Kubernetes Admission Controller Events

Quick Links
This article is a how-to guide about exploring admission controller events in Tenable One Cloud Exposure.

For a how-to guide about configuring admission controller policies in Cloud Exposure, see Admission Controller Policies.

For a conceptual overview of the admission controller feature in Cloud Exposure, see Admission Controller Overview.

The Admission Controller Events page displays actions that were taken within your clusters that were evaluated by admission controller policies. Once you enable an admission controller policy and the admission controller is installed on clusters, you can review the actions on this page.

In the Events table, click on a logged action to open a slideout panel to see more information. In the Overview tab, see the policy information. In the Request YAML tab, you can review the YAML used for the action.

By default, the Admission Controller Logs page is filtered to display only the actions that triggered an alert or were denied.

Logs are deleted after 30 to 60 days.

Kubernetes Admission Controller Events

For configuring admission controller policies, see Admission Controller Policies.
For a conceptual overview, see Admission Controller.

The Kubernetes Admission Controller Events type displays actions taken within your clusters that were evaluated by admission controller policies. After you enable an admission controller policy and the admission controller is installed, you can review the actions here.

Click a logged action to open a slideout panel. The Overview tab shows policy information; the Request YAML tab shows the YAML used for the action.

By default, this view is filtered to display only the actions that triggered an alert or were denied. Logs are deleted after 30 to 60 days.

Admission Controller Events Column Data

Column	Description
Time	The time the action occurred.
Action	The type of operation performed on the Kubernetes resource, such as Create, Update, or Delete.
Resource	The resource on which the action took place, displayed as the namespace followed by the resource name.
Cluster	The cluster in which the action occurred.
Account	The account associated with the cluster.
Result	The outcome of the admission controller's evaluation: Passed (met all policy requirements and allowed), Alerted (did not meet requirements but allowed, with an alert; only when the policy uses an Alert effect), or Denied (did not meet requirements and blocked; only when the policy uses a Deny effect).
Policy Violations	The policies violated by the action. Red indicates policies that denied the action; orange indicates policies that issued an alert.
Policies Evaluated	A list of all policies that evaluated the action.
Owner resource	The resource that initiated the action.
Identity	The user or service account that initiated the action.