<p>Using Kubernetes' <code>kubectl</code> I can execute arbitrary commands on any pod such as <code>kubectl exec pod-id-here -c container-id -- malicious_command --steal=creditcards</code></p>

<p>Should that ever happen, I would need to be able to pull up a log saying who executed the command and what command they executed. This includes if they decided to run something else by simply running <code>/bin/bash</code> and then stealing data through the tty.</p>

<p>How would I see which authenticated user executed the command as well as the command they executed?</p>

<p>Audit logging is not currently offered, but the Kubernetes community <a href="https://github.com/kubernetes/features/issues/22" rel="nofollow">is working to get it available in the 1.4 release</a>, which should come around the end of September.</p>
