Get sourceIP/x-forwarded-for IP in audit logs

[KoffeinKaio]

Hey,

thanks for continuing to maintain this. Saved me a lot of headaches with our provider.

Is it somehow possible to get the source IP of the client in the audit logs?

As I could see, the clients IP is included in debug logs:

I0415 08:25:59.440834       1 handlers.go:138] adding impersonate extra user header Remote-Client-IP: xx.xxx.xx.xxx:49912 (xx.xxx.xx.xxx:49912)

round_trippers.go:423] curl -k -v -XGET  -H "X-Forwarded-Scheme: https" -H "X-Forwarded-For: xx.xxx.xx.xxx, 192.168.0.86"

but not in audit logs:

{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"RequestResponse","auditID":"b5306e8b-b8f4-4be9-9d11-c1355e3eae74","stage":"ResponseStarted","requestURI":"/","verb":"get","user":{},"sourceIPs":["192.168.0.142","192.168.1.207"],"userAgent":"curl/8.13.0","responseStatus":{"metadata":{},"message":"Authentication failed, no credentials provided","code":401},"requestReceivedTimestamp":"2025-04-15T09:42:52.366451Z","stageTimestamp":"2025-04-15T09:42:52.366550Z"}

Any idea?

[mlbiam]

pretty sure it's already in the access logs. will see if it can be added to the audit logs