The author shares a checklist for reviewing Kubernetes audit policies, based on a personal configuration of over 500 lines. The primary goal is to avoid 'blind spots' that arise when policies are not updated regularly and accumulate outdated exceptions.
A critical technical detail is that rules are processed from top to bottom, and the first match is applied. This means broad exception rules placed above narrow security rules can prevent the latter from ever triggering, making the order of rules more important than individual rule errors.
To manage noise from system components, the author recommends precisely limiting exceptions to specific users, verbs, and resources. Omitting verbs or resources in a 'None' level rule can hide unauthorized mutations if a service account token is compromised.
For sensitive data like secrets and configmaps, the 'Metadata' level is recommended to log the fact of access without exposing the content. Conversely, 'RequestResponse' should be used for high-risk actions such as pods/exec, pods/attach, pods/portforward, and RBAC changes.
The checklist suggests quarterly audits to remove obsolete service accounts, such as those remaining after a CNI migration from kube-router to Cilium. It also emphasizes ensuring that comments accurately reflect the actual logic of the rules to avoid debugging errors.
