A) Explanation: $vim /etc/kubernetes/log-policy/audit-policy.yaml - level: RequestResponse userGroups: ['system:nodes'] - level: Request resources: - group: '' # core API group resources: ['persistentvolumes'] namespaces: ['frontend'] - level: Metadata resources: - group: '' resources: ['configmaps', 'secrets'] - level: Metadata $vim /etc/kubernetes/manifests/kube-apiserver.yaml Add these - --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml - --audit-log-path=/var/log/kubernetes/logs.txt - --audit-log-maxage=5 - --audit-log-maxbackup=10 Explanation [desk@cli] $ssh master1 [master1@cli] $vim /etc/kubernetes/log-policy/audit-policy.yaml apiVersion: audit.k8s.io/v1 # This is required. kind: Policy # Don't generate audit events for all requests in RequestReceived stage. omitStages: - 'RequestReceived' rules: # Don't log watch requests by the 'system:kube-proxy' on endpoints or services - level: None users: ['system:kube-proxy'] verbs: ['watch'] resources: - group: '' # core API group resources: ['endpoints', 'services'] # Don't log authenticated requests to certain non-resource URL paths. - level: None userGroups: ['system:authenticated'] nonResourceURLs: - '/api*' # Wildcard matching. - '/version' # Add your changes below - level: RequestResponse userGroups: ['system:nodes'] # Block for nodes - level: Request resources: - group: '' # core API group resources: ['persistentvolumes'] # Block for persistentvolumes namespaces: ['frontend'] # Block for persistentvolumes of frontend ns - level: Metadata resources: - group: '' # core API group resources: ['configmaps', 'secrets'] # Block for configmaps & secrets - level: Metadata # Block for everything else [master1@cli] $vim /etc/kubernetes/manifests/kube-apiserver.yaml apiVersion: v1 kind: Pod metadata: annotations: kubeadm.kubernetes.io/kube-apiserver.advertise-address.endpoint: 10.0.0.5:6443 labels: component: kube-apiserver tier: control-plane name: kube-apiserver namespace: kube-system spec: containers: - command: - kube-apiserver - --advertise-address=10.0.0.5 - --allow-privileged=true - --authorization-mode=Node,RBAC - --audit-policy-file=/etc/kubernetes/log-policy/audit-policy.yaml #Add this - --audit-log-path=/var/log/kubernetes/logs.txt #Add this - --audit-log-maxage=5 #Add this - --audit-log-maxbackup=10 #Add this ... output truncated Note: log volume & policy volume is already mounted invim /etc/kubernetes/manifests/kube-apiserver.yamlso no need to mount it. Reference:https://kubernetes.io/docs/tasks/debug-application-cluster/audit/ Note: log volume & policy volume is already mounted invim /etc/kubernetes/manifests/kube-apiserver.yamlso no need to mount it. Reference:https://kubernetes.io/docs/tasks/debug-application-cluster/audit/