Project: KICS (Provisioning / Security & Compliance)
File: 768aab52-2504-4a2f-a3e3-329d5a679848.md

title: Audit Log Maxbackup Not Properly Set hide: toc: true navigation: true <style> .highlight .hll { background-color: #ff171742; } .md-content { max-width: 1100px; margin: 0 auto; } </style> Query id: 768aab52-2504-4a2f-a3e3-329d5a679848 Query name: Audit Log Maxbackup Not Properly Set Platform: Kubernetes Severity: <span style="color:#edd57e">Low</span> Category: Observability URL: When using kube-apiserver command, the '--audit-log-maxbackup' flag should be defined and set to 10 or more files<br> ```yaml title="Positive test num. 1 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=5"] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 2 - yaml file" hl_lines="11" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: [] restartPolicy: OnFailure ``` ```yaml title="Positive test num. 3 - yaml file" hl_lines="40 27 12 55" apiVersion: serving.knative.dev/v1 kind: Service metadata: name: dummy namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=5"] restartPolicy: OnFailure apiVersion: serving.knative.dev/v1 kind: Configuration metadata: name: dummy-config namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=5"] restartPolicy: OnFailure apiVersion: serving.knative.dev/v1 kind: Revision metadata: name: dummy-rev namespace: knative-sequence spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=5"] restartPolicy: OnFailure apiVersion: sources.knative.dev/v1 kind: ContainerSource metadata: name: dummy-cs namespace: knative-sequence spec: template: spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=5"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 1 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver"] args: ["--audit-log-maxbackup=10"] restartPolicy: OnFailure ``` ```yaml title="Negative test num. 2 - yaml file" apiVersion: v1 kind: Pod metadata: name: command-demo labels: purpose: demonstrate-command spec: containers: name: command-demo-container image: gcr.io/google_containers/kube-apiserver-amd64:v1.6.0 command: ["kube-apiserver","--audit-log-maxbackup=15"] args: [] restartPolicy: OnFailure ```