Skip to content

Audit event when agent is created and deleted

We want to be able to track agent deletion actions. Thus, we should create an audit event whenever an agent is deleted: via UI, REST API and GraphQL API.

Release notes

As you work on maintaining the auditability of your systems it's critical to know when a component that can access your system gets added or removed. As the agent for Kubernetes allows bi-directional data flow between a Kubernetes cluster and GitLab, knowing about new or removed agents is a central piece of auditability. Until now compliance teams had to use custom tooling or search for this data in GitLab directly. GitLab now provides the following audit events:

  - `cluster_agent_created` records who registered a new agent for Kubernetes
  - `cluster_agent_create_failed` records who tried to register a new agent for Kubernetes but failed
  - `cluster_agent_deleted` records who removed an agent for Kubernetes registration
  - `cluster_agent_delete_failed` records who tried to remove an agent for Kubernetes registration but failed

These audit events extend the already existing cluster_agent_token_created and cluster_agent_token_revoked audit events to improve the auditability of your GitLab instance.

Edited by Viktor Nagy (GitLab)