[Yandex Cloud documentation](../../index.md) > [Yandex Managed Service for Kubernetes](../index.md) > [Concepts](index.md) > Audit policy

# Audit policy in Managed Service for Kubernetes

An [audit policy](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy) establishes [rules](#rules-audit-policy) that determine which events to write to an [audit log](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/) and what data they should contain. Audit events are generated by requests to the Kubernetes API server at each [stage](#stages) of their execution. The audit policy rules apply one by one. The first rule matching the event sets the audit event [level](#levels).

## Stages {#stages}

Stage | Event generation point
--- | ---
`RequestReceived` | Once the audit event handler receives a request.
`ResponseStarted` | After sending the response headers but before sending the response body.
`ResponseComplete` | After sending the response body.
`Panic` | After critical errors occur.

## Levels {#levels}

Level | Description
--- | ---
`None` | Do not log any events.
`Metadata` | Log the event metadata, excluding the request or response body.
`Request` | Log the event metadata and request body without the response body.
`RequestResponse` | Log the event metadata, request body, and response body.

## Audit policy files in Managed Service for Kubernetes {#rules-audit-policy}

An audit policy file in Managed Service for Kubernetes has this format:

```yaml
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]
    resources:
      - group: "" # Core.
        resources: ["endpoints", "services", "services/status"]
  - level: None
    users: ["system:unsecured"]
    namespaces: ["kube-system"]
    verbs: ["get"]
    resources:
      - group: "" # Core.
        resources: ["configmaps"]
  - level: None
    users: ["kubelet"] # Legacy kubelet identity.
    verbs: ["get"]
    resources:
      - group: "" # Core.
        resources: ["nodes", "nodes/status"]
  - level: None
    userGroups: ["system:nodes"]
    verbs: ["get"]
    resources:
      - group: "" # Core.
        resources: ["nodes", "nodes/status"]
  - level: None
    users:
      - system:kube-controller-manager
      - system:kube-scheduler
      - system:serviceaccount:kube-system:endpoint-controller
    verbs: ["get", "update"]
    namespaces: ["kube-system"]
    resources:
      - group: "" # Core.
        resources: ["endpoints"]
  - level: None
    users: ["system:apiserver"]
    verbs: ["get"]
    resources:
      - group: "" # Core.
        resources: ["namespaces", "namespaces/status", "namespaces/finalize"]
  - level: None
    users: ["cluster-autoscaler"]
    verbs: ["get", "update"]
    namespaces: ["kube-system"]
    resources:
      - group: "" # Core.
        resources: ["configmaps", "endpoints"]
  - level: None
    users:
      - system:kube-controller-manager
    verbs: ["get", "list"]
    resources:
      - group: "metrics.k8s.io"
  - level: None
    nonResourceURLs:
      - /healthz*
      - /version
      - /swagger*
  - level: None
    resources:
      - group: "" # Core.
        resources: ["events"]
  - level: Request
    users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"]
    verbs: ["update","patch"]
    resources:
      - group: "" # Core.
        resources: ["nodes/status", "pods/status"]
    omitStages:
      - "RequestReceived"
  - level: Request
    userGroups: ["system:nodes"]
    verbs: ["update","patch"]
    resources:
      - group: "" # Core.
        resources: ["nodes/status", "pods/status"]
    omitStages:
      - "RequestReceived"
  - level: Request
    users: ["system:serviceaccount:kube-system:namespace-controller"]
    verbs: ["deletecollection"]
    omitStages:
      - "RequestReceived"
  - level: Metadata
    resources:
      - group: "" # Core.
        resources: ["secrets", "configmaps", "serviceaccounts/token"]
      - group: authentication.k8s.io
        resources: ["tokenreviews"]
    omitStages:
      - "RequestReceived"
  - level: Request
    verbs: ["get", "list", "watch"]
    resources:
      - group: "" # Core.
      - group: "admissionregistration.k8s.io"
      - group: "apiextensions.k8s.io"
      - group: "apiregistration.k8s.io"
      - group: "apps"
      - group: "authentication.k8s.io"
      - group: "authorization.k8s.io"
      - group: "autoscaling"
      - group: "batch"
      - group: "certificates.k8s.io"
      - group: "extensions"
      - group: "metrics.k8s.io"
      - group: "networking.k8s.io"
      - group: "policy"
      - group: "rbac.authorization.k8s.io"
      - group: "scheduling.k8s.io"
      - group: "settings.k8s.io"
      - group: "storage.k8s.io"
    omitStages:
      - "RequestReceived"
  - level: RequestResponse
    resources:
      - group: "" # Core.
      - group: "admissionregistration.k8s.io"
      - group: "apiextensions.k8s.io"
      - group: "apiregistration.k8s.io"
      - group: "apps"
      - group: "authentication.k8s.io"
      - group: "authorization.k8s.io"
      - group: "autoscaling"
      - group: "batch"
      - group: "certificates.k8s.io"
      - group: "extensions"
      - group: "metrics.k8s.io"
      - group: "networking.k8s.io"
      - group: "policy"
      - group: "rbac.authorization.k8s.io"
      - group: "scheduling.k8s.io"
      - group: "settings.k8s.io"
      - group: "storage.k8s.io"
    omitStages:
      - "RequestReceived"
  - level: Metadata
    omitStages:
      - "RequestReceived"
```

### Descriptions of audit policy rules {#rule-descriptions}

You can find examples of audit policy rules below.

#### Rule for the `None` level {#none}

```yaml
- level: None
  users: ["kubelet"] # Legacy kubelet identity.
  verbs: ["get"]
  resources:
    - group: "" # Core.
      resources: ["nodes", "nodes/status"]
```

It means that event details should not be logged if the following conditions are true:
* The `kubelet` component sends a request from a [Managed Service for Kubernetes cluster](index.md#kubernetes-cluster) [node](index.md#node-group).
* The request type is `get`.
* The request refers to the `nodes` or `nodes/status` resources.

#### Rule for the `Metadata` level {#metadata}

```yaml
- level: Metadata
  resources:
    - group: "" # Core.
      resources: ["secrets", "configmaps", "serviceaccounts/token"]
    - group: authentication.k8s.io
      resources: ["tokenreviews"]
  omitStages:
    - "RequestReceived"
```

It means that the event metadata should be logged if the following conditions are true:
* The event does not match any of the previous rules in the audit policy.
* The request refers to the `secrets`, `configmaps`, `serviceaccounts/token`, or `tokenreviews` resources.
* The event is not at the `RequestReceived` stage.

#### Rule for the `Request` level {#request}

```yaml
- level: Request
  userGroups: ["system:nodes"]
  verbs: ["update","patch"]
  resources:
    - group: "" # Core.
      resources: ["nodes/status", "pods/status"]
  omitStages:
    - "RequestReceived"
```

It means that the event metadata and request body should be logged if the following conditions are true:
* The event does not match any of the previous rules in the audit policy.
* A component from the `system:nodes` group sends a request.
* The request type is `update` or `patch`.
* The request refers to the `nodes/status` or `pods/status` resources.
* The event is not at the `RequestReceived` stage.

#### Rule for the `Request` level {#request2}

```yaml
- level: Request
  verbs: ["get", "list", "watch"]
  resources:
    - group: "" # Core.
    - group: "admissionregistration.k8s.io"
    - group: "apiextensions.k8s.io"
    - group: "apiregistration.k8s.io"
    - group: "apps"
    - group: "authentication.k8s.io"
    - group: "authorization.k8s.io"
    - group: "autoscaling"
    - group: "batch"
    - group: "certificates.k8s.io"
    - group: "extensions"
    - group: "metrics.k8s.io"
    - group: "networking.k8s.io"
    - group: "policy"
    - group: "rbac.authorization.k8s.io"
    - group: "scheduling.k8s.io"
    - group: "settings.k8s.io"
    - group: "storage.k8s.io"
  omitStages:
    - "RequestReceived"
```

It means that the event metadata and request body should be logged if the following conditions are true:
* The event does not match any of the previous rules in the audit policy.
* The request type is `get`, `list`, or `watch`.
* The request refers to a resource group from the list.
* The event is not at the `RequestReceived` stage.

#### Rule for the `RequestResponse` level {#requestresponse}

```yaml
- level: RequestResponse
  resources:
    - group: "" # Core.
    - group: "admissionregistration.k8s.io"
    - group: "apiextensions.k8s.io"
    - group: "apiregistration.k8s.io"
    - group: "apps"
    - group: "authentication.k8s.io"
    - group: "authorization.k8s.io"
    - group: "autoscaling"
    - group: "batch"
    - group: "certificates.k8s.io"
    - group: "extensions"
    - group: "metrics.k8s.io"
    - group: "networking.k8s.io"
    - group: "policy"
    - group: "rbac.authorization.k8s.io"
    - group: "scheduling.k8s.io"
    - group: "settings.k8s.io"
    - group: "storage.k8s.io"
  omitStages:
    - "RequestReceived"
```

It means that the event metadata, request body, and response body should be logged if the following conditions are true:
* The event does not match any of the previous rules in the audit policy.
* The request type is `create`, `update`, or `delete`. While not specified explicitly, it is clear from the fact that the rule does not apply to the previously specified request types: `get`, `list`, or `watch`.
* The request refers to a resource group from the list.
* The event is not at the `RequestReceived` stage.

Learn more about audit policies in [this Kubernetes guide](https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/#audit-policy).