{
  "id": "cks-audit-policy",
  "title": "Write a Kubernetes Audit Policy",
  "category": "Cluster Setup",
  "difficulty": "Hard",
  "type": "task",
  "weight": 7,
  "description": "## Kubernetes Audit Policy\n\nAudit logging lets you track who did what on the cluster. The kube-apiserver reads an **audit policy file** to decide which events to log and at which verbosity level.\n\n**Your task:**\n\nWrite an audit policy file at `/etc/kubernetes/audit-policy.yaml` with the following rules (in order):\n\n1. Log all operations on `secrets` in any namespace at level **`RequestResponse`**.\n2. Log read operations (`get`, `list`, `watch`) on `pods` at level **`Metadata`**.\n3. **Drop** (level `None`) all events for the `system:masters` group.\n4. Log everything else at level **`Metadata`** as a catch-all.\n\n```bash\n# Verify the policy file exists and contains the key fields:\ncat /etc/kubernetes/audit-policy.yaml\n```",
  "hints": [
    {
      "title": "Audit policy structure",
      "body": "An audit policy is a YAML file with `apiVersion: audit.k8s.io/v1`, `kind: Policy`, and a `rules:` list. Order matters — first matching rule wins.",
      "command": "cat <<EOF > /etc/kubernetes/audit-policy.yaml\napiVersion: audit.k8s.io/v1\nkind: Policy\nrules:\n- level: RequestResponse\n  resources:\n  - group: \"\"\n    resources: [\"secrets\"]\n- level: Metadata\n  verbs: [\"get\", \"list\", \"watch\"]\n  resources:\n  - group: \"\"\n    resources: [\"pods\"]\n- level: None\n  userGroups: [\"system:masters\"]\n- level: Metadata\nEOF"
    }
  ],
  "setup_commands": [
    {
      "command": "mkdir -p /etc/kubernetes"
    }
  ],
  "validation": {
    "commands": [
      {
        "description": "Audit policy file is valid YAML with kind: Policy",
        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print(p.get('kind',''))\"",
        "expected_output": "Policy",
        "match": "exact"
      },
      {
        "description": "Rule 1: level is RequestResponse and targets secrets",
        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); r=p['rules'][0]; print('ok' if r['level']=='RequestResponse' and any('secrets' in x.get('resources',[]) for x in r.get('resources',[])) else 'fail')\"",
        "expected_output": "ok",
        "match": "exact"
      },
      {
        "description": "Rule 2: level is Metadata, targets pods, verbs include get/list/watch",
        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='Metadata' and any('pods' in x.get('resources',[]) for x in r.get('resources',[])) and set(r.get('verbs',[])) >= {'get','list','watch'} for r in p['rules']) else 'fail')\"",
        "expected_output": "ok",
        "match": "exact"
      },
      {
        "description": "Rule 3: level is None for system:masters group",
        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); print('ok' if any(r.get('level')=='None' and 'system:masters' in r.get('userGroups',[]) for r in p['rules']) else 'fail')\"",
        "expected_output": "ok",
        "match": "exact"
      },
      {
        "description": "Rule 4: catch-all is level Metadata with no other selectors",
        "command": "python3 -c \"import yaml; p=yaml.safe_load(open('/etc/kubernetes/audit-policy.yaml')); last=p['rules'][-1]; print('ok' if set(last.keys())=={'level'} and last['level']=='Metadata' else 'fail')\"",
        "expected_output": "ok",
        "match": "exact"
      }
    ]
  },
  "default_namespace": "default",
  "teardown_commands": [
    {
      "command": "rm -f /etc/kubernetes/audit-policy.yaml"
    }
  ]
}