diff --git a/docs/ansible/vars.md b/docs/ansible/vars.md index f1e9b03c5..42f9a1306 100644 --- a/docs/ansible/vars.md +++ b/docs/ansible/vars.md @@ -308,6 +308,8 @@ node_taints: * `audit_policy_file`: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.yaml" By default, the `audit_policy_file` contains [default rules](https://github.com/kubernetes-sigs/kubespray/blob/master/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2) that can be overridden with the `audit_policy_custom_rules` variable. + + Set `audit_policy_global_omit_stages` to a list of audit stages to omit globally via the audit policy's top-level `omitStages` field. * *kubernetes_audit_webhook* - When set to `true`, enables the webhook audit backend. The webhook parameters can be tuned via the following variables (which default values are shown below): * `audit_webhook_config_file`: "{{ kube_config_dir }}/audit-policy/apiserver-audit-webhook-config.yaml" diff --git a/roles/kubernetes/control-plane/defaults/main/main.yml b/roles/kubernetes/control-plane/defaults/main/main.yml index ed49545ab..d2ea434d7 100644 --- a/roles/kubernetes/control-plane/defaults/main/main.yml +++ b/roles/kubernetes/control-plane/defaults/main/main.yml @@ -80,6 +80,11 @@ audit_policy_file: "{{ kube_config_dir }}/audit-policy/apiserver-audit-policy.ya # verbs: [] # resources: [] +# audit global omit stages +# Set this variable to a list of audit stages to omit globally in the audit policy. +# e.g. audit_policy_global_omit_stages: ["RequestReceived"] +audit_policy_global_omit_stages: [] + # audit log hostpath audit_log_name: audit-logs audit_log_hostpath: /var/log/kubernetes/audit diff --git a/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2 b/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2 index ca7bcf806..0f2470507 100644 --- a/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2 +++ b/roles/kubernetes/control-plane/templates/apiserver-audit-policy.yaml.j2 @@ -1,5 +1,6 @@ apiVersion: audit.k8s.io/v1 kind: Policy +omitStages: {{ audit_policy_global_omit_stages | to_yaml(default_flow_style=True) | trim }} rules: {% if audit_policy_custom_rules is defined and audit_policy_custom_rules != "" %} {{ audit_policy_custom_rules | indent(2, true) }}