World map

 

BM

World K6: Guards

Audit logs

You will learn: to find out who did what in your cluster, and how much the logbook should write.

Checked with Kubernetes 1.37 on 31 Oct 2026

The problem

Friday, 3 a.m.: someone deleted the shop Deployment. Who did it?

Watch

An audit log: The guard's logbook: who asked the API server for what, and when. is the guard’s logbook. Every request becomes one event. Here is one, trimmed. Tap the line that says who.

Tap the line that says who did it.

0 of 1 found

Try it

Each rule in the audit policy picks a level: how much the guard writes. Put the levels from least to most.

Least detail at the top. Put these in order. Use the arrows, or drag.

  • None: write nothing
  • Request: also what was sent
  • Metadata: who, what, when
  • RequestResponse: also what came back

Try it

Pick a level for each kind of request.

Drag a card into a box. Or tap the card, then tap the box.

        Predict

        Your policy logs Secrets at RequestResponse. What did you just do?

        Check

        Good logbook habit, or risky? Swipe each one.

        Swipe right for good, left for needs work. Or use the buttons.

        1 / 4

        Ship audit logs off the cluster to safe storage

        You did it!

        You can now read the guard’s logbook, and choose what it writes.

        Go deeper (optional)

        The API server needs --audit-policy-file and --audit-log-path. Without a policy file, nothing is logged. Pod Security adds notes too, like pod-security.kubernetes.io/audit-violations. kind can turn auditing on with a little extra config. Its docs have an Auditing page.

        Real mission

        3. kubectl run audit-me --image=nginx:1.29-alpine && kubectl delete pod audit-me

        0 of 4 steps done · Your ticks are saved.