Repository: kubernetes
Issue: Server Side Apply - No Create event in audit log
Labels: kind/bug,sig/api-machinery,triage/accepted

### What happened?

when using server side apply to create an object, only a patch event is logged in the audit log and no create event is event logged.

cc @liggitt 

### What did you expect to happen?

a create event should be logged in the audit log.

### How can we reproduce it (as minimally and precisely as possible)?

1. Have a cluster with audit logging enabled
2. create a sample yaml
```bash
cat <<EOF > sa.yaml
apiVersion: v1
kind: ServiceAccount
metadata:
  name: test-ssa
  namespace: default
EOF
```
3. apply the manifest using server side apply
```bash
kubectl apply -f sa.yaml --server-side
```
4. retrieve the audit log
5. find the events related to this new service account
```bash
cat audit.log | grep "test-ssa"
```

### Anything else we need to know?

sample of the output in the audit log:
```json
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"42ce8e59-f4f4-471e-9054-9b95556252f5","stage":"RequestReceived","requestURI":"/api/v1/namespaces/default/serviceaccounts/test-ssa?fieldManager=kubectl\u0026force=false","verb":"patch","user":{"username":"kubernetes-admin","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.18.0.1"],"userAgent":"kubectl/v1.22.4 (linux/amd64) kubernetes/b695d79","objectRef":{"resource":"serviceaccounts","namespace":"default","name":"test-ssa","apiVersion":"v1"},"requestReceivedTimestamp":"2023-02-08T18:25:15.132116Z","stageTimestamp":"2023-02-08T18:25:15.132116Z"}
{"kind":"Event","apiVersion":"audit.k8s.io/v1","level":"Metadata","auditID":"42ce8e59-f4f4-471e-9054-9b95556252f5","stage":"ResponseComplete","requestURI":"/api/v1/namespaces/default/serviceaccounts/test-ssa?fieldManager=kubectl\u0026force=false","verb":"patch","user":{"username":"kubernetes-admin","groups":["system:masters","system:authenticated"]},"sourceIPs":["172.18.0.1"],"userAgent":"kubectl/v1.22.4 (linux/amd64) kubernetes/b695d79","objectRef":{"resource":"serviceaccounts","namespace":"default","name":"test-ssa","apiVersion":"v1"},"responseStatus":{"metadata":{},"code":201},"requestReceivedTimestamp":"2023-02-08T18:25:15.132116Z","stageTimestamp":"2023-02-08T18:25:15.134778Z","annotations":{"authorization.k8s.io/decision":"allow","authorization.k8s.io/reason":""}}
```

### Kubernetes version

<details>

```console
$ kubectl version
Client Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.4", GitCommit:"872a965c6c6526caa949f0c6ac028ef7aff3fb78", GitTreeState:"clean", BuildDate:"2022-11-09T13:28:30Z", GoVersion:"go1.19.3", Compiler:"gc", Platform:"linux/amd64"}
Kustomize Version: v4.5.7
Server Version: version.Info{Major:"1", Minor:"25", GitVersion:"v1.25.3", GitCommit:"434bfd82814af038ad94d62ebe59b133fcb50506", GitTreeState:"clean", BuildDate:"2022-10-25T19:35:11Z", GoVersion:"go1.19.2", Compiler:"gc", Platform:"linux/amd64"}
```

</details>


### Cloud provider

<details>
kind
</details>


### OS version

<details>

```console
# On Linux:
$ cat /etc/os-release
NAME="Ubuntu"
VERSION="20.04.3 LTS (Focal Fossa)"
ID=ubuntu
ID_LIKE=debian
PRETTY_NAME="Ubuntu 20.04.3 LTS"
VERSION_ID="20.04"
HOME_URL="https://www.ubuntu.com/"
SUPPORT_URL="https://help.ubuntu.com/"
BUG_REPORT_URL="https://bugs.launchpad.net/ubuntu/"
PRIVACY_POLICY_URL="https://www.ubuntu.com/legal/terms-and-policies/privacy-policy"
VERSION_CODENAME=focal
UBUNTU_CODENAME=focal
$ uname -a
Linux tce-admin-vm 5.4.0-132-generic #148-Ubuntu SMP Mon Oct 17 16:02:06 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux

# On Windows:
C:\> wmic os get Caption, Version, BuildNumber, OSArchitecture
# paste output here
```

</details>


### Install tools

<details>

</details>


### Container runtime (CRI) and version (if applicable)

<details>

</details>


### Related plugins (CNI, CSI, ...) and versions (if applicable)

<details>

</details>