# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-audit-approvers
reviewers:
  - sig-auth-audit-reviewers
labels:

See the License for the specific language governing permissions and
limitations under the License.
*/

// Package audit contains implementations for pkg/audit/AuditBackend interface

limitations under the License.
*/

// +k8s:deepcopy-gen=package
// +k8s:protobuf-gen=package
// +k8s:conversion-gen=k8s.io/apiserver/pkg/apis/audit
// +k8s:openapi-gen=true
// +k8s:defaulter-gen=TypeMeta

// +groupName=audit.k8s.io

				</Delete>
			</DefaultRolloverStrategy>
		</RollingFile>
		<RollingFile name="AuditFile" fileName="${log.file.basedir}/audit.log"
			filePattern="${log.file.basedir}/audit${backup.date.suffix}-%i.log.gz">
			<PatternLayout>
				<Pattern>${audit.log.pattern}</Pattern>
			</PatternLayout>
			<Policies>
				<TimeBasedTriggeringPolicy />
				<SizeBasedTriggeringPolicy size="100 MB" />
			</Policies>

			Optional:    true,
			Type:        "number",
		},
		config.HelpKV{
			Key:         QueueDir,
			Description: `staging dir for undelivered audit messages e.g. '/home/audit-events'`,
			Optional:    true,
			Type:        "string",
		},
		config.HelpKV{
			Key:         config.Comment,
			Description: config.DefaultComment,
			Optional:    true,

}

func TestAuditAnnotationsWithAuditLoggingSetup(t *testing.T) {
	// No audit context data in the request context
	ctx := context.Background()
	AddAuditAnnotation(ctx, "nil", "0")

	// initialize audit context, policy not evaluated yet
	ctx = WithAuditContext(ctx)
	AddAuditAnnotation(ctx, "before-evaluation", "1")

	// policy evaluated, audit logging enabled
	if ac := AuditContextFrom(ctx); ac != nil {

# See the OWNERS docs at https://go.k8s.io/owners

approvers:
  - sig-auth-audit-approvers
reviewers:
  - sig-auth-audit-reviewers
labels:

limitations under the License.
*/

// Package truncate provides an implementation for the audit.Backend interface
// that truncates audit events and sends them to the delegate audit.Backend.

	auditinternal "k8s.io/apiserver/pkg/apis/audit"
	"k8s.io/apiserver/pkg/audit"
	"k8s.io/apiserver/pkg/endpoints/handlers/responsewriters"
)

// WithFailedAuthenticationAudit decorates a failed http.Handler used in WithAuthentication handler.
// It is meant to log only failed authentication requests.
func WithFailedAuthenticationAudit(failedHandler http.Handler, sink audit.Sink, policy audit.PolicyRuleEvaluator) http.Handler {

	"k8s.io/apimachinery/pkg/util/runtime"
	"k8s.io/apimachinery/pkg/util/wait"
	auditinternal "k8s.io/apiserver/pkg/apis/audit"
	"k8s.io/apiserver/pkg/audit"
	"k8s.io/client-go/util/flowcontrol"
)

// PluginName is the name reported in error metrics.
const PluginName = "buffered"

// BatchConfig represents batching delegate audit backend configuration.
type BatchConfig struct {
	// BufferSize defines a size of the buffering queue.