<p>I'm currently trying to change the audit policy for the openshift-kube-apiserver pod to output more information that isn't set up by default, primarily getting the requestBody of all incoming requests. There is an option in the kube-apiserver to change the audit policy here: <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/debug-application-cluster/audit/</a>. However, I can't seem to find that option on OpenShift. I suspect it might be within the openshift-kube-apiserver-operator, but have hit a dead end. Does anyone else have experience with this problem and can provide some guidance? Thank you in advance.</p>

<p>Unfortunately, at the moment OpenShift v4 does not allow you to custom audit policy. OpenShift v3 can custom it. But alternatively as of OCPv4.6 you can specify some predefined policies instead of your custom.
Refer <a href="https://docs.openshift.com/container-platform/4.6/nodes/nodes/nodes-nodes-audit-config.html#configuring-audit-policy_nodes-nodes-audit-config" rel="nofollow noreferrer">Configuring the node audit log policy</a> for more details.</p>
<p>OpenShift Container Platform provides the following predefined audit policy profiles:</p>
<ul>
<li><p><code>Default</code>
Logs only metadata for read and write requests; does not log request bodies. This is the default policy.</p>
</li>
<li><p><code>WriteRequestBodies</code>
In addition to logging metadata for all requests, logs request bodies for every write request to the API servers (create, update, patch).</p>
</li>
<li><p><code>AllRequestBodies</code>
In addition to logging metadata for all requests, logs request bodies for every read and write request to the API servers (get, list, create, update, patch).</p>
</li>
</ul>
<p>You can change the audit policy as follows,</p>
<pre><code>$ oc edit apiserver cluster
apiVersion: config.openshift.io/v1
kind: APIServer
metadata:
...
spec:
  audit:
    profile: WriteRequestBodies
</code></pre>
<p>After above changes, all kube-apiserver pods are going to restart through rolling update for taking effects.</p>
