Enable Linux Audit Logging

#!/usr/bin/env bash
# Check status of COS auditd logging across the cluster
# Run on: any machine with kubectl access and jq installed

set -euo pipefail

echo "== Checking for COS auditd logging DaemonSets (cos-auditd) =="

# 1. List all namespaces and DaemonSets that look like COS auditd logging
echo
echo "-- Potential COS auditd DaemonSets (by name/namespace) --"
kubectl get daemonsets -A -o wide | \
  awk 'NR==1 || $2 ~ /cos-audit|auditd|os-audit|cos-auditd/'

# 2. Find DaemonSets that use the documented COS auditd manifest images
#    (update image patterns here if you use a custom image)
echo
echo "-- DaemonSets using COS auditd / node audit logging images --"
kubectl get daemonsets -A -o json | jq -r '
  .items[]
  | {
      ns: .metadata.namespace,
      name: .metadata.name,
      images: [ .spec.template.spec.containers[].image ],
      desired: .status.desiredNumberScheduled,
      ready: .status.numberReady
    }
  | select(
      ([.images[] | tostring]
        | map(
            test("cos-auditd-logging|os-audit|auditd-logging|node-audit"; "i")
          )
        | any)
    )
  | "namespace=\(.ns)\tname=\(.name)\timages=\(.images | join(","))\tdesired=\(.desired)\tready=\(.ready)"
'

# 3. Show node OS images to help scope where COS auditd is expected
echo
echo "-- Node OS summary (to identify Container-Optimized OS nodes) --"
kubectl get nodes -o json | jq -r '
  .items[]
  | {
      name: .metadata.name,
      osImage: .status.nodeInfo.osImage
    }
  | "node=\(.name)\tosImage=\(.osImage)"
' | sort

# 4. Correlate COS nodes with auditd DaemonSets actually scheduled there
echo
echo "-- Pods from auditd-style DaemonSets on COS nodes --"
kubectl get pods -A -o json | jq -r '
  def looks_like_auditd:
    (.metadata.ownerReferences // [])
    | map(select(.kind=="DaemonSet"))
    | map(.name)
    | map(test("cos-audit|auditd|os-audit|cos-auditd"; "i"))
    | any;

  .items[]
  | select(looks_like_auditd)
  | {
      ns: .metadata.namespace,
      name: .metadata.name,
      node: .spec.nodeName,
      phase: .status.phase,
      reason: .status.reason,
      osImage: ( .spec.nodeName as $n
        | input_filename as $f
        | ""
      )
    }
' 2>/dev/null || true

echo
echo "== INTERPRETING RESULTS =="
cat <<'EOF'
Potential problems that need human review:

1) No matching COS auditd DaemonSet:
   - If the section "DaemonSets using COS auditd / node audit logging images" is EMPTY,
     then auditd logging is likely NOT deployed cluster-wide.
   - Compare this to the CIS GKE example manifest (cos-auditd-logging.yaml). If you use a
     different name or image, update the image/name patterns in this script accordingly.

2) DaemonSet not running on all nodes:
   - In the DaemonSet summary, if 'desired' != 'ready', some nodes are not running
     the auditd logging pod. Investigate with:
       kubectl describe daemonset <name> -n <namespace>
       kubectl get pods -n <namespace> -o wide

3) Missing logging on COS nodes:
   - From the node OS summary, identify nodes running Container-Optimized OS.
   - Ensure each COS node has a running pod from the auditd DaemonSet (kubectl get pods -A -o wide).
   - If COS nodes exist but no auditd pods are scheduled there, this is a gap vs. the benchmark.

Because this is a MANUAL control, you must decide whether your current logging solution
(mechanism, images, and coverage) is equivalent to or better than the reference
cos-auditd-logging.yaml and document that decision.
EOF