diff --git a/scripts/config/kind/audit-config.yaml b/scripts/config/kind/audit-config.yaml new file mode 100644 index 0000000000..5b22c9b104 --- /dev/null +++ b/scripts/config/kind/audit-config.yaml @@ -0,0 +1,29 @@ +kind: Cluster +apiVersion: kind.x-k8s.io/v1alpha4 +nodes: +- role: control-plane + kubeadmConfigPatches: + - | + kind: ClusterConfiguration + apiServer: + # enable auditing flags on the API server + extraArgs: + audit-log-path: /var/log/kubernetes/kube-apiserver-audit.log + audit-policy-file: /etc/kubernetes/policies/audit-policy.yaml + # mount new files / directories on the control plane + extraVolumes: + - name: audit-policies + hostPath: /etc/kubernetes/policies + mountPath: /etc/kubernetes/policies + readOnly: true + pathType: "DirectoryOrCreate" + - name: "audit-logs" + hostPath: "/var/log/kubernetes" + mountPath: "/var/log/kubernetes" + readOnly: false + pathType: DirectoryOrCreate + # mount the local file on the control plane + extraMounts: + - hostPath: ./scripts/config/kind/audit-policy.yaml + containerPath: /etc/kubernetes/policies/audit-policy.yaml + readOnly: true diff --git a/scripts/config/kind/audit-policy.yaml b/scripts/config/kind/audit-policy.yaml new file mode 100644 index 0000000000..0aa9818479 --- /dev/null +++ b/scripts/config/kind/audit-policy.yaml @@ -0,0 +1,7 @@ +apiVersion: audit.k8s.io/v1 +kind: Policy +rules: +- level: RequestResponse + resources: + - group: "kyverno.io" + resources: ["policies", "clusterpolicies"]