How do I enable an audit log on minikube?

Question

Is it enabled by default? How could I set up an example audit log?

I've tried:

minikube start --extra-config=apiserver.Authorization.Mode=RBAC --extra-config=apiserver.Audit.LogOptions.Path=/var/log/apiserver/audit.log --extra-config=apiserver.Audit.LogOptions.MaxAge=30 --extra-config=apiserver.Audit.LogOptions.MaxSize=100 --extra-config=apiserver.Audit.LogOptions.MaxBackups=5

I'm also busy reading through (trying out all the options might take a while as minikube start ... is not a quick process): https://github.com/kubernetes/minikube/issues/1609

Answer 1

https://github.com/kubernetes/minikube/blob/master/site/content/en/docs/Tutorials/audit-policy.md

A bit of a workaround:

minikube stop

mkdir -p ~/.minikube/files/etc/ssl/certs

cat <<EOF > ~/.minikube/files/etc/ssl/certs/audit-policy.yaml
# Log all requests at the Metadata level.
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
- level: Metadata
EOF

minikube start \
  --extra-config=apiserver.audit-policy-file=/etc/ssl/certs/audit-policy.yaml \
  --extra-config=apiserver.audit-log-path=-

kubectl logs kube-apiserver-minikube -n  kube-system | grep audit.k8s.io/v1

Answer 2

As far as I know and as per all available information: There is no way no enable audit log on minikube. Its under implementation right now and lets hope kube team will shortly release this feature.