falco and audit logging cluster config

cluster-config2.yaml

kind: Cluster
apiVersion: kind.x-k8s.io/v1alpha4
nodes:
- role: control-plane
  extraMounts:
  - hostPath: /tmp/audit
    containerPath: /tmp/audit
  # allow Falco to use devices provided by the kernel module
  - hostPath: /dev
    containerPath: /dev
    # allow Falco to use the Docker unix socket
  - hostPath: /var/run/docker.sock
    containerPath: /var/run/docker.sock
- role: worker
kubeadmConfigPatches:
- |
  kind: ClusterConfiguration
  apiServer:
    extraArgs:
      audit-log-path: "/tmp/audit/log/kube-apiserver-audit.log"
      audit-policy-file: "/tmp/audit/policy/apiserver-audit-policy.yaml"
    extraVolumes:
    - name: "audit-logs"
      hostPath: /tmp/audit/log
      mountPath: /tmp/audit/log
      pathType: DirectoryOrCreate
      readOnly: false
    - name: "audit-policy-file"
      hostPath: /tmp/audit/policy/apiserver-audit-policy.yaml
      mountPath: /tmp/audit/policy/apiserver-audit-policy.yaml
      readOnly: true
      pathType: File