--insecure-port=0 -- requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission- plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultS torageClass,DefaultTolerationSeconds,Mut --insecure-port=0 -- requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission- plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultS CIS 1.6 Benchmark - Self-Assessment Guide --insecure-port=0 -- requestheader-group-headers=X-Remote-Group --secure-port=6443 --enable-admission- plugins=NamespaceLifecycle,LimitRanger,ServiceAccount,DefaultS torageClass,DefaultTolerationSeconds,Mut

0-SNAPSHOT bundle Your Branding Bundle Name <plugins> org.apache.felix maven-bundle-plugin 2 -context:=false 106 BRANDING plugins> You can put your branding.properties file in the project resources (src/main/ my.group.id branding bundle <plugins> org.apache.felix maven-bundle-plugin 2

${KUBECTL_PLUGINS_PATH} 如果指定， 如果指定，则 则搜索将在此 搜索将在此处 处停止。 停止。 如果 如果 KUBECTL_PLUGINS_PATH 环 环境 境变 变量存在， 量存在，则 则加 加载 载程序会将其用作 程序会将其用作查 查找插件的唯一 找插件的唯一 位置。 位置。KUBECTL_PLUGINS_PATH 中，列表以分号分隔。 如果 如果 KUBECTL_PLUGINS_PATH 不存在， 不存在，则 则加 加载 载程序将开始搜索 程序将开始搜索额 额外位置。 外位置。 2. ${XDG_DATA_DIRS}/kubectl/plugins 该 该插件加 插件加载 载程序根据 程序根据 XDG kubectl/plugins 目 目录 录。如果没有指定 。如果没有指定 XDG_DATA_DIRS， ，则 则默 默认为 认为 /usr/local/share:/usr/share。 。 3. ~/.kube/plugins 用 用户 户的 的 kubeconfig 目 目录 录下的 下的 plugins 目 目录 录。在大多数情况下，

<plugins> org.apache.karaf.tooling karaf-maven-plugin 4.0.0 true plugins> instances • manage the confgurations • manage the log service The WebConsole is extensible via a plugins system. Some applications can add new pages to the WebConsole. For instance, Apache Karaf Cellar my.group.id branding bundle <plugins> org.apache.felix maven-bundle-plugin 2

Agenda • Introduction to Apache APISIX • Custom plugin development in API Gateway • Generate APISIX plugins automatically • The future of API Gateway Apache APISIX • Cloud Native API Gateway （https://github • Cover all features of Nginx • Fully dynamic: routing, SSL certificates, upstream, plugins… • More than 40 plugins: authentication, security, logging, observability... What can Apache APISIX do？ • etc.) • Dozens of plugins, unable to meet all the needs of the enterprise • Different open source projects have different solutions to this Kong • Native Support: Lua plugins • Few developers are

files: # #path.logs: /path/to/logs # Path to where plugins are installed: # #path.plugins: /path/to/plugins path.plugins: ${karaf.home}/elasticsearch/plugins #################################### Plugin # data • node.name • node.master • path.data • network.host • cluster.routing.schedule • path.plugins • http.cors.enabled • http.cors.allow-origin The advantage of using this file is that the elasticsearch osgi.compendium 4.3.1 <plugins> You can now enable this collector, just by installing the bundle in Apache Karaf (using the deploy

kubernetes/manifests/kube-apiserver.yaml on the master node and either remove the --enable-admission-plugins parameter, or set it to a value that does not include AlwaysAdmit. Audit: /bin/ps -ef | grep kube-apiserver PersistentVolumeClaimResize,PodSecurityPoli cy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable- admission-plugins' is not present CIS Benchmark Rancher Self-Assessment Guide - v2.4 18 1.2.14 Ensure that the admission /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and ensure that the --disable-admission- plugins parameter is set to a value that does not include ServiceAcco unt. Audit: /bin/ps -ef | grep kube-apiserver

kubernetes/manifests/kube-apiserver.yaml on the master node and either remove the --enable-admission-plugins parameter, or set it to a value that does not include AlwaysAdmit. Audit: /bin/ps -ef | grep kube-apiserver PersistentVolumeClaimResize,PodSecurityPoli cy,EventRateLimit' not have 'AlwaysAdmit' OR '--enable- admission-plugins' is not present CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 18 1.2.14 Ensure that /etc/kubernetes/manifests/kube-apiserver.yaml on the master node and ensure that the --disable-admission- plugins parameter is set to a value that does not include ServiceAcco unt. Audit: /bin/ps -ef | grep kube-apiserver

u t : --anonymous-auth=false --profiling=false --service-account-lookup=true --enable-admission-plugins=ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota secrets_encryption_config: enabled: true extra_args: anonymous-auth: "false" enable-admission-plugins: "ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass,ResourceQuota extra_binds: - "/opt/kubernetes:/opt/kubernetes" F or k 8s 1. 14 enable-admission-plugins s h ou l d b e enable-admission-plugins: "ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel,DefaultStorageClass

(Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--enable-admission-plugins=.*(AlwaysAdmit).*").captures[].string' Returned Value: null Result: Pass 1.1.11 - Ensure that (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--enable-admission-plugins=.*(AlwaysPullImages).*").captures[].string' Returned Value: AlwaysPullImages Result: Pass 1 (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | match("--enable-admission-plugins=.*(DenyEscalatingExec).*").captures[].string' Returned Value: DenyEscalatingExec Result: Pass