Skip to content

fix: change k8s audit log user and impersonatedUser extra field type to flattened - #20580

Open
Kavindu-Dodan wants to merge 1 commit into
elastic:mainfrom
Kavindu-Dodan:fix/k8s-audit-log-extra-field
Open

fix: change k8s audit log user and impersonatedUser extra field type to flattened#20580
Kavindu-Dodan wants to merge 1 commit into
elastic:mainfrom
Kavindu-Dodan:fix/k8s-audit-log-extra-field

Conversation

@Kavindu-Dodan

Copy link
Copy Markdown
Contributor

Proposed commit message

user.extra and impersonatedUser.extra fields previous used type: object. However, per K8s API, these values as object type 1. Given these are arbitrary objects with arbitary keys, flattened is the best choice to store these values.

Checklist

  • I have reviewed tips for building integrations and this pull request is aligned with them.
  • I have verified that all data streams collect metrics or logs.
  • I have added an entry to my package's changelog.yml file.
  • I have verified that Kibana version constraints are current according to guidelines.
  • I have verified that any added dashboard complies with Kibana's Dashboard good practices

Footnotes

  1. https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.36/#userinfo-v1-authentication-k8s-io

@Kavindu-Dodan
Kavindu-Dodan requested a review from a team as a code owner August 6, 2026 21:11
@Kavindu-Dodan
Kavindu-Dodan force-pushed the fix/k8s-audit-log-extra-field branch from 5e7497c to 03d63a9 Compare August 6, 2026 21:12
@Kavindu-Dodan Kavindu-Dodan changed the title fix: change k8s audit log user and impersonatedUser extra field to flattened fix: change k8s audit log user and impersonatedUser extra field type to flattened Aug 6, 2026
Signed-off-by: Kavindu Dodanduwa <kavindu.dodanduwa@elastic.co>
@Kavindu-Dodan
Kavindu-Dodan force-pushed the fix/k8s-audit-log-extra-field branch from 03d63a9 to dce4f66 Compare August 7, 2026 01:12
@github-actions

github-actions Bot commented Aug 7, 2026

Copy link
Copy Markdown
Contributor

✅ Elastic Docs Style Checker (Vale)

No issues found on modified lines!


The Vale linter checks documentation changes against the Elastic Docs style guide. To use Vale locally or report issues, refer to Elastic style guide for Vale.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

✅ All changelog entries have the correct PR link.

@elastic-vault-github-plugin-prod

Copy link
Copy Markdown
Contributor

🚀 Benchmarks report

To see the full report comment with /test benchmark fullreport

@infra-vault-gh-plugin-prod

Copy link
Copy Markdown

💚 Build Succeeded

History

@gizas gizas left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The new mapping applies after the data stream rolls over on upgrade.
All existing indices retain the old age time out. Just a note for here or for the sdh

@mergify

mergify Bot commented Aug 10, 2026

Copy link
Copy Markdown
Contributor

Tick the box to add this pull request to the merge queue (same as @mergifyio queue).

  • Queue this pull request

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants