apiVersion: v1
kind: ConfigMap
metadata:
  name: kube-apiserver-audit-policies
  namespace: openshift-kube-apiserver
data:
  default.yaml: |
    apiVersion: audit.k8s.io/v1beta1
    kind: Policy
    metadata:
      name: Default
    # Don't generate audit events for all requests in RequestReceived stage.
    omitStages:
    - "RequestReceived"
    rules:
    # Don't log requests for events
    - level: None
      resources:
      - group: ""
        resources: ["events"]
    # Don't log oauth tokens as metadata.name is the secret
    - level: None
      resources:
      - group: "oauth.openshift.io"
        resources: ["oauthaccesstokens", "oauthauthorizetokens"]
    # Don't log authenticated requests to certain non-resource URL paths.
    - level: None
      userGroups: ["system:authenticated", "system:unauthenticated"]
      nonResourceURLs:
      - "/api*" # Wildcard matching.
      - "/version"
      - "/healthz"
      - "/readyz"
    # A catch-all rule to log all other requests at the Metadata level.
    - level: Metadata
      # Long-running requests like watches that fall under this rule will not
      # generate an audit event in RequestReceived.
      omitStages:
      - "RequestReceived"

  writerequestbodies.yaml: |
    apiVersion: audit.k8s.io/v1beta1
    kind: Policy
    metadata:
      name: WriteRequestBodies
    # Don't generate audit events for all requests in RequestReceived stage.
    omitStages:
    - "RequestReceived"
    rules:
    # Don't log requests for events
    - level: None
      resources:
      - group: ""
        resources: ["events"]
    # Don't log oauth tokens as metadata.name is the secret
    - level: None
      resources:
      - group: "oauth.openshift.io"
        resources: ["oauthaccesstokens", "oauthauthorizetokens"]
    # Don't log authenticated requests to certain non-resource URL paths.
    - level: None
      userGroups: ["system:authenticated", "system:unauthenticated"]
      nonResourceURLs:
      - "/api*" # Wildcard matching.
      - "/version"
      - "/healthz"
      - "/readyz"
    # exclude resources where the body is security-sensitive
    - level: Metadata
      resources:
      - group: "route.openshift.io"
        resources: ["routes"]
      - resources: ["secrets"]
    - level: Metadata
      resources:
      - group: "oauth.openshift.io"
        resources: ["oauthclients"]
    # log request and response payloads for all write requests
    - level: RequestResponse
      verbs:
      - update
      - patch
      - create
      - delete
      - deletecollection
    # catch-all rule to log all other requests at the Metadata level.
    - level: Metadata
      # Long-running requests like watches that fall under this rule will not
      # generate an audit event in RequestReceived.
      omitStages:
      - RequestReceived

  allrequestbodies.yaml: |
    apiVersion: audit.k8s.io/v1beta1
    kind: Policy
    metadata:
      name: AllRequestBodies
    # Don't generate audit events for all requests in RequestReceived stage.
    omitStages:
    - "RequestReceived"
    rules:
    # Don't log requests for events
    - level: None
      resources:
      - group: ""
        resources: ["events"]
    # Don't log oauth tokens as metadata.name is the secret
    - level: None
      resources:
      - group: "oauth.openshift.io"
        resources: ["oauthaccesstokens", "oauthauthorizetokens"]
    # Don't log authenticated requests to certain non-resource URL paths.
    - level: None
      userGroups: ["system:authenticated", "system:unauthenticated"]
      nonResourceURLs:
      - "/api*" # Wildcard matching.
      - "/version"
      - "/healthz"
      - "/readyz"
    # exclude resources where the body is security-sensitive
    - level: Metadata
      resources:
      - group: "route.openshift.io"
        resources: ["routes"]
      - resources: ["secrets"]
    - level: Metadata
      resources:
      - group: "oauth.openshift.io"
        resources: ["oauthclients"]
    # catch-all rule to log all other requests with request and response payloads
    - level: RequestResponse
