GistPin/infrastructure/k8s/audit-policy.yaml at fix/frontend-leaflet-types · ghzhost/GistPin · GitHub

1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
apiVersion: audit.k8s.io/v1
kind: Policy
metadata:
  name: gistpin-audit-policy
rules:
  # Do not log read-only requests to non-sensitive resources
  - level: None
    verbs: ["get", "list", "watch"]
    resources:
      - group: ""
        resources: ["endpoints", "services", "configmaps"]
    namespaces: ["kube-system"]

  # Do not log lease renewals (noisy, low-value)
  - level: None
    resources:
      - group: "coordination.k8s.io"
        resources: ["leases"]

  # Do not log read-only healthz/readyz/livez
  - level: None
    nonResourceURLs:
      - "/healthz*"
      - "/readyz*"
      - "/livez*"
      - "/metrics"

  # Log secret/configmap/token access at Metadata level only (no content)
  - level: Metadata
    resources:
      - group: ""
        resources: ["secrets", "configmaps"]
      - group: "authentication.k8s.io"
        resources: ["tokenreviews"]
      - group: "authorization.k8s.io"
        resources: ["subjectaccessreviews"]

  # Log all writes to persistent volumes and storage classes
  - level: Request
    verbs: ["create", "update", "patch", "delete"]
    resources:
      - group: ""
        resources: ["persistentvolumes", "persistentvolumeclaims"]
      - group: "storage.k8s.io"
        resources: ["storageclasses"]

  # Log RBAC changes at RequestResponse level
  - level: RequestResponse
    verbs: ["create", "update", "patch", "delete"]
    resources:
      - group: "rbac.authorization.k8s.io"
        resources:
          - clusterroles
          - clusterrolebindings
          - roles
          - rolebindings

  # Log namespace creation/deletion
  - level: RequestResponse
    verbs: ["create", "delete"]
    resources:
      - group: ""
        resources: ["namespaces"]

  # Log pod exec/attach/port-forward (sensitive operations)
  - level: RequestResponse
    resources:
      - group: ""
        resources: ["pods/exec", "pods/attach", "pods/portforward"]

  # Log deployment/statefulset mutations
  - level: Request
    verbs: ["create", "update", "patch", "delete"]
    resources:
      - group: "apps"
        resources: ["deployments", "statefulsets", "daemonsets", "replicasets"]

  # Log all gistpin namespace activity at Request level
  - level: Request
    namespaces: ["gistpin-prod", "gistpin-staging", "gistpin-dev"]

  # Default: log metadata for everything else
  - level: Metadata