API server sets --audit-log-maxage to 30

​

What this check verifies

Kubernetes API server audit logging retention is governed by --audit-log-maxage. This evaluates whether the configured value (e.g., 30 days) is set consistently across API server containers to retain audit events for a sufficient period.

​

Risk

Short audit retention limits visibility into historical API actions. Credential abuse, privilege escalation, or cluster tampering may evade detection, and investigations lack evidence for timeline reconstruction-degrading data integrity and confidentiality through undetected unauthorized changes and exfiltration.

​

Recommendation

Set --audit-log-maxage to at least 30 days (or your policy) to support forensics. Align rotation with --audit-log-maxbackup and --audit-log-maxsize. Forward logs to a tamper-resistant central store, enforce least privilege on access, and periodically validate retention coverage.

​

Remediation

Dashboard steps

1. SSH to a control plane node
2. Edit the API server static pod manifest: /etc/kubernetes/manifests/kube-apiserver.yaml
3. Under spec.containers[0].command add:
   • —audit-log-maxage=30 (Use your cluster-required value instead of 30 if different.)
4. Save the file; the kubelet will restart the API server automatically

​

References

• https://rke.docs.rancher.com/config-options/audit-log
• https://kubernetes.io/docs/reference/command-line-tools-reference/kube-apiserver/
• https://kubernetes.io/docs/concepts/cluster-administration/audit/
• https://kubernetes.io/docs/tasks/debug/debug-cluster/audit/

​

Where this check fires

This check runs on every scheduled scan against your Kubernetes account. Findings appear at Cloud Security → Findings filterable by Check ID = apiserver_audit_log_maxage_set. To re-evaluate after a fix, hit Run now on the account’s schedule under Cloud Security → Schedules — the next scan re-checks this control and marks the finding fixed or keeps it persistent.

---

← Back to Kubernetes checks