Lesson 0035 · 45 minutes · Hard mode · Control plane

Harden the API server and preserve forensic evidence

Repair an insecure static Pod and connect it to an ordered audit policy. Treat this as a control-plane maintenance task: preserve required configuration, make paths persistent, and avoid using kubectl apply.

Task

Read lab/lesson-35-kube-apiserver-insecure.yaml. Create both:

lab/lesson-35-kube-apiserver-answer.yaml, a complete replacement static-Pod manifest; and
lab/lesson-35-audit-policy.yaml, the referenced audit policy.

Preserve every metadata field, Pod field, container field, image, PKI mount, and command flag unless a requirement below explicitly changes it.

API-server requirements

Disable anonymous authentication and profiling.
Use authorization modes Node,RBAC.
Enable ServiceAccount lookup.
Preserve existing admission plugins and additionally enable NodeRestriction.
Read the audit policy at /etc/kubernetes/audit-policy.yaml.
Write audit events to /var/log/kubernetes/audit/audit.log.
Retain audit logs for 14 days, keep 10 backups, and rotate at 100 MB.
Mount host file /etc/kubernetes/audit-policy.yaml read-only at the identical container path using hostPath type File.
Mount host directory /var/log/kubernetes/audit read-write at the identical container path using hostPath type DirectoryOrCreate.

Audit-policy requirements

Use audit.k8s.io/v1, kind Policy, globally omit RequestReceived, and order rules so the first match produces:

RequestResponse for all Secret requests in namespaces payments and orders-prod;
Metadata for create, update, patch, delete, and deletecollection on Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings;
Request for all pods/exec requests; and
Metadata for every remaining request.

Do not add a None rule, omit any existing required flag, use a relative path, mount the audit log directory read-only, or apply the static manifest to the API server.

Hard-mode traps: audit rules are first-match wins; RBAC resources use group rbac.authorization.k8s.io; exec is resource pods with subresource exec, represented as pods/exec; and API-server file paths are useless unless the static Pod mounts their host locations.

Verification

# These are configuration files, not objects to apply.
grep -E -- '--anonymous-auth|--authorization-mode|--profiling|--service-account-lookup|--enable-admission-plugins|--audit-' lab/lesson-35-kube-apiserver-answer.yaml

# Confirm the two mount paths appear in commands, mounts, and hostPath volumes.
grep -nE '/etc/kubernetes/audit-policy.yaml|/var/log/kubernetes/audit' lab/lesson-35-kube-apiserver-answer.yaml

# Inspect rule order and spelling.
cat lab/lesson-35-audit-policy.yaml

Retrieval check

Question

Why must the Secret rule appear before the catch-all Metadata rule?

The first matching rule determines the recorded audit level. All matching rules merge into one combined audit event. The final matching rule determines the recorded audit level.

Documentation targets

After your first attempt, use the official Kubernetes kube-apiserver flag reference and auditing documentation.

What to send me

Save both files and say check. I will list all detected issues and correct one per round. Ask a follow-up question whenever a flag, mount, or audit-rule match is unclear.