Improve advanced audit documentation

[rsevilla87]

Make audit configuration match with the real behavior of openshift-ansible:

openshift/openshift-ansible#10856

[openshift-ci-robot]

Hi @rsevilla87. Thanks for your PR.

I'm waiting for a openshift member to verify that this patch is reasonable to test. If it is, they should reply with /ok-to-test on its own line. Until that is done, I will not automatically test new commits in this PR, but the usual testing commands by org members will still work. Regular contributors should join the org to skip this step.

Once the patch is verified, the new status will be reflected by the ok-to-test label.

I understand the commands that are listed here.

Details

Instructions for interacting with me using PR comments are available here. If you have questions or suggestions related to my behavior, please file an issue against the kubernetes/test-infra repository.

[kalexand-rh]

@soltysh, will you PTAL?

[soltysh]

lgtm

[vikram-redhat]

/ok-to-test

[vikram-redhat]

@kalexand-rh just for 3.11, right? Not master?

[kalexand-rh]

@vikram-redhat, no, it should go in master, and I wouldn't be surprised if it's relevant in more than 3.11. The audit log information is old, and I can't remember when the master API switched to static pods. (This PR could also use a text edit and squash.)

@xingxingxia, do you know how far back this change is valid?

[vikram-redhat]

@rsevilla87 - could you submit this PR against the master and squash the commits?

[rsevilla87]

@kalexand-rh just for 3.11, right? Not master?

It should be also cherry-picked to 3.10

[xingxingxia]

@kalexand-rh sorry for delay due to holidays and later other work. Valid since version >= 3.10 using static pods, 3.10 began to report similar https://bugzilla.redhat.com/show_bug.cgi?id=1565555, https://bugzilla.redhat.com/show_bug.cgi?id=1615798

[kalexand-rh]

Thank you for checking @xingxingxia!

[kalexand-rh]

Closing in favor of #13690