How to Determine If Someone Deleted a Kubernetes Resource Using CLI

 

How to Detect Kubernetes Resource Deletion Using CLI

Have you noticed unexpected changes in your Kubernetes cluster? Want to check if someone deleted a resource using the kubectl CLI? Here’s a step-by-step guide to help you find out!

Check Kubernetes Audit Logs

The first step is to check the Kubernetes audit logs, which record every action performed within the cluster.

kubectl logs -n kube-system kube-apiserver -f

Look for DELETE actions in the logs. These entries will show who deleted the resource and when.

Use Kubectl to Check Event History

Run the following command to check for deletion events:

kubectl get events --sort-by='.lastTimestamp'

This command will show recent events, including deletion actions.

Enable Logging for Better Tracking

If audit logging is not enabled, you can turn it on by modifying your Kubernetes API server settings.

Check Role-Based Access Control (RBAC) Policies

To see who has permission to delete resources, use:

kubectl get roles -A

🛡️ Secure Your Cluster!

To prevent unauthorized deletions, consider:

• Enabling role-based access control (RBAC)
• Setting up audit logging
• Using monitoring tools like Prometheus

Secure Your Cluster Now

📌 Final Thoughts

By following these steps, you can easily determine if someone deleted a Kubernetes resource using the CLI. Stay secure, monitor logs, and protect your cluster!

Get Security Tools Now