Kubernetes Resource and Action References

This catalog groups authored Kubernetes rule references by resource type and action. It does not identify deployed resources or establish that a matching event was observed.

For an event-first view, see Kubernetes coverage.

Resource types and actions

admissionregistration

mutatingwebhookconfigurations

create
- GKE Admission Webhook Created or Modified
patch
- GKE Admission Webhook Created or Modified
update
- GKE Admission Webhook Created or Modified

validatingwebhookconfigurations

create
- GKE Admission Webhook Created or Modified
patch
- GKE Admission Webhook Created or Modified
update
- GKE Admission Webhook Created or Modified

admissionregistration.k8s.io

mutatingwebhookconfigurations (subresource unconstrained)

create
- Kubernetes Admission Controller Modification
delete
- Kubernetes Admission Controller Modification
patch
- Kubernetes Admission Controller Modification
replace
- Kubernetes Admission Controller Modification
update
- Kubernetes Admission Controller Modification

validatingwebhookconfigurations (subresource unconstrained)

create
- Kubernetes Admission Controller Modification
delete
- Kubernetes Admission Controller Modification
patch
- Kubernetes Admission Controller Modification
replace
- Kubernetes Admission Controller Modification
update
- Kubernetes Admission Controller Modification

API group unspecified

certificatesigningrequests (subresource unconstrained)

clusterrolebindings (subresource unconstrained)

clusterroles (subresource unconstrained)

create
- Kubernetes Service Account Modified RBAC Objects
delete
- Kubernetes Service Account Modified RBAC Objects
patch
- Kubernetes Service Account Modified RBAC Objects
update
- Kubernetes Service Account Modified RBAC Objects

configmaps (subresource unconstrained)

cronjobs (subresource unconstrained)

daemonsets (subresource unconstrained)

deployments (subresource unconstrained)

create
- Unusual Kubernetes Sensitive Workload Modification
delete
- Deployment Deleted From Kubernetes Cluster
patch
- Unusual Kubernetes Sensitive Workload Modification

events (subresource unconstrained)

delete
- Kubernetes Events Deleted

mutatingwebhookconfigurations (subresource unconstrained)

nodes/proxy

(any verb)
- Kubernetes API Server Proxying Request to Kubelet

pods (subresource unconstrained)

rolebindings (subresource unconstrained)

roles (subresource unconstrained)

create
- Kubernetes Service Account Modified RBAC Objects
delete
- Kubernetes Service Account Modified RBAC Objects
patch
- Kubernetes Service Account Modified RBAC Objects
update
- Kubernetes Service Account Modified RBAC Objects

secrets (subresource unconstrained)

selfsubjectaccessreviews (subresource unconstrained)

create
- Kubernetes Suspicious Self-Subject Review via Unusual User Agent

selfsubjectrulesreviews (subresource unconstrained)

create
- Kubernetes Suspicious Self-Subject Review via Unusual User Agent

serviceaccounts (subresource unconstrained)

create
- New Kubernetes Service Account Created

serviceaccounts/token

create
- Kubernetes Service Account Token Created via TokenRequest API

services (subresource unconstrained)

validatingwebhookconfiguration (subresource unconstrained)

create
- New Admission Controller Created
- New Admission Controller Created

validatingwebhookconfigurations (subresource unconstrained)

create
- Kubernetes Admission Webhook Created or Modified
delete
- Kubernetes Admission Webhook Created or Modified
patch
- Kubernetes Admission Webhook Created or Modified
update
- Kubernetes Admission Webhook Created or Modified

apps

daemonsets

create
- GKE Unusual Sensitive Workload Modification
patch
- GKE Unusual Sensitive Workload Modification

deployments

create
- GKE Unusual Sensitive Workload Modification
patch
- GKE Unusual Sensitive Workload Modification

deployments (subresource unconstrained)

patch
- Potential Sidecar Injection Into Running Deployment

authorization

selfsubjectaccessreviews

create
- GKE Suspicious Self-Subject Review via Service Account

selfsubjectrulesreviews

create
- GKE Suspicious Self-Subject Review via Service Account

authorization.k8s.io

selfsubjectrulesreviews (subresource unconstrained)

create
- RBAC Permission Enumeration Attempt

authorization.rbac

clusterrolebindings

clusterroles

rolebindings

roles

batch

cronjobs

create
- GKE Unusual Sensitive Workload Modification
patch
- GKE Unusual Sensitive Workload Modification

cronjobs (subresource unconstrained)

create
- Kubernetes CronJob/Job Modification
delete
- Kubernetes CronJob/Job Modification
patch
- Kubernetes CronJob/Job Modification
replace
- Kubernetes CronJob/Job Modification
update
- Kubernetes CronJob/Job Modification

jobs (subresource unconstrained)

create
- Kubernetes CronJob/Job Modification
delete
- Kubernetes CronJob/Job Modification
patch
- Kubernetes CronJob/Job Modification
replace
- Kubernetes CronJob/Job Modification
update
- Kubernetes CronJob/Job Modification

certificates

certificatesigningrequests

create
- GKE Certificate Signing Request API Client Signer Requested
- GKE Client Certificate Signing Request Created or Approved

certificatesigningrequests/approval

update
- GKE Client Certificate Signing Request Created or Approved

core

configmaps

delete
- GKE CoreDNS or Kube-DNS Configuration Modified
patch
- GKE CoreDNS or Kube-DNS Configuration Modified
update
- GKE CoreDNS or Kube-DNS Configuration Modified

nodes/proxy

create
- GKE API Server Proxying Request to Kubelet
get
- GKE API Server Proxying Request to Kubelet

pods

pods/ephemeralcontainers

patch
- GKE Ephemeral Container Added to Pod
update
- GKE Ephemeral Container Added to Pod

pods/exec

secrets

services

create
- GKE Exposed Service Created With Type NodePort
patch
- GKE Exposed Service Created With Type NodePort
update
- GKE Exposed Service Created With Type NodePort

rbac.authorization.k8s.io

clusterrolebindings (subresource unconstrained)

create
- Kubernetes Rolebinding Modification
delete
- Kubernetes Rolebinding Modification
patch
- Kubernetes Rolebinding Modification
replace
- Kubernetes Rolebinding Modification
update
- Kubernetes Rolebinding Modification

rolebindings (subresource unconstrained)

create
- Kubernetes Rolebinding Modification
delete
- Kubernetes Rolebinding Modification
patch
- Kubernetes Rolebinding Modification
replace
- Kubernetes Rolebinding Modification
update
- Kubernetes Rolebinding Modification

Other rule references

These rules have retained Kubernetes conditions that do not identify a resource and action reference here.

All resource references

Kubernetes Resource and Action References

Resource types and actions

mutatingwebhookconfigurations

validatingwebhookconfigurations

mutatingwebhookconfigurations (subresource unconstrained)

validatingwebhookconfigurations (subresource unconstrained)

certificatesigningrequests (subresource unconstrained)

clusterrolebindings (subresource unconstrained)

clusterroles (subresource unconstrained)

configmaps (subresource unconstrained)

cronjobs (subresource unconstrained)

daemonsets (subresource unconstrained)

deployments (subresource unconstrained)

events (subresource unconstrained)

mutatingwebhookconfigurations (subresource unconstrained)

nodes/proxy

pods (subresource unconstrained)

pods/attach

pods/ephemeralcontainers

pods/exec

rolebindings (subresource unconstrained)

roles (subresource unconstrained)

secrets (subresource unconstrained)

selfsubjectaccessreviews (subresource unconstrained)

selfsubjectrulesreviews (subresource unconstrained)

serviceaccounts (subresource unconstrained)

serviceaccounts/token

services (subresource unconstrained)

validatingwebhookconfiguration (subresource unconstrained)

validatingwebhookconfigurations (subresource unconstrained)

daemonsets

deployments

deployments (subresource unconstrained)

selfsubjectaccessreviews

selfsubjectrulesreviews

selfsubjectrulesreviews (subresource unconstrained)

clusterrolebindings

clusterroles

rolebindings

roles

cronjobs

cronjobs (subresource unconstrained)

jobs (subresource unconstrained)

certificatesigningrequests

certificatesigningrequests/approval

configmaps

nodes/proxy

pods

pods/ephemeralcontainers

pods/exec

secrets

services

clusterrolebindings (subresource unconstrained)

rolebindings (subresource unconstrained)