AKS Kubernetes audit log all activites performed by user

Question

Hi, I tried to set both the kube-audit and the kube-audit-admin log levels but I found that the data logged did not include information on the object that was create/modified, only the user. Information on modified deployments, pods, secrets, configmaps are especially interesting. I queried the AzureDiagnostics table but could not find this information. Is there any way to get the metadata on what actions were performed?

Answer 1

Hi @Christoffer Vig
I'm not sure this is possible now.
You can follow this link -> https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/ to try and execute it yourself,
without integration with Azure Montior.

I do know there is a roadmap item to give users more visibility and to better support this in the future.
If I've helped you please accept this answer so it will help more users.

Answer 2

Hello @Christoffer Vig

Thank you for your heads up.

I would like to provide the next post which seems very similar for what you were describing previously.... So please direct yourself down below:

https://stackoverflow.com/questions/57070577/how-to-fetch-audit-log-from-a-azure-kubernetes-cluster-later-i-want-to-use-it-t

I hope you can find this useful to overcome your concern.

Looking forward to your feedback,

Cheers,

Please "Accept the answer" if the information helped you. This will help us and others in the community as well.