This effort is related to https://docs.google.com/document/d/1hhogXnGPG_hHanB10TJBZof6eNlbDQOsJpiP_9CZfZU/edit?usp=sharing, OBSDA-541.

1. We should check:

• Write a Policy which enforces a high Audit-Level on the Cluster: https://docs.openshift.com/container-platform/4.14/security/audit-log-policy-config.html
• Configure AuditLogging is part of our openshift-best-practices PolicySet: https://github.com/open-cluster-management-io/policy-collection/blob/main/policygenerator/policy-sets/community/ocp-best-practices/input-audit/policy-config-audit.yaml
• OpenShift Service Log (which doubles up as a kind of Event Store as well) has a simple API where changes could be pushed by other sources.
• A changelog service: https://changelog.stage.devshift.net/services/host-inventory where for example changes are being pushed from Terraform

2. Identify what actions need to be monitored

—

Design document: https://docs.google.com/document/d/1aN_TunfOp6gXhpQU4YAnukfGvtwE3bFbNEQcjKnHvUE/edit?usp=sharing