Kubernetes Audit Logging for Security Monitoring

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  # Log all requests to secrets at metadata level
  - level: Metadata
    resources:
    - group: ""
      resources: ["secrets"]

  # Log pod exec/attach at request level
  - level: Request
    resources:
    - group: ""
      resources: ["pods/exec", "pods/attach"]

  # Log changes to configmaps
  - level: RequestResponse
    resources:
    - group: ""
      resources: ["configmaps"]
    verbs: ["create", "update", "patch", "delete"]

  # Don't log read-only endpoints
  - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]
    resources:
    - group: ""
      resources: ["endpoints", "services"]

--audit-policy-file=/etc/kubernetes/audit-policy.yaml
--audit-log-path=/var/log/kubernetes/audit.log
--audit-log-maxage=30
--audit-log-maxbackup=10
--audit-log-maxsize=100

# Prometheus AlertManager rule
- alert: SuspiciousSecretAccess
  expr: |
    count(kube_audit_event{
      resource="secrets",
      verb=~"get|list|watch"
    }) > 100
  for: 5m

--audit-webhook-config-file=/etc/kubernetes/audit-webhook.yaml