Kubernetes Security Technical Implementation Guide

The Kubernetes Security Technical Implementation Guide (V2 R6) has 92 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

92STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 01 2026

The Kubernetes API Server must be set to audit log max size.

Kubernetes Security Technical Implementation Guide

Assessment Title

Rule Text

The Kubernetes API Server must be set to audit log max size.

Description

Discussion Text

The Kubernetes API Server must be set for enough storage to retain log information over the period required. When audit logs are large in size, the monitoring service for events becomes degraded. The function of the maximum log file size is to set these limits.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-242462

Rule

SV-242462r961863_rule

Severity

medium

Rule Version

CNTR-K8-003290

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Control Plane. Run the command:
grep -i audit-log-maxsize * 

If the setting "--audit-log-maxsize" is not set in the Kubernetes API Server manifest file or it is set to less than "100", this is a finding.

Implementation Procedure

Fix Text

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. 

Set the value of "--audit-log-maxsize" to a minimum of "100".

STIG check 78 of 92 in the Kubernetes STIG checklist

← Previous · V-242461Kubernetes API Server audit logs must be enabled.Next · V-242463 →The Kubernetes API Server must be set to audit log maximum backup.