Completed upto lesson 35

lessons/0035-apiserver-audit-hard-mode.html

@@ -0,0 +1,80 @@
+<!doctype html>
+<html lang="en">
+<head>
+  <meta charset="utf-8">
+  <meta name="viewport" content="width=device-width,initial-scale=1">
+  <title>Lesson 35: API server and audit hard mode</title>
+  <link rel="stylesheet" href="../assets/course.css">
+</head>
+<body>
+<main>
+  <p class="eyebrow">Lesson 0035 · 45 minutes · Hard mode · Control plane</p>
+  <h1>Harden the API server and preserve forensic evidence</h1>
+  <p class="lede">Repair an insecure static Pod and connect it to an ordered audit policy. Treat this as a control-plane maintenance task: preserve required configuration, make paths persistent, and avoid using <code>kubectl apply</code>.</p>
+
+  <h2>Task</h2>
+  <p>Read <code>lab/lesson-35-kube-apiserver-insecure.yaml</code>. Create both:</p>
+  <ul>
+    <li><code>lab/lesson-35-kube-apiserver-answer.yaml</code>, a complete replacement static-Pod manifest; and</li>
+    <li><code>lab/lesson-35-audit-policy.yaml</code>, the referenced audit policy.</li>
+  </ul>
+  <p>Preserve every metadata field, Pod field, container field, image, PKI mount, and command flag unless a requirement below explicitly changes it.</p>
+
+  <h2>API-server requirements</h2>
+  <ul>
+    <li>Disable anonymous authentication and profiling.</li>
+    <li>Use authorization modes <code>Node,RBAC</code>.</li>
+    <li>Enable ServiceAccount lookup.</li>
+    <li>Preserve existing admission plugins and additionally enable <code>NodeRestriction</code>.</li>
+    <li>Read the audit policy at <code>/etc/kubernetes/audit-policy.yaml</code>.</li>
+    <li>Write audit events to <code>/var/log/kubernetes/audit/audit.log</code>.</li>
+    <li>Retain audit logs for 14 days, keep 10 backups, and rotate at 100 MB.</li>
+    <li>Mount host file <code>/etc/kubernetes/audit-policy.yaml</code> read-only at the identical container path using hostPath type <code>File</code>.</li>
+    <li>Mount host directory <code>/var/log/kubernetes/audit</code> read-write at the identical container path using hostPath type <code>DirectoryOrCreate</code>.</li>
+  </ul>
+
+  <h2>Audit-policy requirements</h2>
+  <p>Use <code>audit.k8s.io/v1</code>, kind <code>Policy</code>, globally omit <code>RequestReceived</code>, and order rules so the first match produces:</p>
+  <ul>
+    <li><code>RequestResponse</code> for all Secret requests in namespaces <code>payments</code> and <code>orders-prod</code>;</li>
+    <li><code>Metadata</code> for <code>create</code>, <code>update</code>, <code>patch</code>, <code>delete</code>, and <code>deletecollection</code> on Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings;</li>
+    <li><code>Request</code> for all <code>pods/exec</code> requests; and</li>
+    <li><code>Metadata</code> for every remaining request.</li>
+  </ul>
+  <p>Do not add a <code>None</code> rule, omit any existing required flag, use a relative path, mount the audit log directory read-only, or apply the static manifest to the API server.</p>
+
+  <div class="callout"><strong>Hard-mode traps:</strong> audit rules are first-match wins; RBAC resources use group <code>rbac.authorization.k8s.io</code>; exec is resource <code>pods</code> with subresource <code>exec</code>, represented as <code>pods/exec</code>; and API-server file paths are useless unless the static Pod mounts their host locations.</div>
+
+  <h2>Verification</h2>
+  <pre><code># These are configuration files, not objects to apply.
+grep -E -- '--anonymous-auth|--authorization-mode|--profiling|--service-account-lookup|--enable-admission-plugins|--audit-' lab/lesson-35-kube-apiserver-answer.yaml
+
+# Confirm the two mount paths appear in commands, mounts, and hostPath volumes.
+grep -nE '/etc/kubernetes/audit-policy.yaml|/var/log/kubernetes/audit' lab/lesson-35-kube-apiserver-answer.yaml
+
+# Inspect rule order and spelling.
+cat lab/lesson-35-audit-policy.yaml</code></pre>
+
+  <h2>Retrieval check</h2>
+  <div class="quiz">
+    <h3>Question</h3>
+    <p>Why must the Secret rule appear before the catch-all Metadata rule?</p>
+    <label><input type="radio" name="q" value="first">The first matching rule determines the recorded audit level.</label>
+    <label><input type="radio" name="q" value="merge">All matching rules merge into one combined audit event.</label>
+    <label><input type="radio" name="q" value="last">The final matching rule determines the recorded audit level.</label>
+    <button onclick="check()">Check answer</button>
+    <p id="feedback" class="feedback" aria-live="polite"></p>
+  </div>
+
+  <h2>Documentation targets</h2>
+  <p>After your first attempt, use the official Kubernetes <a href="https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/">kube-apiserver flag reference</a> and <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/">auditing documentation</a>.</p>
+
+  <h2>What to send me</h2>
+  <p>Save both files and say <em>check</em>. I will list all detected issues and correct one per round. Ask a follow-up question whenever a flag, mount, or audit-rule match is unclear.</p>
+  <footer>Previous: <a href="0034-harden-and-isolate-orders-api.html">Harden and isolate orders-api</a> · Public curriculum alignment: CKS v1.34</footer>
+</main>
+<script>
+function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='first'){f.textContent='Correct. A catch-all placed first would shadow every specific rule.';f.className='feedback good';}else{f.textContent='Not quite. Kubernetes stops at the first matching audit rule.';f.className='feedback bad';}}
+</script>
+</body>
+</html>