What's the best way to audit user activity in Granola? The native logs are a mess.

Having spent the last quarter implementing Granola across our multi-cloud Kubernetes clusters, I've hit a significant roadblock in our compliance and security review cycle. While Granola's resource optimization metrics are superb, its native user activity auditing is, frankly, inadequate for enterprise scrutiny. The audit logs emitted by the Granola controller are high-volume, unstructured, and lack the necessary identity context to trace actions back to specific individuals or service accounts.

The core issue is that Granola's logs default to showing *what* happened (e.g., `StatefulSet "prod-db" recommendation applied`), but they obfuscate the *who* and the *contextual why*. When a change leads to a performance degradation or cost spike, our SRE team needs to reconstruct the approval chain, which currently involves cross-referencing three disparate data sources:

1. **Granola Controller Logs:** JSON-structured but using internal IDs.
2. **Kubernetes Audit Logs:** To get user/ServiceAccount info, but filtered separately.
3. **Git Commit History:** For the declarative changes if using GitOps.

This triage process is manual and unsustainable. I've begun a project to build a unified audit pipeline and wanted to share my preliminary architecture and solicit feedback on alternative approaches.

My current solution involves tapping into the Kubernetes webhook system and enriching Granola's events before they hit our logging sink. The key is to intercept the `ValidatingWebhookConfiguration` or `MutatingWebhookConfiguration` that Granola uses (if configured) and inject richer metadata. Alternatively, a sidecar container pattern on the Granola controller pod can be employed for log parsing and enrichment.

Here's a basic Fluent Bit configuration I'm testing as a sidecar to parse and transform the native logs, adding Kubernetes metadata:

```lua
[INPUT]
Name tail
Path /var/log/granola/*.log
Tag granola.audit
Parser json_embedded

[FILTER]
Name kubernetes
Match granola.audit
Kube_URL https://kubernetes.default.svc:443
Merge_Log On

[FILTER]
Name record_modifier
Match granola.audit
Record audit_source granola
Record enriched true

[OUTPUT]
Name opensearch
Match granola.audit
Host ${OPENSEARCH_HOST}
Port ${OPENSEARCH_PORT}
Index kubernetes-audit
Generate_ID On
```

This helps, but it's a band-aid. The more robust method I'm exploring is a small admission controller that logs enriched events directly. However, I'm concerned about the performance overhead and potential latency introduced into the recommendation application loop.

My questions to the community are:

* Has anyone successfully integrated Granola with Open Policy Agent or similar for declarative, policy-based audit trails?
* Are there existing open-source tools or exporters that specifically target Granola observability?
* For those in regulated environments (SOC2, HIPAA), how have you bridged this audit gap? Did you have to supplement with commercial monitoring tools?

I'll be benchmarking the performance impact of the webhook-based approach next week and can share those results. Ideally, the Granola project itself would offer a structured, configurable audit log format as a first-class feature.

—chris