Audit in Kubernetes Now, and in the Future
summary
Current Kubernetes auditing is an API‑server filter that writes Apache‑style access lines (IP, HTTP method, user/groups, impersonation, response code, and a generated request ID) to a file via --audit-log-path with rolling options; aggregated API servers support it since 1.6 but logs are noisy, HTTP‑only and stored locally so unauthenticated traffic and deep object changes are missing. A proposal (PR 145) introduces a structured event/request/object layers model, configurable rules to filter by user/resource/namespace, optional request‑object and storage‑diff capture, and pluggable central backends with request ID propagation.
AI-written summary · about
chapters (4)
- 0:00Start
- 7:23Audit does not provide additional security to your system
- 10:08Cloud Auditing Data Federation
- 13:36Pros lightweight simple format
related talks
35mUsing K8s Audit Logs to Secure Your Cluster
19mAuditing Kubernetes Users: Tracking Security Holes
20mKubernetes audit log best practices
36mMaking the Most Out of Kubernetes Audit Logs
33mWho Shot the Cluster? - Audit Logging in Kubernetes - Marian Lobur & Mik Vyatskov, Google
49mScale Your Auditing Events
44mScale Your Auditing Events
30mA Monitoring Platform for Kubernetes Cluster Security