<p>In minikube, API server fails to connect to my audit log webhook, I see the following error in the api-server logs</p>
<pre><code>E0308 08:30:26.457841       1 metrics.go:109] Error in audit plugin 'webhook' affecting 400 audit events: Post &quot;http://ca-audit.armo-system:8888/&quot;: dial tcp: lookup ca-audit.armo-system on 10.42.4.254:53: no such host
</code></pre>
<p>I dont know why the api-server is connecting to <code>10.42.4.254:53</code> since my service ip is different:</p>
<pre><code>$ kubectl -n armo-system get services
NAME       TYPE        CLUSTER-IP       EXTERNAL-IP   PORT(S)    AGE
ca-audit   ClusterIP   10.109.132.114   &lt;none&gt;        8888/TCP   8m33s
</code></pre>
<p>I do not understand what I'm doing wrong, any suggestions?</p>
<hr />
<p>This is how I configured my audit policy, webhook and minikube-</p>
<p>I pre-configured my minikube as following:</p>
<pre><code># Create the webhook config and audit policy
export C_CONTEXT=$(kubectl config current-context)
export C_NAME=$(kubectl config get-contexts ${C_CONTEXT} --no-headers | awk '{print $2}')
export C_CLUSTER=$(kubectl config get-contexts ${C_CONTEXT} --no-headers | awk '{print $3}')
export C_USER=$(kubectl config get-contexts ${C_CONTEXT} --no-headers | awk '{print $4}')

export ARMO_NAMESPACE=&quot;armo-system&quot;
export ARMO_AUDIT_SERVICE=&quot;ca-audit&quot;
export ARMO_AUDIT_PORT=8888

mkdir -p ~/.minikube/files/etc/ssl/certs

cat &lt;&lt;EOF &gt; ~/.minikube/files/etc/ssl/certs/audit-webhook.yaml
{
  &quot;apiVersion&quot;: &quot;v1&quot;,
  &quot;clusters&quot;: [
    {
      &quot;cluster&quot;: {
        &quot;server&quot;: &quot;http://${ARMO_AUDIT_SERVICE}.${ARMO_NAMESPACE}:${ARMO_AUDIT_PORT}/&quot;
      },
      &quot;name&quot;: &quot;${C_NAME}&quot;
    }
  ],
  &quot;contexts&quot;: [
    {
      &quot;context&quot;: {
        &quot;cluster&quot;: &quot;${C_CLUSTER}&quot;,
        &quot;user&quot;: &quot;${C_USER}&quot;
      },
      &quot;name&quot;: &quot;${C_NAME}&quot;
    }
  ],
  &quot;current-context&quot;: &quot;${C_CONTEXT}&quot;,
  &quot;kind&quot;: &quot;Config&quot;,
  &quot;preferences&quot;: {},
  &quot;users&quot;: []
}
EOF

cat &lt;&lt;EOF &gt; ~/.minikube/files/etc/ssl/certs/audit-policy.yaml
{
  &quot;apiVersion&quot;: &quot;audit.k8s.io/v1&quot;,
  &quot;kind&quot;: &quot;Policy&quot;,
  &quot;rules&quot;: [
    {
      &quot;level&quot;: &quot;Metadata&quot;
    }
  ]
}
EOF

# Copy the audit policy to `/etc/ssl/certs/.` 
sudo cp ~/.minikube/files/etc/ssl/certs/audit-policy.yaml ~/.minikube/files/etc/ssl/certs/audit-webhook.yaml /etc/ssl/certs/.

# Start the minikube, add the flags `--extra-config=apiserver.audit-policy-file=/etc/ssl/certs/audit-policy.yaml`, `--extra-config=apiserver.audit-webhook-config-file=/etc/ssl/certs/audit-webhook.yaml`
sudo -E minikube start --vm-driver=none --extra-config=apiserver.audit-policy-file=/etc/ssl/certs/audit-policy.yaml --extra-config=apiserver.audit-webhook-config-file=/etc/ssl/certs/audit-webhook.yaml

</code></pre>
<p>Now that my minikube is up and running, I created the namespace, service and webhook deployment:</p>
<pre><code>cat &lt;&lt;EOF | kubectl apply -f -
---
apiVersion: v1
kind: Namespace
metadata:
  name: ${ARMO_NAMESPACE}

---
kind: Service
apiVersion: v1
metadata:
  labels:
    app: ${ARMO_AUDIT_SERVICE}
  name: ${ARMO_AUDIT_SERVICE}
  namespace: ${ARMO_NAMESPACE}
spec:
  ports:
  - port: ${ARMO_AUDIT_PORT}
    targetPort: ${ARMO_AUDIT_PORT}
    protocol: TCP
  selector:
    app: ${ARMO_AUDIT_SERVICE}
---
apiVersion: apps/v1
kind: Deployment
metadata:
    name: ${ARMO_AUDIT_SERVICE}
    namespace: ${ARMO_NAMESPACE}
    labels:
      app: ${ARMO_AUDIT_SERVICE}
spec:
  selector:
    matchLabels:
      app: ${ARMO_AUDIT_SERVICE}
  replicas: 1
  template:
    metadata:
      labels:
        app: ${ARMO_AUDIT_SERVICE}
    spec:
      containers:
        - name: ${ARMO_AUDIT_SERVICE}
          image: quay.io/armosec/k8s-ca-auditlog-ubi:dummy
          imagePullPolicy: Always
          env:
          - name: ARMO_AUDIT_PORT
            value: &quot;${ARMO_AUDIT_PORT}&quot;
          ports:
          - containerPort: ${ARMO_AUDIT_PORT}
            name: ${ARMO_AUDIT_SERVICE}
EOF
</code></pre>
<p>The webhook image code (<code>quay.io/armosec/k8s-ca-auditlog-ubi:dummy</code>) is as following:</p>
<pre><code>package main

import (
  &quot;encoding/json&quot;
  &quot;flag&quot;
  &quot;fmt&quot;
  &quot;net/http&quot;
  &quot;os&quot;

  &quot;k8s.io/apiserver/pkg/apis/audit&quot;

  &quot;github.com/golang/glog&quot;
)

func main() {
  flag.Parse()
  flag.Set(&quot;alsologtostderr&quot;, &quot;1&quot;) // display logs in stdout

  InitServer()

}

// InitServer - Initialize webhook listener
func InitServer() {
  port, ok := os.LookupEnv(&quot;ARMO_AUDIT_PORT&quot;)
  if !ok {
    port = &quot;8888&quot;
  }
  glog.Infof(&quot;Webhook listening on port: %s, path: %s&quot;, port, &quot;/&quot;)
  http.HandleFunc(&quot;/&quot;, HandleRequest)
  glog.Fatal(http.ListenAndServe(fmt.Sprintf(&quot;:%s&quot;, port), nil))
}

//HandleRequest -
func HandleRequest(w http.ResponseWriter, req *http.Request) {
  eventList := audit.EventList{}
  err := json.NewDecoder(req.Body).Decode(&amp;eventList)
  if err != nil {
    e := fmt.Errorf(&quot;failed parsing api-server request, reason: %s&quot;, err.Error())
    glog.Errorf(e.Error())
    http.Error(w, e.Error(), http.StatusBadRequest)
    return
  }
  glog.Infof(&quot;webhook received audit list, len: %d&quot;, len(eventList.Items))
  for _, event := range eventList.Items {
    bEvent, _ := json.Marshal(event)
    glog.Infof(&quot;Received event: %s&quot;, string(bEvent))
  }

  w.WriteHeader(http.StatusOK)
}
</code></pre>

David Wer
<p>Actually I don't know well about minikube but I have used audit for k8s so my answer wouldn't be help for minikube environment.</p>
<p><em>First</em>, k8s dns format is incorrect. It should be <strong>{service-name}.{namespace}.svc or {service-name}.{namespace}.svc.cluster.local</strong>. Of course, http:// or https:// can be added also.</p>
<p><em>Second</em>, you should give dnsPolicy option <strong>kube-apiserver.yaml</strong>.
To make kube-apiserver search dns resolution in cluster, 'dnsPolicy' should be written.</p>
<pre><code>sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
</code></pre>
<p>open kube-apiserver.yaml and add <strong>dnsPolicy: ClusterFirstWithHostNet</strong> to it .
The location of dnsPolicy is below .spec and same level with containers or volumes</p>
