Kubernetes audit exporter

Legacy / optional. The v1 Kubernetes exporter is the Deployment informer. Audit captures API intent (who changed what); it is not runtime deploy outcome and is not a v1 catalog source.

Receives Kubernetes API audit webhook events and emits Evidence Events for relevant mutations (workloads, config, RBAC). Complements the Deployment informer — audit captures who changed what; the informer captures rollout completion + image digest.

Code: Evitrus/exporter → k8s-audit/.

Install

helm install evitrus-k8s-audit oci://ghcr.io/evitrus/charts/k8s-audit \
  --set ingest.apiKey=$EVITRUS_KEY \
  --set webhook.bearerToken=$AUDIT_TOKEN

Or from the repo chart: exporter/k8s-audit/chart.

Point the API server (or managed control-plane audit webhook) at https://<service>/audit with a kubeconfig bearer token matching webhook.bearerToken. See the exporter README for a full kubeconfig example.

Mapping (defaults)

Audit resources	Evidence type
Deployments, DaemonSets, StatefulSets, ReplicaSets, Jobs, CronJobs	deploy.started (delete → deploy.rolled_back)
ConfigMaps, Secrets*, NetworkPolicies, admission webhooks	operate.config.changed
RBAC roles / bindings	iam.applied

source = kubernetes, metadata.channel = audit.

* Secret values are never included — only key names.

High-volume noise (get / list / watch, leases, pods, …) is filtered out.