refactor(scenarios): split monolithic configuration into individual files

- Split `scenarios/scenarios.json` into individual JSON files under `scenarios/data/` named `<scenario-id>.json` - Split `scenarios/bundles.json` into individual JSON files under `scenarios/bundles/` named `<bundle-id>.json` - Updated `backend/server.js` to dynamically load scenario and bundle files from their respective directories - Updated documentation in `scenarios/SCHEMA.md` and `README.md` to reflect the new repository layout and contributor workflow Signed-off-by: Abhinav Sinha <[email protected]>
2026-06-15 07:52:47 +05:30
parent 2104c5fea6
commit 124e5276d4
94 changed files with 4256 additions and 4217 deletions
@@ -0,0 +1,61 @@
+{
+  "id": "cks-audit-policy",
+  "title": "Write a Kubernetes Audit Policy",
+  "category": "Cluster Setup",
+  "difficulty": "Hard",
+  "type": "task",
+  "weight": 7,
+  "description": "## Kubernetes Audit Policy\n\nAudit logging lets you track who did what on the cluster. The kube-apiserver reads an **audit policy file** to decide which events to log and at which verbosity level.\n\n**Your task:**\n\nWrite an audit policy file at `/etc/kubernetes/audit-policy.yaml` with the following rules (in order):\n\n1. Log all operations on `secrets` in any namespace at level **`RequestResponse`**.\n2. Log read operations (`get`, `list`, `watch`) on `pods` at level **`Metadata`**.\n3. **Drop** (level `None`) all events for the `system:masters` group.\n4. Log everything else at level **`Metadata`** as a catch-all.\n\n```bash\n# Verify the policy file exists and contains the key fields:\ncat /etc/kubernetes/audit-policy.yaml\n```",
+  "hints": [
+    {
+      "title": "Audit policy structure",
+      "body": "An audit policy is a YAML file with `apiVersion: audit.k8s.io/v1`, `kind: Policy`, and a `rules:` list. Order matters — first matching rule wins.",
+      "command": "cat <<EOF > /etc/kubernetes/audit-policy.yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n- level: RequestResponse\n  resources:\n  - group: \"\"\n    resources: [\"secrets\"]\n- level: Metadata\n  verbs: [\"get\", \"list\", \"watch\"]\n  resources:\n  - group: \"\"\n    resources: [\"pods\"]\n- level: None\n  userGroups: [\"system:masters\"]\n- level: Metadata\nEOF"
+    }
+  ],
+  "setup_commands": [
+    {
+      "command": "mkdir -p /etc/kubernetes"
+    }
+  ],
+  "validation": {
+    "commands": [
+      {
+        "description": "Audit policy file is valid YAML with kind: Policy",
+        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print(p.get('kind',''))\"",
+        "expected_output": "Policy",
+        "match": "exact"
+      },
+      {
+        "description": "Rule 1: level is RequestResponse and targets secrets",
+        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); r=p['rules'][0]; print('ok' if r['level']=='RequestResponse' and any('secrets' in x.get('resources',[]) for x in r.get('resources',[])) else 'fail')\"",
+        "expected_output": "ok",
+        "match": "exact"
+      },
+      {
+        "description": "Rule 2: level is Metadata, targets pods, verbs include get/list/watch",
+        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='Metadata' and any('pods' in x.get('resources',[]) for x in r.get('resources',[])) and set(r.get('verbs',[])) >= {'get','list','watch'} for r in p['rules']) else 'fail')\"",
+        "expected_output": "ok",
+        "match": "exact"
+      },
+      {
+        "description": "Rule 3: level is None for system:masters group",
+        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='None' and 'system:masters' in r.get('userGroups',[]) for r in p['rules']) else 'fail')\"",
+        "expected_output": "ok",
+        "match": "exact"
+      },
+      {
+        "description": "Rule 4: catch-all is level Metadata with no other selectors",
+        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); last=p['rules'][-1]; print('ok' if set(last.keys())=={'level'} and last['level']=='Metadata' else 'fail')\"",
+        "expected_output": "ok",
+        "match": "exact"
+      }
+    ]
+  },
+  "default_namespace": "default",
+  "teardown_commands": [
+    {
+      "command": "rm -f /etc/kubernetes/audit-policy.yaml"
+    }
+  ]
+}