Enabling Kubernetes auditing on RKE2 cluster

While Sisense Audit logs provide a lot of information about changes in the application, there might arise a need of auditing Kubernetes cluster to investigate different cases.

Here the Kubernetes auditing steps in. It generates audit events from the kube-apiserver requests as per set Policy, which can restrict unneeded data from populating the logs.

Below is an example on how to enable auditing with reasonable Policy on your single-node RKE2 deployment, you can edit the Policy as per your needs.

Create the "audit-policy.yaml" file in the /etc/kubernetes/ directory:

sudo vi /etc/kubernetes/audit-policy.yaml

Paste the below config, save and exit

apiVersion: audit.k8s.io/v1
kind: Policy
rules:
# Drop some common events from the standard APIs
- level: None
  resources:
  - group: ""
    resources: ["events"]
  - group: "coordination.k8s.io"
    resources: ["leases"]

# Drop all of the internal system processing commands
- level: None
  users: 
     - "system:serviceaccount:kube-system:generic-garbage-collector"
     - "system:serviceaccount:kube-system:namespace-controller"

# Dont log anything for system secrets
- level: None
  users: 
     - "system:kube-controller-manager"
     - "system:apiserver"
  resources:
  - group: ""
    resources: ["secrets", "configmaps", "serviceaccounts/token"]

- level: None
  userGroups: ["system:nodes"]
  resources:
  - group: ""
    resources: ["secrets", "configmaps", "serviceaccounts/token"]

#log only metadata for secrest
- level: Metadata
  resources:
  - group: ""
    resources: ["configmaps", "secrets", "serviceaccounts/token"]
  omitStages:
    - "RequestReceived"

# Log pod executions (kubectl exec, attach, port-forward)
- level: RequestResponse
  resources:
    - group: ""
      resources: ["pods/exec", "pods/attach", "pods/portforward"]

# Ignore logs for non modifying commands. This can save extra logs but you wont pickup any unauthoized calls which you may want to know about
- level: None
  verbs: ["get", "watch", "list"]

#Log the full request response for common cluster operations
- level: RequestResponse
  verbs: ["create", "delete", "update", "patch", "deletecollection"]
  resources:
      - group: ""
      - group: "admissionregistration.k8s.io"
      - group: "apiextensions.k8s.io"
      - group: "apiregistration.k8s.io"
      - group: "apps"
      - group: "authentication.k8s.io"
      - group: "authorization.k8s.io"
      - group: "autoscaling"
      - group: "batch"
      - group: "certificates.k8s.io"
      - group: "extensions"
      - group: "metrics.k8s.io"
      - group: "networking.k8s.io"
      - group: "policy"
      - group: "rbac.authorization.k8s.io"
      - group: "scheduling.k8s.io"
      - group: "settings.k8s.io"
      - group: "storage.k8s.io"
  omitStages:
      - "RequestReceived"

- level: Metadata
  omitStages:
    - "RequestReceived"

Open the the RKE2 config file in the editor:

sudo vi /etc/rancher/rke2/config.yaml

Find the "API Server settings" and add the following line:

- "audit-policy-file=/etc/kubernetes/audit-policy.yaml"

The resulting config in this part should be like below:

# API Server settings
kube-apiserver-arg:
  - "anonymous-auth=false"
  - "audit-log-path=/var/log/kube-audit/audit-log.json"
  - "audit-log-maxage=30"
  - "audit-log-maxbackup=5"
  - "audit-log-maxsize=100"
  - "audit-log-format=json"
  - "audit-policy-file=/etc/kubernetes/audit-policy.yaml"   <================= THIS LINE WAS ADDED
  - "delete-collection-workers=3"
  - "kubelet-preferred-address-types=InternalDNS,InternalIP,Hostname,ExternalDNS,ExternalIP"
  - "v=1"

# Controller manager settings

You might also need to set the retention policy as per your needs (see the useful links at the end)
Save and exit
Restart RKE2 server:

sudo systemctl restart rke2-server

The logs in the /var/log/kube-audit/ directory should start populating with the data:

ls -lah /var/log/kube-audit/
total 125M
drwxr-xr-x  2 root root   4.0K Sep 17 12:31 .
drwxr-xr-x 16 root syslog 4.0K Sep 17 06:26 ..
-rw-------  1 root root   100M Sep 17 12:31 audit-log-2026-09-17T12-31-13.691.json
-rw-------  1 root root    25M Sep 17 16:25 audit-log.json

Useful links:

General information about Audit log setup
https://medium.com/@techpaul/my-favourite-kubernetes-audit-log-policy-385ab8a4200a
Audit log configuration
https://rke.docs.rancher.com/config-options/audit-log
How to update arguments in the kune-apiserver
https://support.scc.suse.com/s/kb/How-to-Update-or-Add-Arguments-to-the-kube-apiserver-in-RKE2-and-K3s-Clusters?language=en_US

Andriy Soroka

Posted Sep 17, 2026 at 5:39 PM

0 comments