Skip to content

Instantly share code, notes, and snippets.

@sudermanjr

sudermanjr/auditLog.yaml

Created January 18, 2019 16:49
Show Gist options
  • Save sudermanjr/0c89fbdfaf8e33e297093e3bd9468035 to your computer and use it in GitHub Desktop.
Save sudermanjr/0c89fbdfaf8e33e297093e3bd9468035 to your computer and use it in GitHub Desktop.
Download ZIP

Revisions

  1. Andrew Suderman created this gist Jan 18, 2019.
    157 changes: 157 additions & 0 deletions auditLog.yaml
    View file
    Original file line number Diff line number Diff line change
    @@ -0,0 +1,157 @@
    spec:
    fileAssets:
    - name: auditPolicyFile
    path: /srv/kubernetes/audit.yaml
    roles:
    - Master
    content: |
    apiVersion: audit.k8s.io/v1beta1
    kind: Policy
    rules:
    # The following requests were manually identified as high-volume and low-risk,
    # so drop them.
    - level: None
    users: ["system:kube-proxy"]
    verbs: ["watch"]
    resources:
    - group: "" # core
    resources: ["endpoints", "services", "services/status"]
    - level: None
    # Ingress controller reads 'configmaps/ingress-uid' through the unsecured port.
    # TODO(#46983): Change this to the ingress controller service account.
    users: ["system:unsecured"]
    namespaces: ["kube-system"]
    verbs: ["get"]
    resources:
    - group: "" # core
    resources: ["configmaps"]
    - level: None
    users: ["kubelet"] # legacy kubelet identity
    verbs: ["get"]
    resources:
    - group: "" # core
    resources: ["nodes", "nodes/status"]
    - level: None
    userGroups: ["system:nodes"]
    verbs: ["get"]
    resources:
    - group: "" # core
    resources: ["nodes", "nodes/status"]
    - level: None
    users:
    - system:kube-controller-manager
    - system:kube-scheduler
    - system:serviceaccount:kube-system:endpoint-controller
    verbs: ["get", "update"]
    namespaces: ["kube-system"]
    resources:
    - group: "" # core
    resources: ["endpoints"]
    - level: None
    users: ["system:apiserver"]
    verbs: ["get"]
    resources:
    - group: "" # core
    resources: ["namespaces", "namespaces/status", "namespaces/finalize"]
    # Don't log HPA fetching metrics.
    - level: None
    users:
    - system:kube-controller-manager
    verbs: ["get", "list"]
    resources:
    - group: "metrics.k8s.io"
    # Don't log these read-only URLs.
    - level: None
    nonResourceURLs:
    - /healthz*
    - /version
    - /swagger*
    # Don't log events requests.
    - level: None
    resources:
    - group: "" # core
    resources: ["events"]
    # node and pod status calls from nodes are high-volume and can be large, don't log responses for expected updates from nodes
    - level: Request
    users: ["kubelet", "system:node-problem-detector", "system:serviceaccount:kube-system:node-problem-detector"]
    verbs: ["update","patch"]
    resources:
    - group: "" # core
    resources: ["nodes/status", "pods/status"]
    omitStages:
    - "RequestReceived"
    - level: Request
    userGroups: ["system:nodes"]
    verbs: ["update","patch"]
    resources:
    - group: "" # core
    resources: ["nodes/status", "pods/status"]
    omitStages:
    - "RequestReceived"
    # deletecollection calls can be large, don't log responses for expected namespace deletions
    - level: Request
    users: ["system:serviceaccount:kube-system:namespace-controller"]
    verbs: ["deletecollection"]
    omitStages:
    - "RequestReceived"
    # Secrets, ConfigMaps, and TokenReviews can contain sensitive & binary data,
    # so only log at the Metadata level.
    - level: Metadata
    resources:
    - group: "" # core
    resources: ["secrets", "configmaps"]
    - group: authentication.k8s.io
    resources: ["tokenreviews"]
    omitStages:
    - "RequestReceived"
    # Get responses can be large; skip them.
    - level: Request
    verbs: ["get", "list", "watch"]
    resources:
    - group: "" # core
    - group: "admissionregistration.k8s.io"
    - group: "apiextensions.k8s.io"
    - group: "apiregistration.k8s.io"
    - group: "apps"
    - group: "authentication.k8s.io"
    - group: "authorization.k8s.io"
    - group: "autoscaling"
    - group: "batch"
    - group: "certificates.k8s.io"
    - group: "extensions"
    - group: "metrics.k8s.io"
    - group: "networking.k8s.io"
    - group: "policy"
    - group: "rbac.authorization.k8s.io"
    - group: "scheduling.k8s.io"
    - group: "settings.k8s.io"
    - group: "storage.k8s.io"
    omitStages:
    - "RequestReceived"
    # Default level for known APIs
    - level: RequestResponse
    resources:
    - group: "" # core
    - group: "admissionregistration.k8s.io"
    - group: "apiextensions.k8s.io"
    - group: "apiregistration.k8s.io"
    - group: "apps"
    - group: "authentication.k8s.io"
    - group: "authorization.k8s.io"
    - group: "autoscaling"
    - group: "batch"
    - group: "certificates.k8s.io"
    - group: "extensions"
    - group: "metrics.k8s.io"
    - group: "networking.k8s.io"
    - group: "policy"
    - group: "rbac.authorization.k8s.io"
    - group: "scheduling.k8s.io"
    - group: "settings.k8s.io"
    - group: "storage.k8s.io"
    omitStages:
    - "RequestReceived"
    # Default level for all other requests.
    - level: Metadata
    omitStages:
    - "RequestReceived"