Detect & Harden · wrap-up
Cheat sheet & self-check
Every command from this section on one page.
API audit (kube-apiserver flags)
--audit-policy-file=/etc/kubernetes/audit/policy.yaml | Which events to record, at which level |
--audit-log-path=/var/log/kubernetes/audit/audit.log | Where to write (or use a webhook backend) |
--audit-log-maxage=30 --audit-log-maxbackup=10 --audit-log-maxsize=200 | Rotation: days, files, MB |
jq 'select(.objectRef.resource=="secrets") | {user: .user.username, verb, ns: .objectRef.namespace}' audit.log | Who touched Secrets |
Falco
helm repo add falcosecurity https://falcosecurity.github.io/charts | Chart repository |
helm install falco falcosecurity/falco -n falco --create-namespace | Install Falco |
kubectl -n falco logs -l app.kubernetes.io/name=falco -f | Watch alerts |
Run kube-bench
kubectl apply -f https://raw.githubusercontent.com/aquasecurity/kube-bench/main/job.yaml | Run kube-bench as a Job on a node |
kubectl logs job/kube-bench | Read the report |
kube-bench run --targets node | Run only node checks (binary on a node) |
Kubelet settings to check (KubeletConfiguration)
authentication.anonymous.enabled: false | No anonymous kubelet API access |
authorization.mode: Webhook | Kubelet asks the API server who may do what |
readOnlyPort: 0 | Disable the unauthenticated read-only port |
protectKernelDefaults: true | Fail rather than silently changing kernel settings |
rotateCertificates: true | Rotate the kubelet client certificate |
Verification commands
kubectl auth can-i --list --as=system:serviceaccount:shop:default -n shop | What the default ServiceAccount may do (should be nothing useful) |
kubectl run test --image=nginx:1.27 -n shop | Should be rejected under restricted PSA |
kubectl -n shop exec deploy/web -- wget -qO- -T 3 http://api.payments:8080 | Cross-namespace call (should time out) |
kubectl logs job/kube-bench | Benchmark result |
