SUSE Rancher and RKE Kubernetes cluster using CSI Driver on DELL EMC PowerFlex September 2021 H18899 White Paper Abstract This white paper describes the deployment of a SUSE Rancher Kubernetes Technologies Solutions PowerFlex Engineering Validated Copyright 2 SUSE Rancher and RKE Kubernetes cluster using CSI Driver on DELL EMC PowerFlex White Paper The information in this publication The information is subject to change without notice. Contents 3 SUSE Rancher and RKE Kubernetes cluster using CSI Driver on DELL EMC PowerFlex White Paper Contents Executive

Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Published 2023-09-08 Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089 USA 408-745-2000 notice. Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Copyright © 2023 Juniper Networks, Inc. All rights reserved. The information in this document is Install Single Cluster CN2 on Rancher RKE2 | 19 Install Single Cluster CN2 on Rancher RKE2 Running Kernel Mode Data Plane | 21 Install Single Cluster CN2 on Rancher RKE2 Running DPDK Data Plane | 24

document describes the installation and configuration of SAP Data Intelligence 3 deployed on SUSE's RKE2 and VMWare vsphere and vsan. Disclaimer: Documents published as part of the SUSE Best Practices vSAN and vSphere Contents 1 Introduction 4 2 Requirements 5 3 Preparations 7 4 Installation of RKE 2 on top of VMware vSphere and VMware vSAN 7 5 Installing SAP Data Intelligence 3.3 11 6 Maintenance of SAP Data Intelligence 3.3 on top of VMware vSphere/vSAN cluster and Rancher Kubernetes Engine (RKE) 2. This guide does not provide information on how to set up a VMware vsphere / vsan cluster. In

- August 2019 Authors Taylor Price Overview The following document scores a Kubernetes 1.13.x RKE cluster provisioned according to the Rancher v2.2.x hardening guide against the CIS 1.4.0 Kubernetes level of security of the hardened cluster against each control in the benchmark. Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS download the benchmark after logging in to CISecurity.org. Testing controls methodology Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to

Hardening Guide with CIS 1.6 Benchmark Rancher v2.5.4 CIS 1.6 Kubernetes v1.18 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS download the benchmark after logging in to CISecurity.org. Testing controls methodology Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the jq and kubectl (with valid config) tools to and are required

Guide v2.4 Rancher v2.4 Hardening Guide v2.4 Kubernetes v1.15 Benchmark v1.5 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS download the benchmark after logging in to CISecurity.org. Testing controls methodology Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the jq and kubectl (with valid config) tools to and are required

Hardening Guide with CIS 1.5 Benchmark Rancher v2.5 CIS v1.5 Kubernetes v1.15 Because Rancher and RKE install Kubernetes services as Docker containers, many of the control verification checks in the CIS download the benchmark after logging in to CISecurity.org. Testing controls methodology Rancher and RKE install Kubernetes services via Docker containers. Configuration is defined by arguments passed to When performing the tests, you will need access to the Docker command line on the hosts of all three RKE roles. The commands also make use of the the jq and kubectl (with valid config) tools to and are required

need Docker containers when used with distributions such as K3s and Rancher Kubernetes Engine 2 (RKE2). For installations that want an even smaller attack surface, SUSE Rancher can utilize an operating Micro to help run Kubernetes in the most efficient way possible. Kubernetes from SUSE Rancher with RKE uses a configuration syntax designed for clarity and dynamic cluster reconfiguration with no downtime management across the major public cloud provider’s distributions, including EKS, AKS and GKE as well as RKE, RKE2 and K3s or any CNCF-conformant Kubernetes distribution. All the SUSE Rancher features are available

required to address CIS-Kubernetes benchmark controls. Rancher CIS-Kubernetes self assessment using RKE This document has been created by the Engineering team at Rancher Labs. Profile Definitions The configuration file on each of the RKE nodes that will be provisioned with the controlplane role: Rationale This configuration file will ensure that the Rancher RKE cluster encrypts secrets at rest, qps: 500 burst: 5000 2.1 - Rancher HA Kubernetes Cluster Configuration via RKE (See Appendix A. for full RKE cluster.yml example) 2.1.1 - Configure kubelet options Profile Applicability Level

Ensure that all Namespaces have Network Policies defined Reference Hardened RKE cluster.yml configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: group for the etcd service is required to be setup prior to installing RKE. The uid and gid for the etcd user will be used in the RKE config.yml to set the proper permissions for files and directories during --gid 52034 etcd useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd Update the RKE config.yml with the uid and gid of the etcd user: services: etcd: gid: 52034 uid: 52034