Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Specify the default batch mode for each backend type. #49809

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
Open

Specify the default batch mode for each backend type. #49809

Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
7e2dea2
Explicitly specify default batch mode for each backend type.
MohammadAlavi1986 Feb 17, 2025
c8426e5
Merge branch 'kubernetes:main' into patch-3
MohammadAlavi1986 Mar 16, 2025
cc8fd81
use tabs to list flags specific to each backend in a separate tab.
MohammadAlavi1986 Mar 16, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
44 changes: 34 additions & 10 deletions content/en/docs/tasks/debug/debug-cluster/audit.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -195,28 +195,52 @@ the service and credentials used to connect to it.

## Event batching {#batching}

Both log and webhook backends support batching. Using webhook as an example, here's the list of
available flags. To get the same flag for log backend, replace `webhook` with `log` in the flag
name. By default, batching is enabled in `webhook` and disabled in `log`. Similarly, by default
throttling is enabled in `webhook` and disabled in `log`.
Both `log` and `webhook` backends support batching. Below is a list of
available flags specific to each backend.
By default, batching and throttling are **enabled** for the `webhook` backend and **disabled** for the `log` backend.

{{< tabs name="tab_with_md" >}}
{{% tab name="webhook" %}}
- `--audit-webhook-mode` defines the buffering strategy. One of the following:
- `batch` - buffer events and asynchronously process them in batches. This is the default.
- `batch` - buffer events and asynchronously process them in batches. This is the default mode for the `webhook` backend.
- `blocking` - block API server responses on processing each individual event.
- `blocking-strict` - Same as blocking, but when there is a failure during audit logging at the
RequestReceived stage, the whole request to the kube-apiserver fails.
RequestReceived stage, the whole request to the kube-apiserver fails.

The following flags are used only in the `batch` mode:

- `--audit-webhook-batch-buffer-size` defines the number of events to buffer before batching.
If the rate of incoming events overflows the buffer, events are dropped.
- `--audit-webhook-batch-max-size` defines the maximum number of events in one batch.
If the rate of incoming events overflows the buffer, events are dropped. The default value is 10000.
- `--audit-webhook-batch-max-size` defines the maximum number of events in one batch. The default value is 400.
- `--audit-webhook-batch-max-wait` defines the maximum amount of time to wait before unconditionally
batching events in the queue.
batching events in the queue. The default value is 30 seconds.
- `--audit-webhook-batch-throttle-enable` defines whether batching throttling is enabled. Throttling is enabled by default.
- `--audit-webhook-batch-throttle-qps` defines the maximum average number of batches generated
per second.
per second. The default value is 10.
- `--audit-webhook-batch-throttle-burst` defines the maximum number of batches generated at the same
moment if the allowed QPS was underutilized previously. The default value is 15.
{{% /tab %}}
{{% tab name="log" %}}
- `--audit-log-mode` defines the buffering strategy. One of the following:
- `batch` - buffer events and asynchronously process them in batches. Batching is not recommended for the `log` backend.
- `blocking` - block API server responses on processing each individual event. This is the default mode for the `log` backend.
- `blocking-strict` - Same as blocking, but when there is a failure during audit logging at the
RequestReceived stage, the whole request to the kube-apiserver fails.

The following flags are used only in the `batch` mode (batching is **disabled** by default for the `log` backend, and when batching is disabled, all batching-related flags are ignored):

- `--audit-log-batch-buffer-size` defines the number of events to buffer before batching.
If the rate of incoming events overflows the buffer, events are dropped.
- `--audit-log-batch-max-size` defines the maximum number of events in one batch.
- `--audit-log-batch-max-wait` defines the maximum amount of time to wait before unconditionally
batching events in the queue.
- `--audit-log-batch-throttle-enable` defines whether batching throttling is enabled.
- `--audit-log-batch-throttle-qps` defines the maximum average number of batches generated
per second.
- `--audit-log-batch-throttle-burst` defines the maximum number of batches generated at the same
moment if the allowed QPS was underutilized previously.
{{% /tab %}}
{{< /tabs >}}

## Parameter tuning

Expand Down