K8s audit logs

Kubernetes Audit Logs

• Audit logs help you figure out the who, what, why, where and when of when something has changed.
• Audit logs live on master nodes because it is info from the api-server
• GKE sends logs to stackdriver
• At FW, we ship AWS audit logs to Datadog
• SSH to a master node and look at the log itself and look in the /var/logs directory
• You've got to configure your audig log policy. In a kops cluster, this is in the cluster.yml file.