创建事件/审计的告警规则

apiVersion: logging.whizard.io/v1alpha1
kind: ClusterRuleGroup
metadata:
  name: example-auditing-rule
  namespace: kubesphere-logging-system
spec:
  type: auditing
  rules:
    - desc: all action not need to be audit
      expr:
        kind: list
        list:
          - get
          - list
          - watch
      name: ignore-action
    - desc: all operator need to be audit
      expr:
        kind: list
        list:
          - create
          - delete
          - update
          - patch
      name: action
    - desc: pod
      expr:
        kind: macro
        macro: ObjectRef.Resource="pods"
      name: pod
    - desc: service
      expr:
        kind: macro
        macro: ObjectRef.Resource="services"
      name: service
    - desc: the alias of the user related to audit event
      expr:
        alias: User.username
        kind: alias
      name: user