Skip to main content

Kibana PodSecurity Violations Alert

This runbook will document the Kibana PodSecurity (PSA) violations monitor and how to debug the offending namespace and resources.

Kibana Alert/Monitor

This Kibana monitor has been created that will alert if any PSA violations are detected.

You can see when previous alerts have been triggered under the Alerts section on the monitor.

Checking logs for PSA violations in Kibana

To diagnose which namespace(s) are violating and to see the reason in the logs, either go to the discover section on Kibana and search for the following query:

"violates PodSecurity" AND NOT "smoketest-restricted" AND NOT "smoketest-privileged"

Or follow this link to get the same search.

This will show any logs of PSA violations (excluding smoketests). If no logs appear then increase the time frame to match when the alert was triggered, you can check this on the monitor under the Alerts heading.

In the logs, it will provide information such as the offending namespace and the reason it has been triggered.

Fixing PSA Violations

To fix a PSA violation and stop the monitor from triggering, gather the namespace and violation reason from the logs and then contact a member of the team that owns the violating namespace with details of what is causing the issue, the user then should resolve this issue.

Slack Alert

Kibana will put a message into the #low-priority-alarms slack channel whenever the PodSecurity Violations monitor first goes into the Triggered status.

The monitor is throttled to only send 1 message every 24 hours per trigger. This means if a namespace is already triggering the monitor then when another violation occurs then it will not send another message. The best way to check what is triggering the monitor is to use the steps mentioned above under Checking logs for PSA violation in Kibana.

This page was last reviewed on 11 June 2024. It needs to be reviewed again on 11 September 2024 by the page owner #cloud-platform .
This page was set to be reviewed before 11 September 2024 by the page owner #cloud-platform. This might mean the content is out of date.