which case Kubernetes will bring it back up if it goes down. Autoscaling of pods replicas can be setup based on other conditions, such as CPU utilization. 1.3.6 Service Registry and Discovery DEPLOYING AND SCALING KUBERNETES WITH RANCHER The master can be run in HA mode with a multi-master setup. Apart from components listed for master as shown in the above diagram, there are optional components is modified. Copy this command and log into a host other than Rancher master on which you want to setup your Kubernetes cluster: Once you run above command on a new machine, the host(s) tries

to apply consistent network policy and security. Figure 5 on page 14 provides more detail on this setup. The Contrail controller sits in the Kubernetes control plane of the central cluster and contains ample.yaml Contrail deployer and necessary resources for the central cluster in a multi-cluster setup. k8s/multi-cluster/ distributed_cluster_certmanager_example.yaml Contrail cert-manager manifests clusters in a multi-cluster setup. k8s/multi-cluster/ distributed_cluster_vrouter_example.yaml Contrail vRouter for the distributed workload clusters in a multi-cluster setup. Contrail Tools in Release

shows logical architecture of the RKE cluster that is deployed on a two-layer PowerFlex cluster setup with four storage-only nodes and three compute-only nodes. Figure 3. Logical architecture of node connection information and roles like controlplane, etcd, and worker to apply to each node. Setup as many nodes as needed, in this example, it runs as a single node: $ rke config --name cluster INFO[0000] Running RKE version: v1.2.6 INFO[0000] Initiating Kubernetes cluster INFO[0000] [dialer] Setup tunnel for host [192.168.153.111] . . . INFO[0861] Finished building Kubernetes cluster successfully

log receivers Third-party ELK required for setup; manual configurations required for Kibana to visualize records Third-party ELK required for setup; manual configurations required for Kibana

Known Issues Rancher exec shell and view logs for pods are not functional in a CIS 1.5 hardened setup when only public IP is provided when registering custom nodes. This functionality requires a private Configure etcd user and group A user account and group for the etcd service is required to be setup prior to installing RKE. The uid and gid for the etcd user will be used in the RKE config.yml to set

set as appropriate (Automated) Result: pass Remediation: Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification Remediation: [Manual test] Follow the etcd documentation and create a dedicated certificate authority setup for the etcd service. Then, edit the etcd pod specification file /etc/kubernetes/manifests/ etcd.yaml admission controller (Manual) Result: warn Remediation: Follow the Kubernetes documentation and setup image provenance. Audit: CIS 1.6 Benchmark - Self-Assessment Guide - Rancher v2.5.4 129 5.7 General

Configure etcd user and group A user account and group for the etcd service is required to be setup prior to installing RKE. The uid and gid for the etcd user will be used in the RKE config.yml to set

Intelligence 3.3 Testing the installation of SAP Data Intelligence 3.3 To have a fully supported setup, there are two Kubernetes clusters required. One runs SUSE Rancher Management server and the other

is set as appropriate (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification

is set as appropriate (Scored) Result: PASS Remediation: Follow the Kubernetes documentation and setup the TLS connection between the apiserver and kubelets. Then, edit the API server pod specification