apiVersion: audit.k8s.io/v1
kind: Policy
metadata:
  creationTimestamp: null
  name: policy
omitManagedFields: true
omitStages:
- RequestReceived
rules:
- level: None
  resources:
  - resources:
    - events
- level: None
  nonResourceURLs:
  - /api*
  - /version
  - /healthz
  - /readyz
  userGroups:
  - system:authenticated
  - system:unauthenticated
- level: None
  namespaces:
  - ""
  resources:
  - group: apiserver.openshift.io
    resources:
    - apirequestcounts
    - apirequestcounts/*
  users:
  - system:apiserver
- level: Metadata
  resources:
  - group: route.openshift.io
    resources:
    - routes
    - routes/status
  - resources:
    - secrets
    - serviceaccounts/token
  - group: authentication.k8s.io
    resources:
    - tokenreviews
    - tokenrequests
  - group: oauth.openshift.io
    resources:
    - oauthclients
    - tokenreviews
- level: None
  users:
  - "system:serviceaccount:kube-system:*"
  - "system:serviceaccount:openshift-apiserver:*"
- level: RequestResponse

