Intuitive UI 4 3 3 3 Hosted & Managed Services 3 3 1 2 Multi-Cluster Management 4 3 2 2 Edge Support 4 3 2 1 Integrated Public Cloud Support 4 2 2 2 Bare Metal, OpenStack & vSphere SUSE Rancher OpenShift Tanzu Anthos Active Directory and LDAP Support 4 4 4 2 Pod and Network Security Policies 4 3 2 2 Configurable Adherence to CIS 4 3 2 2 Global RBAC Policies from the cloud to core and at the edge. Each distribution requires the bare minimum of host configuration, usually no more than a supported version of Docker. For edge deployments, SUSE Rancher does not

※※※ ※※※※※ Multi-cluster Management ※※※※ ※※※ ※※※※※ Edge Computing ※※※※※ ※※ ※※※※※ Network ※※※※※ ※※※※※ ※※※※ Storage ※※※※※ ※※※※※ ※※※※※ Network Policy and Management ※※※※※ ※※※※※ ※※※ Multi-tenant required Manually configure the Jaeger UI Manually configure the Jaeger UI Multicloud and Edge Multicloud Support Deep integration with major cloud container services, including AWS EKS, clusters Edge computing Deep integration with KubeEdge; K3s supported; No feature available and OpenShift Sponsoring K3s project as the solution for 10 Application distribution to edge nodes with

infrastructure DEV DATA CENTER CLOUD BRANCH 5G / EDGE ✔ Common API & Packaging ✔ Health Checks/HA ✔ Load Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling Access Control DEV DATA CENTER CLOUD BRANCH 5G / EDGE ✔ Common API & Packaging ✔ Health Checks/HA ✔ Load Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling Control ✔ Common API & Packaging ✔ Health Checks/HA ✔ Load Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling ✔ Service Discovery ✔ Networking ✔ RBAC

simplifies the cluster installation and operations, whether they are on-premises, in the cloud, or at the edge, giving the DevOps team freedom to build and run containerized applications anywhere. The PowerFlex Enterprise Server SSD Solid-State Disk TLS Transport Layer Security VLAN Virtual Local Area Network VM Virtual Machine PowerFlex product overview 7 SUSE Rancher and RKE Kubernetes offers customers a smaller starting point of four nodes, while enabling them to use their existing network infrastructure. With PowerFlex, the customers deploy to match their initial needs and easily expand

(CN2) brings this rich SDN feature set natively to Kubernetes as a networking platform and container network interface (CNI) plug-in. Redesigned for cloud-native architectures, CN2 takes advantage of the benefits single-cluster and multi-cluster deployments • Highly available and resilient network controller overseeing all aspects of the network configuration and control planes • Analytics services using telemetry and workload being instantiated, network provisioning events such as a new virtual network being created, routing updates from internal and external sources, and unexpected network events such as link and node

Innovation With Leadership in Linux & Kubernetes Hybrid Cloud Infrastructure Dev Datacenter Branch Cloud Edge Support & Services Catalog Security Storage Governance The platform for managing all Kubernetes Security Availability Management The most adaptable Linux operating system Other Linux Datacenter Edge Block Storage Container Security I.a.a.S Copyright © SUSE 2021 5 Source: IDC Drivers and Inhibitors — SCEaaS — RKE2 FIPS Validated 140-2 Kubernetes — FinOps — DBaaS — STaaS — BaaS — DRaaS — Edge Here at SUSE, we cater to learners. Taking an open source approach, we are sharing, enabling, and

calico on AWS # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface # # network: # plugin: flannel # flannel_network_provider: # iface: eth1 # # # To specify flannel interface for canal plugin # # network: # plugin: canal # canal_network_provider: # iface: eth1 28 # network: options: flannel_backend_type: vxlan plugin: canal restore: calico on AWS # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface # # network: # plugin: flannel # flannel_network_provider: # iface:

Configure Kernel Runtime Parameters Configure etcd user and group Ensure that all Namespaces have Network Policies defined Reference Hardened RKE cluster.yml configuration Reference Hardened RKE Template Namespaces have Network Policies defined Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation supposed to. A network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy

Configure Kernel Runtime Parameters Configure etcd user and group Ensure that all Namespaces have Network Policies defined Reference Hardened RKE cluster.yml configuration Reference Hardened RKE Template Namespaces have Network Policies defined Running different applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation v2.4 5 network policy is a specification of how selections of pods are allowed to communicate with each other and other network endpoints. Network Policies are namespace scoped. When a network policy

Mitigation Make sure nodes with role:controlplane are on the same local network as your nodes with role:worker . Use network ACLs to restrict connections to the kubelet port (10250/tcp) on worker nodes that the Container Network Interface file permissions are set to 644 or more restrictive (Not Scored) Notes This is a manual check. Audit ( /var/lib/cni/networks/k8s-pod-network ) Note This may return /var/lib/cni/networks/k8s-pod-network/* Returned Value: /var/lib/cni/networks/k8s-pod-network/10.42.0.2 - 644 /var/lib/cni/networks/k8s-pod-network/10.42.0.3 - 644 /var/lib/cni/networks/k8s-pod-network/last_reserved_ip