A GUIDE TO KUBERNETES LOGS THAT ISN'T A VENDOR PITCH

Summary from the TLDR InfoSec newsletter

This post explains logging in Kubernetes clusters using the 4Cs of cloud-native security framework. Code level logging can be achieved with sidecar pods. Cloud level logging relies on the specific cloud's services (for example CloudTrail on AWS). Container level logging isn't generally helpful for security. The post contains a deep dive into using and enabling AuditPolicy to collect logs at the cluster level.