Series
Kubernetes audit logging
4 posts in this series. Read them in order or jump to any one.
- Kubernetes Audit Log Format: Anatomy of an Audit Event
Field-by-field guide to the Kubernetes audit log format: stages, levels, user, sourceIPs, objectRef, responseStatus, annotations, and what matters in forensics.
- Kubernetes Audit Policy: What to Log for Forensics
Write a Kubernetes audit policy that captures the evidence an investigation needs (exec, RBAC, workloads, tokens) without logging secrets or drowning in noise.
- EKS, GKE and AKS Audit Logs: Enable and Export Them
How to enable and export Kubernetes audit logs on Amazon EKS, Google GKE and Azure AKS: where they live, what the managed policy drops, and the export commands.
- What Kubernetes Audit Logs Don't Show (and What Does)
The blind spots of Kubernetes audit logs: in-container activity, kubelet and etcd access, policy gaps, spoofable fields, and the evidence that fills them.