Hi all did any one had issue while applying audit policy in cks exam , i had is . . .

Kubernetes-Slack Discussions
#1

Ripunjay G:
Hi all did any one had issue while applying audit policy in cks exam , i had issue while applying audit policy that kind policy does not exist

#2

David Brunkow:
I didn’t have an issue. Did you literally apply it or let apiserver just load it?

#3

Ripunjay G:
Initially I did not apply then api server was not coming up then I tried checking policy

#4

Ripunjay G:
It was due to policy

#5

Ripunjay G:
Same policy I had tried in labs

#6

denis.dsouza:
in labs i faced issue when i applied audit-policy,
the api-server pod was not starting
also no logs for api-server container in ‘crictl’ (since there were no logs i was not able to find the root cause of issue)

#7

Ripunjay G:
Exactly same issue with me

#8

Alistair Mackay:
It is almost impossible to debug API server pod not starting
It is a good idea to back up the manifest before editing it so that you can make it run again if need be.

cp /etc/kubernetes/manifests/kube-apiserver.yaml /tmp/

Some answers may not be able to be validated if you end the exam with a broken API server, meaning you’ll lose marks for other questions that might actually be correct!

When enabling auditing check:
• No errors in audit policy if you have edited it.
• Volumes and volume mounts added correctly if you need them
• Paths for --audit-policy-file and --audit-log-path are correct with respect to the container’s file system.

#9

Ripunjay G:
I passed the exam already btw , however wanted to bring this issue . I had backed kube-api manifest file n there was no issue with that n I had properly done as you mentioned . For sure issue was while applying audit policy n it was not syntax issue . It seemed some crd cluster level issue . I have raised ticket to them let’s see .
Good news I cleared the CKS exam :blossom::pray::skin-tone-2::tada:thanks to all of you for your help . But wasted lot of time in that question to debug n hence could only attempt 14 questions

#10

unnivkn:
Hi @Ripunjay G did you get any chance to look at the below logs for any hints:
If kube-apiserver is not coming up after modifications & normal wait time, then check the logs(below is an example):
controlplane $ cd /var/log/pods/kube-system_kube-apiserver-controlplane_80ec794cc4ee54b7604a6564c4e2604b/
controlplane $ ls
kube-apiserver
controlplane $ cd kube-apiserver/
controlplane $ ls
0.log 1.log 2.log 3.log
controlplane $

Note: keep in mind kube-apiserver.yaml is very sensitive, even if an additional space you made by mistake, may impact it’s normal functionality.

#11

Alistair Mackay:
Hi @Ripunjay G
We now have a FAQ page on diagnosing broken API server.
Please see https://github.com/kodekloudhub/community-faq/blob/main/docs/diagnose-crashed-apiserver.md