Enable Linux auditd logging for Container Optimized OS GKE nodes

SrednjaNivo 2Ručni pregledgke

Opis

Enable Linux auditd logging for GKE nodes running Container Optimized OS to collect detailed operating system audit events from the node. These logs provide host level visibility into activity such as login attempts, error messages, and binary executions, and can be forwarded to Cloud Logging using the supported logging agent configuration. The benchmark marks this recommendation Manual.

Kako se proverava

Metod provere: Ručni pregled

Ova preporuka se ne može proveriti automatski. Skeniranje je navodi sa ovim uputstvima kada prosledite --include-manual.

Review the cluster and verify that Linux auditd logging is deployed for Container Optimized OS nodes using an approved DaemonSet. Search for an audit logging DaemonSet across all namespaces: kubectl get daemonsets -A | grep -Ei 'auditd|cos-auditd' • Expected output: An approved audit logging DaemonSet, such as cos-auditd-logging, should be present and show the desired Pods as available. If no matching DaemonSet is returned, Linux auditd logging is not deployed.

Kako se ispravlja

Metod ispravke: Smernica ili zakrpa infrastrukture

Deploy an approved Linux auditd logging DaemonSet when the audit returns no matching auditd or cos-auditd DaemonSets or Pods. The DaemonSet should run on eligible Container Optimized OS nodes and forward Linux audit events to Cloud Logging or another approved log destination. • Download the current GKE example manifest for Linux auditd logging on Container Optimized OS nodes. curl https://raw.githubusercontent.com/GoogleCloudPlatform/k8s-node-tools/master/troubleshooting/os-audit/cos-auditd-logging.yaml > cos-auditd-logging.yaml • Review the manifest before deployment, including the namespace, DaemonSet name, node selectors, ConfigMap settings, and logging destination. • Replace any sample logging agent image with an approved image from a trusted source and pin it by digest where required.

Svojstva

Operativni sistemi: Bilo koji
Oznake: gkemanaged-serviceslogging
Referenca: CIS Google Kubernetes Engine (GKE) Benchmark v2.0.0 - 5.7.2 Enable Linux auditd logging for Container Optimized OS GKE nodes