CKS — Audit Logging

2 minute read

Chapter 11 — Audit Logging

CKS Exam Domain: Domain 6 — Monitoring, Logging & Runtime Security (20%)

Kubernetes audit logging records every request made to the API server — who did what, when, to which resource, and what the outcome was. It is the definitive source of truth for security investigations, compliance audits, and incident response. Without audit logs, you are operating blind — there is no way to determine whether an attacker accessed secrets, escalated privileges, or exfiltrated data.

Audit logs answer the critical questions:

  • Who made the request? (user, service account, anonymous)
  • What did they do? (verb: get, list, create, delete, patch)
  • Which resource was targeted? (pods, secrets, roles, nodes)
  • When did it happen? (timestamp with microsecond precision)
  • Where did the request come from? (source IP address)
  • Was it allowed? (response status code — 200, 403, 404, etc.)

Why Audit Logging Is CKS-Critical

Aspect Detail
Exam Weight Part of the 20% Monitoring, Logging & Runtime Security domain
Key Skills Write audit policies, configure audit backends, analyze audit logs with jq
Attack Detection Unauthorized secret access, privilege escalation, anonymous API access
Compliance SOC 2, HIPAA, PCI-DSS all require API audit trails
Exam Tasks Create audit policy → configure API server → verify events are logged

What You Will Learn

# Topic Link Focus
1 Audit Policy Audit Policy Policy structure, audit levels, rule matching, precedence
2 Audit Backends Audit Backends Log backend, webhook backend, API server configuration
3 Audit Log Analysis Audit Log Analysis JSON structure, jq filtering, common security queries
4 Monitoring API Access Monitoring API Access Tracking access patterns, anonymous detection, SA monitoring
5 Audit Best Practices Audit Best Practices Production policies, log retention, compliance, centralized collection
6 Hands-On Lab Audit Logging Lab End-to-end exercises: policy creation, API server config, log analysis

The Audit Logging Pipeline

┌─────────────────────────────────────────────────────────┐
│                    kubectl / client                       │
│              User, ServiceAccount, controller             │
└──────────────────────┬──────────────────────────────────┘
                       │ API request
                       ▼
┌─────────────────────────────────────────────────────────┐
│                   kube-apiserver                          │
│                                                          │
│  ┌─────────────────────────────────────────────────┐     │
│  │          Audit Policy Engine                     │     │
│  │   /etc/kubernetes/audit/audit-policy.yaml        │     │
│  │                                                  │     │
│  │   Rule 1: secrets → Request level               │     │
│  │   Rule 2: pods    → Metadata level              │     │
│  │   Rule 3: *       → Metadata level (catch-all)  │     │
│  └──────────────┬──────────────┬────────────────────┘     │
│                 │              │                          │
│          ┌──────▼──────┐ ┌────▼─────────┐                │
│          │ Log Backend │ │ Webhook      │                │
│          │ (file)      │ │ Backend      │                │
│          └──────┬──────┘ └────┬─────────┘                │
└─────────────────┼─────────────┼──────────────────────────┘
                  │             │
                  ▼             ▼
           /var/log/        External SIEM
           audit.log     (Elasticsearch, Splunk)

Key Concepts at a Glance

Concept Description
Audit Policy Defines which events to record and at what detail level
Audit Levels None, Metadata, Request, RequestResponse
Log Backend Writes audit events to a local file on the API server node
Webhook Backend Sends audit events to an external HTTP endpoint
Rule Precedence First matching rule wins — order matters
omitStages Skip logging at certain request stages (e.g., RequestReceived)

Exam Strategy

  1. Memorize the audit policy YAML structure — apiVersion: audit.k8s.io/v1, kind: Policy, and the rules array.
  2. Know the four audit levels — None, Metadata, Request, RequestResponse. Understand what each captures.
  3. Practice API server configuration — the --audit-policy-file and --audit-log-path flags, plus the required volumeMounts and volumes.
  4. Master jq for log analysis — filtering by verb, resource, user, status code.
  5. Time management — audit logging tasks are often multi-step (write policy → configure API server → verify). Practice the full workflow.

Next: Audit Policy →

Updated:

You may also enjoy