<p>I deployed a deployment <code>nginx</code> in Kubernetes cluster as below.
The deployments shows as below:</p>

<pre><code>[root@iZwz97twzbvh62zh76pk8zZ zzx]# k get deployment nginx
NAME    DESIRED   CURRENT   UP-TO-DATE   AVAILABLE   AGE
nginx   2         2         2            1           7s
</code></pre>

<p>The deployment template is as below:</p>

<pre><code>apiVersion: apps/v1 # for versions before 1.9.0 use apps/v1beta2
kind: Deployment
metadata:
  name: nginx
spec:
  selector:
    matchLabels:
      app: nginx
  replicas: 2 # tells deployment to run 2 pods matching the template
  template:
    metadata:
      labels:
        app: nginx
    spec:
      containers:
      - name: nginx
        image: nginx:1.17.0
        ports:
        - containerPort: 80
</code></pre>

<p>Somehow the deployment <code>nginx</code> was gone, I wonder whether there is any place which tracked the ‘gone/delete’ operation? </p>

zzxwill
<p>There has to be another audit log, related to the user operation that trigger initially 'delete deployment' action on your Kubernetes cluster.</p>

<p>The audit log you pasted is only a part of this delete operation chain, coming from system component: kubelet, responsible for deleting Pods -> ReplicaSet belonging to your Deployment resource.  </p>

<p>So look for audit log containing this piece of information:</p>

<pre><code>  authorizationInfo: [
   0: {
    granted:  true     
    permission:  "io.k8s.extensions.v1beta1.deployments.delete"
    resource:  "extensions/v1beta1/namespaces/default/deployments/nginx"     
   }
 ]
</code></pre>
