---
apiVersion: v1
items:
- apiVersion: v1
  data:
    allrequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: AllRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # catch-all rule to log all other requests with request and response payloads
      - level: RequestResponse
    default.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: Default
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # Log the full Identity API resource object so that the audit trail
      # allows us to match the username with the IDP identity.
      - level: RequestResponse
        verbs: ["create", "update", "patch"]
        resources:
          - group: "user.openshift.io"
            resources: ["identities"]
      # A catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - "RequestReceived"
    secure-oauth-storage-allrequestbodies.yaml: |-
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: AllRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # catch-all rule to log all other requests with request and response payloads
      - level: RequestResponse
    secure-oauth-storage-default.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: Default
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # Log the full Identity API resource object so that the audit trail
      # allows us to match the username with the IDP identity.
      - level: RequestResponse
        verbs: ["create", "update", "patch"]
        resources:
          - group: "user.openshift.io"
            resources: ["identities"]
          - group: "oauth.openshift.io"
            resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # A catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - "RequestReceived"
    secure-oauth-storage-writerequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: WriteRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # log request and response payloads for all write requests
      - level: RequestResponse
        verbs:
        - update
        - patch
        - create
        - delete
        - deletecollection
      # catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - RequestReceived
    writerequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: WriteRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # log request and response payloads for all write requests
      - level: RequestResponse
        verbs:
        - update
        - patch
        - create
        - delete
        - deletecollection
      # catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - RequestReceived
  kind: ConfigMap
  metadata:
    creationTimestamp: "2022-03-08T10:39:02Z"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:allrequestbodies.yaml: {}
          f:default.yaml: {}
          f:secure-oauth-storage-allrequestbodies.yaml: {}
          f:secure-oauth-storage-default.yaml: {}
          f:secure-oauth-storage-writerequestbodies.yaml: {}
          f:writerequestbodies.yaml: {}
      manager: authentication-operator
      operation: Update
      time: "2022-03-08T10:39:02Z"
    name: audit
    namespace: openshift-oauth-apiserver
    resourceVersion: "7449"
    selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps/audit
    uid: 2ceda5b2-d23d-4883-994f-b722f923fc3e
- apiVersion: v1
  data:
    allrequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: AllRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # catch-all rule to log all other requests with request and response payloads
      - level: RequestResponse
    default.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: Default
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # Log the full Identity API resource object so that the audit trail
      # allows us to match the username with the IDP identity.
      - level: RequestResponse
        verbs: ["create", "update", "patch"]
        resources:
          - group: "user.openshift.io"
            resources: ["identities"]
      # A catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - "RequestReceived"
    secure-oauth-storage-allrequestbodies.yaml: |-
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: AllRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # catch-all rule to log all other requests with request and response payloads
      - level: RequestResponse
    secure-oauth-storage-default.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: Default
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # Log the full Identity API resource object so that the audit trail
      # allows us to match the username with the IDP identity.
      - level: RequestResponse
        verbs: ["create", "update", "patch"]
        resources:
          - group: "user.openshift.io"
            resources: ["identities"]
          - group: "oauth.openshift.io"
            resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # A catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - "RequestReceived"
    secure-oauth-storage-writerequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: WriteRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # log request and response payloads for all write requests
      - level: RequestResponse
        verbs:
        - update
        - patch
        - create
        - delete
        - deletecollection
      # catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - RequestReceived
    writerequestbodies.yaml: |
      apiVersion: audit.k8s.io/v1beta1
      kind: Policy
      metadata:
        name: WriteRequestBodies
      # Don't generate audit events for all requests in RequestReceived stage.
      omitStages:
      - "RequestReceived"
      rules:
      # Don't log requests for events
      - level: None
        resources:
        - group: ""
          resources: ["events"]
      # Don't log oauth tokens as metadata.name is the secret
      - level: None
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthaccesstokens", "oauthauthorizetokens"]
      # Don't log authenticated requests to certain non-resource URL paths.
      - level: None
        userGroups: ["system:authenticated", "system:unauthenticated"]
        nonResourceURLs:
        - "/api*" # Wildcard matching.
        - "/version"
        - "/healthz"
        - "/readyz"
      # exclude resources where the body is security-sensitive
      - level: Metadata
        resources:
        - group: "route.openshift.io"
          resources: ["routes"]
        - resources: ["secrets"]
      - level: Metadata
        resources:
        - group: "oauth.openshift.io"
          resources: ["oauthclients"]
      # log request and response payloads for all write requests
      - level: RequestResponse
        verbs:
        - update
        - patch
        - create
        - delete
        - deletecollection
      # catch-all rule to log all other requests at the Metadata level.
      - level: Metadata
        # Long-running requests like watches that fall under this rule will not
        # generate an audit event in RequestReceived.
        omitStages:
        - RequestReceived
  kind: ConfigMap
  metadata:
    creationTimestamp: "2022-03-08T10:39:04Z"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:allrequestbodies.yaml: {}
          f:default.yaml: {}
          f:secure-oauth-storage-allrequestbodies.yaml: {}
          f:secure-oauth-storage-default.yaml: {}
          f:secure-oauth-storage-writerequestbodies.yaml: {}
          f:writerequestbodies.yaml: {}
        f:metadata:
          f:ownerReferences:
            .: {}
            k:{"uid":"e8914293-ecba-4707-bd31-800ab19eefcc"}:
              .: {}
              f:apiVersion: {}
              f:kind: {}
              f:name: {}
              f:uid: {}
      manager: authentication-operator
      operation: Update
      time: "2022-03-08T10:39:04Z"
    name: audit-2
    namespace: openshift-oauth-apiserver
    ownerReferences:
    - apiVersion: v1
      kind: ConfigMap
      name: revision-status-2
      uid: e8914293-ecba-4707-bd31-800ab19eefcc
    resourceVersion: "7576"
    selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps/audit-2
    uid: f3e41036-7a08-4eaf-a320-b08ffda4ec72
- apiVersion: v1
  data:
    ca-bundle.crt: |
      -----BEGIN CERTIFICATE-----
      MIIDGDCCAgCgAwIBAgIIEOB7widDiQwwDQYJKoZIhvcNAQELBQAwKjESMBAGA1UE
      CxMJb3BlbnNoaWZ0MRQwEgYDVQQDEwtldGNkLXNpZ25lcjAeFw0yMjAzMDgxMDEw
      MjRaFw0zMjAzMDUxMDEwMjRaMCoxEjAQBgNVBAsTCW9wZW5zaGlmdDEUMBIGA1UE
      AxMLZXRjZC1zaWduZXIwggEiMA0GCSqGSIb3DQEBAQUAA4IBDwAwggEKAoIBAQDM
      qN2MxX+ct316ZR7yiujlm3Geq2yHBaexfDkwFFV5jaD/UKG6x/oWy7oSOU3h2GQV
      EgrNUMab53XdjOFKCfDI2TOdaYxSKRtXN+9CW7P71EJ4/INXazLzSxR9YqH93ANH
      uHxbBndPKmjkcA5beU8ZbXuGpasb5QM0orIJQUBPJDGWxPFJu1WRhkebqLbOyRVL
      SiyfN5XgnM72KAQgeMbauoUfkJaVbNd9VMPxcBFf+WRoWi5ypvxZohUmiIshxHFo
      qBWRf0l8VgTEu3sf9DpDEkv1hhfIxhQRJiGkeCBB1oNwUvm90163HUcQRzOVSpbo
      uhV3dpt/5nhqiNB0zAipAgMBAAGjQjBAMA4GA1UdDwEB/wQEAwICpDAPBgNVHRMB
      Af8EBTADAQH/MB0GA1UdDgQWBBRGHfEUBzZMHxIqd3UtuyqYBvr4KTANBgkqhkiG
      9w0BAQsFAAOCAQEAhndKtei2BpAWKsf4M/w2drHBFfEz1X1T8EiE0Chdyt+9Ko+l
      XiHLBEFxR+JJyaQcREjZLcVIqRYERX1iHaVEfiUWQgRImYR5XI25y9EQ/3CP+uFP
      wzVcERhkCIkXrvI6QT9e6nR7htMsKGtF7eiD8/RGcD2w8TrQ91kB7zSPODBgZwVp
      qWFWPR5BsnSZDdy3rcldCVlxnHOgCjLpyWbNQzW3G0j9xtTMfuS0BWNH2NcGTlBz
      qTU6hmnzR/CrHekxxrzkyrtlFOzL406/PXPDgEhbyKzgYUssAg5g0NgLJxz6rqs0
      ZAmADm4FqC1BV/afreI0oSjc2UH7Fg6FMQYulQ==
      -----END CERTIFICATE-----
  kind: ConfigMap
  metadata:
    creationTimestamp: "2022-03-08T10:38:57Z"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:ca-bundle.crt: {}
      manager: authentication-operator
      operation: Update
      time: "2022-03-08T10:38:57Z"
    name: etcd-serving-ca
    namespace: openshift-oauth-apiserver
    resourceVersion: "7139"
    selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps/etcd-serving-ca
    uid: a2afe253-2963-4f88-bbd5-0507337701ec
- apiVersion: v1
  data:
    revision: "1"
    status: Abandoned
  kind: ConfigMap
  metadata:
    creationTimestamp: "2022-03-08T10:38:58Z"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:revision: {}
          f:status: {}
      manager: authentication-operator
      operation: Update
      time: "2022-03-08T10:38:58Z"
    name: revision-status-1
    namespace: openshift-oauth-apiserver
    resourceVersion: "7360"
    selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps/revision-status-1
    uid: 97700a6c-30ea-47f0-84c0-dddb1a42f1eb
- apiVersion: v1
  data:
    revision: "2"
    status: InProgress
  kind: ConfigMap
  metadata:
    creationTimestamp: "2022-03-08T10:39:00Z"
    managedFields:
    - apiVersion: v1
      fieldsType: FieldsV1
      fieldsV1:
        f:data:
          .: {}
          f:revision: {}
          f:status: {}
      manager: authentication-operator
      operation: Update
      time: "2022-03-08T10:39:00Z"
    name: revision-status-2
    namespace: openshift-oauth-apiserver
    resourceVersion: "7304"
    selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps/revision-status-2
    uid: e8914293-ecba-4707-bd31-800ab19eefcc
kind: ConfigMapList
metadata:
  resourceVersion: "82508"
  selfLink: /api/v1/namespaces/openshift-oauth-apiserver/configmaps
