<p>I'm trying to enable 'auditing'. <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/debug-application-cluster/audit/</a> mentions:</p>

<blockquote>
  <p>You can pass a file with the policy to kube-apiserver using the
  --audit-policy-file flag. If the flag is omitted, no events are logged.</p>
</blockquote>

<p>I've used kubeadm to configure the cluster (running in 3 VMs in total).</p>

<p>However where is this set when using kubeadm ? I don't see where it interacts with kube-apiserver.</p>

<p>For a recent version of Kubernetes, add this to the <code>kind: ClusterConfiguration</code> section:</p>

<pre><code>    apiServer:
      extraArgs:
        audit-log-path: /tmp/k8s-audit.log
        audit-policy-file: /etc/kubernetes/audit.yaml
        audit-log-maxage: "1"
        audit-log-maxsize: "100"
        audit-log-maxbackup: "1"
      extraVolumes:
        - name: audit
          hostPath: /host/audit.yaml
          mountPath: /etc/kubernetes/audit.yaml
          readOnly: true
          pathType: File
</code></pre>

<p>Example <code>/host/audit.yaml</code> file which logs all request and response bodies:</p>

<pre><code>apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - "ResponseStarted"
rules:
  - level: RequestResponse
</code></pre>
