How to get k8s master logs on EKS?
Logs can be send to CloudWatch (not free of charge). The following logs can be individually selected to be send to CloudWatch:
- API server
- Audit
- Authenticator
- Controller Manager
- Scheduler
Logs can be enabled via UI or AWS CLI. See Amazon EKS Control Plane Logging
Things like kube-api server logs, the kube-scheduler logs, the kube-controller manager logs, etc. will be available in CloudWatch logs. While (as you have stated) EKS API calls will be logged to cloudtrail.
**I take that back, I guess AWS EKS has not gotten around to that yet. You will need to use an EFK stack to get the logs.
Someone has already put together a quick how-to:https://github.com/aws-samples/aws-workshop-for-kubernetes/tree/master/02-path-working-with-clusters/204-cluster-logging-with-EFK