ReplicaSets
| Operation | Description | Sample | Rule |
|---|---|---|---|
| get-replicasets | Y | N | |
| list-replicasets | Y | N | |
| watch-replicasets | Y | N | |
| create-replicasets | Y | N | |
| update-replicasets | Y | N | |
| patch-replicasets | Y | N | |
| delete-replicasets | Y | N | |
| deletecollection-replicasets | Y | N | |
| get-replicasets-scale | Y | N | |
| update-replicasets-scale | Y | N | |
| patch-replicasets-scale | Y | N | |
| get-replicasets-status | Y | N | |
| update-replicasets-status | Y | N | |
| patch-replicasets-status | Y | N | |
| any-replicasets | Synthetic aggregation for rules that filter the replicasets resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone. | N | N |
get replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets",
"verb": "get",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T04:47:32.578660Z",
"stageTimestamp": "2026-07-02T04:47:32.582716Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
list replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets?limit=500&timeout=3s",
"verb": "list",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T04:47:32.792674Z",
"stageTimestamp": "2026-07-02T04:47:32.798730Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
watch replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets?resourceVersion=1542&timeout=3s&watch=true",
"verb": "watch",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T04:47:32.800109Z",
"stageTimestamp": "2026-07-02T04:47:35.801327Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
create replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets?fieldManager=kubectl-create&fieldValidation=Strict",
"verb": "create",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 201
},
"requestObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn"
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 0
}
},
"responseObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "1535",
"generation": 1,
"creationTimestamp": "2026-07-02T04:47:32Z"
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 0
}
},
"requestReceivedTimestamp": "2026-07-02T04:47:32.466633Z",
"stageTimestamp": "2026-07-02T04:47:32.471484Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
update replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets?fieldManager=kubectl-replace&fieldValidation=Strict",
"verb": "update",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"uid": "00000000-0000-0000-0000-000000000000",
"apiGroup": "apps",
"apiVersion": "v1",
"resourceVersion": "704"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "704",
"generation": 1,
"creationTimestamp": "2026-07-02T21:30:58Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"responseObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "704",
"generation": 1,
"creationTimestamp": "2026-07-02T21:30:58Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"requestReceivedTimestamp": "2026-07-02T21:31:02.023903Z",
"stageTimestamp": "2026-07-02T21:31:02.026927Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
patch replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets?fieldManager=kubectl-patch",
"verb": "patch",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {
"metadata": {
"labels": {
"dw-harn-patched": "1"
}
}
},
"responseObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "1556",
"generation": 1,
"creationTimestamp": "2026-07-02T04:47:32Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"requestReceivedTimestamp": "2026-07-02T04:47:35.871306Z",
"stageTimestamp": "2026-07-02T04:47:35.876619Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
delete replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets",
"verb": "delete",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"status": "Success",
"details": {
"name": "dw-harn-replicasets",
"group": "apps",
"kind": "replicasets",
"uid": "00000000-0000-0000-0000-000000000000"
},
"code": 200
},
"requestObject": {
"kind": "DeleteOptions",
"apiVersion": "meta.k8s.io/__internal",
"propagationPolicy": "Background"
},
"responseObject": {
"kind": "Status",
"apiVersion": "v1",
"metadata": {},
"status": "Success",
"details": {
"name": "dw-harn-replicasets",
"group": "apps",
"kind": "replicasets",
"uid": "00000000-0000-0000-0000-000000000000"
}
},
"requestReceivedTimestamp": "2026-07-02T04:47:35.941201Z",
"stageTimestamp": "2026-07-02T04:47:35.944632Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
deletecollection replicasets
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets?labelSelector=dw-harn-patched",
"verb": "deletecollection",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=3ffde68ef687218e01296d94b0aa59c81cc98de2bd73ab70e21510c8cd4b9cec"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"apiGroup": "apps",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"responseObject": {
"kind": "ReplicaSetList",
"apiVersion": "apps/v1",
"metadata": {
"resourceVersion": "832"
},
"items": [
{
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "831",
"generation": 2,
"creationTimestamp": "2026-07-02T23:13:00Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 2,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 2,
"fullyLabeledReplicas": 2,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 2
}
}
]
},
"requestReceivedTimestamp": "2026-07-02T23:13:04.556306Z",
"stageTimestamp": "2026-07-02T23:13:04.565976Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
get replicasets/scale
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/scale",
"verb": "get",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1",
"subresource": "scale"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T22:12:15.478839Z",
"stageTimestamp": "2026-07-02T22:12:15.480229Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
update replicasets/scale
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/scale",
"verb": "update",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=2f9bb39ae9e6831406f8ad02206bf46e69b5760f7adffe5feb860da290b80a7e"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"uid": "00000000-0000-0000-0000-000000000000",
"apiGroup": "apps",
"apiVersion": "v1",
"resourceVersion": "783",
"subresource": "scale"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {
"kind": "Scale",
"apiVersion": "autoscaling/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "783",
"creationTimestamp": "2026-07-03T00:14:31Z"
},
"spec": {
"replicas": 1
},
"status": {
"replicas": 1,
"selector": "app=dw-harn"
}
},
"responseObject": {
"kind": "Scale",
"apiVersion": "autoscaling/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "785",
"creationTimestamp": "2026-07-03T00:14:31Z"
},
"spec": {
"replicas": 1
},
"status": {
"replicas": 1,
"selector": "app=dw-harn"
}
},
"requestReceivedTimestamp": "2026-07-03T00:14:35.554747Z",
"stageTimestamp": "2026-07-03T00:14:35.560845Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
patch replicasets/scale
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/scale",
"verb": "patch",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=fd038e49e5a46840f8f58360c3f09257f92bccd0cadad3ad68fcfec20b99b52c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1",
"subresource": "scale"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {
"spec": {
"replicas": 2
}
},
"responseObject": {
"kind": "Scale",
"apiVersion": "autoscaling/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "745",
"creationTimestamp": "2026-07-02T22:12:11Z"
},
"spec": {
"replicas": 2
},
"status": {
"replicas": 1,
"selector": "app=dw-harn"
}
},
"requestReceivedTimestamp": "2026-07-02T22:12:15.716126Z",
"stageTimestamp": "2026-07-02T22:12:15.719608Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
get replicasets/status
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "Metadata",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/status",
"verb": "get",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1",
"subresource": "status"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestReceivedTimestamp": "2026-07-02T21:31:02.089380Z",
"stageTimestamp": "2026-07-02T21:31:02.090927Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
update replicasets/status
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/status?fieldManager=kubectl-replace&fieldValidation=Strict",
"verb": "update",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=4cf95d11cbd90036bab41cdc6b88cc8f91550e9135ed4bb61495b02f647812ff"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"uid": "00000000-0000-0000-0000-000000000000",
"apiGroup": "apps",
"apiVersion": "v1",
"resourceVersion": "704",
"subresource": "status"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "704",
"generation": 1,
"creationTimestamp": "2026-07-02T21:30:58Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"responseObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "704",
"generation": 1,
"creationTimestamp": "2026-07-02T21:30:58Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"requestReceivedTimestamp": "2026-07-02T21:31:02.184620Z",
"stageTimestamp": "2026-07-02T21:31:02.187687Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
patch replicasets/status
#Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/apps/v1/namespaces/dw-harn/replicasets/dw-harn-replicasets/status?fieldManager=kubectl-patch",
"verb": "patch",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=786fc563dbb253683c44d23d0aac3742ea61ade7f27a43f50934a82662e15409"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "replicasets",
"namespace": "dw-harn",
"name": "dw-harn-replicasets",
"apiGroup": "apps",
"apiVersion": "v1",
"subresource": "status"
},
"responseStatus": {
"metadata": {},
"code": 200
},
"requestObject": {},
"responseObject": {
"kind": "ReplicaSet",
"apiVersion": "apps/v1",
"metadata": {
"name": "dw-harn-replicasets",
"namespace": "dw-harn",
"uid": "00000000-0000-0000-0000-000000000000",
"resourceVersion": "734",
"generation": 1,
"creationTimestamp": "2026-07-02T22:17:40Z",
"labels": {
"dw-harn-patched": "1"
}
},
"spec": {
"replicas": 1,
"selector": {
"matchLabels": {
"app": "dw-harn"
}
},
"template": {
"metadata": {
"labels": {
"app": "dw-harn"
}
},
"spec": {
"containers": [
{
"name": "c",
"image": "docker.io/library/busybox:1.36",
"command": [
"sh",
"-c",
"sleep 3600"
],
"resources": {},
"terminationMessagePath": "/dev/termination-log",
"terminationMessagePolicy": "File",
"imagePullPolicy": "IfNotPresent"
}
],
"restartPolicy": "Always",
"terminationGracePeriodSeconds": 0,
"dnsPolicy": "ClusterFirst",
"securityContext": {},
"schedulerName": "default-scheduler"
}
}
},
"status": {
"replicas": 1,
"fullyLabeledReplicas": 1,
"readyReplicas": 1,
"availableReplicas": 1,
"terminatingReplicas": 0,
"observedGeneration": 1
}
},
"requestReceivedTimestamp": "2026-07-02T22:17:44.296250Z",
"stageTimestamp": "2026-07-02T22:17:44.299402Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}
References #
any verb on replicasets (synthetic aggregation)
#Description
Synthetic aggregation for rules that filter the replicasets resource with no specific verb. Not a distinct audit record; hosts rule listings that key on objectRef.resource alone.