Server SSD Solid-State Disk TLS Transport Layer Security VLAN Virtual Local Area Network VM Virtual Machine PowerFlex product overview 7 SUSE Rancher and RKE Kubernetes cluster two-layer PowerFlex cluster. SUSE Rancher supports Kubernetes clusters running on Ubuntu, CentOS, Oracle Linux, SLES, and RedHat Enterprise Linux. For information about the supported Operating Systems server is used from Workstation VM. https://releases.rancher.com/s erver-charts/stable SUSE Rancher Kubernetes Engine (RKE) 1.2.6 RKE is used from Workstation VM. https://github.com/rancher/rke/

t o t r u e ( S c or e d ) A u d i t • Ve r i f y vm.overcommit_memory = 1 sysctl vm.overcommit_memory • Ve r i f y vm.panic_on_oom = 0 sysctl vm.panic_on_oom • Ve r i f y kernel.panic = 10 sysctl ol l ow i n g p ar am e t e r s i n /etc/sysctl.d/90-kubelet.conf on al l n od e s : 3 vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel hosts - path: /etc/sysctl.d/90-kubelet.conf owner: root:root permissions: '0644' content: | vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel

type in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 needed before installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 - sysctl -w kernel.panic_on_oops=1 - curl path: /etc/sysctl.d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.3.5 21

type in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 needed before installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 Hardening Guide v2.4 21 - sysctl -w kernel path: /etc/sysctl.d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.4 22

that the --protect-kernel-defaults argument is set to true (Scored) Audit Verify vm.overcommit_memory = 1 sysctl vm.overcommit_memory Verify kernel.panic = 10 sysctl kernel.panic Verify kernel.panic_on_oops kernel.panic_on_oops Remediation Set the following parameters in /etc/sysctl.conf on all nodes: vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Run sysctl -p to enable the settings

dynamic end-to-end virtual networking and security for cloud-native containerized and virtual machine (VM) workloads, across multi-cluster compute and storage environments, all from a central point of control Prometheus and Grafana • Support for both CRI-O and containerd runtimes • Support for container and VM workloads (using kubevirt) • Support for DPDK data plane acceleration The Contrail controller automatically

virtualization platform based on Kubevirt and Longhorn. It offers a flexible and affordable way to put VM workloads in your edge locations. Harvester can be managed with SUSE Rancher, giving you a single