<p>Need to define RBAC based on the audit log. This can be a regular process to onboard a team and provide access.</p>

<p>I find audit2rbac tool simple and clear to use. </p>

<p>Need guidance wrt kubernetes service on azure.</p>

atul sahu
<p>Here is an example query for getting audit logs from Azure Log Analytics.</p>
<p>It removes some of the noise to try and give just logs for when a user has modified a resource in Kubernetes. The requestURI and requestObject fields will give you the most info about what the user was doing.</p>
<pre><code>AzureDiagnostics
| where Category == &quot;kube-audit&quot;
| extend log_j=parse_json(log_s) 
| extend requestURI=log_j.requestURI 
| extend verb=log_j.verb 
| extend username=log_j.user.username
| extend requestObject = parse_json(log_j.requestObject)
| where verb !in (&quot;get&quot;, &quot;list&quot;, &quot;watch&quot;, &quot;&quot;)
| where username !in (&quot;aksService&quot;, &quot;masterclient&quot;, &quot;nodeclient&quot;)
| where username !startswith &quot;system:serviceaccount:kube-system&quot;
| where requestURI startswith &quot;/api/&quot;
| where requestURI !startswith &quot;/api/v1/nodes/&quot;
| where requestURI !startswith &quot;/api/v1/namespaces/kube-system/&quot;
| where requestURI !startswith &quot;/api/v1/namespaces/ingress-basic/&quot;
</code></pre>
