Installing SAP Data Intelligence 3.3 11 6 Maintenance tasks 17 7 Legal notice 20 8 GNU Free Documentation License 21 3 SAP Data Intelligence 3 on Rancher Kubernetes Engine 2 using VMware vSAN and vSphere the terms of the GNU Free Documentation License, Version 1.2 or (at your option) version 1.3; with the Invariant Section being this copyright notice and license. A copy of the license version 1.2 is included included in the section entitled "GNU Free Documentation License". SUSE, the SUSE logo and YaST are registered trademarks of SUSE LLC in the United States and other countries. For SUSE trademarks, see

2038. However, the NTP application is known to have some difficulty in the year 2036. END USER LICENSE AGREEMENT The Juniper Networks product that is the subject of this technical documentation consists Juniper Networks software. Use of such software is subject to the terms and conditions of the End User License Agreement ("EULA") posted at https://support.juniper.net/support/eula/. By downloading, installing networks to connect, isolate, and secure cloud workloads and services seamlessly across private and public clouds. Cloud-Native Contrail Networking (CN2) brings this rich SDN feature set natively to Kubernetes

scale some sample multi-tier applications. But before we dive into details, let’s first cover the general capabilities and concepts of Kubernetes. If you have some basic familiarity with Kubernetes, then environment from the drop-down menu at top of the screen, where we can add a host machine from some of public clouds or from a custom stack. In this example, we’ll choose the custom method. If you are still Services and you will notice that the service we deployed with “LoadBalancer” type has created a public endpoint: ©Rancher Labs 2017. All rights Reserved. 22 DEPLOYING AND SCALING KUBERNETES

and distribution of any software described in this publication requires an applicable software license. Copyright © 2021 Dell Inc. or its subsidiaries. All Rights Reserved. Dell Technologies, Dell, SUSE Rancher lets you streamline cluster deployment on bare metal, edge devices, private clouds, public clouds, and vSphere and secures them using global security policies. Use Helm or SUSE Rancher App cluster using CSI Driver on DELL EMC PowerFlex White Paper Note: All servers must have SUSE SLES license and must be able to connect to SUSE customer enter or a local RMT server. To update the servers

[SP 800-57 P1 r5] NIST SP 800-57 Part 1 Rev. 5, Recommendation for Key Management: Part 1 – General 5/4/2020 [SP 800-67 r2] NIST SP 800-67 Rev. 2, Recommendation for the Triple Data Encryption Algorithm EC DH Elliptic Curve Diffie-Hellman FIPS Federal Information Processing Standard GPC General Purpose Computer HMAC Keyed-Hash Message Authentication Code IG Implementation Guidance ...................................................................................... 12 7.5 Public Keys ...........................................................................................

Services 3 3 1 2 Multi-Cluster Management 4 3 2 2 Edge Support 4 3 2 1 Integrated Public Cloud Support 4 2 2 2 Bare Metal, OpenStack & vSphere 4 3 2 2 Import Existing Clusters that includes Terraform and a set of scripts to deploy OCP4. Installation guides are provided for public and private cloud providers, along with guides for bare metal and "any other provider." Cloud provider managing or deploying Kubernetes clusters. It offers full lifecycle management across the major public cloud provider’s distributions, including EKS, AKS and GKE as well as RKE, RKE2 and K3s or any

Policies 5.3 Network Policies and CNI CIS Benchmark Rancher Self-Assessment Guide - v2.4 2 53 5.6 General Policies CIS Benchmark Rancher Self-Assessment Guide - v2.4 3 CIS Kubernetes Benchmark v1.5 - /kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: --service-account-key-file= Audit: /bin/ps -ef | grep fi done echo "pass" Audit Execution: ./5.3.2.sh Expected result: 'pass' is present 5.6 General Policies 5.6.4 The default namespace should not be used (Scored) Result: PASS Remediation: Ensure

5 Benchmark - Self-Assessment Guide - Rancher v2.5 2 52 53 5.3 Network Policies and CNI 5.6 General Policies CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 3 CIS v1.5 Kubernetes Benchmark /kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: --service-account-key-file= Audit: /bin/ps -ef | grep fi done echo "pass" Audit Execution: ./5.3.2.sh Expected result: 'pass' is present 5.6 General Policies 5.6.4 The default namespace should not be used (Scored) Result: PASS Remediation: Ensure

Control 5.5.1 Configure Image Provenance using ImagePolicyWebhook admission controller (Manual) 5.7 General Policies 5.7.1 Create administrative boundaries between resources using namespaces (Manual) 5.7 kubernetes/manifests/kube-apiserver.yaml on the master node and set the --service-account-key-file parameter to the public key file for service accounts: --service-account-key-file= Audit: /bin/ps -ef | grep kube-apiserver image provenance. Audit: CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 129 5.7 General Policies 5.7.1 Create administrative boundaries between resources using namespaces (Manual) Result:

nginx-ingress ) utilize SecurityContext to switch users and assign capabilities. These exceptions to the general principle of not allowing privilege or capabilities can be managed with PSP. Audit docker inspect /etc/kubernetes/ssl/kube-ca.pem).*)").string' Returned Value: null Result: Pass (See Mitigation) 1.6 - General Security Primitives These "Not Scored" controls are implementation best practices. To ease the administrative