Enable audit logs - Kubernetes API Server

[alanc...@gmail.com]

Hi!

Trying to set up Monitoring Kubernetes on Splunk, need to enable audit logs.

Reviewed the below documents, however seem that don t need to modify anything on the collector level:

containers:

- name: collectorforkubernetes

image: outcoldsolutions/collectorforkubernetes:4.0.171.180516

securityContext:

# runAsUser: 0

        command:

        - --audit-policy-file=/etc/kubernetes/policies/audit-policy.yaml

        - --audit-log-path=-

        - --audit-log-format=json

https://www.outcoldsolutions.com/docs/monitoring-kubernetes/v4/audit/

https://kubernetes.io/docs/tasks/debug-application-cluster/audit

Client Version: version.Info{Major:"1", Minor:"10", GitVersion:"v1.10.3", GitCommit:"2bba0127d85d5a46ab4b778548be28623b32d0b0", GitTreeState:"clean", BuildDate:"2018-05-21T09:17:39Z", GoVersion:"go1.9.3", Compiler:"gc", Platform:"linux/amd64"}

Server Version: version.Info{Major:"1", Minor:"9", GitVersion:"v1.9.2", GitCommit:"5fa2db2bd46ac79e5e00a4e6ed24191080aa463b", GitTreeState:"clean", BuildDate:"2018-01-18T09:42:01Z", GoVersion:"go1.9.2", Compiler:"gc", Platform:"linux/amd64"}

Any ideas please ?

Regards

Alan