Audit logging is essential to any Kubernetes security strategy. In this lab, you will have the opportunity to practice your skills with Kubernetes audit logging by configuring audit logging for a cluster.
Learning Objectives
Successfully complete this lab by achieving the following learning objectives:
- Implement Audit Policy Rules
Add the following rules to the audit policy.
Note: You can find an audit policy file located at
/etc/kubernetes/audit-policy.yaml.- Log request and response bodies for all changes to namespaces.
- Log request bodies (but not response bodies) for changes to Pods and Services in the
webnamespace. - Log metadata for all changes to Secrets.
- Create a catch-all rule to log metadata for all other requests.
- Configure Audit Logging
Configure audit logging in the following way:
Note: kube-apiserver is already configured to mount both the audit policy file and the log output file.
- Use the audit policy file located at
/etc/kubernetes/audit-policy.yaml. - Output logs to the file located at
/var/log/kubernetes/k8s-audit.log. - Keep old log files for a maximum of
60days. - Keep a maximum of
1old log file.
- Use the audit policy file located at
