Enabling KubeArmor logging
By default, KubeArmor is not enabled to log events or alerts to STDOUT. Later in the chapter, we will go over how to watch logging events in the console interactively, which is useful for troubleshooting issues with policies in real time, but it is not an efficient way to log a history of policy events.
Most logging solutions made for Kubernetes will pick up logged events from STDOUT and STDERROR. By enabling KubeArmor’s logging options, you will have a history of events in your standard logging solution. Using these events, you can create alerts and produce a history of changes and events when a security audit occurs.
KubeArmor offers three events that can be logged:
- Alert: When a policy is violated, an event will be logged with information including the action, policy name, pod name, namespace, and more
- Log: Creates a log event when a pod executes a syscall, file access, process creation, network socket events, etc ...
