How can I set a flag of kube-apiserver on an AKS cluster?

Question

I have to enable specific auditing for my AKS cluster and according to the kubernetes documentation(https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/), I need to pass --audit-policy-file flag with the file path containing the audit policy to the kube-api-server pods, but I could not see any kube-api-server pods in the kube-system namespace. So how can I pass this audit policy flag and also make the kube-api-server containers mount on this file to read the audit policy.

Answer 1

Hello Shivam Sood,

Welcome to microsoft Q&A. Thankyou for posting your query here

1.AKS (Azure Kubernetes Service) is a managed service, where many of the underlying Kubernetes components and configurations are managed by Azure for simplicity and to ensure a secure and optimized environment.

2.AKS does not provide direct access to the kube-api-server configuration, including passing flags such as --audit-policy-file.

3.We may not have the same level of customization as manually editing the --audit-policy-file, Azure Monitor for Containers provides a robust set of tools for monitoring, logging, and responding to events in your AKS cluster.

4.we can enable and configure audit logging for your AKS cluster through Azure Monitor to collect, analyze, and act on audit logs from your AKS cluster.

5.Enable Azure Monitor for Containers, if you haven't already, you need to enable Azure Monitor for Containers on your AKS cluster. This can be done through the Azure Portal and Azure CLI. This service collects logs and metrics from your AKS cluster, including control plane logs.

6.In Azure Portal, navigate to your AKS cluster resource, and find the "Diagnostic settings" section. Here, you can add a diagnostic setting to specify which data to collect. For auditing purposes, ensure that "Kubernetes audit logs" or similar are selected. You can send these logs to different destinations, including Log Analytics workspace, Event Hubs, or Storage Account.

7.Once configured, audit logs can be queried and analyzed from the Log Analytics workspace you've sent the logs to. You can use Kusto Query Language (KQL) to write queries and analyze the audit data.

Hope this helps you. If an answer has been helpful, please consider accepting the answer to help increase visibility of this question for other members of the Microsoft Q&A community. If not, please let us know what is still needed in the comments so the question can be answered. Thank you for helping to improve Microsoft Q&A!