The Kubernetes Audit Subsystem is the de-facto standard for answering the ‘who what where why and how’ of things that are interacting with you cluster API. It’s an invaluable tool in the belt of a cluster operator. In this post, we explore an innovative way to receive these events with a RESTful API service, instead of collecting files on disk.

Webhook Back End

The Webhook back end is a very useful, though lightly documented feature that enables the K8’s control plane to stream audit events as they are generated.