Security Center:Add a self-managed Kubernetes cluster to Security Center

Step 1. Install Logtail

For more information, see Install Logtail components in a self-managed Kubernetes cluster, specifically the Install Logtail section.

Step 2. Enable cluster auditing

The following steps are for reference only. For more information, see Use cluster auditing.

1. A registered cluster is created and the self-managed Kubernetes cluster is connected to the registered cluster. For more information, see Create an ACK One registered cluster.

2. Configure the audit policy file on master nodes.

   Log on to a master node and edit /etc/kubernetes/audit-policy.yaml using the template below. Repeat this step on all other master nodes.

   Note

   The apiVersion value depends on your Kubernetes version:

   • Kubernetes earlier than 1.24: use audit.k8s.io/v1beta1

   • Kubernetes 1.24 and later: use audit.k8s.io/v1

   For details, see Kubernetes 1.24 release notes.

   apiVersion: audit.k8s.io/v1beta1  # Use audit.k8s.io/v1 for Kubernetes >= 1.24
   kind: Policy
   # Suppress events in the RequestReceived stage.
   omitStages:
     - "RequestReceived"
   rules:
     # High-volume, low-risk requests — not logged.
     - level: None
       users: ["system:kube-proxy"]
       verbs: ["watch"]
       resources:
         - group: "" # core
           resources: ["endpoints", "services"]
     - level: None
       users: ["system:unsecured"]
       namespaces: ["kube-system"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["configmaps"]
     - level: None
       users: ["kubelet"] # legacy kubelet identity
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       userGroups: ["system:nodes"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["nodes"]
     - level: None
       users:
         - system:kube-controller-manager
         - system:kube-scheduler
         - system:serviceaccount:kube-system:endpoint-controller
       verbs: ["get", "update"]
       namespaces: ["kube-system"]
       resources:
         - group: "" # core
           resources: ["endpoints"]
     - level: None
       users: ["system:apiserver"]
       verbs: ["get"]
       resources:
         - group: "" # core
           resources: ["namespaces"]
     # Read-only URLs — not logged.
     - level: None
       nonResourceURLs:
         - /healthz*
         - /version
         - /swagger*
     # Events — not logged.
     - level: None
       resources:
         - group: "" # core
           resources: ["events"]
     # Secrets, ConfigMaps, and TokenReviews contain sensitive or binary data —
     # log metadata only.
     - level: Metadata
       resources:
         - group: "" # core
           resources: ["secrets", "configmaps"]
         - group: authentication.k8s.io
           resources: ["tokenreviews"]
     # Read requests for known API groups — log request metadata only (responses can be large).
     - level: Request
       verbs: ["get", "list", "watch"]
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # Write requests for known API groups — log full request and response.
     - level: RequestResponse
       resources:
         - group: "" # core
         - group: "admissionregistration.k8s.io"
         - group: "apps"
         - group: "authentication.k8s.io"
         - group: "authorization.k8s.io"
         - group: "autoscaling"
         - group: "batch"
         - group: "certificates.k8s.io"
         - group: "extensions"
         - group: "networking.k8s.io"
         - group: "policy"
         - group: "rbac.authorization.k8s.io"
         - group: "settings.k8s.io"
         - group: "storage.k8s.io"
     # All other requests — log metadata only.
     - level: Metadata

3. Configure the Kube API Server file on master nodes.

   Log on to all master nodes one by one and complete the following configurations in the Kube API Server file at the path /etc/kubernetes/manifests/kube-apiserver.yaml:

   • dd the --audit-log-* parameter to the command based on the following example:

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...

   • Add the env parameter aliyun_logs_audit-* based on the following example:

     You must replace {cluster_id} in the following example with the Cluster ID of your cluster. You can log on to Security Center console and obtain the Cluster ID of the cluster on the Container page. ${cluster_id} specifies the cluster ID. You can log on to the Security Center console and obtain the Cluster ID of the destination cluster from the Cluster Information column in the cluster list on the Container Assets > Cluster page.

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1

   • Mount /etc/kubernetes/audit-policy.yaml to the API Server Pod as shown in the following example.

     ...
     spec:
       containers:
       - command:
         - kube-apiserver
         - --audit-log-maxbackup=10
         - --audit-log-maxsize=100
         - --audit-log-path=/var/log/kubernetes/kubernetes.audit
         - --audit-log-maxage=30
         - --audit-policy-file=/etc/kubernetes/audit-policy.yaml
         ...
         ...
         env:
         - name: aliyun_logs_audit-${cluster_id}
           value: /var/log/kubernetes/kubernetes.audit
         - name: aliyun_logs_audit-${cluster_id}_tags
           value: audit=apiserver
         - name: aliyun_logs_audit-${cluster_id}_product
           value: k8s-audit
         - name: aliyun_logs_audit-${cluster_id}_jsonfile
           value: "true"
         image: registry-vpc.cn-shenzhen.aliyuncs.com/acs/kube-apiserver:v1.20.4-aliyun.1
         ...
         ...
         volumeMounts:
         - mountPath: /var/log/kubernetes
           name: k8s-audit
         - mountPath: /etc/kubernetes/audit-policy.yaml
           name: audit-policy
           readOnly: true
         ...
         ...
       volumes:
       - hostPath:
           path: /var/log/kubernetes
           type: DirectoryOrCreate
         name: k8s-audit
       - hostPath:
           path: /etc/kubernetes/audit-policy.yaml
           type: FileOrCreate
         name: audit-policy
       ...

Step 3. Verify log collection

1. Log on to the Simple Log Service console.

2. Click the name of the destination project.

3. Check whether the related logs are collected to the Logstore under the destination project.

Step 4. Enable threat detection

1. Log on to Security Center console.

2. In the left-side navigation pane, choose Asset Center > Container. In the upper-left corner of the console, select the region where the asset to be protected is located: Chinese Mainland or Outside Chinese Mainland.

3. On the Cluster tab, click Self-built cluster access.

4. Find the self-managed cluster for which you want to enable K8s log-based threat detection. In the Actions column, click Edit.

5. On the Enable Log Collection tab, select Enable Kubernetes Log Reporting to Detect Threats, configure the audit log information, and then click Save.

   • Region of Log Audit Service: Select the region in which audit logs are stored.

   • Project of Log Audit Service: Enter the name of the project created in Step 1. Install Logtail. Example: k8s-log-custom-sd89ehdq.

   • Logstore of Log Audit Service: Enter the name of the Logstore automatically created in Step 1. Install Logtail. Example: audit-027b007a7dd11967a9f7e2449d8dc497.