SYS-632 add audit-policies.yaml.j2

instantlinux · Jan 1, 2025 · 61d8c0a · 61d8c0a
1 parent 1a5fdec
commit 61d8c0a
Showing 1 changed file with 35 additions and 0 deletions.
diff --git a/ansible/roles/kubernetes/templates/audit-policies.yaml.j2 b/ansible/roles/kubernetes/templates/audit-policies.yaml.j2
@@ -0,0 +1,35 @@
+{{ ansible_managed | comment }}
+
+apiVersion: audit.k8s.io/v1
+kind: Policy
+rules:
+# inhibit these
+- level: None
+  nonResourceURLs: ['/healthz*', '/logs', '/metrics', '/swagger*', '/version']
+
+# exclude auth token material
+- level: Metadata
+  omitStages: [RequestReceived]
+  resources:
+  - group: authentication.k8s.io
+    resources: [tokenreviews]
+
+# extended audit of auth delegation
+- level: RequestResponse
+  omitStages: [RequestReceived]
+  resources:
+  - group: authorization.k8s.io
+    resources: [subjectaccessreviews]
+
+# log changes to pods at RequestResponse level
+- level: RequestResponse
+  omitStages: [RequestReceived]
+  resources:
+  # core API group; add API services as desired
+  - group: ''
+    resources: [pods]
+    verbs: [create, patch, update, delete]
+
+# log everything else at Metadata level
+- level: Metadata
+  omitStages: [RequestReceived]