Security audit trail

[jkleinlercher]

Our security officer asks for a security audit trail for our K8s platform and especially for argo-cd since everything in our K8s Cluster can be managed by argo-cd. Anyone already needed to fullfil such requirements? Any good practices? I think such security audit trails should help with things like intrusion detection or analysing any other security relevant events concerning argo-cd (login attempts, changing permissions, roles, tokens,who changed which resource when). Does argo-cd log such events for a security audit trail?

[jgwest]

Hi @jkleinlercher, good question: I suggest checking out the section on Auditing in the Argo CD docs, which may at least partially satisfy your requirements re: application resource changes on clusters.

As for auth auditing, Argo CD does have info level logging of some of these events AFAICT, but it is all unstructured logging and thus probably not as useful for auditing purposes.