Kubernetes Audit Log — Six Events with an RBAC Denial (jsonl)
Six Kubernetes audit events at two audit levels, including one 403 whose authorization annotations record the forbid decision and its reason. The shape a cluster-audit alert or compliance report reads, with every user and service account invented.
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"9f31a700-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/pods","verb":"get","user":{"username":"system:serviceaccount:shop:checkout","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"pods","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2026-03-17T09:14:32.850000000Z","stageTimestamp":"2026-03-17T09:14:32.891000000Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"9f31a701-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/secrets","verb":"list","user":{"username":"alice@example.com","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"secrets","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":403},"requestReceivedTimestamp":"2026-03-17T09:14:34.250000000Z","stageTimestamp":"2026-03-17T09:14:34.291000000Z","annotations":{"authorization.k8s.io/decision":"forbid","authorization.k8s.io/reason":"no RBAC policy matched"}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"9f31a702-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/deployments","verb":"create","user":{"username":"ci-bot@example.com","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"deployments","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestReceivedTimestamp":"2026-03-17T09:14:35.650000000Z","stageTimestamp":"2026-03-17T09:14:35.691000000Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"9f31a703-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/configmaps","verb":"patch","user":{"username":"alice@example.com","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"configmaps","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2026-03-17T09:14:37.050000000Z","stageTimestamp":"2026-03-17T09:14:37.091000000Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"9f31a704-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/pods","verb":"delete","user":{"username":"system:serviceaccount:shop:operator","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"pods","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2026-03-17T09:14:38.450000000Z","stageTimestamp":"2026-03-17T09:14:38.491000000Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"9f31a705-4c3d-4e9f-8a1b-2c3d4e5f6a7b","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/shop/events","verb":"watch","user":{"username":"system:serviceaccount:kube-system:controller","groups":["system:authenticated"]},"sourceIPs":["192.0.2.11"],"userAgent":"kubectl/v1.32.1 (linux/amd64)","objectRef":{"resource":"events","namespace":"shop","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":200},"requestReceivedTimestamp":"2026-03-17T09:14:39.850000000Z","stageTimestamp":"2026-03-17T09:14:39.891000000Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
Specifications
- Lines
- 6
- Denied Events
- 1
- Audit Levels
- Metadata, RequestResponse
- Stage
- ResponseComplete
- Has Authorization Annotations
- true
- Verbs
- get, list, create, patch, delete, watch
Testing contract
Expected to pass- Scenario
- Query the audit stream for denied requests.
- Expected result
- Exactly one event returns code 403 with authorization.k8s.io/decision set to forbid, and both RequestResponse-level events are distinguishable from the four Metadata-level ones.
What is a .jsonl file?
JSONL (JSON Lines) is a text format where each line is a complete, independent JSON value, allowing records to be streamed and appended without parsing the whole file. It is not itself a JSON array and each line must stand alone. It is common in logging, machine learning datasets, and data pipelines.
How to use this file
Use an example JSONL to test line-by-line streaming parsers, append-and-resume ingestion, and batch pipelines that process one record per line.
How to use this file for testing
“Kubernetes Audit Log — Six Events with an RBAC Denial (jsonl)” is a deterministic Novus Examples fixture for Observability, Log parsing, JSON parsing. Structured and plain-text telemetry with known timestamps, levels, request identifiers, and error states for testing log ingestion, correlation, dashboards, and alert pipelines.
Documented properties for this file: JSONL · 4,090 bytes. Compare results against paired or grouped companions on this page when present (clean↔damaged, searchable↔scanned, or format twins) so scores stay reproducible across runs.
Download the file once, keep the path stable in CI or local scripts, and treat the spec table as the contract: dimensions, seeds, field lists, and roles are intentional. Corrupt or invalid samples are labelled as such — expect parsers to fail loudly rather than silently accept them.
Telemetry fixtures use fixed trace IDs, span IDs, and timestamps so ingestion is reproducible run to run. Point your collector, parser, or query layer at the file and assert the documented span tree, metric families, or severity mix; service and host names are invented.
Code examples
import json
with open("kubernetes-audit.jsonl") as f:
rows = [json.loads(line) for line in f]
print(len(rows), rows[0])Related files
- jsonOTLP Logs — Export Document with Severity and Trace Correlation (json)An OTLP logs export across two resources: five records spanning DEBUG to FATAL with both severityNumber and severityText, separate event and observed timestamps, trace and span correlation, and one record whose body is a full multi-line Python traceback.
- jsonlAlert State History — Pending, Firing and Resolved Transitions (jsonl)Sixteen state transitions across four alerts, each moving inactive to pending to firing to resolved with the previous state recorded. The pending stage is where a for: duration is being served and no notification is sent, which is what makes alert-noise analysis possible.
- logDocker Container Log — json-file driver (log)A Docker json-file container log — one JSON object per line with the log text, stream (stdout/stderr), and an RFC 3339 timestamp, exactly as Docker's default logging driver writes it. A fixture for container-log shippers and parsers.
- log.NET Exception with an Inner Exception Chain (log)A .NET exception whose inner exception is introduced by the ---> marker and closed by End of inner exception stack trace, wrapped in pipe-delimited log lines. Error groupers that key on the outermost message alone merge two genuinely different faults here.
- logCRI Container Log — Partial Lines and Two Streams (log)The CRI log format Kubernetes nodes actually write: an RFC 3339 nanosecond timestamp, a stream name, and an F or P tag marking whether the line is full or a partial continuation. One long message is split across several P lines that must be rejoined before parsing.
- logGo Panic with Full Goroutine Dump (log)A Go panic followed by the runtime's full goroutine dump — four goroutines with their wait states, two-line frames and a created by attribution, separated by blank lines. Blank-line separation defeats multi-line rules that treat an empty line as the end of an event.
Generated by generation/observability.py. Free for any use, no attribution required — license.