diff --git a/content/en/docs/tasks/debug-application-cluster/audit.md b/content/en/docs/tasks/debug-application-cluster/audit.md index 600af51d00..5e435ba32d 100644 --- a/content/en/docs/tasks/debug-application-cluster/audit.md +++ b/content/en/docs/tasks/debug-application-cluster/audit.md @@ -133,6 +133,39 @@ log audit backend using the following [kube-apiserver][kube-apiserver] flags: - `--audit-log-maxbackup` defines the maximum number of audit log files to retain - `--audit-log-maxsize` defines the maximum size in megabytes of the audit log file before it gets rotated +{{< note >}} +In case kube-apiserver is configured as a Pod,remember to mount the hostPath to the localtion of the policy file and log file. For example, +` +--audit-policy-file=/etc/kubernetes/audit-policy.yaml +--audit-log-path=/var/log/audit.log +` +then mount the volumes: + + +``` +- mountPath: /etc/kubernetes/audit-policy.yaml + name: audit + readOnly: true + - mountPath: /var/log/audit.log + name: audit-log + readOnly: false +``` +finally the hostPath: + +``` +- hostPath: + path: /etc/kubernetes/audit-policy.yaml + type: File + name: audit + - hostPath: + path: /var/log/audit.log + type: FileOrCreate + name: audit-log + +``` + + +{{< /note >}} ### Webhook backend Webhook backend sends audit events to a remote API, which is assumed to be the