What are some examples of Kubernetes audit policies?

What are some examples of Kubernetes audit policies?

Kubernetes audit policies define what events are logged and how they are recorded. Examples include logging all requests to the API server or only specific actions like 'create' or 'delete'.

Can you provide a sample audit policy configuration?

Sure! Here's a simple example:

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    resources:
      - group: ""
        resources: ["pods"]
    verbs: ["create", "delete"]

This policy logs metadata for create and delete actions on pods.

How can I apply this audit policy in my cluster?

You can apply the audit policy by specifying it in the API server startup options using the --audit-policy-file flag. Make sure to restart the API server after making changes.

What are the different levels of audit logging?

The different levels of audit logging include:

• None: No logging.
• Metadata: Logs metadata about the request.
• Request: Logs the request and response.
• RequestResponse: Logs the request, response, and metadata.