apiVersion: audit.k8s.io/v1 # This is required.
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
  - "RequestReceived"
rules:
  # Log pod changes at RequestResponse level
  - level: RequestResponse
    resources:
    - group: ""
      # Resource "pods" doesn't match requests to any subresource of pods,
      # which is consistent with the RBAC policy.
      resources: ["secrets"]
    namespaces: ["payments"]

  - level: Metadata
    verbs:
    - create
    - update
    - patch
    - delete
    - deletecollection
    resources:
    - group: "rbac.authorization.k8s.io" # core API group
      resources: ["roles", "rolebindings","clusterroles","clusterrolebindings"]

  - level: Metadata