report1 stated that these cloud native technologies are quickly becoming the preferred way for global organizations to build and modernize their applications and services at scale. The potential of 2019, Red Hat continues to command market share. By leveraging their existing relationships with global enterprises, Red Hat has been successful 1 “The Forrester Wave™: Multicloud Container Development Han Bao, Bill Nagel, Forrester – Download Report 2 "Gartner Forecasts Strong Revenue Growth for Global Container Management Software and Services Through 2024” by Susan Moore, Gartner – View Press Release

secrets in the definition files that define containers/clusters, Kubernetes encodes them in Secret objects for later referral in the definition files. 1.3.4 Application Health Long-running applications Rancher’s intuitive user interface allows you to execute CRUD operations on all of Kubernetes objects such as pods, replication controllers and services. Users can even manage underlying containers The left hand side menu provides quick navigation between namespaces and multiple types of objects such as Services, Deployments, Secrets etc. The nodes section provides a quick overview of the nodes

controllers to perform the following functions: • translates configuration from the control plane into objects that the vRouter understands • interfaces with the control plane for the management of routes • contrail-k8s-apiserver translates incoming networking requests into REST API calls to the respective CN2 objects. In some cases, these calls may result in the Contrail controller sending XMPP messages to the vRouter contrail-deploy namespace and resources that belong to that namespace • default-global-vrouter-config and default-global-system-config Before you can run this procedure, ensure you've installed the ContrailReadiness

deployment rancher -n cattle-system -o yaml |grep 'add- local' In the Rancher UI go to Clusters in the Global view and verify that no local cluster is present. On a fresh install the Clusters tab will look the organization's change management process for user accounts. Audit In the Rancher UI, select Global Select Security Select Authentication Ensure the authentication provider for your environment to policies for global access. The Rancher server permits customization of the default global permissions. We recommend that auditors also review the policies of any custom global roles. Remediation

is set (Automated) Result: pass Remediation: Follow the documentation and create ServiceAccount objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver (Automated) Result: pass Remediation: Follow the documentation and create Pod Security Policy objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver (Manual) Result: warn Remediation: Where possible, remove get, list and watch access to secret objects in the cluster. Audit: 5.1.3 Minimize wildcard use in Roles and ClusterRoles (Manual) Result:

Account is set (Scored) Result: PASS Remediation: Follow the documentation and create ServiceAccount objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver set (Scored) Result: PASS Remediation: Follow the documentation and create Pod Security Policy objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver Policies defined (Scored) Result: PASS Remediation: Follow the documentation and create NetworkPolicy objects as you need them. Audit Script: 5.3.2.sh #!/bin/bash -e export KUBECONFIG=${KUBECONFIG:-"/root/

Account is set (Scored) Result: PASS Remediation: Follow the documentation and create ServiceAccount objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver set (Scored) Result: PASS Remediation: Follow the documentation and create Pod Security Policy objects as per your environment. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver Policies defined (Scored) Result: PASS Remediation: Follow the documentation and create NetworkPolicy objects as you need them. Audit Script: 5.3.2.sh #!/bin/bash -e export KUBECONFIG=${KUBECONFIG:-"/root/

configTemplate: | [Global] cluster-id = {{ required ".Values.vCenter.clusterId must be provided" (default .Values.vCenter.clusterId .Values.global.cattle.clusterId) | quote }}

required for edit PSP and OPA GateKeeper supported as the consistent management tools for global security policies on the platform Others Windows Container Support Not supported yet Supported

deployment on bare metal, edge devices, private clouds, public clouds, and vSphere and secures them using global security policies. Use Helm or SUSE Rancher App Catalog to deploy and manage applications across