CKS Practice Question 9: Audit Policy Rule Ordering
Certified Kubernetes Security Specialist (CKS) · Test 1 · question 9 of 10
An investigation into a suspected Secret exfiltration needs the request and response bodies of every secrets API call. The cluster's audit policy is applied and the API server is logging, but entries for Secret reads only ever contain "level":"Metadata". The policy reads:
rules: - level: Metadata - level: RequestResponse resources: - group: "" resources: ["secrets"]
What is the cause, and what is the fix?
Show answer and explanation
Answer:
An audit policy is an ordered list. Each event is tested against the rules from top to bottom and the first matching rule sets the audit level for that event; no later rule is consulted. A rule with no selectors matches everything, so putting level: Metadata first makes every subsequent rule dead code. Specific rules must be listed before broad ones; the usual shape is the narrow secrets/configmaps rules at the top and a catch-all at the bottom.
Option A invents a protection that does not exist. RequestResponse on secrets really does log the object bodies, which is why the documentation warns about it and why most production policies deliberately restrict Secret logging to Metadata.
Option B misstates omitStages. It suppresses named stages such as RequestReceived from being emitted; it never strips bodies from an event whose level is RequestResponse, and the default is not to omit ResponseComplete.
Option D confuses rotation with content. --audit-log-maxsize is the size in megabytes at which the log file is rotated; it has no influence on the level recorded for an event.
Reference: Auditing