LocalSubjectAccessReviews
| Operation | Description | Sample | Rule |
|---|---|---|---|
| create-localsubjectaccessreviews | LocalSubjectAccessReview created (namespace-scoped permission check; reconnaissance). | Y | N |
create localsubjectaccessreviews
#Description
LocalSubjectAccessReview created (namespace-scoped permission check; reconnaissance).
Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/authorization.k8s.io/v1/namespaces/dw-harn/localsubjectaccessreviews",
"verb": "create",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "localsubjectaccessreviews",
"namespace": "dw-harn",
"apiGroup": "authorization.k8s.io",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 201
},
"requestObject": {
"kind": "LocalSubjectAccessReview",
"apiVersion": "authorization.k8s.io/v1",
"metadata": {
"namespace": "dw-harn"
},
"spec": {
"resourceAttributes": {
"namespace": "dw-harn",
"verb": "get",
"resource": "secrets"
},
"user": "dw-harn-user"
},
"status": {
"allowed": false
}
},
"responseObject": {
"kind": "LocalSubjectAccessReview",
"apiVersion": "authorization.k8s.io/v1",
"metadata": {
"namespace": "dw-harn"
},
"spec": {
"resourceAttributes": {
"namespace": "dw-harn",
"verb": "get",
"resource": "secrets"
},
"user": "dw-harn-user"
},
"status": {
"allowed": false
}
},
"requestReceivedTimestamp": "2026-07-02T04:48:59.747903Z",
"stageTimestamp": "2026-07-02T04:48:59.749166Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}