PersistentVolumes

Operation	Description	Sample	Rule
get-persistentvolumes		Y	N
list-persistentvolumes		Y	N
watch-persistentvolumes		Y	N
create-persistentvolumes		Y	N
update-persistentvolumes		Y	N
patch-persistentvolumes		Y	N
delete-persistentvolumes		Y	N
deletecollection-persistentvolumes		Y	N
get-persistentvolumes-status		Y	N
update-persistentvolumes-status		Y	N
patch-persistentvolumes-status		Y	N
any-persistentvolumes	Synthetic aggregation for rules that filter the persistentvolumes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.	N	N

get persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:31.432442Z",
  "stageTimestamp": "2026-07-02T04:48:31.434289Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

list persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes?labelSelector=dw-harn-patched%3D1",
  "verb": "list",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:27.608945Z",
  "stageTimestamp": "2026-07-02T22:13:27.610415Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

watch persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes?resourceVersion=974&timeout=3s&watch=true",
  "verb": "watch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T22:13:23.989009Z",
  "stageTimestamp": "2026-07-02T22:13:27.003573Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

create persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes?fieldManager=kubectl-create&fieldValidation=Strict",
  "verb": "create",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 201
  },
  "requestObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes"
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Pending"
    }
  },
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1717",
      "creationTimestamp": "2026-07-02T04:48:31Z",
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Pending",
      "lastPhaseTransitionTime": "2026-07-02T04:48:31Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:31.369023Z",
  "stageTimestamp": "2026-07-02T04:48:31.372777Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiVersion": "v1",
    "resourceVersion": "916"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "916",
      "creationTimestamp": "2026-07-02T21:32:10Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T21:32:10Z"
    }
  },
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "916",
      "creationTimestamp": "2026-07-02T21:32:10Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T21:32:10Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:13.620561Z",
  "stageTimestamp": "2026-07-02T21:32:13.623491Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "metadata": {
      "labels": {
        "dw-harn-patched": "1"
      }
    }
  },
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1723",
      "creationTimestamp": "2026-07-02T04:48:31Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T04:48:31Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.630785Z",
  "stageTimestamp": "2026-07-02T04:48:34.634451Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

delete persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes",
  "verb": "delete",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "DeleteOptions",
    "apiVersion": "meta.k8s.io/__internal",
    "propagationPolicy": "Background"
  },
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "1724",
      "creationTimestamp": "2026-07-02T04:48:31Z",
      "deletionTimestamp": "2026-07-02T04:48:34Z",
      "deletionGracePeriodSeconds": 0,
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T04:48:31Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T04:48:34.693865Z",
  "stageTimestamp": "2026-07-02T04:48:34.697574Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

deletecollection persistentvolumes

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes?labelSelector=dw-harn-patched",
  "verb": "deletecollection",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "apiVersion": "v1"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "responseObject": {
    "kind": "PersistentVolumeList",
    "apiVersion": "v1",
    "metadata": {
      "resourceVersion": "1127"
    },
    "items": [
      {
        "metadata": {
          "name": "dw-harn-persistentvolumes",
          "uid": "00000000-0000-0000-0000-000000000000",
          "resourceVersion": "1125",
          "creationTimestamp": "2026-07-02T23:14:24Z",
          "labels": {
            "dw-harn-patched": "1"
          },
          "finalizers": [
            "kubernetes.io/pv-protection"
          ]
        },
        "spec": {
          "capacity": {
            "storage": "1Mi"
          },
          "hostPath": {
            "path": "/mnt/dw-harn-none",
            "type": ""
          },
          "accessModes": [
            "ReadWriteOnce"
          ],
          "persistentVolumeReclaimPolicy": "Retain",
          "volumeMode": "Filesystem"
        },
        "status": {
          "phase": "Available",
          "lastPhaseTransitionTime": "2026-07-02T23:14:24Z"
        }
      }
    ]
  },
  "requestReceivedTimestamp": "2026-07-02T23:14:28.271224Z",
  "stageTimestamp": "2026-07-02T23:14:28.277226Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

get persistentvolumes/status

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "Metadata",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes/status",
  "verb": "get",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:13.689420Z",
  "stageTimestamp": "2026-07-02T21:32:13.691055Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

update persistentvolumes/status

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes/status?fieldManager=kubectl-replace&fieldValidation=Strict",
  "verb": "update",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "uid": "00000000-0000-0000-0000-000000000000",
    "apiVersion": "v1",
    "resourceVersion": "916",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "916",
      "creationTimestamp": "2026-07-02T21:32:10Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T21:32:10Z"
    }
  },
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "916",
      "creationTimestamp": "2026-07-02T21:32:10Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T21:32:10Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T21:32:13.817008Z",
  "stageTimestamp": "2026-07-02T21:32:13.819885Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

patch persistentvolumes/status

Resource: persistentvolumes

Example Audit Event #

{
  "kind": "Event",
  "apiVersion": "audit.k8s.io/v1",
  "level": "RequestResponse",
  "auditID": "00000000-0000-0000-0000-000000000000",
  "stage": "ResponseComplete",
  "requestURI": "/api/v1/persistentvolumes/dw-harn-persistentvolumes/status?fieldManager=kubectl-patch",
  "verb": "patch",
  "user": {
    "username": "kubernetes-admin",
    "groups": [
      "kubeadm:cluster-admins",
      "system:authenticated"
    ],
    "extra": {
      "authentication.kubernetes.io/credential-id": [
        "X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
      ]
    }
  },
  "sourceIPs": [
    "203.0.113.10"
  ],
  "userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
  "objectRef": {
    "resource": "persistentvolumes",
    "name": "dw-harn-persistentvolumes",
    "apiVersion": "v1",
    "subresource": "status"
  },
  "responseStatus": {
    "metadata": {},
    "code": 200
  },
  "requestObject": {},
  "responseObject": {
    "kind": "PersistentVolume",
    "apiVersion": "v1",
    "metadata": {
      "name": "dw-harn-persistentvolumes",
      "uid": "00000000-0000-0000-0000-000000000000",
      "resourceVersion": "970",
      "creationTimestamp": "2026-07-02T22:18:53Z",
      "labels": {
        "dw-harn-patched": "1"
      },
      "finalizers": [
        "kubernetes.io/pv-protection"
      ]
    },
    "spec": {
      "capacity": {
        "storage": "1Mi"
      },
      "hostPath": {
        "path": "/mnt/dw-harn-none",
        "type": ""
      },
      "accessModes": [
        "ReadWriteOnce"
      ],
      "persistentVolumeReclaimPolicy": "Retain",
      "volumeMode": "Filesystem"
    },
    "status": {
      "phase": "Available",
      "lastPhaseTransitionTime": "2026-07-02T22:18:53Z"
    }
  },
  "requestReceivedTimestamp": "2026-07-02T22:18:57.180600Z",
  "stageTimestamp": "2026-07-02T22:18:57.182943Z",
  "annotations": {
    "authorization.k8s.io/decision": "allow",
    "authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
  }
}

References #

Sample log: detection.wiki first-party kind capture

any verb on persistentvolumes (synthetic aggregation)

Resource: persistentvolumes

Description

Synthetic aggregation for rules that filter the persistentvolumes resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.