Auditing in Kubernetes 101
summary
Explains how Kubernetes audit logs record every API-server request, shows a minikube demo producing ~14,000 audit events in minutes, and walks through audit policy rules (stages: RequestReceived/ResponseStarted/ResponseComplete/Panic) and levels (None/Metadata/Request/RequestResponse). Covers backends (file vs webhook), batching modes, and integration patterns using Fluentd, Logstash, Falco. Presents the new alpha dynamic audit configuration resource (auditregistration.k8s.io) that updates policies without restarting the API server, notes security and performance caveats.
AI-written summary · about
chapters (11)
- 0:00Start
- 2:33WHAT HAPPENED
- 3:24WHEN DID IT HAPPEN
- 4:03WHO DID IT
- 9:23LEVELS
- 13:44BATCHING
- 15:13DYNAMIC AUDIT CONFIGURATION
- 20:31LOG COLLECTOR PATTERNS
- 22:31UNDERSTANDING K8S INTERNALS
- 23:01TROUBLESHOOTING ISSUES
- 23:15PERFORMANCE ISSUES
related talks
31mAuditing in Kubernetes 101
35mUsing K8s Audit Logs to Secure Your Cluster
36mMaking the Most Out of Kubernetes Audit Logs
19mAuditing Kubernetes Users: Tracking Security Holes
33mWho Shot the Cluster? - Audit Logging in Kubernetes - Marian Lobur & Mik Vyatskov, Google
10mA Simple and Practical Guide to Obser...
05m⚡Lightning Talk: Learning Kubernetes From Logs: Building a Foundation for Future…
30mA Monitoring Platform for Kubernetes Cluster Security