我想跟踪 k8s 集群中的用户活动。例如，我想获取在 pod 中执行命令的用户的 k8s 用户名。有一个工具叫Tetragon。它可以使用k8s api。以下日志是 k8s 集群上 Tetragon 的示例输出：
{
"process_exec": {
"process": {
"exec_id": "bWluaWt1YmU6NzAyMDQ2ODIyNTEwNDg6MTE5MDk1MQ==",
"pid": 1190951,
"uid": 0,
"cwd": "/",
"binary": "/bin/sh",
"arguments": "-c \"sleep 60m\"",
"flags": "execve rootcwd clone",
"start_time": "2023-07-22T13:37:01.382355175Z",
"auid": 4294967295,
"pod": {
"namespace": "default",
"name": "alpine-59dcb54bd-l7dtv",
"container": {
"id": "docker://767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6",
"name": "alpine",
"image": {
"id": "docker-pullable://alpine@sha256:82d1e9d7ed48a7523bdebc18cf6290bdb97b82302a8a9c27d4fe885949ea94d1",
"name": "alpine:latest"
},
"start_time": "2023-07-22T13:37:01Z",
"pid": 1
},
"pod_labels": {
"pod-template-hash": "59dcb54bd",
"run": "alpine"
}
},
"docker": "767327faa6bc703188e434b74e80ed2",
"parent_exec_id": "bWluaWt1YmU6NzAyMDQ1NTgzNDYxOTA6MTE5MDkzMQ==",
"refcnt": 1,
"tid": 1190951
},
"parent": {
"exec_id": "bWluaWt1YmU6NzAyMDQ1NTgzNDYxOTA6MTE5MDkzMQ==",
"pid": 1190931,
"uid": 0,
"cwd": "/run/containerd/io.containerd.runtime.v2.task/moby/767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6",
"binary": "/usr/bin/containerd-shim-runc-v2",
"arguments": "-namespace moby -id 767327faa6bc703188e434b74e80ed29f14973556b4411060674056cf9b305d6 -address /run/containerd/containerd.sock",
"flags": "execve clone",
"start_time": "2023-07-22T13:37:01.258449828Z",
"auid": 4294967295,
"parent_exec_id": "bWluaWt1YmU6NzAyMDQ1NTAyNzk4MDM6MTE5MDkyNA==",
"tid": 1190931
}
},
"node_name": "minikube",
"time": "2023-07-22T13:37:01.382358135Z"
}
现在我想让用户的 k8s 用户名执行此命令。例如我想在上面的 json 中有一个字段，例如：
username: minikube-user
有人有想法吗？