NetworkPolicies Kubernetes-networkpolicies
8 operations, identified by Operation in the audit log.
| Operation | Description |
|---|---|
| get-networkpolicies | |
| list-networkpolicies | |
| watch-networkpolicies | |
| create-networkpolicies | NetworkPolicy created (lateral movement enablement by loosening network segmentation). |
| update-networkpolicies | |
| patch-networkpolicies | |
| delete-networkpolicies | NetworkPolicy deleted (defense evasion: removal of network segmentation). |
| any-networkpolicies | Synthetic aggregation for rules that filter the networkpolicies resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone. |
get-networkpolicies: get networkpolicies
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
list-networkpolicies: list networkpolicies
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
watch-networkpolicies: watch networkpolicies
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
create-networkpolicies: create networkpolicies
#Description
NetworkPolicy created (lateral movement enablement by loosening network segmentation).
Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
update-networkpolicies: update networkpolicies
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
patch-networkpolicies: patch networkpolicies
#Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
delete-networkpolicies: delete networkpolicies
#Description
NetworkPolicy deleted (defense evasion: removal of network segmentation).
Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |
any-networkpolicies: any verb on networkpolicies (synthetic aggregation)
#Description
Synthetic aggregation for rules that filter the networkpolicies resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.
Fields #
| Name | Description |
|---|---|
verb | The request verb (get, list, watch, create, update, replace, patch, delete, deletecollection, ...). |
objectRef.resource | The targeted resource type (plural API name, e.g. pods, secrets). |
objectRef.subresource | The targeted subresource, when present (e.g. exec, log, token). |
objectRef.namespace | Namespace of the targeted object (empty for cluster-scoped resources). |
objectRef.name | Name of the targeted object. |
objectRef.apiGroup | API group of the targeted resource (empty string for core group). |
user.username | Authenticated identity that issued the request (user or service account). |
user.groups | Groups of the requesting identity. |
sourceIPs | Source IP addresses of the request. |
responseStatus.code | HTTP status code of the API response (200, 201, 403, 404, ...). |
stage | Audit stage: RequestReceived, ResponseStarted, ResponseComplete, Panic. |
requestReceivedTimestamp | Time the apiserver received the request. |