kind-audit-logging.yaml

# Source: https://github.com/kubernetes-sigs/kind/pull/457/files#diff-d9fa0450190d60ba133fb92282a94725R118
# enables audit policy on apiserver
kind: Cluster
apiVersion: kind.sigs.k8s.io/v1alpha4
nodes:
  - role: control-plane
    extraMounts:
      # edit ./audit-policy.yaml for audit policy
      # logs will stored to ./apiserver-audit.log
      - hostPath: /Users/bhutwala/gocode/src/github.com/yashbhutwala/kind-hacks/audit-policy.yaml
        containerPath: /etc/kubernetes/audit-policy.yaml
      - hostPath: /Users/bhutwala/gocode/src/github.com/yashbhutwala/kind-hacks/apiserver-audit.log
        containerPath: /var/log/apiserver-audit.log
  - role: worker
  - role: worker
kubeadmConfigPatches:
  - |
    # v1beta2 only works for 1.15+
    apiVersion: kubeadm.k8s.io/v1beta2
    kind: ClusterConfiguration
    metadata:
      name: config
    apiServer:
      extraArgs:
        # https://kind.sigs.k8s.io/docs/user/quick-start/#enable-feature-gates-in-your-cluster
        # "feature-gates": "TTLAfterFinished=true"
        # "feature-gates": "ServerSideApply=true"
        audit-log-path: /var/log/apiserver-audit.log
        audit-policy-file: /etc/kubernetes/audit-policy.yaml
      extraVolumes:
        - name: auditpolicy
          pathType: File
          readOnly: true
          hostPath: /etc/kubernetes/audit-policy.yaml
          mountPath: /etc/kubernetes/audit-policy.yaml
        - name: auditlog
          pathType: File
          readOnly: false
          hostPath: /var/log/apiserver-audit.log
          mountPath: /var/log/apiserver-audit.log
# kubeadmConfigPatches:
#   - |
#     # kubeadm.k8s.io/v1alpha2 works for kubeadm 1.11
#     # kubeadm.k8s.io/v1beta1 works for >= 1.13 and <= 1.18
#     # kubeadm.k8s.io/v1beta2 works for >= 1.15 and <= ?
#     apiVersion: kubeadm.k8s.io/v1alpha2
#     # MasterConfiguration changed to ClusterConfiguration in 1.13
#     kind: MasterConfiguration
#     metadata:
#       name: config
#     apiServer:
#       extraArgs:
#         audit-log-path: /var/log/apiserver-audit.log
#         audit-policy-file: /etc/kubernetes/audit-policy.yaml
#     apiServerExtraVolumes:
#     - name: auditpolicy
#       pathType: File
#       readOnly: true
#       hostPath: /etc/kubernetes/audit-policy.yaml
#       mountPath: /etc/kubernetes/audit-policy.yaml
#     - name: auditlog
#       pathType: File
#       readOnly: false
#       hostPath: /var/log/apiserver-audit.log
#       mountPath: /var/log/apiserver-audit.log