Enable audit log collection for k0s

Views:

Enable Kubernetes audit log collection on a k0s cluster by creating audit policy and webhook configuration files, configuring k0s to use them, and restarting the service.

Procedure

Create the audit configuration directory and files.

Run the following commands to create the audit policy and webhook configuration:

sudo mkdir -p /etc/k0s/audit

sudo tee /etc/k0s/audit/audit-policy.yaml << 'EOF'
apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: Metadata
    verbs: ["create"]
    resources:
      - group: "authorization.k8s.io"
        resources: ["subjectaccessreviews", "selfsubjectaccessreviews", "localsubjectaccessreviews"]
  - level: RequestResponse
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
    resources:
      - group: "rbac.authorization.k8s.io"
        resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]
  - level: Metadata
    verbs: ["create", "update", "delete"]
    resources:
      - group: ""
        resources: ["serviceaccounts"]
  - level: None
EOF

sudo tee /etc/k0s/audit/audit-webhook-config.yaml << 'EOF'
apiVersion: v1
kind: Config
clusters:
- name: audit-collector
  cluster:
    server: http://127.0.0.1:8030/k8s-audit
contexts:
- context:
    cluster: audit-collector
    user: ""
  name: default-context
current-context: default-context
preferences: {}
users: []
EOF

sudo chown -R root:root /etc/k0s/audit
sudo chmod 644 /etc/k0s/audit/*.yaml

Configure k0s to use the audit policy and webhook.

Edit /etc/k0s/k0s.yaml:

apiVersion: k0s.k0sproject.io/v1beta1
kind: ClusterConfig
metadata:
  name: k0s
spec:
  api:
    extraArgs:
      audit-policy-file: /etc/k0s/audit/audit-policy.yaml
      audit-webhook-config-file: /etc/k0s/audit/audit-webhook-config.yaml
      audit-webhook-batch-max-size: "1"

Or if you don't have an existing config file:

k0s config create > /etc/k0s/k0s.yaml
# Then edit to add the extraArgs above

Restart the k0s controller to apply the changes.
```
sudo systemctl restart k0scontroller
```

Verify the configuration.

sudo systemctl status k0scontroller
sudo k0s kubectl get nodes