5 lines
3.9 KiB
HTML
5 lines
3.9 KiB
HTML
<!doctype html><html lang="en"><head><meta charset="utf-8"><meta name="viewport" content="width=device-width,initial-scale=1"><title>CKS lesson 14: Audit policy</title><link rel="stylesheet" href="../assets/course.css"></head><body><main><p class="eyebrow">Lesson 0014 · 35 minutes · Monitoring, Logging, and Runtime Security</p><h1>Write an audit policy that captures escalation evidence</h1><p class="lede">Audit logs are only useful when the policy records enough detail for high-risk actions without turning every request into expensive noise. This is a from-scratch configuration task—there is no starter YAML.</p><div class="callout"><strong>Exam reflex:</strong> audit-policy rules are first-match wins. Put the most specific, high-value rules first and end with a deliberate catch-all.</div><h2>Timed task: 25 minutes</h2><p>Create <code>lab/lesson-14-audit-policy.yaml</code>. It must be a valid Kubernetes audit policy that meets every requirement:</p><ul><li>Use <code>audit.k8s.io/v1</code> and kind <code>Policy</code>.</li><li>Never record the <code>RequestReceived</code> stage.</li><li>Record at <code>RequestResponse</code> level for all Secret requests in namespace <code>payments</code>.</li><li>Record at <code>Metadata</code> level for <code>create</code>, <code>update</code>, <code>patch</code>, <code>delete</code>, and <code>deletecollection</code> operations on Roles, RoleBindings, ClusterRoles, and ClusterRoleBindings, regardless of namespace.</li><li>Record every other request at <code>Metadata</code> level.</li></ul><p>Do not use <code>None</code> to hide any requests beyond the omitted stage. Do not place the catch-all rule above the specific rules.</p><h2>Validation</h2><p>An audit policy is an API-server configuration file, not a Kubernetes object. <code>kubectl apply</code> cannot validate or install it. Check its YAML syntax with your editor, then inspect the rule ordering manually. In a real cluster, the API server must be started with <code>--audit-policy-file</code> pointing to this file.</p><pre><code>Get-Content .\lab\lesson-14-audit-policy.yaml
|
||
|
||
# On a Linux control-plane node, examine the API-server manifest/configuration:
|
||
grep -R -- '--audit-policy-file' /etc/kubernetes/manifests /etc/kubernetes 2>/dev/null</code></pre><h2>Retrieval check</h2><div class="quiz"><h3>Question</h3><p>A catch-all <code>Metadata</code> rule is first in the rule list, followed by a Secret <code>RequestResponse</code> rule. What level is recorded for a Secret request?</p><label><input type="radio" name="q" value="metadata">Metadata, because the first matching audit-policy rule wins.</label><label><input type="radio" name="q" value="response">RequestResponse, because it is more specific.</label><label><input type="radio" name="q" value="both">Both levels are recorded.</label><button onclick="check()">Check answer</button><p id="feedback" class="feedback" aria-live="polite"></p></div><h2>Documentation target</h2><p>Use the official Kubernetes <a href="https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/">auditing</a> documentation. Confirm the resource-group names for RBAC objects.</p><h2>What to send me</h2><p>Paste the policy YAML. I’ll evaluate ordering, resource matching, verb coverage, and whether it records the necessary response bodies.</p><footer>Previous: <a href="0013-image-digest-admission-policy.html">Image digest admission</a> · CKS domain: Monitoring, Logging, and Runtime Security</footer></main><script>function check(){const c=document.querySelector('input[name=q]:checked'),f=document.getElementById('feedback');if(!c){f.textContent='Choose an answer.';f.className='feedback bad';return;}if(c.value==='metadata'){f.textContent='Correct. Audit-policy rules are evaluated in order; the first match determines the result.';f.className='feedback good';}else{f.textContent='Not quite. The first matching rule wins, so ordering is part of the security design.';f.className='feedback bad';}}</script></body></html>
|