CME-1011

Kubernetes API Server Audit Policy

Detect Application Unquantified evidence Detective

Description

Configures the Kubernetes API server audit policy to log security-relevant events including authentication failures, RBAC denials, sensitive resource access (secrets, configmaps), privileged pod creation, and exec/attach to running containers. Provides detection capability for lateral movement, privilege escalation attempts, and unauthorized API access within the cluster. Audit logs can feed SIEM systems for alerting and forensic analysis. OpenShift provides built-in audit profiles (Default, WriteRequestBodies, AllRequestBodies) configurable via the APIServer resource.

CVSS Vector Impacts

Metric	Transition	Rationale
Attack Complexity (AC)	L → H	Attacker actions within the cluster are logged and can trigger alerts, increasing detection risk; maintaining stealth requires evading audit policy coverage, which adds significant complexity to the attack chain

CWE Relationships

CWE-778 CWE-223

Verification

Verify Kubernetes API server audit policy is configured and active

$ kubectl get --raw /apis/audit.k8s.io/v1 2>/dev/null && echo audit-api-available
# Expected: audit-api-available

Platform: kubernetes

$ grep audit-policy-file /etc/kubernetes/manifests/kube-apiserver.yaml 2>/dev/null
# Expected: Audit policy file referenced in API server configuration

Platform: kubernetes

$ oc get apiservers.config.openshift.io cluster -o jsonpath='{.spec.audit.profile}'
# Expected: Default, WriteRequestBodies, or AllRequestBodies (not None)

Platform: kubernetes

Remediation

kubernetes Kubernetes API server audit policy for security-relevant events


printf 'apiVersion: audit.k8s.io/v1
kind: Policy
rules:
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["secrets", "configmaps"]
    verbs: ["get", "list", "watch", "create", "update", "patch", "delete"]
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods/exec", "pods/attach", "pods/portforward"]
  - level: RequestResponse
    users: ["system:anonymous"]
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods"]
    verbs: ["create"]
  - level: Request
    verbs: ["create", "update", "patch", "delete"]
  - level: Metadata
    verbs: ["get", "list", "watch"]
' > /etc/kubernetes/audit-policy.yaml
grep -q 'audit-policy-file' /etc/kubernetes/manifests/kube-apiserver.yaml || sed -i '/- kube-apiserver/a\    - --audit-policy-file=/etc/kubernetes/audit-policy.yaml\n    - --audit-log-path=/var/log/kubernetes/audit.log\n    - --audit-log-maxage=30\n    - --audit-log-maxbackup=10\n    - --audit-log-maxsize=100' /etc/kubernetes/manifests/kube-apiserver.yaml
mkdir -p /var/log/kubernetes

kubernetes OpenShift API server audit profile (WriteRequestBodies)


oc patch apiserver cluster --type=merge -p '{"spec":{"audit":{"profile":"WriteRequestBodies"}}}'