H a r d e n i n g G u i d e - R a n c h e r v 2 . 3 . 3 + C o nt e nt s Har d e n i n g G u i d e f or R an c h e r 2. 3. 3+ w i t h K u b e r n e t e s 1. 16 . . . 2 O v e r v i e w . . . . . . . . . . . . . . . 2 1. 1 - R an c h e r R K E K u b e r n e t e s c l u s t e r h os t c on fi gu r at i on . . . . . . . 3 1. 1. 1 - C on fi gu r e d e f au l t s y s c t l s e t t i n gs on al l h os h e e t c d d at a d i r e c t or y p e r m i s s i on s ar e s e t t o 700 or m or e r e s t r i c t i v e . . . . . . . . . . . . . . . . . . . . 4 1. 4. 12 - E n s u r e t h at t h e e t c d d at a

(based on the etcd data directory found above). For example, chmod 700 /var/lib/etcd Audit: stat -c %a /node/var/lib/etcd Expected Result: '700' is equal to '700' Returned Value: 700 1.1.12 Ensure Refer to Rancher's hardening guide for more details on how to configure this ownership. Audit: stat -c %U:%G /node/var/lib/etcd CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 10 Expected Result: - Rancher v2.5.4 11 exit fi if [[ $(stat -c %U:%G ${INPUT_DIR}) != "root:root" ]]; then echo "false" exit fi statInfoLines=$(stat -c "%n %U:%G" ${INPUT_DIR}/*) while read -r statInfoLine;

return a lockfile. Permissions on this file do not need to be as restrictive as the CNI files. stat -c "%n - %a" /var/lib/cni/networks/k8s-pod-network/* Returned Value: /var/lib/cni/networks/k8s-pod-network/10 erved_ip.0 - 644 /var/lib/cni/networks/k8s-pod-network/lock - 750 Audit ( /etc/cni/net.d ) stat -c "%n - %a" /etc/cni/net.d/* Returned Value: /etc/cni/net.d/10-canal.conflist - 664 /etc/cni/net.d/calico-kubeconfig (Not Scored) Notes This is a manual check. Audit ( /var/lib/cni/networks/k8s-pod-network ) stat -c "%n - %U:%G" /var/lib/cni/networks/k8s-pod-network/* Returned Value: /var/lib/cni/networks/k8s-pod-network/10

inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "$ {test_dir}" | cut -d ":" -f 1 | xargs stat -c %a Audit Execution: ./1.1.11.sh etcd Expected result: '700' is equal to '700' 1.1.12 Ensure that inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "$ {test_dir}" | cut -d ":" -f 1 | xargs stat -c %U:%G Audit Execution: ./1.1.12.sh etcd Expected result: 'etcd:etcd' is present 1.1.13 Ensure that your system) on the master node. For example, chown -R root:root /etc/kubernetes/ssl Audit: stat -c %U:%G /etc/kubernetes/ssl Expected result: 'root:root' is present 1.1.20 Ensure that the Kubernetes

inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "$ {test_dir}" | cut -d ":" -f 1 | xargs stat -c %a Audit Execution: ./1.1.11.sh etcd Expected result: '700' is equal to '700' 1.1.12 Ensure that inspect etcd | jq -r '.[].HostConfig.Binds[]' | grep "$ {test_dir}" | cut -d ":" -f 1 | xargs stat -c %U:%G Audit Execution: ./1.1.12.sh etcd Expected result: 'etcd:etcd' is present 1.1.13 Ensure that your system) on the master node. For example, chown -R root:root /etc/kubernetes/ssl Audit: stat -c %U:%G /etc/kubernetes/ssl Expected result: 'root:root' is present 1.1.20 Ensure that the Kubernetes

including root SSH access • NTP (must be chrony) The cluster nodes in our examples are running Ubuntu. c. If you're planning on running with a DPDK data plane, prepare each cluster node that is running DPDK 172.16.0.11 rke2-s1 contrail contrail-k8s-kubemanager-7d7f5b4c88-rgk2k 1/1 Running 0 12h 172.16.0.11 rke2-s1 ller-849d69c748-v42dv 1/1 Running 0 12h 10.42.2.2 rke2-a2 kube-system rke2-snapshot-validation-webhook-654f6677b-c4v5z

12/3/2002 [140AA] FIPS 140-2 Annex A: Approved Security Functions 6/10/2019 [140AC] FIPS 140-2 Annex C: Approved Random Number Generators 6/10/2019 [140AD] FIPS 140-2 Annex D: Approved Key Establishment Page 7 of 16 3 Cryptographic Module Specification The module is a software library providing a C-language application program interface (API) for use by other processes that require cryptographic 9.8 DRBG Health Tests Performed on DRBG, per [SP 800-90A r1] Section 11.3. Required per [140IG] C.1. Pairwise consistency tests are performed for both possible modes of use, e.g. Sign/Verify and

https://help.sap.com/viewer/a8d90a56d61a49718ebcb5f65014bbe7/3.3.latest/en- US/8ae38791d71046fab1f25ee0f682dc4c.html . Download the SLC Bridge software to the management workstation. 5.3 Installing the SLC Bridge Access (https://help.sap.com/viewer/a8d90a56d61a49718ebcb5f65014bbe7/3.3.lat- est/en-US/7e4847e241c340b3a3c50a5db11b46e2.html) of the SAP Data Intelligence 3.3 Instal- lation Guide. 5.4.1 Creating Stack Input Parameters (https://help.sap.com/viewer/a8d90a56d61a49718e- bcb5f65014bbe7/3.3.latest/en-US/abfa9c73f7704de2907ea7ff65e7a20a.html) of the SAP Data Intelligence Installation Guide. 5.6 Post-installation

应用名称只允许最多 15 位的小写字母，数字或"-"，并以字母或数字开头和结尾。 选择部署类型 点击更多选项查看更多部署类型： a) 标准的 Pod 类型 b) DaemonSet 类型 c) StatefulSet 类型 d) Cron 类型 e) Job 类型 填写镜像名 命名空间： 可选择已有的命名空间或者填写并创建新的命名空间 Page 17 IP+端口都可以访问对应的服务，Pod 跨主机 时通过 iptables 规则来转发数据； b) Hostport： 类似于 docker -p 的方式映射的端口，只有 Pod 所在的节点 IP+端口才可以访问； c) ClusterIP： 为 service 配置 cluster IP 地址； d) L4 负载均衡： 此功能对应公有云的负载均衡器，内网环境或自定义云主机安装的集群请不要使用。 NFS 存储为例) c) 配置 NFS 服务器参数，这里的路径为 NFS 服务器配置的共享存储路径。 Page 20 d) 上面步骤中最后点击确定后，设置卷名和容器路径。 持久卷声明 升级策略 支持四种策略： a) 滚动: 先启动新 Pod，再停止旧 Pod（默认） b) 滚动: 先停止旧 Pod，再启动新 Pod c) 删除所有 Pod，然后重新开始

cert-manager-75cf57777c-ztw9f 1/1 Running 0 2m2s cert-manager-cainjector-f54c57bf8-wkc2z 1/1 Running 0 2m2s cert-manager-webhook-76794c6967-84gb6 1/1 AGE rancher-7f4df87477-mfcxc 1/1 Running 1 36d rancher-webhook-b5b7b76c4-r9nwn 1/1 Running 1 36d Result: Rancher is up and running. Installation of