Hands-on Lab·Certified Kubernetes Security Specialist
Querying Kubernetes Audit Logs
An audit log is a haystack by design. This guide does five ordinary things to a cluster and then finds each of them again, which is the skill the competency is actually about.
Monitoring and Runtime Guide 33 of 40 Advanced
- Kubernetesapiserver v1.36.4, kubelet v1.36.3
- Runtimecontainerd 2.2.6
- CNICilium 1.18.1
- Built withkubeadm v1.36.3
- TimeAbout 18 min
The same cka8001 apiserver, with audit logging on from the previous guide. The query helper is thirty lines of Python and is on the page.
- Host kernel7.0.0-29
| Server Name | IP Address | OS | Roles | CPU | RAM | HDD |
|---|---|---|---|---|---|---|
| CKA8001 | 192.168.0.56 | Ubuntu 26.04 LTS | Single Node (control plane, untainted) | 2 Core | 4 GB | 50 GB |
This guide includes
Use this once auditing is on, because the log is a haystack by design. This matters because filtering by resource is not the query you want - the useful questions are about verbs and identities.
- doing five things worth finding later, then going and finding the first of them
- seeing why filtering by resource is not the query, by asking the same log two ways
- finding an exec, and then reading that same exec in full
- measuring what it costs after a few idle minutes, and reverting it
Before you start
- guide 32 - this guide reads what that one switched on.
-
Do five things worth finding later
-
Why filtering by resource is not the query
-
The one that matters most
-
What it costs, and putting it back