Who Shot the Cluster? - Audit Logging in Kubernetes - Marian Lobur & Mik Vyatskov, Google

on YouTube ↗33m

" summary

Audit logs can answer “who changed what and when” by recording API server requests; demo uses GKE sending events to Stackdriver to find a recreated malicious deployment, showing the creator as a default service account, the node name and client IP, and the request payload. Audit subsystem writes to log files or remote webhooks, supports batching, and emits multiple entries per request via request/response stages. Configuration uses audit policy levels (None, Metadata, Request, RequestResponse); cost to API server CPU is negligible but log volume varies.

AI-written summary · about

" chapters (9)

1. 0:00Intro
2. 0:26Who Shot the Cluster
3. 2:10Audit Logging
4. 3:38Demo
5. 10:17Questions
6. 16:56Audit Logging on API
7. 21:09Configure Audit Logging
8. 23:38Summary
9. 24:55QA

" related talks

• 35mUsing K8s Audit Logs to Secure Your ClusterMark Stemm · KubeCon + CloudNativeCon Europe 2019
• 36mMaking the Most Out of Kubernetes Audit LogsLaurent Bernaille, Robert Boll · KubeCon + CloudNativeCon North America 2019
• 25mAuditing in Kubernetes 101Nikhita Raghunath · Kubernetes Forum Delhi 2020
• 31mAuditing in Kubernetes 101Nikhita Raghunath · Kubernetes Forum Bengaluru 2020
• 22mAudit in Kubernetes Now, and in the FutureMaciej Szulik · CloudNativeCon + KubeCon Europe 2017
• 20mKubernetes audit log best practicesKenneth DuMez · Conf42 Cloud Native 2023
• 19mAuditing Kubernetes Users: Tracking Security HolesCarol Valencia · KubeDay Colombia 2024
• 34mContainer Forensics: What to Do When Your Cluster is a ClusterAnn Wallace, Maya Kaczorowski · KubeCon + CloudNativeCon Europe 2019