> ## Documentation Index
> Fetch the complete documentation index at: https://cloudanix.com/docs/llms.txt
> Use this file to discover all available pages before exploring further.

# Ensure Audit Log Maxbackup Argument Is Appropriate

### More Info:

Retain 10 or an appropriate number of old log files.

### Risk Level

Low

### Address

Security

### Compliance Standards

* CIS Kubernetes

### Triage and Remediation

<Tabs>
  <Tab title="Remediation">
    ### Remediation

    <AccordionGroup>
      <Accordion title="Manual Steps" defaultOpen="true">
        1. On every control plane node, open the kube-apiserver static pod manifest for editing:

           ```bash theme={null}
           sudo vi /etc/kubernetes/manifests/kube-apiserver.yaml
           ```

        2. In the `command:` section of the `kube-apiserver` container, locate any existing `--audit-log-maxbackup` flag. If it exists with the wrong value, change it to 10 (or your chosen appropriate value). If it does not exist, add it as a separate list item, for example:

           ```yaml theme={null}
           - --audit-log-maxbackup=10
           ```

        3. Save and exit the editor. The kubelet will automatically detect the manifest change and restart the kube-apiserver static pod. Be aware this restarts the API server on this node.

        4. Wait for the kube-apiserver container to become ready again:

           ```bash theme={null}
           sudo crictl ps | grep kube-apiserver
           ```

        5. Verify that the kube-apiserver process is now running with the correct `--audit-log-maxbackup` argument on this control plane node:

           ```bash theme={null}
           /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -- '--audit-log-maxbackup=10'
           ```

        6. Repeat steps 1–5 on every control plane node.
      </Accordion>

      <Accordion title="Using kubectl">
        kubectl cannot modify the kube-apiserver static Pod manifest or its process flags. This setting must be changed directly in `/etc/kubernetes/manifests/kube-apiserver.yaml` on every control plane node; see the Manual Steps section for how to update `--audit-log-maxbackup` and verify the fix.
      </Accordion>

      <Accordion title="Automation">
        ```bash theme={null}
        #!/usr/bin/env bash
        #
        # Fix CISKubernetes 1.2.21:
        # Ensure --audit-log-maxbackup is set to 10 in /etc/kubernetes/manifests/kube-apiserver.yaml
        #
        # Run on: every control plane node (as root)
        #
        # Usage: sudo ./fix-audit-log-maxbackup.sh

        set -euo pipefail

        API_MANIFEST="/etc/kubernetes/manifests/kube-apiserver.yaml"
        DESIRED_VALUE="10"
        BACKUP_SUFFIX=".pre_audit_log_maxbackup_$(date +%Y%m%d%H%M%S)"

        if [ ! -f "$API_MANIFEST" ]; then
          echo "ERROR: $API_MANIFEST not found on this node. Is this a control plane node?"
          exit 1
        fi

        echo "Backing up $API_MANIFEST to ${API_MANIFEST}${BACKUP_SUFFIX}"
        cp -p "$API_MANIFEST" "${API_MANIFEST}${BACKUP_SUFFIX}"

        TMP_FILE="$(mktemp)"
        trap 'rm -f "$TMP_FILE"' EXIT

        # Idempotent edit:
        # - If --audit-log-maxbackup already present, replace its value with DESIRED_VALUE.
        # - If not present, append it as a new - --audit-log-maxbackup=... line under the existing command args.
        #
        # This assumes standard kubeadm-style manifest where the apiserver is run as:
        #   command:
        #     - kube-apiserver
        #     - --flag1=...
        #     ...
        #
        # The edit is YAML-structure-preserving enough for typical manifests.

        awk -v desired="$DESIRED_VALUE" '
          BEGIN {
            in_command_block = 0
            saw_flag = 0
          }
          # Detect start/end of command: block
          /^ *command: */ {
            in_command_block = 1
            saw_flag = 0
            print
            next
          }
          in_command_block == 1 && /^ *-/ {
            # Within command list; check for existing flag
            if ($0 ~ /--audit-log-maxbackup=/) {
              sub(/--audit-log-maxbackup=[^ ]*/, "--audit-log-maxbackup=" desired)
              saw_flag = 1
              print
              next
            } else {
              print
              next
            }
          }
          in_command_block == 1 && !/^ *-/ {
            # We reached the end of the list; if flag not seen, insert it before leaving block
            if (saw_flag == 0) {
              printf "    - --audit-log-maxbackup=%s\n", desired
              saw_flag = 1
            }
            in_command_block = 0
            print
            next
          }
          {
            print
          }
          END {
            # If file ended while still in command: list, and flag not added yet, append it
            if (in_command_block == 1 && saw_flag == 0) {
              printf "    - --audit-log-maxbackup=%s\n", desired
            }
          }
        ' "$API_MANIFEST" > "$TMP_FILE"

        # Only replace if changed
        if ! cmp -s "$API_MANIFEST" "$TMP_FILE"; then
          echo "Updating $API_MANIFEST with desired --audit-log-maxbackup=$DESIRED_VALUE"
          cp "$TMP_FILE" "$API_MANIFEST"
          # Editing a static pod manifest will cause the kubelet to restart the kube-apiserver pod automatically.
          echo "kube-apiserver static pod will be restarted automatically by kubelet due to manifest change."
        else
          echo "No changes required; $API_MANIFEST already has --audit-log-maxbackup=$DESIRED_VALUE"
        fi

        # Verification: wait for kube-apiserver process to expose the correct flag
        echo "Verifying kube-apiserver process flags..."

        # Allow some time for the static pod to restart if needed
        sleep 10

        if /bin/ps -ef | grep kube-apiserver | grep -v grep | grep -q -- "--audit-log-maxbackup=${DESIRED_VALUE}"; then
          echo "PASS: kube-apiserver is running with --audit-log-maxbackup=${DESIRED_VALUE}"
          exit 0
        else
          echo "WARNING: kube-apiserver process does not yet show --audit-log-maxbackup=${DESIRED_VALUE}"
          echo "Current kube-apiserver command line(s):"
          /bin/ps -ef | grep kube-apiserver | grep -v grep || true
          exit 1
        fi
        ```
      </Accordion>
    </AccordionGroup>
  </Tab>
</Tabs>

### Additional Reading:

* [https://kubernetes.io/docs/admin/kube-apiserver/](https://kubernetes.io/docs/admin/kube-apiserver/)