Kubernetes audit logging is enabled and covers authentication, API calls, and RBAC denials

Without Kubernetes audit logging, there is no record of who accessed secrets, which pods were created, or when RBAC permissions were changed — post-incident forensics become guesswork (NIST 800-53 AU-2, AU-12). Adversaries routinely enumerate cluster resources, read secrets, and create privileged pods during an attack, then clean up their traces. Audit logs are the only evidence of these actions. CIS Kubernetes 3.2.1 mandates audit policy configuration. An audit policy that covers fewer than 3 event categories misses either authentication failures or RBAC denials — the two most actionable security signals in a cluster.

Create an audit policy file at /etc/kubernetes/audit-policy.yaml and enable it on the API server. Minimum viable policy covering authentication, secret access, and RBAC:

apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - RequestReceived
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets"]
  - level: Metadata
    verbs: ["create", "delete", "update", "patch"]
  - level: Metadata
    nonResourceURLs: ["/api*", "/version"]
  - level: None
    users: ["system:kube-proxy"]

Add to the kube-apiserver startup args: --audit-policy-file=/etc/kubernetes/audit-policy.yaml --audit-log-path=/var/log/kubernetes/audit.log --audit-log-maxage=30. Forward logs to your centralized logging system.