Evaluate ValidatingWebhook-Based Audit Approach (kube-audit-rest)

[Rolika4]

Summary

Evaluate ValidatingWebhook-based audit approach using kube-audit-rest to determine viability for KubeRocketCI audit trail requirements on EKS.

Repository

epam/edp-cluster-add-ons

Details

Deploy and test kube-audit-rest in a sandbox EKS cluster. This approach intercepts API mutations via ValidatingWebhookConfiguration without requiring control plane access. Focus on reliability and failure handling — ensure API operations are not blocked when audit service is unavailable. Evaluate if failurePolicy can be configured (Ignore vs Fail) or if a flag-based approach exists to control behavior.

References
kube-audit-rest
Acceptance Criteria
kube-audit-rest deployed in sandbox EKS cluster
ValidatingWebhookConfiguration configured for KubeRocketCI CRDs
Audit events captured for create, update, delete operations with user identity preserved
Failure handling verified: API operations continue when kube-audit-rest is unavailable
Configuration options documented for controlling behavior when audit service is down (failurePolicy or flag-based)
Performance impact on API server response times measured
Recommendation on viability for production use