From 8046ea9808b09a15ce1ce856e5bae15dba68aa53 Mon Sep 17 00:00:00 2001 From: Anisimov Evgeniy Date: Tue, 11 Aug 2026 11:20:59 +0200 Subject: [PATCH 1/2] fix(audit): log user for filtered requests Signed-off-by: Anisimov Evgeniy --- internal/webserver/webserver.go | 9 +++++++-- 1 file changed, 7 insertions(+), 2 deletions(-) diff --git a/internal/webserver/webserver.go b/internal/webserver/webserver.go index f5921d97..a00a2868 100644 --- a/internal/webserver/webserver.go +++ b/internal/webserver/webserver.go @@ -439,7 +439,12 @@ func (n *kubeFilter) authorizationMiddleware(next http.Handler) http.Handler { }) } -func (n *kubeFilter) handleRequest(request *http.Request, selector labels.Selector) { +func (n *kubeFilter) handleRequest(request *http.Request, selector labels.Selector, username string) { + // Requests handled with a selector are forwarded using the proxy ServiceAccount, + // so the Kubernetes audit event cannot retain the original user through + // impersonation. Record that identity before replacing the bearer token. + n.log.V(4).Info("proxying filtered request", "username", username, "method", request.Method, "uri", request.URL.Path) + req.SanitizeImpersonationHeaders(request) selectorValue := selector.String() @@ -649,7 +654,7 @@ func (n *kubeFilter) registerModules(ctx context.Context, root *mux.Router) { // if there's no selector, let it pass to the n.impersonateHandler(writer, request) default: - n.handleRequest(request, selector) + n.handleRequest(request, selector, username) } }) } From 3b14c800a0d1e102f3776d09f81ac5143b491e19 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Oliver=20B=C3=A4hler?= <26610571+oliverbaehler@users.noreply.github.com> Date: Wed, 19 Aug 2026 12:17:42 +0200 Subject: [PATCH 2/2] Update internal/webserver/webserver.go --- internal/webserver/webserver.go | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/internal/webserver/webserver.go b/internal/webserver/webserver.go index a00a2868..332494a9 100644 --- a/internal/webserver/webserver.go +++ b/internal/webserver/webserver.go @@ -443,7 +443,7 @@ func (n *kubeFilter) handleRequest(request *http.Request, selector labels.Select // Requests handled with a selector are forwarded using the proxy ServiceAccount, // so the Kubernetes audit event cannot retain the original user through // impersonation. Record that identity before replacing the bearer token. - n.log.V(4).Info("proxying filtered request", "username", username, "method", request.Method, "uri", request.URL.Path) + n.log.V(5).Info("proxying filtered request", "username", username, "method", request.Method, "uri", request.URL.Path) req.SanitizeImpersonationHeaders(request)