Skip to content
CKSMonitoring, Logging and Runtime SecuritySingle nodeHard

Audit logging with a tailored policy

Scenario cks-run-001 · about 10 minutes · 9 points · 5 grader checks

Write an audit policy with per-resource levels and wire it into the API server static pod with log rotation.

  • audit-logging
  • kube-apiserver
  • audit-policy
  • static-pod
  • monitoring

What you will practise

  • Write an audit Policy with ordered rules and levels
  • Add audit flags, hostPath volumes and mounts to the API server manifest
  • Read audit events with jq

Start this lab

With the CLI installed and signed in, this command provisions a single node cluster on your Mac, applies the scenario setup and prints the task below.

goldenkube start cks-run-001

Task

The task text exactly as the CLI shows it. Solve it on the cluster, then run goldenkube submit.

Enable Kubernetes audit logging on the kube-apiserver of exam-cp1. 1. Create the audit policy /etc/kubernetes/audit/policy.yaml that: - omits the stage RequestReceived; - logs Secrets (core API group) in all namespaces at level Metadata; - logs ConfigMaps in namespace "audit-demo" at level RequestResponse; - logs nothing else (a final catch-all rule at level None). 2. Configure the kube-apiserver to use that policy and write the log to /var/log/kubernetes/audit/audit.log, keeping at most 2 rotated log files for at most 7 days. Both paths must be available inside the static pod. The API server must be healthy afterwards and access to Secrets and to the ConfigMaps in "audit-demo" must show up in the log. Do not rebuild the cluster.

Requirements and details

Certification
CKS · Certified Kubernetes Security Specialist
Domain
Monitoring, Logging and Runtime Security
Difficulty
Hard
Cluster topology
Single node
Cluster features
None beyond the base cluster
Recommended time
10 minutes
Points
9
Grader checks
5
Kubernetes version
1.35
Minimum CLI version
0.1.0
Scenario version
1
Published

Grading runs locally: 5 state checks read your cluster when you submit; the scenario passes when every check passes. Hints, the reference solution and the check definitions are available only inside the CLI, not on this page.

Install the CLICreate a free account

More Monitoring, Logging and Runtime Security labs

CKSMonitoring, Logging and Runtime SecurityMedium

Immutable containers at runtime

Run nginx with a read-only root filesystem, keeping only the directories it really needs writable through emptyDir volumes.

Single node · ~8 min · 7 points

  • immutability
  • readonlyrootfilesystem
  • emptydir
  • runtime-security
  • deployment

goldenkube start cks-run-002

CKSMonitoring, Logging and Runtime SecurityMedium

Find and contain a crypto-miner process

Investigate running containers to find the one executing a mining process, record it and contain it without destroying evidence.

Single node · ~7 min · 8 points

  • runtime-security
  • incident-response
  • processes
  • behavioral-analytics
  • crictl

goldenkube start cks-run-003

CKSMonitoring, Logging and Runtime SecurityMedium

Investigate an audit log and revoke access

Use an exported audit log to identify who deleted a Secret and from where, then revoke that user's namespace access.

Single node · ~8 min · 8 points

  • audit-logs
  • incident-response
  • jq
  • rbac
  • investigation

goldenkube start cks-run-004

Independent community project, not affiliated with or endorsed by CNCF or The Linux Foundation. Lab results are practice feedback, not an exam score.