45 lines
1.5 KiB
YAML
45 lines
1.5 KiB
YAML
# Apiserver audit policy. Mounted into the control plane at creation when a
|
|
# profile sets AUDIT=on — an apiserver flag, so it cannot be added to a running
|
|
# cluster without recreating it.
|
|
#
|
|
# Deliberately modest: enough to make "who changed what, and when" answerable
|
|
# during onboarding without filling the disk. Read the log with:
|
|
# docker exec <cluster>-control-plane cat /var/log/kubernetes/audit.log
|
|
apiVersion: audit.k8s.io/v1
|
|
kind: Policy
|
|
|
|
# Never log the request body for these — they contain credentials.
|
|
omitStages:
|
|
- RequestReceived
|
|
|
|
rules:
|
|
# Secrets/configmaps: record that access happened, never the contents.
|
|
- level: Metadata
|
|
resources:
|
|
- group: ""
|
|
resources: ["secrets", "configmaps"]
|
|
|
|
# Authn/authz decisions — the part an auditor actually asks about.
|
|
- level: Metadata
|
|
nonResourceURLs:
|
|
- /apis*
|
|
- /api*
|
|
|
|
# Mutations to workloads and policy: full request, so a diff is reconstructable.
|
|
- level: Request
|
|
verbs: ["create", "update", "patch", "delete"]
|
|
resources:
|
|
- group: ""
|
|
resources: ["pods", "services", "serviceaccounts", "namespaces"]
|
|
- group: "apps"
|
|
- group: "networking.k8s.io"
|
|
- group: "rbac.authorization.k8s.io"
|
|
|
|
# Everything else that changes state: metadata only.
|
|
- level: Metadata
|
|
verbs: ["create", "update", "patch", "delete"]
|
|
|
|
# Reads are dropped entirely — otherwise controller polling drowns the log.
|
|
- level: None
|
|
verbs: ["get", "list", "watch"]
|