Ingresses Kubernetes-ingresses
11 operations, identified by Operation in the audit log.
| Operation | Description |
|---|---|
| get-ingresses | |
| list-ingresses | |
| watch-ingresses | |
| create-ingresses | Ingress created (external exposure of cluster services; potential C2 or data exfiltration channel). |
| update-ingresses | |
| patch-ingresses | |
| delete-ingresses | |
| get-ingresses-status | |
| update-ingresses-status | |
| patch-ingresses-status | |
| any-ingresses | Synthetic aggregation for rules that filter the ingresses resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone. |
get-ingresses: get ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
list-ingresses: list ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
watch-ingresses: watch ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
create-ingresses: create ingresses
#Description
Ingress created (external exposure of cluster services; potential C2 or data exfiltration channel).
Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
update-ingresses: update ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
patch-ingresses: patch ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
delete-ingresses: delete ingresses
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
get-ingresses-status: get ingresses/status
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
update-ingresses-status: update ingresses/status
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
patch-ingresses-status: patch ingresses/status
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
any-ingresses: any verb on ingresses (synthetic aggregation)
#Description
Synthetic aggregation for rules that filter the ingresses resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.
Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |