Skip to main content

Ensure Audit Log Maxbackup Argument Is Appropriate

More Info:​

Retain 10 or an appropriate number of old log files.

Risk Level​

Low

Address​

Security

Compliance Standards​

  • CIS Kubernetes

Triage and Remediation​

Remediation​

Manual Steps

  1. On every control plane node, open the kube-apiserver static pod manifest for editing:

    sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml

  2. In the command: section of the kube-apiserver container, locate any existing --audit-log-maxbackup flag. If it exists with the wrong value, change it to 10 (or your chosen appropriate value). If it does not exist, add it as a separate list item, for example:

    - --audit-log-maxbackup=10

  3. Save and exit the editor. The kubelet will automatically detect the manifest change and restart the kube-apiserver static pod. Be aware this restarts the API server on this node.

  4. Wait for the kube-apiserver container to become ready again:

    sudo crictl ps | grep kube-apiserver

  5. Verify that the kube-apiserver process is now running with the correct --audit-log-maxbackup argument on this control plane node:

    /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--audit-log-maxbackup=10'

  6. Repeat steps 1–5 on every control plane node.

Using kubectl

kubectl cannot modify the kube-apiserver static Pod manifest or its process flags. This setting must be changed directly in /etc/kubernetes/manifests/kube-apiserver.yaml on every control plane node; see the Manual Steps section for how to update --audit-log-maxbackup and verify the fix.

Automation
#!/usr/bin/env bash
#
# Fix CISKubernetes 1.2.21:
# Ensure --audit-log-maxbackup is set to 10 in /etc/kubernetes/manifests/kube-apiserver.yaml
#
# Run on: every control plane node (as root)
#
# Usage: sudo ./fix-audit-log-maxbackup.sh

set -euo pipefail

API_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
DESIRED_VALUE="10"
BACKUP_SUFFIX=".pre_audit_log_maxbackup_$(date +%Y%m%d%H%M%S)"

if [ ! -f "$API_MANIFEST" ]; then
  echo "ERROR: $API_MANIFEST not found on this node. Is this a control plane node?"
  exit 1
fi

echo "Backing up $API_MANIFEST to ${API_MANIFEST}${BACKUP_SUFFIX}"
cp -p "$API_MANIFEST" "${API_MANIFEST}${BACKUP_SUFFIX}"

TMP_FILE="$(mktemp)"
trap 'rm -f "$TMP_FILE"' EXIT

# Idempotent edit:
# - If --audit-log-maxbackup already present, replace its value with DESIRED_VALUE.
# - If not present, append it as a new - --audit-log-maxbackup=... line under the existing command args.
#
# This assumes standard kubeadm-style manifest where the apiserver is run as:
#   command:
#     - kube-apiserver
#     - --flag1=...
#     ...
#
# The edit is YAML-structure-preserving enough for typical manifests.

awk -v desired="$DESIRED_VALUE" '
  BEGIN {
    in_command_block = 0
    saw_flag = 0
  }
  # Detect start/end of command: block
  /^ *command: */ {
    in_command_block = 1
    saw_flag = 0
    print
    next
  }
  in_command_block == 1 && /^ *-/ {
    # Within command list; check for existing flag
    if ($0 ~ /--audit-log-maxbackup=/) {
      sub(/--audit-log-maxbackup=[^ ]*/, "--audit-log-maxbackup=" desired)
      saw_flag = 1
      print
      next
    } else {
      print
      next
    }
  }
  in_command_block == 1 && !/^ *-/ {
    # We reached the end of the list; if flag not seen, insert it before leaving block
    if (saw_flag == 0) {
      printf "    - --audit-log-maxbackup=%s\n", desired
      saw_flag = 1
    }
    in_command_block = 0
    print
    next
  }
  {
    print
  }
  END {
    # If file ended while still in command: list, and flag not added yet, append it
    if (in_command_block == 1 && saw_flag == 0) {
      printf "    - --audit-log-maxbackup=%s\n", desired
    }
  }
' "$API_MANIFEST" > "$TMP_FILE"

# Only replace if changed
if ! cmp -s "$API_MANIFEST" "$TMP_FILE"; then
  echo "Updating $API_MANIFEST with desired --audit-log-maxbackup=$DESIRED_VALUE"
  cp "$TMP_FILE" "$API_MANIFEST"
  # Editing a static pod manifest will cause the kubelet to restart the kube-apiserver pod automatically.
  echo "kube-apiserver static pod will be restarted automatically by kubelet due to manifest change."
else
  echo "No changes required; $API_MANIFEST already has --audit-log-maxbackup=$DESIRED_VALUE"
fi

# Verification: wait for kube-apiserver process to expose the correct flag
echo "Verifying kube-apiserver process flags..."

# Allow some time for the static pod to restart if needed
sleep 10

if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--audit-log-maxbackup=${DESIRED_VALUE}"; then
  echo "PASS: kube-apiserver is running with --audit-log-maxbackup=${DESIRED_VALUE}"
  exit 0
else
  echo "WARNING: kube-apiserver process does not yet show --audit-log-maxbackup=${DESIRED_VALUE}"
  echo "Current kube-apiserver command line(s):"
  /bin/ps -ef | grep kube-apiserver | grep -v grep || true
  exit 1
fi

Additional Reading:​