Audit logs in OpenShift are the single source of truth when every container, pod, and API call could matter. They capture each request to the API server, every create, modify, and delete action across the cluster. Without them, you’re blind to unauthorized access, broken automation, or security incidents that vanish without a trace.
OpenShift audit logs track four key things:
- What happened – Requests and responses at the API server
- Who made the request – Service accounts, users, or automation
- When it happened – Precise timestamps for event correlation
- From where – IP address and source of the action
By default, OpenShift uses the Kubernetes audit logging framework, but it extends it for enterprise environments. This means you can capture high-volume, granular events while still applying fine control over what’s logged to avoid performance overhead. The AuditConfig in OpenShift’s master configuration lets you define audit policies, output formats, and storage location. You can log to JSON for detailed parsing or plaintext for quick inspection.
For deep visibility, fine-tune audit policies. Set RequestReceived level to catch every inbound request. Use Metadata or RequestResponse if you need the full payload of API calls. Make sure logs are shipped to secure storage — built-in file logging works, but external systems like ELK, Splunk, or cloud-native log aggregators make indexing and searching easier.
Security teams use these audit trails to detect anomalies, trace privilege escalations, or confirm compliance. Engineers use them to debug automation gone wrong or confirm the source of failing deployments. Managers depend on them to meet regulatory requirements without guessing.
If you ignore audit logs, you risk losing forensic proof in an incident. If you configure them well, you gain clarity, accountability, and control over your OpenShift environment. They are not optional. They are foundational.
You don’t need weeks to verify your own setup. You can see live audit logging in action in minutes with hoop.dev — connect, observe, and search your own secure audit stream without rebuilding your cluster.