Kubernetes Audit Policy is one of those artifacts that gets written once during initial cluster setup and then lives unchanged for years, gradually accumulating exceptions for new components and rarely undergoing a complete review.
In practice this turns the policy from a security control into an archaeological layer filled with comments such as "# temporary, TODO remove" that are three years old or older.
Recently the author re-examined their own configuration file, which had grown to approximately 580 lines. The policy was assembled from several sources, with the Kubernetes Threat Matrix serving as the main reference.
This origin explains why many rules are not limited to noise reduction but are specifically aimed at catching security-significant actions, including changes to RBAC objects and deletion of events.
The article stresses that without periodic holistic reviews, audit policies lose their effectiveness and fail to provide meaningful detection against targeted threats.
