According to GKE Security documentation , Kubernetes API Server Audit Logging is the primary source of truth for administrative actions within a cluster. This feature captures every call made to the API server, including those made via kubectl, the Cloud Console, or automated controllers.

By enabling GKE Audit Logging and ensuring Cloud Audit Logs (specifically Admin Activity and Data Access logs) are active, you fulfill the requirement for a non-repudiable trail. This log will contain:

Who: The identity of the caller (the IAM user or service account).

What: The action taken (e.g., create pod, get secret, patch deployment).

When: The timestamp of the operation.

Option A (Binary Authorization) is a preventative control, not an audit logging tool. Option C (Security Command Center) is for threat detection, not for maintaining a raw audit trail. Option D (DaemonSet) collects application logs from within containers, but cannot capture administrative API calls like " modifying cluster configuration " or " accessing secrets " made through the Kubernetes control plane.