An exec into prod, then a stolen token
Filter a Kubernetes API audit log with jq. Find the exec that read a service account token, where it came from, and the secret that token was then used to fetch.
Briefing
The API server writes one JSON object per request to its audit log. Exec into a pod is a create on the pods/exec subresource, and the command it ran is in the requestURI as command= parameters.
A reporting account that never runs kubectl showed up in the identity provider’s risky sign-ins this morning. Here is last night’s audit log from the prod cluster.
ops-bastion · Kubernetes review
Type help for the command list and objectives for your tasks. Everything runs in this browser.
Up and down arrows walk your history. Ctrl+L clears the screen. Try help, ls, and objectives.