Kubernetes audit log best practices
summary
Explains concrete config: an audit policy with omitStages, levels, resources, verbs, users and namespaces to cut noise; pushes logs to S3 and aggregates clusters; runs rules in Falco and analyzes with OpenRaven or Elastic. Demonstrates a working Teleport + fluent D pipeline that ties every API request to an identity, issues short-lived x509 certificates instead of secrets, and records rich JSON sessions with Teleport session playback so commands and provenance are auditable in real time.
AI-written summary · about
chapters (9)
- 0:00Kubernetes audit logging intro
- 3:04Native audit logging
- 5:11Audit policy best practices
- 7:59Monitoring audit logs
- 10:50Limitations of audit tools
- 11:53Centralizing logs with Teleport
- 13:38Session playback and identity
- 16:28Demo: Kubernetes via Teleport
- 19:39Conclusion
related talks
35mUsing K8s Audit Logs to Secure Your Cluster
22mAudit in Kubernetes Now, and in the Future
36mMaking the Most Out of Kubernetes Audit Logs
30mA Monitoring Platform for Kubernetes Cluster Security
33mWho Shot the Cluster? - Audit Logging in Kubernetes - Marian Lobur & Mik Vyatskov, Google
38mDeep Dive: Falco
32mThreat Hunting at Scale: Auditing Thousands of Clusters With Falco + F...
57mThe Kubernetes Sessions Security