Using K8s Audit Logs to Secure Your Cluster
summary
Kubernetes adds API-server audit logging in K8s 1.11/1.13 and audit events are JSON records; you can route them to files, webhooks or dynamic audit sink resources. Practical tooling shown: streaming parsing with jq filters (examples to find namespace deletes, configmaps containing “AWS access key ID”, wildcard roles) and Falco rules that receive webhook batches, match execs, configmap secrets, privileged/host mounts and role-bindings. Live demos show logs and Falco alerts firing immediately when resources are created, modified or abused.
AI-written summary · about
chapters (19)
- 0:00Introduction
- 0:12About me
- 0:23K8s Audit Events
- 1:14Example Audit Event
- 2:22Overview of Audit Logs
- 4:04How Audit Logs Work
- 5:33Audit Log Backends
- 7:03Audit Log 111
- 7:57Audit Log 113
- 8:33JQ
- 9:59JQ Filters
- 12:14Falco
- 13:58Falco Architecture
- 15:02Falco Example
- 17:53How to Use Audit Logs
- 18:52Whats Allowed
- 22:34Rules
- 26:14Demo
- 33:54Outro
related talks
25mAuditing in Kubernetes 101
20mKubernetes audit log best practices
22mAudit in Kubernetes Now, and in the Future
31mAuditing in Kubernetes 101
36mMaking the Most Out of Kubernetes Audit Logs
33mWho Shot the Cluster? - Audit Logging in Kubernetes - Marian Lobur & Mik Vyatskov, Google
30mA Monitoring Platform for Kubernetes Cluster Security
49mScale Your Auditing Events