Exam
CKS
Home › CKS practice tasks › Implement and Extend an API Server Audit Policy
CKS · Monitoring, Logging and Runtime Security
Implement and Extend an API Server Audit Policy
First, reconfigure the cluster's API server, so that: the basic audit policy located at /etc/kubernetes/logpolicy/audit-policy.yaml is used, logs are stored at /var/log/kubernetes/audit-logs.txt, and…
🗓️ Free Task of the Week: one CKS task is unlocked free for everyone every week - no card, real cluster, auto-graded (2 tries/week). Create a free account and check whether this one is live now.
The task
Context
You must implement auditing for the kubeadm provisioned cluster.
Task
First, reconfigure the cluster's API server, so that:
- the basic audit policy located at
/etc/kubernetes/logpolicy/audit-policy.yamlis used, - logs are stored at
/var/log/kubernetes/audit-logs.txt, - and a maximum of
2logs are retained for10days.
The cluster uses the Docker Engine as its container runtime. If needed, use the docker command to troubleshoot running containers.
> The basic policy only specifies what not to log.
Next, edit and extend the basic policy to log:
- namespaces interactions at
RequestResponselevel - the request body of deployments interactions in the namespace
webapps - ConfigMap and Secret interactions in all namespaces at the
Metadatalevel - all other requests at the
Metadatalevel
> Make sure the API server uses the extended policy. Failure to do so may result in a reduced score.
*Lab note: this practice node runs containerd rather than the Docker Engine, so use crictl (or kubectl) where you would use docker.*
What this tests
Detect threats at runtime with Falco, behavioral analytics, and audit logging. On the CKS exam, Monitoring, Logging and Runtime Security tasks are graded purely on what you build in the cluster - not multiple choice - so the only way to get faster is to do them on a real cluster against a clock.
Practice it for real
prepium.sh drops you into your own isolated Kubernetes cluster in the browser - no install, no credit card. You solve the task in a real terminal, hit validate, and a programmatic checker scores exactly what you got right and wrong (with partial credit). The canonical solution unlocks after you attempt it, so you learn the fast, exam-ready way to do it.