<p>If someone has edit yaml or property file of any running service, then how should I know who and when edit command was used on that particular service.</p>

<p>kubectl edit deploy ServiceName -n NameSpace</p>

Sudhanshu Mishra
<p>Kubernetes audit logs should tell you that.Kubernetes auditing provides a security-relevant chronological set of records documenting the sequence of activities that have affected system by individual users, administrators or other components of the system.</p>

<p>The known audit levels are:</p>

<ol>
<li><p>None - don’t log events that match this rule.</p></li>
<li><p>Metadata - log request metadata (requesting user, timestamp, resource, verb, etc.) but not request or response body.</p></li>
<li><p>Request - log event metadata and request body but not response body. This does not apply for non-resource requests.</p></li>
<li><p>RequestResponse - log event metadata, request and response bodies. This does not apply for non-resource requests.</p></li>
</ol>

<p>You could write a audit policy like below</p>

<pre><code>apiVersion: audit.k8s.io/v1 # This is required.
kind: Policy
# Don't generate audit events for all requests in RequestReceived stage.
omitStages:
  - "RequestReceived"
rules:
  # Log deployment changes at RequestResponse level
  - level: RequestResponse
    resources:
    - group: "apps/v1"
      resources: ["deployments"]
</code></pre>

<p>You need to apply this via <code>--audit-policy-file</code> flag of kube API Server.</p>

<p>Also you can Fluentd to collect the audit logs as in this <a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/#use-fluentd-to-collect-and-distribute-audit-events-from-log-file" rel="nofollow noreferrer">guide</a></p>

<p><a href="https://kubernetes.io/docs/tasks/debug-application-cluster/audit/" rel="nofollow noreferrer">https://kubernetes.io/docs/tasks/debug-application-cluster/audit/</a></p>
