Issue: Multiple namespaces are got deleted automatically and this is the 4th occurrence, customer wants to find the RCA who is deleting this namespace. below are the namespaces which is got deleted mainly  

"open-cluster-management-agent"
"open-cluster-management-agent-addon"
"openshift-local-storage"
"openshift-nmstate"
"openshift-sriov-network-operator"
"openshift-storage"

 As per customer the events happened at 16th May 04:42:20

Its happened multiple times and each time cu is reinstalling the cluster it seems


- We do have auditlog from 2024-05-13T11:13 to 2024-05-16T04:43:32, if customer finding is true ( ie, namespace is got auto deleted at 16th May 04:42:20 ) then the event should be present in the available audit logs.
- But the auditlog is only having delete/deletecollection[1] events with ".userAgent" kube-controller-manager that too only namespace open-cluster-management-agent,open-cluster-management-agent-addon.
- The other concerned namespaces openshift-local-storage,openshift-nmstate,openshift-sriov-network-operator,openshift-storage not having any delete verbs either from kube-controller-manager.

ACM 2.8.1
MCE 2.3.1
OCP 4.12

 N?A   

N/A

No audit logs for delete events. (Only delete logs by namespace-controller)

Audit log  must capture the user/SA name who deleted those projects