Kubernetes Security Technical Implementation Guide

The Kubernetes Security Technical Implementation Guide (V2 R6) has 92 STIG checks. New to STIG checklists? Read What is a STIG checklist?, CKL vs CKLB, and STIG vs SCAP benchmark.

Find STIG checks

92STIG checks

Search filters this STIG's checks locally. Separate terms must all match (use quotes for an exact phrase). A search you ran on the Search page carries over here.

Severity

Version

V2 · R6

CurrentPublished Wed Apr 01 2026

The Kubernetes API Server must be set to audit log maximum backup.

Kubernetes Security Technical Implementation Guide

Assessment Title

Rule Text

The Kubernetes API Server must be set to audit log maximum backup.

Description

Discussion Text

The Kubernetes API Server must set enough storage to retain logs for monitoring suspicious activity and system misconfiguration, and provide evidence for Cyber Security Investigations.

New to STIG checklists? Read What is a STIG checklist? and CKL vs CKLB.

Objective

V-242463

Rule

SV-242463r961863_rule

Severity

medium

Rule Version

CNTR-K8-003300

Documentable

false

IA Controls

NIST SP 800-53

Rev 5

Assessment Procedure

Check Text

Change to the /etc/kubernetes/manifests/ directory on the Kubernetes Control Plane. Run the command:
grep -i audit-log-maxbackup * 

If the setting "audit-log-maxbackup" is not set in the Kubernetes API Server manifest file or it is set less than "10", this is a finding.

Implementation Procedure

Fix Text

Edit the Kubernetes API Server manifest file in the /etc/kubernetes/manifests directory on the Kubernetes Control Plane. Set the value of "--audit-log-maxbackup" to a minimum of "10".

STIG check 79 of 92 in the Kubernetes STIG checklist

← Previous · V-242462The Kubernetes API Server must be set to audit log max size.Next · V-242464 →The Kubernetes API Server audit log retention must be set.