Identify pod security violations through audit logs

You can identify pod security admission violations in a workload by viewing the server audit logs. To do this, you must access and parse audit logs to find these violations.

Prerequisites

  • You have installed the jq utility.

  • You have root access to the node.

Procedure

  1. Retrieve the node name by running the following command:

    $ NODE_NAME=$(oc get node -ojsonpath='{.items[0].metadata.name}')

  2. View the available audit logs by running the following command:

    $ oc adm node-logs ${NODE_NAME} --path=kube-apiserver/
    Example output
    rhel-94.lab.local audit-2024-10-18T18-25-41.663.log
rhel-94.lab.local audit-2024-10-19T11-21-29.225.log
rhel-94.lab.local audit-2024-10-20T04-16-09.622.log
rhel-94.lab.local audit-2024-10-20T21-11-41.163.log
rhel-94.lab.local audit-2024-10-21T14-06-10.402.log
rhel-94.lab.local audit-2024-10-22T06-35-10.392.log
rhel-94.lab.local audit-2024-10-22T23-26-27.667.log
rhel-94.lab.local audit-2024-10-23T16-52-15.456.log
rhel-94.lab.local audit-2024-10-24T07-31-55.238.log

  3. Parse the audit logs to find pod security violations by running the following command:

    $ oc adm node-logs ${NODE_NAME} --path=kube-apiserver/audit.log \
  | jq -r 'select((.annotations["pod-security.kubernetes.io/audit-violations"] != null) and (.objectRef.resource=="pods")) | .objectRef.namespace + " " + .objectRef.name + " " + .objectRef.resource' \
  | sort | uniq -c

↑ Up: Check audit logs | ⌂ Home: Red Hat build of MicroShift | Next: Troubleshoot etcd →