🔴 Auditing GKE operations? Configure Data Access audit logs

The GKE Admin Activity logs are missing "get" operations on Secret objects by default. So for example, if you store a service account password in your cluster as a Kubernetes secret, a "kubectl get secret service_account_password -o yaml" will get an attacker the entire secret without logging a single line into the audit logs.

https://padlock.argh.in/2022/02/10/gke-audit.html

#gcp