KUBERNETES AUDIT LOG “GOTCHAS”

Summary from the TLDR InfoSec newsletter

Kubernetes provides robust audit logs essential for investigations. This post outlines common issues with cloud providers, including inconsistent logging policies, vendor modifications to Kubernetes logs, and cloud providers controlling audit policies. Use dynamic admission controllers and cloud-specific logs like CloudTrail, or VPC Flow Logs to address these issues.