<p>How to pass on my own kubernetes audit policy yaml to the GKE master node?</p>
<p>For self-managed kubernetes, we can ssh into master node and pass the policy yaml into <code>/etc/kubernetes/manifests/kube-apiserver.yaml</code>. How could we achieve the same in GKE?</p>

kristen_1024
<p>For creating or updating an <a href="https://cloud.google.com/kubernetes-engine/docs/concepts/audit-policy#kubernetes_audit_policy" rel="nofollow noreferrer">audit policy</a> you have to set <code>--audit-policy-file flag</code> and <code>--audit-webhook-config-file</code> flags as arguments in the API server.</p>
<p>Google manages GKE master completely and you cannot reach it or update it.Currently, it's impossible to update cluster networks and remove tags for existing clusters using the gcloud command. I have verified this information using the gcloud container clusters update command <a href="https://cloud.google.com/sdk/gcloud/reference/container/clusters/update" rel="nofollow noreferrer">documentation</a>.</p>
<p>Instead you can filter the audit logs in the Cloud Console, the Logs page has two filtering interfaces: basic and advanced. For information about the two filtering interfaces, <a href="https://cloud.google.com/kubernetes-engine/docs/how-to/audit-logging#basic_and_advanced_filter_interfaces" rel="nofollow noreferrer">see Logs Viewer filter interfaces</a>.</p>
<p>There is a <a href="https://issuetracker.google.com/issues/185868707" rel="nofollow noreferrer">feature request</a> on it, check it and raise a new request if you need it by using the <a href="https://cloud.google.com/support/docs/issue-trackers" rel="nofollow noreferrer">issue tracker</a>.</p>
