Auditing and monitoring secret usage

To record and monitor ongoing activities on a Kubernetes cluster, we have the option of auditing. Events that happen in a Kubernetes cluster are sent to the output stream or saved as logs; this makes it feasible to identify what happened in our system.

In our case, we want to monitor our secret usage. To avoid the overhead of other activities, we will focus only on audits generated for Secrets.

The audit configuration to enable audits on Secrets should be the following:

apiVersion: audit.k8s.io/v1
kind: Policy
omitStages:
  - "RequestReceived"
rules:
  - level: Metadata
    resources:
    - group: ""
      resources: ["secrets"]

On a Kubernetes installation, this can be achieved by using the --audit-policy-file flag and passing it when running kube-apiserver:

kube-apiserver --audit-policy-file=/path/to/audit-policy...