小编jan*_*sha的帖子

参考

我想添加 audit-policy-file 参数并且文件存在于 /etc/kubernetes/audit-policy.yaml

它具有基本的元数据记录规则。

但是一旦我重新启动服务 apiserver 就不会出现。如果我将值保留为空，则它可以正常工作并登录 /var/log/containers 说文件读取失败。

{"log":"\n","stream":"stderr","time":"2018-12-24T12:23:36.82013719Z"} {"log":"错误：加载审计策略文件：失败读取文件路径\"/etc/kubernetes/audit-policy.yaml\": 打开/etc/kubernetes/audit-policy.yaml: 没有那个文件或目录\n","stream":"stderr","time" :"2018-12-24T12:23:36.820146912Z"}

[root@kube2-master containers]# kubectl version
Client Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.1", GitCommit:"eec55b9ba98609a46fee712359c7b5b365bdd920", GitTreeState:"clean", BuildDate:"2018-12-13T10:39:04Z", GoVersion:"go1.11.2", Compiler:"gc", Platform:"linux/amd64"}
Server Version: version.Info{Major:"1", Minor:"13", GitVersion:"v1.13.1", GitCommit:"eec55b9ba98609a46fee712359c7b5b365bdd920", GitTreeState:"clean", BuildDate:"2018-12-13T10:31:33Z", GoVersion:"go1.11.2", Compiler:"gc", Platform:"linux/amd64"}

[root@kube2-master containers]# cat /etc/kubernetes/audit-policy.yaml
rules:
- level: Metadata

[root@kube2-master containers]# cat /etc/kubernetes/manifests/kube-apiserver.yaml
apiVersion: v1
kind: Pod
metadata:
  annotations:
    scheduler.alpha.kubernetes.io/critical-pod: ""
  creationTimestamp: null
  labels:
    component: kube-apiserver
    tier: control-plane
  name: kube-apiserver
  namespace: kube-system
spec:
  containers:
  - command:
    - kube-apiserver
    - …