<p>I am reviewing my rke installation:</p>
<p><a href="https://docs.rke2.io/security/cis_self_assessment123#1219" rel="nofollow noreferrer">https://docs.rke2.io/security/cis_self_assessment123#1219</a></p>
<p>The instruction works, makes sense, but shouldn't I be able to check this by running a <code>kubectl describe po -n kube-system kube-apiserver-{my-ip}</code>. I did a <code>describe po</code> on the resource, expecting to see the <code>audit-log-path</code>, but it was not there. How can I discover this setting if it isn't in the pod description. Is <code>ps</code> the best way? The only way?</p>

smuggledPancakes
<p>Audit backends stores audit logs to an external persistent storage. There are two backends available for  kube-apiserver:
Log backend, stores logs to a director in the filesystem.
Webhook backend, which pushes logs to an external storage using HTTP API.
Since you are trying to store data locally we will be using the log backend. As mentioned in the doc provided by you --audit-log-path is used for setting up the path for your audit log files and if haven’t provided any path it will go to the standard output <code>/var/log/kubernetes/audit/audit.log</code> and persistent volumes should be used for storing these logs, so you can get the path details by using below command</p>
<p><code>Kubectl get pv</code> (In most cases <em>audit</em> will be the keyword so you can find the path using this)</p>
<p>References:</p>
<ol>
<li><a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/</a></li>
<li><a href="https://www.ibm.com/docs/en/mvi/1.1.1?topic=environment-checking-kubernetes-storage-status" rel="nofollow noreferrer">https://www.ibm.com/docs/en/mvi/1.1.1?topic=environment-checking-kubernetes-storage-status</a></li>
</ol>
