Documentation
¶
Overview ¶
Package auditutil contains shared Kubernetes audit-event parsing helpers.
Index ¶
- func ObjectRefGVR(ref *auditv1.ObjectReference) (schema.GroupVersionResource, bool)
- func ObjectRefGroupVersion(ref *auditv1.ObjectReference) (string, string)
- func SplitAPIVersion(apiVersion string) (string, string)
- func VerbToOperation(verb string) (configv1alpha3.OperationType, bool)
- type AuditObjectIdentity
Constants ¶
This section is empty.
Variables ¶
This section is empty.
Functions ¶
func ObjectRefGVR ¶
func ObjectRefGVR(ref *auditv1.ObjectReference) (schema.GroupVersionResource, bool)
ObjectRefGVR returns the GVR described by ref when resource and version are usable.
func ObjectRefGroupVersion ¶
func ObjectRefGroupVersion(ref *auditv1.ObjectReference) (string, string)
ObjectRefGroupVersion returns the API group and version described by ref.
func SplitAPIVersion ¶
SplitAPIVersion splits Kubernetes apiVersion into group and version.
func VerbToOperation ¶
func VerbToOperation(verb string) (configv1alpha3.OperationType, bool)
VerbToOperation maps mutating Kubernetes audit verbs to watch operations.
Types ¶
type AuditObjectIdentity ¶
AuditObjectIdentity is the (namespace, name, uid) of the object referenced by an audit event, after backfilling missing fields from the request or response body. Any field may be empty when the audit event does not carry it.
func IdentityFromAuditEvent ¶
func IdentityFromAuditEvent(event auditv1.Event, op configv1alpha3.OperationType) AuditObjectIdentity
IdentityFromAuditEvent resolves the object identity of an audit event.
It starts from event.ObjectRef — the URL-level reference Kubernetes attached to the event — and backfills missing namespace/name/uid fields from the audit body that carries the authoritative object for op:
- for non-delete operations the preferred body is ResponseObject, with RequestObject as fallback;
- for delete operations the preferred body is RequestObject, with ResponseObject as fallback.
This handles `metadata.generateName` creates, where the server allocates the final name and writes it into responseObject.metadata.name while the objectRef points at the collection URL with an empty name.
A malformed body is ignored: the helper never panics and never overwrites a value that was already present on objectRef.
Source Files