<p>I have created a k8s cluster in GKE. But I want to configure API server for k8s audit purposes so I have to set <code>--audit-policy-file</code> flag and <code>--audit-webhook-config-file</code> flags as arguments in the API server. How do I do that?</p>

<p>I am afraid it's not possible.</p>
<p>Please keep in mind that there are some differences between On-Premise Kubernetes cluster and GKE cluster. Most important is that GKE master is managed completely by Google and you cannot reach it or change anything there. For example in <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/control-plane-security#vulnerability_and_patch_management" rel="nofollow noreferrer">Vulnerability and patch management</a> documentation you can find information:</p>
<blockquote>
<p>GKE control plane components are managed by a team of Google site reliability engineers, and are kept up to date with the latest security patches. This includes patches to the host operating system, Kubernetes components, and containers running on the control plane VMs.</p>
</blockquote>
<p>In short, you cannot change <code>Audit Policy</code> for <code>GKE</code>, however in <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/audit-policy" rel="nofollow noreferrer">GKE Audit Policy</a> you have information on how it works.</p>
<p><a href="https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging" rel="nofollow noreferrer">Audit Logs</a> are pre configured by Google and the only thing you can do is filtering. There is also a <a href="https://cloud.google.com/logging/docs/audit/configure-data-access#yaml" rel="nofollow noreferrer">Data Access Log</a> which is disabled by default. You can enable it to get more information, however it's extra cost.</p>
<p>The last thing I want to mention, that there is already a <code>Feature Request</code> asking for an overwrite <code>audit-policy-file</code>. More details you can find in report - <a href="https://issuetracker.google.com/issues/185868707" rel="nofollow noreferrer">Adjusting audit log levels</a></p>
