Kubernetes Audit Logs Must Be Owned By Root

Description

All audit logs must be owned by root user and group. By default, the path for the Kubernetes audit log is

/var/log/kube-apiserver/

. To properly set the owner of /var/log/kube-apiserver, run the command:

$ sudo chown root /var/log/kube-apiserver 

To properly set the owner of /var/log/kube-apiserver/*, run the command:

$ sudo chown root /var/log/kube-apiserver/* 

Rationale

Unauthorized disclosure of audit records can reveal system and configuration data to attackers, thus compromising its confidentiality.