fix: Update to latest audit policy (#145)

Author: jimmidyson

pkg/handlers/auditpolicy/embedded/apiserver-audit-policy.yaml

@@ -1,4 +1,4 @@
-# Taken from https://github.com/kubernetes/kubernetes/blob/master/cluster/gce/gci/configure-helper.sh
+# Taken from https://github.com/kubernetes/kubernetes/blob/v1.28.1/cluster/gce/gci/configure-helper.sh#L1101
 # Recommended in Kubernetes docs
 apiVersion: audit.k8s.io/v1
 kind: Policy
@@ -35,6 +35,7 @@ rules:
 - level: None
   users:
     - system:kube-controller-manager
+    - system:cloud-controller-manager
     - system:kube-scheduler
     - system:serviceaccount:kube-system:endpoint-controller
   verbs: ["get", "update"]
@@ -59,20 +60,24 @@ rules:
 - level: None
   users:
     - system:kube-controller-manager
+    - system:cloud-controller-manager
   verbs: ["get", "list"]
   resources:
     - group: "metrics.k8s.io"
+
 # Don't log these read-only URLs.
 - level: None
   nonResourceURLs:
     - /healthz*
     - /version
     - /swagger*
-# Don't log events requests.
+
+# Don't log events requests because of performance impact.
 - level: None
   resources:
     - group: "" # core
       resources: ["events"]
+
 # node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes
 - level: Request
   users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"]
@@ -90,18 +95,20 @@ rules:
       resources: ["nodes/status", "pods/status"]
   omitStages:
     - "RequestReceived"
+
 # deletecollection calls can be large, don't log responses for expected namespace deletions
 - level: Request
   users: ["system:serviceaccount:kube-system:namespace-controller"]
   verbs: ["deletecollection"]
   omitStages:
     - "RequestReceived"
-# Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
+
+# Secrets, ConfigMaps, TokenRequest and TokenReviews can contain sensitive & binary data,
 # so only log at the Metadata level.
 - level: Metadata
   resources:
     - group: "" # core
-      resources: ["secrets", "configmaps"]
+      resources: ["secrets", "configmaps", "serviceaccounts/token"]
     - group: authentication.k8s.io
       resources: ["tokenreviews"]
   omitStages:
@@ -127,7 +134,6 @@ rules:
     - group: "policy"
     - group: "rbac.authorization.k8s.io"
     - group: "scheduling.k8s.io"
-    - group: "settings.k8s.io"
     - group: "storage.k8s.io"
   omitStages:
     - "RequestReceived"
@@ -151,7 +157,6 @@ rules:
     - group: "policy"
     - group: "rbac.authorization.k8s.io"
     - group: "scheduling.k8s.io"
-    - group: "settings.k8s.io"
     - group: "storage.k8s.io"
   omitStages:
     - "RequestReceived"