Introducing Kubernetes auditing
Kubernetes auditing was introduced in version 1.11. Kubernetes’ auditing records events such as creating a Deployment, patching Pods, deleting namespaces, and more in chronological order. With auditing, a Kubernetes cluster administrator can answer questions such as the following:
- What happened (for instance, whether a Pod was created and what kind of Pod it is)?
- Who did it (user/admin)?
- When did it happen (the timestamp of the event)?
- Where did it happen (in which namespace is the Pod created)?
From a security standpoint, auditing enables DevOps and the security team to do better anomaly detection and prevention by tracking events happening inside the Kubernetes cluster.
In a Kubernetes cluster, it is kube-apiserver that does the auditing. When a request (for example, create a namespace) is sent to kube-apiserver, the request may go through multiple stages. There will be an event generated per stage...
