t o t h e R K E cluster.yml k u b e l e t s e c t i on u n d e r services: services: kubelet: generate_serving_certificate: true extra_args: feature-gates: "RotateKubeletServerCertificate=true" pro t o t h e R K E cluster.yml k u b e l e t s e c t i on u n d e r services: services: kubelet: generate_serving_certificate: true extra_args: feature-gates: "RotateKubeletServerCertificate=true" pro terminated-pod-gc-threshold: '1000' kubelet: extra_args: protect-kernel-defaults: 'true' fail_swap_on: false generate_serving_certificate: true kubeproxy: {} scheduler: extra_args: address: 127.0.0.1 profiling:

scheduler: image: "" extra_args: {} extra_binds: [] extra_env: [] kubelet: generate_serving_certificate: true extra_args: feature-gates: "RotateKubeletServerCertificate=true" 3.5 7 infra_container_image: "" cluster_dns_server: "" fail_swap_on: false generate_serving_certificate: true kubeproxy: image: "" extra_args: {} extra_binds: [] TLS_RSA_WITH_AES _256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 fail_swap_on: false generate_serving_certificate: true scheduler: Hardening Guide v2.3.5 20 extra_args:

aescbc is the key type, and secret is populated with a 32-byte base64 encoded string. Remediation Generate a key and an empty configuration file: Rancher_Hardening_Guide.md 11/30/2018 4 / 24 head -c 32 io/v1beta1 kind: Policy rules: - level: Metadata Remediation On nodes with the controlplane role: Generate an empty configuration file: touch /etc/kubernetes/audit.yaml Set the file ownership to root:root Rancher_Hardening_Guide.md 11/30/2018 7 / 24 Remediation On nodes with the controlplane role: Generate an empty configuration file: touch /etc/kubernetes/admission.yaml touch /etc/kubernetes/event

scheduler: image: "" extra_args: {} extra_binds: [] extra_env: [] kubelet: generate_serving_certificate: true extra_args: feature-gates: "RotateKubeletServerCertificate=true" TLS_RSA_WITH_AES _256_GCM_SHA384,TLS_RSA_WITH_AES_128_GCM_SHA256 fail_swap_on: false generate_serving_certificate: true scheduler: extra_args: address: 127.0.0.1

"xxxxxxxxxxx" password: "xxxxxxxxxxxx" insecure: true credentialsSecret: generate: true cloudControllerManager: nodeSelector: node-role.kubernetes.io/control-plane: Maintenance Planner at https://apps.support.sap.com/sap/support/mp published on the SAP Web site and generate a Stack XML le with the container image definitions of the SAP Data Intelligence release that

24 DEPLOYING AND SCALING KUBERNETES WITH RANCHER You can also generate the configuration file from “Generate config” button at the top – and along with a local executable of kubectl, interact

($M), 2022-2025 Aaron’s Anecdote In my prior life as a product manager for an MSP I expected to generate a dollar of services and consulting revenue for every ten dollars of software I sold. Source:

API in plaintext Output via API in plaintext AES-GCM Key AES (128/192/256) encrypt/decrypt/generate/verify key Input via API in plaintext Output via API in plaintext AES Wrapping Key AES