Configuring Kube-apiserver Audit Logs in RKE2

Wed, 11 Sep 2024 03:26:00 -0500

Audit logs in Kubernetes are vital in monitoring and securing your cluster. They help you track API requests, identify configuration changes, and trace actions to their source. In RKE2 (Rancher Kubernetes Engine 2), you can configure kube-apiserver audit logs to capture high-level and detailed information about what happens in your cluster.

In this post, we’ll walk through how to set up basic and detailed audit logging for the kube-apiserver in RKE2, providing examples to help you monitor API activities effectively.

Using Audit Logs to Track Changes in Fleet or ArgoCD

Wed, 11 Sep 2024 02:26:00 -0500

In environments where GitOps tools like Fleet or ArgoCD are used to manage Kubernetes clusters, changes can be rapid and automated. However, when things go wrong—such as deployments failing, or configurations being overwritten—it’s important to know who made the change, what was changed, and when the change occurred.

In this post, we’ll focus on how you can use audit logs from Rancher, Fleet, and ArgoCD to track down the root cause of issues. We’ll walk through practical examples, and show you how to trace changes back to the IP address or user responsible.

Audit Logging on Support Tools

Configuring Kube-apiserver Audit Logs in RKE2

Using Audit Logs to Track Changes in Fleet or ArgoCD