TokenReviews
| Operation | Description | Sample | Rule |
|---|---|---|---|
| create-tokenreviews | TokenReview created (token validation; used by webhooks and admission controllers; potential lateral pivot if misused). | Y | N |
create tokenreviews
#Description
TokenReview created (token validation; used by webhooks and admission controllers; potential lateral pivot if misused).
Example Audit Event #
{
"kind": "Event",
"apiVersion": "audit.k8s.io/v1",
"level": "RequestResponse",
"auditID": "00000000-0000-0000-0000-000000000000",
"stage": "ResponseComplete",
"requestURI": "/apis/authentication.k8s.io/v1/tokenreviews",
"verb": "create",
"user": {
"username": "kubernetes-admin",
"groups": [
"kubeadm:cluster-admins",
"system:authenticated"
],
"extra": {
"authentication.kubernetes.io/credential-id": [
"X509SHA256=9bb0383c49b319fbf6b5ed61ab944378956d4292c784d32244ce2fa4dd846a3c"
]
}
},
"sourceIPs": [
"203.0.113.10"
],
"userAgent": "kubectl/v1.36.2 (linux/amd64) kubernetes/24e2b02",
"objectRef": {
"resource": "tokenreviews",
"apiGroup": "authentication.k8s.io",
"apiVersion": "v1"
},
"responseStatus": {
"metadata": {},
"code": 201
},
"requestObject": {
"kind": "TokenReview",
"apiVersion": "authentication.k8s.io/v1",
"metadata": {},
"spec": {
"token": "dw-harn-not-a-real-token"
},
"status": {
"user": {}
}
},
"responseObject": {
"kind": "TokenReview",
"apiVersion": "authentication.k8s.io/v1",
"metadata": {},
"spec": {
"token": "dw-harn-not-a-real-token"
},
"status": {
"user": {},
"error": "invalid bearer token"
}
},
"requestReceivedTimestamp": "2026-07-02T04:48:59.805581Z",
"stageTimestamp": "2026-07-02T04:48:59.806786Z",
"annotations": {
"authorization.k8s.io/decision": "allow",
"authorization.k8s.io/reason": "RBAC: allowed by ClusterRoleBinding \"kubeadm:cluster-admins\" of ClusterRole \"cluster-admin\" to Group \"kubeadm:cluster-admins\""
}
}