Rancher Kubernetes Cryptographic Library FIPS 140-2 Non-Proprietary Security Policy Document Version 1.1 January 4, 2021 Prepared for: Prepared by: Rancher classified by FIPS 140-2 as a software module, multi-chip standalone module embodiment. The validated version of the library is 66005f41fbc3529ffe8d007708756720529da20d. The cryptographic module was tested Federal Communications Commission (FCC) Electromagnetic Interference (EMI) and Electromagnetic Compatibility (EMC) requirements for business use as defined by 47 Code of Federal Regulations, Part 15, Subpart

operations SUSE Rancher provides simple and consistent cluster operations including provisioning, version management, visibility and diagnostics, monitoring and alerting, and centralized audit. Security All Supported Versions. At the time of validating this solution, the latest version of SUSE Rancher v2.5.7 and RKE version v1.2.6 along with Kubernetes v1.20.4 and docker v19.03.15 for SLES15 SP2 were using RKE are as follows: Table 2. Requirements for RKE cluster on PowerFlex family Name Version Description Reference SUSE Rancher server 2.5.7 SUSE Rancher server is used from Workstation

Provisioning 4 4 4 1 Private Registry & Image Management 3 4 4 2 Cluster Upgrades & Version Management 4 4 2 2 Storage Support 4 4 4 3 Arm Support 4 2 1 0 Airgap Support distribution requires the bare minimum of host configuration, usually no more than a supported version of Docker. For edge deployments, SUSE Rancher does not need Docker containers when used with distributions in doing so, operators will lose access to some features of Tanzu. Upgrades are bound to the version of the TKGI CLI and require that users download and install virtual machines and base image templates

hyperscalers to adopt cloud-native approaches for nearly every use case Inhibitor: Legacy App Compatibility Low hanging fruit continue to be picked off, meaning transformations will become increasingly

cluster Download and install RKE 2 $ export INSTALL_RKE2_TYPE=server $ export INSTALL_RKE2_VERSION=version here> $ curl -sfL https://get.rke2.io | sh - $ systemctl enable --now rke2-server.service as workers of the RKE 2 cluster: $ export INSTALL_RKE2_TYPE=agent $ export INSTALL_RKE2_VERSION=version here> $ curl -sfL https://get.rke2.io | sh - $ systemctl enable --now rke2-agent.service AGE ingress-nginx-controller NodePort 10.43.86.90 80:31963/ TCP,443:{di_version}06/TCP 53d In our example here, the TLS port is be 3.306. Note the port IP down as you will need

described below. You can of course change this as per your use case. Hostname Details Docker Version ranch-svr Rancher Master Latest Ranch-def Default environment Latest Ranch-Kubernetes For the rolling-update method, first create a replication controller with 4 replicas and nginx version 1.7.9. Wait for the replication controller to bring all 4 pods up: apiVersion: v1 kind: ReplicationController a deployment for its success or for failures (3) You can rollback an earlier deployment if the version is found to be unstable (4) You can pause and resume a deployment – this is especially handy for

the status of the nodes. kubectl get nodes NAME STATUS ROLES AGE VERSION rke2-a1 Ready 17h v1.25.10+rke2r1 rke2-a2 Ready the cluster with the following characteristics: • Cluster has no CNI plug-in. • Enable multus version 0.3.1. 2. Specify the DPDK nodes. For each node running DPDK, label it as follows: kubectl label deployment. a. Show the status of the nodes. NAME STATUS ROLES AGE VERSION rke2-a1 Ready 17h v1.25.10+rke2r1 rke2-a2 Ready

Hardening Guide Version Rancher Version CIS Benchmark Version Kubernetes Version Hardening Guide v2.3.5 Rancher v2.3.5 Benchmark v1.5 Kubernetes 1.15 Click here to download a PDF version of this document the documentation on how to configure custom RKE images. Hardening Guide v2.3.5 6 kubernetes_version: "v1.15.9-rancher1-1" enable_network_policy: true default_pod_security_policy_template_id: "restricted" ssh_cert_path: "" ssh_agent_auth: false authorization: mode: "" options: {} ignore_docker_version: false private_registries: [] ingress: provider: "" options: {} node_selector: {} extra_args:

Hardening Guide Version Rancher Version CIS Benchmark Version Kubernetes Version Hardening Guide v2.4 Rancher v2.4 Benchmark v1.5 Kubernetes 1.15 Click here to download a PDF version of this document environment, # please consult the documentation on how to configure custom RKE images. kubernetes_version: "v1.15.9-rancher1-1" enable_network_policy: true default_pod_security_policy_template_id: "restricted" ssh_cert_path: "" ssh_agent_auth: false authorization: mode: "" options: {} ignore_docker_version: false private_registries: [] Hardening Guide v2.4 13 ingress: provider: "" options: {}

CIS Kubernetes Benchmark v1.5 - Rancher v2.4 with Kubernetes v1.15 Click here to download a PDF version of this document Overview This document is a companion to the Rancher v2.4 security hardening guide Kubernetes, and the CIS Benchmark: Self Assessment Guide Version Rancher Version Hardening Guide Version Kubernetes Version CIS Benchmark Version Self Assessment Guide v2.4 Rancher v2.4 Hardening Guide Audit Script: 5.1.5.sh #!/bin/bash export KUBECONFIG=${KUBECONFIG:-/root/.kube/config} kubectl version > /dev/null if [ $? -ne 0 ]; then echo "fail: kubectl failed" exit 1 fi accounts="$(kubectl