Which step must be taken to enable Kubernetes auditing on a Tanzu Kubernetes cluster?

In VMware Tanzu Kubernetes Grid (TKG), cluster features are configured declaratively using a cluster configuration file before deployment. To enable the Kubernetes API server audit logging feature, the ENABLEAUDITLOGGING configuration variable must be set to true in the cluster's YAML manifest. This setting instructs the TKG control plane to configure the Kubernetes API server on the cluster with the necessary flags to activate audit logging upon creation. This declarative approach ensures consistent and reproducible cluster configurations, which is a core principle of infrastructure-as-code.

B. The auditd service is a general-purpose Linux system auditing daemon, which is distinct from the Kubernetes API server's specific audit logging functionality.

C. Kubernetes audit logging is disabled by default in Tanzu Kubernetes clusters to conserve storage and compute resources, as it can generate a high volume of log data.

D. While Kubernetes uses an audit policy file, enabling the feature is not done by setting a variable within this file. Configuration in TKG is managed declaratively through the cluster manifest, not by manually editing files on control plane nodes.

1. VMware Tanzu Kubernetes Grid Documentation: Configure Audit Logging for a Tanzu Kubernetes Cluster. This official document explicitly states

"To enable Kubernetes API server audit logging on a workload cluster

set the ENABLEAUDITLOGGING variable to true in the cluster configuration file before you deploy the cluster." It also confirms the default value is false. (Refer to the section "Enable and Disable Audit Logging").

2. VMware Tanzu Kubernetes Grid Documentation: Configuration File Variable Reference. This reference guide lists ENABLEAUDITLOGGING as the specific variable for this purpose. It describes its function: "Set to true to enable audit logging for the Kubernetes API server." (Refer to the table of configuration variables under the "Audit Logging" or similar section).