Lesson 0014 · 35 minutes · Monitoring, Logging, and Runtime Security

Write an audit policy that captures escalation evidence

Audit logs are only useful when the policy records enough detail for high-risk actions without turning every request into expensive noise. This is a from-scratch configuration task—there is no starter YAML.

Timed task: 25 minutes

Create lab/lesson-14-audit-policy.yaml. It must be a valid Kubernetes audit policy that meets every requirement:

• Use audit.k8s.io/v1 and kind Policy.
• Never record the RequestReceived stage.
• Record at RequestResponse level for all Secret requests in namespace payments.
• Record at Metadata level for create, update, patch, delete, and deletecollection operations on Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings, regardless of namespace.
• Record every other request at Metadata level.

Do not use None to hide any requests beyond the omitted stage. Do not place the catch-all rule above the specific rules.

Validation

An audit policy is an API-server configuration file, not a Kubernetes object. kubectl apply cannot validate or install it. Check its YAML syntax with your editor, then inspect the rule ordering manually. In a real cluster, the API server must be started with --audit-policy-file pointing to this file.

Get-Content .\lab\lesson-14-audit-policy.yaml

# On a Linux control-plane node, examine the API-server manifest/configuration:
grep -R -- '--audit-policy-file' /etc/kubernetes/manifests /etc/kubernetes 2>/dev/null

Retrieval check

Documentation target

Use the official Kubernetes auditing documentation. Confirm the resource-group names for RBAC objects.

What to send me

Paste the policy YAML. I’ll evaluate ordering, resource matching, verb coverage, and whether it records the necessary response bodies.