RichardoC / kube-audit-rest

Kubernetes audit logging, when you don't control the control plane

Geek Repo:Geek Repo

Github PK Tool:Github PK Tool

Timestamp missing from some requests so one should be injected

RichardoC opened this issue · comments

Kuebernetes doesn't provide an event timestamp in the AdmissionRequest and not all actions lead to a timestamp being added to the object that can be used instead (e.g. DELETEs don't have to add a deletionTimestamp.

Due to this, we should inject a requestReceivedTimestamp (same as used in audit event objects) into the object for this use, and it should follow RFC3339 to match the native time format of Kubernetes.

This would make the tool much more useful with tools such as falco