reopen PR #12580 (#13162)

docs/ansible/vars.md

@@ -308,6 +308,8 @@ node_taints:
   * `audit_policy_file`: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.yaml"
 
   By default, the `audit_policy_file` contains [default rules](https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2) that can be overridden with the `audit_policy_custom_rules` variable.
+
+  Set `audit_policy_global_omit_stages` to a list of audit stages to omit globally via the audit policy's top-level `omitStages` field.
 * *kubernetes_audit_webhook* - When set to `true`, enables the webhook audit backend.
   The webhook parameters can be tuned via the following variables (which default values are shown below):
   * `audit_webhook_config_file`: "{{ kube_config_dir }}/audit-policy/apiserver-audit-webhook-config.yaml"

roles/kubernetes/control-plane/defaults/main/main.yml

@@ -80,6 +80,11 @@ audit_policy_file: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.ya
 #     verbs: []
 #     resources: []
 
+# audit global omit stages
+# Set this variable to a list of audit stages to omit globally in the audit policy.
+# e.g. audit_policy_global_omit_stages: ["RequestReceived"]
+audit_policy_global_omit_stages: []
+
 # audit log hostpath
 audit_log_name: audit-logs
 audit_log_hostpath: /var/log/kubernetes/audit

roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2

@@ -1,5 +1,6 @@
 apiVersion: audit.k8s.io/v1
 kind: Policy
+omitStages: {{ audit_policy_global_omit_stages | to_yaml(default_flow_style=True) | trim }}
 rules:
 {% if audit_policy_custom_rules is defined and audit_policy_custom_rules != "" %}
 {{ audit_policy_custom_rules | indent(2, true) }}