init

audit/commands

@@ -0,0 +1,10 @@
+minikube start \
+  --extra-config=apiserver.audit-policy-file=/etc/ssl/certs/policy.yaml \
+  --extra-config=apiserver.audit-log-path=-  --mount \
+  --mount-string="$(pwd)/policy.yaml:/etc/ssl/certs/policy.yaml"
+
+
+kubectl -n kube-system logs kube-apiserver-minikube -f
+
+
+https://gist.githubusercontent.com/noqcks/9cc2f70e12898f0227396a906b06cab6/raw/ea0e80e594f29850611a8bee7376b89cb22d6628/audit-policy-example.yml

audit/policy.yaml

@@ -0,0 +1,14 @@
+apiVersion: audit.k8s.io/v1
+kind: Policy
+rules:
+  - level: Metadata
+    resources:
+    - group: ""
+      resources: ["pods"]
+  - level: RequestResponse
+    verbs: ["create", "update", "patch"]
+    resources:
+    - group: "apps"
+      resources: ["deployments"]
+  - level: None
+    users: ["system:kube-proxy"]