimestamp": "2026-07-02T23:14:39Z",
          "labels": {
            "dw-harn-patched": "1"
          }
        },
        "spec": {
          "priorityLevelConfiguration": {
            "name": "global-default"
          },
          "matchingPrecedence": 1000,
          "rules": [
            {
              "subjects": [
                {
                  "kind": "Group",
                  "group": {
                    "name": "dw-harn"
                  }
                }
              ],
              "nonResourceRules": [
                {
                  "verbs": [
                    "get"
                  ],
                  "nonResourceURLs": [
                    "/healthz"
                  ]
                }
              ]
            }
          ]
        },
        "status": {
          "conditions": [
            {
              "type": "Dangling",
              "status": "False",
              "lastTransitionTime": "2026-07-02T23:14:39Z",
              "reason": "Found",
              "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
            }
          ]
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:14:43.369577Z",
  "stageTimestamp": "2026-07-02T23:14:43.374565Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

get flowschemas/status

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:28.626211Z",
  "stageTimestamp": "2026-07-02T21:32:28.627820Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update flowschemas/status

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1",
    "resourceVersion": "952",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "952",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T21:32:25Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "responseObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "952",
      "generation": 1,
      "creationTimestamp": "2026-07-02T21:32:25Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T21:32:25Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:28.702073Z",
  "stageTimestamp": "2026-07-02T21:32:28.704688Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch flowschemas/status

Resource: flowschemas

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/apis/flowcontrol.apiserver.k8s.io/v1/flowschemas/dw-harn-flowschemas/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "flowschemas",
    "name": "dw-harn-flowschemas",
    "apiGroup": "flowcontrol.apiserver.k8s.io",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "FlowSchema",
    "apiVersion": "flowcontrol.apiserver.k8s.io/v1",
    "metadata": {
      "name": "dw-harn-flowschemas",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1005",
      "generation": 1,
      "creationTimestamp": "2026-07-02T22:19:08Z",
      "labels": {
        "dw-harn-patched": "1"
      }
    },
    "spec": {
      "priorityLevelConfiguration": {
        "name": "global-default"
      },
      "matchingPrecedence": 1000,
      "rules": [
        {
          "subjects": [
            {
              "kind": "Group",
              "group": {
                "name": "dw-harn"
              }
            }
          ],
          "nonResourceRules": [
            {
              "verbs": [
                "get"
              ],
              "nonResourceURLs": [
                "/healthz"
              ]
            }
          ]
        }
      ]
    },
    "status": {
      "conditions": [
        {
          "type": "Dangling",
          "status": "False",
          "lastTransitionTime": "2026-07-02T22:19:08Z",
          "reason": "Found",
          "message": "This FlowSchema references the PriorityLevelConfiguration object named \"global-default\" and it exists"
        }
      ]
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:19:12.424132Z",
  "stageTimestamp": "2026-07-02T22:19:12.426704Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on flowschemas (synthetic aggregation)

Resource: flowschemas

Description

Synthetic aggregation for rules that filter the flowschemas resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.