cis-ocp-v170-1-2-20

name	cis-ocp-v170-1.2.20
description	Ensure that the --audit-log-path argument is set (Manual)
category	cis-openshift
version	1.7.0
author	cyberstrike-official
tags	["cis","openshift","kubernetes","redhat","control-plane","api-server"]
cis_id	1.2.20
cis_benchmark	CIS Red Hat OpenShift Container Platform Benchmark v1.7.0
tech_stack	["kubernetes","openshift","redhat"]
cwe_ids	[]
chains_with	[]
prerequisites	[]
severity_boost	{}

CIS Red Hat OpenShift Container Platform Benchmark v1.7.0 - Control 1.2.20

Profile Applicability

• Level: 1

Description

Enable auditing on the Kubernetes API Server and set the desired audit log path.

Rationale

Auditing the Kubernetes API Server provides a security-relevant chronological set of records documenting the sequence of activities that have affected the system by individual users, administrators or other components of the system. Even though currently, Kubernetes provides only basic audit capabilities, it should be enabled. You can enable it by setting an appropriate audit log path.

Impact

None

Audit Procedure

OpenShift audit works at the API server level, logging all requests coming to the server. API server audit is on by default.

Run the following command to find the Kubernetes API audit log path:

oc get configmap config -n openshift-kube-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["audit-log-path"]'

Verify the path is /var/log/kube-apiserver/audit.log.

Use the following to verify the audit log exists:

export POD=$(oc get pods -n openshift-kube-apiserver -l app=openshift-kube-apiserver -o jsonpath='{.items[0].metadata.name}')
oc rsh -n openshift-kube-apiserver -c kube-apiserver $POD ls /var/log/kube-apiserver/audit.log
echo $?

Verify a return code of 0.

Run the following command to find the OpenShift API audit log path:

oc get configmap config -n openshift-apiserver -ojson | jq -r '.data["config.yaml"]' | jq '.apiServerArguments["audit-log-path"]'

Verify the path is /var/log/openshift-apiserver/audit.log.

Use the following to verify the audit log exists:

export POD=$(oc get pods -n openshift-apiserver -l apiserver=true -o jsonpath='{.items[0].metadata.name}')
oc rsh -n openshift-apiserver $POD ls /var/log/openshift-apiserver/audit.log
 $?