Information
Run the auditd logging daemon to obtain verbose operating system logs from GKE nodes running Container-Optimized OS (COS).
Rationale:
Auditd logs provide valuable information about the state of the cluster and workloads, such as error messages, login attempts, and binary executions. This information can be used to debug issues or to investigate security incidents.
NOTE: Nessus has not performed this check. Please review the benchmark to ensure target compliance.
Solution
Using Command Line
Download the example manifests:
curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/os-audit/cos-auditd-logging.yaml > cos-auditd-logging.yaml
Edit the example manifests if needed. Then, deploy them:
kubectl apply -f cos-auditd-logging.yaml
Verify that the logging Pods have started. If you defined a different Namespace in your manifests, replace cos-auditd with the name of the namespace you're using:
kubectl get pods --namespace=cos-auditd
Impact:
Increased logging activity on a node increases resource usage on that node, which may affect the performance of your workload and may incur additional resource costs. Audit logs sent to Stackdriver consume log quota from the project. You may need to increase your log quota and storage to accommodate the additional logs.
Note that the provided logging daemonset only works on nodes running Container-Optimized OS (COS).
Default Value:
By default, the auditd logging daemonset is not launched when a GKE cluster is created.