Exercise 5.5: Enabling API Server Auditing: mount audit.log file as FileOrCreate

Hi,

In "Exercise 5.5: Enabling API Server Auditing" I can see that it's suggested to mount audit.log file as FileOrCreate.

    - --audit-log-maxbackup=2
    - --audit-log-maxsize=50
    - --audit-log-path=/var/log/audit.log
...
  - hostPath:
      path: /var/log/audit.log
      type: FileOrCreate
    name: audit-log

Does it make any sense? Once log file reached the size limit it remains unchanged. And in kube-apiserver log appear messages like

E0120 09:05:09.242149       1 metrics.go:110] Error in audit plugin 'log' affecting 1 audit events: can't rename log file: rename /var/log/audit.log /var/log/audit-2025-01-20T09-05-09.242.log: device or resource busy

Perhaps it makes more sense to mount host directory rather than file to let kube-apiserver roll the log

    volumeMounts:
    - mountPath: /var/log
      name: audit-log
      readOnly: false
...
  volumes:
  - hostPath:
      path: /var/log
      type: Directory
    name: audit-log

Regards,
Dmytro