<p>Wonder if there is anyway to trace who has deleted the PVC , deployment or POD's .
I am running with issue where 2 of my Couchbase cluster(deployed in Onprem K8s cluster) with 3 nodes in each of them got deleted from 2 separate namespaces . </p>

<p>We are working in distributed framework with multiple people has access to same namespaces . curious if there is anyway to trace how this got deleted and wiped off database cluster.
the couchbase operator stay intact with POD in CrashLoopBackoff and not running state and no PVC , no deployment , no cluster found . </p>

<p>thanks</p>

pauldx
<p>You can use <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">Auditing</a></p>

<blockquote>
  <p>Kubernetes auditing provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system. It allows cluster administrator to answer the following questions:</p>
  
  <ul>
  <li>what happened?</li>
  <li>when did it happen?</li>
  <li>who initiated it?</li>
  <li>on what did it happen?</li>
  <li>where was it observed?</li>
  <li>from where was it initiated?</li>
  <li>to where was it going?</li>
  </ul>
</blockquote>
