<p>I want to log activity of users in k8s. I want to log each users that exec commands in pods. for example if a user has username 'user01' in k8s (or openshift) and executes 'whoami' in a pod, I want to log this activity with username 'user01'.</p>
<p>I explored Tetragon and Falco. these tools cannot give me k8s username. they just give real and effective user in pod.
k8s audit log stores username but it does not store whole activity.</p>

Michael Cab
<p>Hey the pod is the smalles unit in kubernetes. The Container that the pod is wrapping does not know about K8s It only have its own users and whatever you configure on application level.</p>
<p>I assume you want to know which k8s user does what, specifically on the pod it he uses <em>kubeclt exec bla -- /bin/sh</em> ?</p>
<p>Since this would be a very specific usecase you have to find a workaround for you.</p>
<p><strong>Solution:</strong>
One possible way to achive this to publish the container logs and the k8s audit log together to your distributed logging system like elastic &amp; kibana. And from that point you can search by correlation. E.g. you have the k8s logs where you can see the container and the k8s user and you can join them with the logs that are performed on this specific container.</p>
