Discuss Linux Foundation CKS Exam Topic 1 Question 32

Enable audit logs in the cluster, To Do so, enable the log backend, and ensure that

1. logs are stored at /var/log/kubernetes-logs.txt.

2. Log files are retained for 12 days.

3. at maximum, a number of 8 old audit logs files are retained.

4. set the maximum size before getting rotated to 200MB

Edit and extend the basic policy to log:

1. namespaces changes at RequestResponse

2. Log the request body of secrets changes in the namespace kube-system.

3. Log all other resources in core and extensions at the Request level.

4. Log "pods/portforward", "services/proxy" at Metadata level.

5. Omit the Stage RequestReceived

All other requests at the Metadata level

AExplanation:
Kubernetes auditing provides a security-relevant chronological set of records about a cluster. Kube-apiserver performs auditing. Each request on each stage of its execution generates an event, which is then pre-processed according to a certain policy and written to a backend. The policy determines what's recorded and the backends persist the records.
You might want to configure the audit log as part of compliance with the CIS (Center for Internet Security) Kubernetes Benchmark controls.
The audit log can be enabled by default using the following configuration incluster.yml:
services:
kube-api:
audit_log:
enabled: true
When the audit log is enabled, you should be able to see the default values at/etc/kubernetes/audit-policy.yaml
The log backend writes audit events to a file inJSONlinesformat. You can configure the log audit backend using the followingkube-apiserverflags:
--audit-log-pathspecifies the log file path that log backend uses to write audit events. Not specifying this flag disables log backend.-means standard out
--audit-log-maxagedefined the maximum number of days to retain old audit log files
--audit-log-maxbackupdefines the maximum number of audit log files to retain
--audit-log-maxsizedefines the maximum size in megabytes of the audit log file before it gets rotated
If your cluster's control plane runs the kube-apiserver as a Pod, remember to mount thehostPathto the location of the policy file and log file, so that audit records are persisted. For example:
--audit-policy-file=/etc/kubernetes/audit-policy.yaml \
--audit-log-path=/var/log/audit.log

Suggested Answer: A

Get Premium CKS Questions as Interactive Web-Based Practice Test or PDF Real Exam Format Detailed Explanations Instant Access Get Your Practice Test

38 comments · newest first

Lura 12 months ago

I thought logs were kept indefinitely? This is new to me!

Kip 1 year ago

200MB max size? That’s a bit small for busy clusters.

Van 1 year ago

Wait, we have to keep logs for 12 days? Seems excessive.

Skye 1 year ago

Totally agree, especially for compliance.

Wilda 1 year ago

Audit logs are super important for security!

Willow 1 year ago

I recall that we need to omit the Stage RequestReceived, but I can't remember if we have to include all other requests at the Metadata level or just specific ones.

Naomi 1 year ago

I’m a bit confused about the policy editing part. Do we need to specify the log level for each resource type in the YAML file?

Bettina 1 year ago

I think we did a similar question where we had to set the log path and retention period. The path was definitely something like /var/log/kubernetes-logs.txt, right?

Sherrell 1 year ago

I remember we practiced enabling audit logs, but I'm not entirely sure about the exact flags for retention settings.

Alline 1 year ago

Okay, I think I've got this. The scenario is all about supporting the business through the architecture, so principles like "Maximize Benefit to the Enterprise" and "Responsive Change Management" are crucial. The other principles in option A also seem well-aligned. I'm feeling pretty confident about that being the best answer.

Luis 1 year ago

This seems like a straightforward question about Microsoft 365 Analytics features. I think the key is to focus on the requirements - scheduling time for priority work and silencing chats in Teams.

Elenor 1 year ago

I'm pretty confident I know the answer to this one. The CAPWAP heartbeat detection interval is set to 20 seconds before the active/standby switchover occurs.

Merlyn 1 year ago

I remember learning about the CANVAS element in my web development class. I believe the valid events are mouseup, mousemove, and click. I'm fairly confident in those choices.

Rebecka 2 years ago

Configuring audit logs is no easy task, but these instructions make it straightforward. I'm glad they included the example for running kube-apiserver as a Pod.

Sabine 1 year ago

↳ replying to Rebecka

I agree, having the example for running kube-apiserver as a Pod is really helpful in understanding the process.

Francine 1 year ago

↳ replying to Rebecka

Yes, configuring audit logs can be complex, but having clear instructions definitely helps.

Helga 1 year ago

↳ replying to Rebecka

Thanks for the detailed explanation. I appreciate the example provided for running kube-apiserver as a Pod.

Ilene 2 years ago

This is a well-thought-out question. The details around the CIS Kubernetes Benchmark and the ability to configure the audit log backend are a nice touch.

Delsie 1 year ago

↳ replying to Ilene

Don't forget to edit and extend the basic policy to log specific changes.

Alba 1 year ago

↳ replying to Ilene

We also need to set the maximum size before rotation to 200MB.

Arlen 1 year ago

↳ replying to Ilene

Yes, we should enable the log backend and make sure the logs are stored at /var/log/kubernetes-logs.txt.

Hyman 1 year ago

↳ replying to Ilene

I think we need to enable audit logs in the cluster.

Jacqueline 1 year ago

↳ replying to Ilene

And don't forget to set the maximum size before rotation to 200MB.

Phung 1 year ago

↳ replying to Ilene

We need to make sure the log files are stored at /var/log/kubernetes-logs.txt.

Malinda 1 year ago

↳ replying to Ilene

Yes, it helps track all the requests and events happening in the cluster.

Nikita 2 years ago

↳ replying to Ilene

I think enabling audit logs in the cluster is crucial for security.

Laticia 2 years ago

Haha, imagine if the audit logs were stored in /dev/null by mistake. The admins would be scratching their heads trying to find the logs!

Arlene 1 year ago

↳ replying to Laticia

Yeah, storing audit logs in /dev/null would definitely cause some confusion.

Mica 2 years ago

↳ replying to Laticia

That would be a nightmare! They would be searching for logs that don't exist.

Mauricio 2 years ago

The policy configuration looks comprehensive, covering changes to namespaces, secrets, and other resources. I like how it includes logging at different stages like RequestResponse and Metadata.

Steffanie 2 years ago

I agree, it's crucial to have a detailed audit trail for compliance purposes.

Talia 2 years ago

Yes, it helps track all the requests and changes made in the cluster.

Jesus 2 years ago

Enabling audit logs in the cluster is crucial for security and compliance. The instructions provided cover the key aspects well, like log file path, retention period, and rotation settings.

Brett 1 year ago

↳ replying to Jesus

Remember to omit the Stage RequestReceived and log all other requests at the Metadata level.

Tegan 1 year ago

↳ replying to Jesus

Set the maximum size before rotation to 200MB and configure the audit policy to log specific changes.

Phillip 2 years ago

↳ replying to Jesus

Don't forget to retain log files for 12 days and limit the number of old audit log files to 8.

Candra 2 years ago

↳ replying to Jesus

Make sure to enable the log backend and set the log file path to /var/log/kubernetes-logs.txt.

Willodean 2 years ago

I think enabling audit logs in the cluster is important for security.

Linux Foundation CKS Exam - Topic 1 Question 32 Discussion