What happened?

While debugging another issue, we saw patches in the audit log coming from a controller that we were sure shouldn't be making any changes. And when we watched with kubectl get TYPE --watch -o yaml, there weren't any changes observed.

Eventually, we realized that the controller in question was making PATCH calls with dryRun=true to detect drift (and not finding any).

If the audit log reported the URL params, that would have saved us a bunch of time.

The patch handler writes to the audit log regardless:

• https://github.com/kubernetes/kubernetes/blob/v1.25.9/staging/src/k8s.io/apiserver/pkg/endpoints/handlers/patch.go#L130

What did you expect to happen?

I expected the audit log to either not log dry-run requests OR log them but have a field to say whether it was a dry-run or not.

How can we reproduce it (as minimally and precisely as possible)?

Perform any patch with dry-run and review that request in the audit logs.

Anything else we need to know?

No response

Kubernetes version

v1.25.7

Cloud provider

GKE

OS version

No response

Install tools

No response

Container runtime (CRI) and version (if applicable)

No response

Related plugins (CNI, CSI, ...) and versions (if applicable)

No response