58 lines
2.3 KiB
YAML
58 lines
2.3 KiB
YAML
|
# kube-apiserver audit policy -- k8s-master (10.0.20.100), single control-plane.
|
||
|
|
#
|
||
|
|
# Goal: a durable "who/when/what" trail for MUTATIONS (create/update/patch/
|
||
|
|
# delete) so resource deletions can be attributed even though direct
|
||
|
|
# kubectl-to-apiserver calls otherwise leave no trace (see the 2026-06-06
|
||
|
|
# novelapp incident: a dashboard delete was attributable, a direct-kubectl
|
||
|
|
# recreate was not). Deployed OUTSIDE Terraform (the k8s VMs are not TF-managed,
|
||
|
|
# see memory id=1575); this file is the source of truth, scp'd to
|
||
|
|
# /etc/kubernetes/audit-policy.yaml and wired into the apiserver static-pod
|
||
|
|
# manifest + the kubeadm-config ConfigMap (so "kubeadm upgrade" preserves it).
|
||
|
|
#
|
||
|
|
# Tuned for LOW WRITE VOLUME (the cluster's sdc HDD is write-sensitive, see
|
||
|
|
# memory id=559): reads are dropped entirely, high-churn resources and probe
|
||
|
|
# endpoints are dropped, and the verbose RequestReceived stage is omitted, so
|
||
|
|
# only one Metadata-level line is written per mutating request.
|
||
|
|
apiVersion: audit.k8s.io/v1
|
||
|
|
kind: Policy
|
||
|
|
# Only emit the post-execution stage -- halves volume vs logging both stages.
|
||
|
|
omitStages:
|
||
|
|
- RequestReceived
|
||
|
|
rules:
|
||
|
|
# 1. Never log read-only verbs -- the overwhelming majority of traffic and
|
||
|
|
# irrelevant to "who changed/deleted X".
|
||
|
|
- level: None
|
||
|
|
verbs: ["get", "list", "watch"]
|
||
|
|
|
||
|
|
# 2. Drop high-churn / low-value resources even on writes.
|
||
|
|
- level: None
|
||
|
|
resources:
|
||
|
|
- group: ""
|
||
|
|
resources: ["events", "endpoints", "nodes/status", "pods/status"]
|
||
|
|
- group: "coordination.k8s.io"
|
||
|
|
resources: ["leases"]
|
||
|
|
- group: "discovery.k8s.io"
|
||
|
|
resources: ["endpointslices"]
|
||
|
|
- group: "metrics.k8s.io"
|
||
|
|
- group: "authentication.k8s.io"
|
||
|
|
resources: ["tokenreviews"]
|
||
|
|
- group: "authorization.k8s.io"
|
||
|
|
resources: ["subjectaccessreviews", "selfsubjectaccessreviews"]
|
||
|
|
|
||
|
|
# 3. Drop noisy non-resource probe / discovery URLs.
|
||
|
|
- level: None
|
||
|
|
nonResourceURLs:
|
||
|
|
- "/healthz*"
|
||
|
|
- "/readyz*"
|
||
|
|
- "/livez*"
|
||
|
|
- "/version"
|
||
|
|
- "/metrics"
|
||
|
|
- "/openapi/*"
|
||
|
|
- "/swagger*"
|
||
|
|
|
||
|
|
# 4. Everything else (every create/update/patch/delete on real resources):
|
||
|
|
# record WHO (user + sourceIP + userAgent), WHAT (resource/namespace/name),
|
||
|
|
# WHEN, and the verb -- at Metadata level (no request/response bodies, so
|
||
|
|
# each entry stays small).
|
||
|
|
- level: Metadata
|