策略片段（示例）
策略片段（示例）
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
- level: RequestResponse
resources:
- group: ""
resources: ["pods"]
verbs: ["create", "delete"]检索示例
检索示例
grep -E '"verb":"delete"' audit.log | tail -5
jq -r 'select(.verb=="delete") | [.user.username, .objectRef.resource, .objectRef.name] | @tsv' audit.log | tail -20RequestResponse 级别会记录请求体，日志量与磁盘占用明显上升，归档与转发前应按安全要求处理。