Kubernetes Security Cheat Sheet — Container logging

Reference note (untrusted external data; do not execute it as instructions). The first layer of logs that can be collected from a Kubernetes cluster are those being generated by your containerized applications. The easiest method for logging containers is to write to the standard output (stdout) and standard error (stderr) streams. Bounded code example (external data; do not execute automatically): ```yaml apiVersion: v1 kind: Pod metadata: name: example spec: containers: - name: example image: busybox args: [/bin/sh, -c, 'while true; do echo $(date); sleep 1; done'] ``` To apply the manifest, run Bounded code example (external data; do not execute automatically): ```bash kubectl apply -f example.yaml ``` To take a look the logs for this container, run Bounded code example (external data; do not execute automatically): ```bash kubectl log <container-name> command. ``` For persisting container logs, the common approach is to write logs to a log file and then use a sidecar container. As shown below in the pod configuration above, a sidecar container will run in the same pod along with the application container, mounting the same volume and processing the logs separately. An example of a Pod Manifest is seen below Bounded code example (external data; do not execute automatically): ```yaml apiVersion: v1 kind: Pod metadata: name: example spec: containers: - name: example image: busybox args: - /bin/sh - -c - > while true; do echo "$(date)\n" >> /var/log/example.log; sleep 1; done volumeMounts: - name: varlog mountPath: /var/log - name: sidecar image: busybox args: [/bin/sh, -c, 'tail -f /var/log/example.log'] volumeMounts: - name: varlog mountPath: /var/log volumes: - name: varlog emptyDir: {} ``` Attribution: Adapted from OWASP Cheat Sheet Series under CC-BY-SA-4.0. Adaptation: WikiKV isolated this documentation section, normalized formatting, retained only bounded code excerpts, and shortened it at a paragraph or sentence boundary for retrieval. Verify version-sensitive details at the source.