Audit policy in production — the security and compliance patterns

The audit policy in production is the discipline of configuring the audit log for the security and compliance requirements. The per-resource rules, the secret auditing, the per-namespace rules are the components. This lesson walks the production patterns, the security requirements, the compliance requirements, and the failure modes.

The audit policy structure

The audit policy structure:

apiVersion: audit.k8s.io/v1
kind: Policy
# Don't log /healthz, /readyz
omitStages:
  - RequestReceived
rules:
  # Default: log Metadata
  - level: Metadata
    omitStages:
      - RequestReceived
  # Secret operations: Metadata only. RequestResponse would write the
  # Secret's data into the audit log, moving the secret off-node to
  # wherever the log ships.
  - level: Metadata
    resources:
    - group: ""
      resources: ["secrets"]
  # ConfigMap operations: log Metadata
  - level: Metadata
    resources:
    - group: ""
      resources: ["configmaps"]

The policy is the configuration.

The secret auditing

The secret auditing:

rules:
- level: Metadata
  resources:
  - group: ""
    resources: ["secrets"]
  # Metadata records who touched which Secret and when, without the value
  - level: Request
  - level: Metadata

The secret auditing is the security requirement.

The PIM operations

The PIM operations (Privileged Identity Management):

rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["pods/exec", "pods/portforward", "pods/attach"]
- level: Metadata
  resources:
  - group: ""
    resources: ["pods", "services", "deployments"]

The PIM operations are the privileged operations.

The RBAC changes

The RBAC changes:

rules:
- level: RequestResponse
  resources:
  - group: "rbac.authorization.k8s.io"
    resources: ["roles", "rolebindings", "clusterroles", "clusterrolebindings"]

The RBAC changes are the access control changes.

The ServiceAccount operations

The ServiceAccount operations:

rules:
- level: RequestResponse
  resources:
  - group: ""
    resources: ["serviceaccounts"]
  - group: "authentication.k8s.io"
    resources: ["tokenreviews"]

The ServiceAccount operations are the identity operations.

The exempt users

The exempt users:

rules:
- level: None
  users:
  - system:serviceaccount:kube-system:cluster-autoscaler
  - system:serviceaccount:kube-system:metrics-server

The exempt users are the system service accounts.

The exempt namespaces

The exempt namespaces:

rules:
- level: None
  namespaces:
  - kube-system
  - kube-public

The exempt namespaces are the system namespaces.

The compliance patterns

The compliance patterns:

# CIS Kubernetes benchmark
rules:
- level: RequestResponse
  namespaces: ["kube-system"]
  verbs: ["create", "update", "delete", "patch"]
  resources:
  - group: ""
    resources: ["pods", "services", "configmaps", "secrets"]
- level: RequestResponse
  verbs: ["create", "update", "delete", "patch"]
  apigroups: ["rbac.authorization.k8s.io"]
  resources: ["*"]

The compliance patterns are the CIS benchmark.

The production patterns

The production patterns:

flowchart LR
    A[Audit policy] --> B[Default: Metadata]
    B --> C[Secrets: Metadata]
    C --> D[PIM: RequestResponse]
    D --> E[RBAC: RequestResponse]
    E --> F[Exempt system SAs]
    F --> G[Compliance]

The pattern is the production discipline.

The validation

The validation:

# Verify the audit policy is valid
kubectl get --raw=/api/v1/namespaces | jq .

# Verify the audit log is being written
tail -f /var/log/kubernetes/audit.log

# Verify the audit log is being shipped
promtool query instant http://prometheus:9090 audit_log_total

The validation is direct.

The cross-course references

• The API server course covers the audit configuration.
• The Security course covers the audit policies.
• The CIS benchmark covers the compliance.

Quiz

Production discipline

• Configure the per-resource rules. The level.
• Audit the secrets. Metadata only — RequestResponse copies the Secret into the log.
• Audit the PIM operations. RequestResponse.
• Audit the RBAC changes. RequestResponse.
• Exempt the system service accounts. The exemption.
• Document the audit policy. The compliance.

The audit policy in production is the security and compliance configuration. Operating it well is the per-resource rules, the secret auditing, and the production patterns.