<p>I have added the following command-line arguments to <code>kube-apiserver</code> to enable audit logging:</p>

<pre><code>- --audit-log-path=/tmp/k8s-audit.log
- --audit-policy-file=/etc/kubernetes/audit.yaml
- --audit-log-maxage=1
- --audit-log-maxsize=100
- --audit-log-maxbackup=1
</code></pre>

<p>The contents of <code>/etc/kubernetes/audit.yaml</code> is:</p>

<pre><code>apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - "ResponseStarted"
  - "ResponseComplete"
rules:
  - level: RequestResponse
</code></pre>

<p>I have run a command with verbose logging, so that I can see the request body:</p>

<pre><code>$ kubectl --v=10 uncordon cluster-worker2
</code></pre>

<p>And the kubectl command logs the request body as follows:</p>

<pre><code>I0328 09:00:07.591869   47228 request.go:942] Request Body: {"spec":{"unschedulable":null}}
</code></pre>

<p>But I don't see this request body anywhere in the audit log file on the kubernetes server. What's wrong with my configuration?</p>

Robin Green
<p>The request is actually only logged in the <code>ResponseComplete</code> stage, somewhat unexpectedly. Even though Kubernetes <em>could</em> theoretically log the request as soon as it receives it, it doesn't.</p>

<p>So it's necessary to remove the <code>ResponseComplete</code> line from the <code>omitstages</code> in the policy configuration file (<code>audit.yaml</code>).</p>
