<p>I want to enable dynamic auditing in GKE and send logs to some endpoint.
How can I enable it?</p>

<p><a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#dynamic-backend" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#dynamic-backend</a></p>

<p>According to official doc I need to restart the api server with mentioned flag. But I am not able to access kube-api server pod in GKE</p>

<p>Need to set these 3 flags</p>

<pre><code>--audit-dynamic-configuratio
--feature-gates=DynamicAuditing=true
--runtime-config=auditregistration.k8s.io/v1alpha1=true
</code></pre>

<p>I am expecting it to enable dynamic auditing.</p>

<p>Consider that GKE is a managed version of Kubernetes and the kube-api server is completely managed by Google, so there is no way to pass these flags and restart the server.</p>

<p>However, GKE is constantly implementing the new features released in the Open Source version of Kubernetes, and such flags might be enabled by default on an <a href="https://cloud.google.com/kubernetes-engine/docs/release-notes" rel="noreferrer">oncoming version</a>.</p>

<p>Unfortunately for this in specific, doesn't seem to be the case (<a href="https://cloud.google.com/kubernetes-engine/docs/concepts/alpha-clusters#about_feature_stages" rel="noreferrer">not even for alpha clusters</a>). If you check the API resources enabled with <code>kubectl api-resources</code>, you'll notice that there is no <a href="https://kubernetes.io/docs/reference/generated/kubernetes-api/v1.13/#auditsink-v1alpha1-auditregistration" rel="noreferrer"><code>auditregistration.k8s.io</code></a>.</p>

<p>Furthermore, this feature has <a href="https://kubernetes.io/docs/concepts/extend-kubernetes/api-extension/custom-resources/" rel="noreferrer">CRDs kinds</a> (<code>AuditSink</code>) not available in GKE yet.</p>

<p>At this point, you can either wait for the feature to be rolled out on GKE or switch to the Open Source version.</p>
