apiVersion: openshiftcontrolplane.config.openshift.io/v1
kind: OpenShiftAPIServerConfig
auditConfig:
  auditFilePath: "/var/log/openshift-apiserver/audit.log"
  enabled: true
  logFormat: "json"
  maximumFileSizeMegabytes: 100
  maximumRetainedFiles: 10
  policyConfiguration:
    apiVersion: audit.k8s.io/v1beta1
    kind: Policy
    # Don't generate audit events for all requests in RequestReceived stage.
    omitStages:
      - "RequestReceived"
    rules:
      # Don't log requests for events
      - level: None
        resources:
          - group: ""
            resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
          - "/api*" # Wildcard matching.
          - "/version"
          - "/healthz"
      # Log the full Identity API resource object so that the audit trail
      # allows us to match the username with the IDP identity.
      - level: RequestResponse
        verbs: ["create", "update", "patch"]
        resources:
          - group: "user.openshift.io"
            resources: ["identities"]
      # A catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
          - "RequestReceived"
storageConfig:
  urls:
    - https://etcd.openshift-etcd.svc:2379
apiServerArguments:
  shutdown-delay-duration:
  - 3s # give SDN some time to converge
servingInfo:
  bindNetwork: "tcp"
