becoming the preferred way for global organizations to build and modernize their applications and services at scale. The potential of containers and Kubernetes was evident when, in 2020, Gartner2 predicted on any infrastructure • Access to Shared Tools and Services: a high level of reliability with easy, consistent access to shared tools and services Given the transformative impact of Kubernetes and Report 2 "Gartner Forecasts Strong Revenue Growth for Global Container Management Software and Services Through 2024” by Susan Moore, Gartner – View Press Release A Buyer’s Guide to Enterprise Kubernetes

etcd • Ad d t h e f ol l ow i n g t o t h e R K E cluster.yml e t c d s e c t i on u n d e r services: services: etcd: uid: gid: Ad d t h e f ol l ow i n g t o t h e R K E cluster.yml k u b e l e t s e c t i on u n d e r services: services: kubelet: generate_serving_certificate: true extra_args: feature-gates: "RotateKubeletS yml ad d t h e f ol l ow i n g d i r e c t i v e s t o t h e kube-api s e c t i on u n d e r services: services: kube_api: always_pull_images: true pod_security_policy: true service_node_port_range: 30000-32767

※※※※ ※※※※※ ※※※※※ Security ※※※※ ※※※※※ ※※ Windows Container ※ ※※※※ ※※※※ 5 Support Commercial Services and Support ※※※※※ ※※※※ ※※※※ 1.2 Metrics Details Product Overview Overview Product name KubeSphere major cloud container services, including AWS EKS, Azure AKS, DigitalOcean Kubernetes, and QKE; importing of hosted clusters running on major cloud container services supported Deep integration integration with major cloud container services, including AWS, Azure, IBM Cloud; importing of any Kubernetes cluster or hosted Kubernetes services not supported; underlying operating system coupled

--uid 52034 --gid 52034 etcd Update the RKE config.yml with the uid and gid of the etcd user: services: etcd: gid: 52034 uid: 52034 Set automountServiceAccountToken to false for defau 9-rancher1-1" enable_network_policy: true default_pod_security_policy_template_id: "restricted" services: etcd: uid: 52034 gid: 52034 kube-api: pod_security_policy: true secr system_images: etcd: "" alpine: "" nginx_proxy: "" cert_downloader: "" kubernetes_services_sidecar: "" kubedns: "" dnsmasq: "" kubedns_sidecar: "" kubedns_autoscaler: "" coredns:

--uid 52034 --gid 52034 etcd Update the RKE config.yml with the uid and gid of the etcd user: services: etcd: gid: 52034 uid: 52034 Hardening Guide v2.4 4 Set automountServiceAccountToken 9-rancher1-1" enable_network_policy: true default_pod_security_policy_template_id: "restricted" services: etcd: uid: 52034 gid: 52034 kube-api: pod_security_policy: true secr Guide v2.4 12 etcd: "" alpine: "" nginx_proxy: "" cert_downloader: "" kubernetes_services_sidecar: "" kubedns: "" dnsmasq: "" kubedns_sidecar: "" kubedns_autoscaler: "" coredns:

Version Management Node Pool Management Cluster Provisioning & Lifecycle Management Platform Services (Build & Run) SUSE Linux Enterprise Product Family Amazon EKS Azure AKS Google GKE Cloud Secrets Static Secrets (Versioned) Crypto as a Service LDAP/AD OIDC JWT Github MFA/Radius Okta AWS Azure GCP AliCloud Kubernetes Cloud Foundry AppRole Databases Public Cloud Consul / Nomad X.509 Certs

..........................................26 3.3 Load Balancing using Rancher Load Balancing services ............................................27 3.4 Service Discovery ....................... namespace, irrespective of the host. This makes exposing ports and managing links between different services much easier. 1.3.7 Load Balancing Every application that is scaled needs load balancing. In execute CRUD operations on all of Kubernetes objects such as pods, replication controllers and services. Users can even manage underlying containers, view logs for those containers, and execute shell

...............................................................8 6 Roles, Authentication and Services .....................................................................................9 7 Cryptographic Cryptographic Module Specification 1 Cryptographic Module Ports and Interfaces 1 Roles, Services, and Authentication 1 Finite State Model 1 Physical Security NA Operational Environment applications and their respective internal daemons/processes. As such there are no untrusted services calling the services of the module. The physical cryptographic boundary is the general-purpose computer

--event-qps=0 Remediation Add the following to the RKE cluster.yml kubelet section under services: services: kubelet: extra_args: streaming-connection-idle-timeout: "" Remediation In the RKE cluster.yml add the following directives to the kube-api section under services: services: kube-api: pod_security_policy: true extra_args: anonymous-auth: "false" --address=127.0.0.1 Remediation In the RKE cluster.yml file ensure the following options are set: services: … scheduler: extra_args: profiling: "false" address: "127.0.0.1" Reconfigure

creation and management of virtualized networks to connect, isolate, and secure cloud workloads and services seamlessly across private and public clouds. Cloud-Native Contrail Networking (CN2) brings this networking including load balancing, security and multi-tenancy, elastic and resilient VPNs, and gateway services in single-cluster and multi-cluster deployments • Highly available and resilient network controller controller overseeing all aspects of the network configuration and control planes • Analytics services using telemetry and industry standard monitoring and presentation tools such as Prometheus and Grafana