Hands-on Lab·Certified Kubernetes Security Specialist
Querying Kubernetes Audit Logs
An audit log is a haystack by design. This guide does five ordinary things to a cluster and then finds each of them again, which is the skill the competency is actually about.
Monitoring and Runtime Guide 33 of 40 Advanced
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1 - tunnel/VXLAN, with Hubble relay and UI
- Host OSUbuntu 26.04 LTS, kernel 7.0.0-29
- Built withkubeadm v1.36.3 - podSubnet 10.244.0.0/16, serviceSubnet 10.96.0.0/12
- TimeAbout 18 min
- Reviewed25 August 2026
Written against the versions above. The same cka8001 apiserver, with audit logging on from the previous guide. The query helper is thirty lines of Python and is on the page.
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA8001 | 192.168.0.56 | Ubuntu 26.04 LTS | Single Node (control plane, untainted) | 2 Core | 4 GB | 50 GB |
Before you start
- guide 32 - this guide reads what that one switched on.
-
Do five things worth finding later
-
Why filtering by resource is not the query
-
The one that matters most
-
What it costs, and putting it back