Glossary
Plain-language definitions of the Kubernetes audit logging and incident-response terms used in our guides.
- Audit level
- How much of a Kubernetes API request is recorded in its audit event: None, Metadata, Request or RequestResponse, set per request by the audit policy.
- Audit policy
- The kube-apiserver configuration that decides which API requests are recorded in the Kubernetes audit log and at which level of detail.
- Audit stage
- The point in handling an API request at which a Kubernetes audit event is emitted: RequestReceived, ResponseStarted, ResponseComplete or Panic.
- cluster-admin
- The built-in Kubernetes ClusterRole granting every verb on every resource. A new binding to it is one of the strongest signs of cluster compromise.
- hostPath volume
- A Kubernetes volume that mounts a node path into a Pod; mounts of /, /etc, the kubelet directory or a runtime socket expose the whole node.
- User impersonation (Kubernetes)
- Kubernetes feature letting a caller with the impersonate verb act as another user, group or service account through Impersonate-* headers.
- nodes/proxy
- The Kubernetes Node subresource that proxies requests through the API server to a node's kubelet API, which can run commands in containers.
- Pod Security Admission
- The built-in Kubernetes admission controller that enforces the Pod Security Standards (privileged, baseline, restricted) per namespace via labels.
- pods/exec
- The Kubernetes Pod subresource used by kubectl exec to run a command in a running container; its audit event carries the command in requestURI.
- Privileged container
- A container run with securityContext.privileged: true: all Linux capabilities and host device access, which makes escape to the node trivial.
- RBAC (Kubernetes)
- Kubernetes role-based access control: Roles and ClusterRoles define permissions; RoleBindings and ClusterRoleBindings grant them to subjects.
- Service account
- A Kubernetes identity for workloads and automation, authenticated with bearer tokens and shown in audit logs as system:serviceaccount:<namespace>:<name>.
- system:anonymous
- The username Kubernetes gives to unauthenticated API requests when anonymous authentication is enabled, in the group system:unauthenticated.
- TokenRequest
- The Kubernetes API (serviceaccounts/token subresource) that mints short-lived, audience-bound tokens for a service account, as used by kubectl create token.