.............. 16 9.2.2 Usage of AES OFB, CFB and CFB8 ................................................................................................. 16 9.2.3 Usage of AES-GCM ............... .................................................................................... 16 9.2.4 Usage of Triple-DES ................................................................................... Keys and CSPs are passed to the module by the calling application. The keys and CSPs are stored in memory in plaintext. Keys and CSPs residing in internally allocated data structures (during the lifetime

you use it and provides immediate access to buffer capacity. Your payment adjusts to match your usage. APEX Datacenter Utility APEX Datacenter Utility provides the leading product portfolio from Dell single invoice provides monthly payments that are based on a predictable rate and vary based on your usage. SUSE Rancher for Kubernetes SUSE Rancher is an enterprise computing platform to run Kubernetes minimum hardware requirement to run Kubernetes node components is one CPU and 1 GB of memory. Considering the CPU and memory, it is recommended to host the different roles of the Kubernetes cluster such as

co-locate tightly coupled components as close to enable easier network communication and shared storage usage. Kubernetes enables co-locating related containers through pods. ©Rancher Labs 2017. All rights container from the list, you will see detailed, vital information about that container such as CPU, memory, network and disk consumption. Information about labels, ©Rancher Labs 2017. All rights Reserved from values.yml and CLI provided values to produce manifests templates/Notes.txt Any info about usage of charts ©Rancher Labs 2017. All rights Reserved. 62 DEPLOYING AND SCALING KUBERNETES

in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 - sysctl -w kernel.panic_on_oops=1 - curl https://releases d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.3.5 21

in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 Hardening Guide v2.4 21 - sysctl -w kernel.panic_on_oops=1 d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.4 22

--protect-kernel-defaults argument is set to true (Scored) Audit Verify vm.overcommit_memory = 1 sysctl vm.overcommit_memory Verify kernel.panic = 10 sysctl kernel.panic Verify kernel.panic_on_oops = 1 panic_on_oops Remediation Set the following parameters in /etc/sysctl.conf on all nodes: vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Run sysctl -p to enable the settings. 1.1.2 - Install

n t i s s e t t o t r u e ( S c or e d ) A u d i t • Ve r i f y vm.overcommit_memory = 1 sysctl vm.overcommit_memory • Ve r i f y vm.panic_on_oom = 0 sysctl vm.panic_on_oom • Ve r i f y kernel.panic ow i n g p ar am e t e r s i n /etc/sysctl.d/90-kubelet.conf on al l n od e s : 3 vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel path: /etc/sysctl.d/90-kubelet.conf owner: root:root permissions: '0644' content: | vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel

Annual and Multi-year purchase options • Royalty-based monthly reporting and invoicing based on usage • Backed by SUSE/Rancher -all products come with SUSE/Rancher L1, L2, and L3 support • Access to

installer The Kubernetes cluster shall have a storage class annotat- ed as default SC Enable Kaniko Usage optional if running on Dock- er enable Container Image Repository Settings for SAP Data Intelli-

Place compensating controls in the form of PodSecurityPolicy (PSP) and RBAC for privileged container usage (Not Scored) Section 1.7 of this guide shows how to add and configure a default "restricted" PSP