Authentication audit logging - denote the authentication mechanism used.

What would you like to be added:

Logging for the authentication mechanism used by a user for requests to the API server.

Why is this needed:

At the moment Kubernetes does not put the mechanism used to authenticate a user into it's audit logs. As Kubernetes supports multiple authentication mechanisms, this could lead to a circumstance where an identical username is defined under different authentication schemes and it would be impossible to identify which had been used for a given request.

This is particularly serious in the case of client certificate authentication. As all that is required for the creation of client certificate credentials is access to the ca.key file for the cluster and credentials can be created using openssl commands, there may be no audit trail of users created with this mechanism.

An attacker who gained read-only access to that file would be able to create new credentials with the same usernames as users authenticated via other mechanisms, removing the ability of cluster operators to accurately audit user actions.