CME-1011
Kubernetes API Server Audit Policy
Description
Configures the Kubernetes API server audit policy to log security-relevant events including authentication failures, RBAC denials, sensitive resource access (secrets, configmaps), privileged pod creation, and exec/attach to running containers. Provides detection capability for lateral movement, privilege escalation attempts, and unauthorized API access within the cluster. Audit logs can feed SIEM systems for alerting and forensic analysis. OpenShift provides built-in audit profiles (Default, WriteRequestBodies, AllRequestBodies) configurable via the APIServer resource.
CVSS Vector Impacts
| Metric | Transition | Rationale |
|---|---|---|
| Attack Complexity (AC) | L → H | Attacker actions within the cluster are logged and can trigger alerts, increasing detection risk; maintaining stealth requires evading audit policy coverage, which adds significant complexity to the attack chain |
CWE Relationships
Verification
Verify Kubernetes API server audit policy is configured and active
$ kubectl get --raw /apis/audit.k8s.io/v1 2>/dev/null && echo audit-api-available
# Expected: audit-api-available
# Expected: audit-api-available
Platform: kubernetes
$ grep audit-policy-file /etc/kubernetes/manifests/kube-apiserver.yaml 2>/dev/null
# Expected: Audit policy file referenced in API server configuration
# Expected: Audit policy file referenced in API server configuration
Platform: kubernetes
$ oc get apiservers.config.openshift.io cluster -o jsonpath='{.spec.audit.profile}'
# Expected: Default, WriteRequestBodies, or AllRequestBodies (not None)
# Expected: Default, WriteRequestBodies, or AllRequestBodies (not None)
Platform: kubernetes