feat(operator): add k8s.audit.event.verb as default stream label for audit tenant

[sradco]

What this is / why we need it

The OpenShift Logging OTLP data model (docs) already maps several audit event fields to structured metadata:

• k8s.user.username
• k8s.audit.event.object_ref.resource
• k8s.audit.event.object_ref.namespace
• k8s.audit.event.object_ref.name
• k8s.audit.event.response.code
• k8s.audit.event.user_agent

However, verb (the API operation: create, update, patch, delete, get, list) is not included in the default attribute mapping — neither as a stream label nor as structured metadata.

verb is arguably the most important filter for audit log queries and is an ideal stream label candidate because:

• Very low cardinality: only ~6 values (create, update, patch, delete, get, list)
• Static/long-lived: values never change
• Most commonly used filter: nearly every audit query filters by verb first
• Partitions search space effectively: most audit volume is get/list, so filtering to create/delete dramatically reduces scan

Proposal

Add k8s.audit.event.verb as a default stream label for the audit tenant in openshift-logging mode. Since cardinality is ≤6, it creates at most 6 additional streams per existing stream combination — well within safe limits.

Alternatively, at minimum add it as structured metadata so it can be used in label filter expressions without | json parsing.

Context

We're building an OCP audit log viewer dashboard (PR) that filters by verb, username, resource, namespace, etc. Currently the query requires | json to parse every log line before filtering — making verb a stream label would allow the stream selector to eliminate most logs before parsing.

References

• OpenShift Logging 6.5 OTLP data model
• Label best practices
• Related: feat(operator)!: switch default for OpenShift stream labels #21001 (stream label defaults discussion)