<p>I am currently trying to enable and configure audit logs in a k3s cluster.
Currently, I am using k3d to set up my k3s cluster. Is there a way how to configure the audit logging?</p>
<p>I know you can parse k3s server args when creating a cluster with k3d. So, I tried it with this:</p>
<pre><code>k3d cluster create test-cluster --k3s-server-arg '--kube-apiserver-arg=audit-log-path=/var/log/kubernetes/apiserver/audit.log' --k3s-server-arg '--kube-apiserver-arg=audit-policy-file=/etc/kubernetes/audit-policies/policy.yaml'
</code></pre>
<p>The obvious problem is that the audit policy does not exist at the cluster until now. Thus it crashes when creating the cluster.</p>
<p>Also tried it, with setting up the cluster using:</p>
<pre><code>k3d cluster create test-cluster --k3s-server-arg '--kube-apiserver-arg=audit-log-path=/var/log/kubernetes/apiserver/audit.log'
</code></pre>
<p>Then ssh onto the master node, created the policy file in the wanted dir, but then I cannot find a way to set the cluster variable <code>audit-log-path</code> to this directory. And thus, the policies will not apply.</p>
<p>Doing this with minikube is quite simple (since it is also documented), but I couldn't get it to work with k3d - There is also nothing regards to this in the docs.
But I am sure, there has to be a way how to configure audit-logs on k3s, without using a third-party-app like <code>Falco</code>.</p>
<p>Has someone an idea of how to solve the problem? Or want to share some experiences doing similar?</p>

Jeremy Harisch
<p>I used following command to create cluster with auditlog functionality. I used volumes to provide policy file to cluster. I think it requires both audit-policy-file and audit-log-path variables to be set.</p>
<pre><code>k3d cluster create test-cluster \\
  --k3s-arg '--kube-apiserver-arg=audit-policy-file=/var/lib/rancher/k3s/server/manifests/audit.yaml@server:*' \\
  --k3s-arg '--kube-apiserver-arg=audit-log-path=/var/log/kubernetes/audit/audit.log@server:*' \\
  --volume &quot;$(pwd)/audit/audit.yaml:/var/lib/rancher/k3s/server/manifests/audit.yaml&quot; 
</code></pre>
