Glossary
Audit level
How much of a Kubernetes API request is recorded in its audit event: None, Metadata, Request or RequestResponse, set per request by the audit policy.
The audit level controls the detail of a Kubernetes audit event:
None: the request is not logged.Metadata: user, source IPs, user agent, verb, object and response code, no bodies.Request: metadata plus the request body.RequestResponse: metadata plus request and response bodies.
The level is written in each event's level field. Secrets, configmaps and token reviews should stay at Metadata, because their bodies contain credentials. Workload and RBAC writes need at least Request to detect privileged pods or cluster-admin bindings. See the anatomy of an audit event.