consistent access to shared tools and services. Feature SUSE Rancher OpenShift Tanzu Anthos Application Catalog 4 4 3 1 Provision with Config Management Systems 4 3 3 3 Integration with from the cloud to core and at the edge. Each distribution requires the bare minimum of host configuration, usually no more than a supported version of Docker. For edge deployments, SUSE Rancher does Kubernetes in the most efficient way possible. Kubernetes from SUSE Rancher with RKE uses a configuration syntax designed for clarity and dynamic cluster reconfiguration with no downtime. 3.1.1.2

....................................................................................... 43 Configuration details ..................................................................................... workloads with varying requirements on a flexible shared infrastructure platform and modernize your application architectures on your schedule. • Extensive automation for predictability and simpler workflows PowerFlex Manager REST APIs and custom Ansible modules to integrate with your infrastructure, application, and DevOps workflows. PowerFlex Manager enables automated deployments and expansions with minimal

.................................................................................. 6 1.3.4 Application Health ....................................................................................... 24 3 Deploying a Multi-Service Application .............................................................................26 3.1 Defining Multi-Service Application ................................. ..............................................26 3.2 Designing a Kubernetes service for an Application .....................................................26 3.3 Load Balancing using Rancher Load

Namespaces have Network Policies defined Reference Hardened RKE cluster.yml configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: Hardening Guide v2 Self-Assessment Guide - Rancher v2.3.5. Configure Kernel Runtime Parameters The following sysctl configuration is recommended for all nodes type in the cluster. Set the following parameters in /etc/sysctl applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate

Namespaces have Network Policies defined Reference Hardened RKE cluster.yml configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: Hardening Guide v2 have any explicit rights assignments. Configure Kernel Runtime Parameters The following sysctl configuration is recommended for all nodes type in the cluster. Set the following parameters in /etc/sysctl applications on the same Kubernetes cluster creates a risk of one compromised application attacking a neighboring application. Network segmentation is important to ensure that containers can communicate

compliant. Junos OS has no known time-related limitations through the year 2038. However, the NTP application is known to have some difficulty in the year 2036. END USER LICENSE AGREEMENT The Juniper Networks deployments • Highly available and resilient network controller overseeing all aspects of the network configuration and control planes • Analytics services using telemetry and industry standard monitoring and facilitates virtual network abstraction, orchestration, and automation. Network configuration plane The network configuration plane interacts with Kubernetes control plane components to manage all CN2 resources

whereas before it would take a few hours at least. All the time we used to spend on manual configuration and security, we can now spend more usefully.” Adrian Lüthi DevOps specialist Inacta AG Copyright Config Maps Application 1 PODs PVs Secrets Config Maps Application 2 PODs PVs Secrets Config Maps Application 1 PODs PODs PODs PVs Secrets Config Maps Restore Application 1 PODs PODs PODs Restore Customer B Customer A Cluster 1 Application 1 Application 2 Customer B Cluster 1 Application 1 Customer A Copyright © SUSE 2021 K8s Database as a Service Rancher Management Server

CIS 1.6 Kubernetes Benchmark - Rancher v2.5.4 with Kubernetes v1.18 Controls 1.1 Etcd Node Configuration Files 1.1.11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) 1.4.2 Ensure that the --bind-address argument is set to 127.0.0.1 (Automated) 2 Etcd Node Configuration Files 2.1 Ensure that the --cert-file and --key-file arguments are set as appropriate (Automated) (Automated) 3.2.2 Ensure that the audit policy covers key security concerns (Manual) 4.1 Worker Node Configuration Files 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive

Master Node Security Configuration 1.1 Master Node Configuration Files 1.2 API Server 1.3 Controller Manager 1.4 Scheduler 2 Etcd Node Configuration 2 Etcd Node Configuration Files 3 Control Plane Plane Configuration 3.2 Logging 4 Worker Node Security Configuration 4.1 Worker Node Configuration Files 4.2 Kubelet 5 Kubernetes Policies 5.1 RBAC and Service Accounts 5.2 Pod Security Policies 5 Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. CIS Benchmark Rancher Self-Assessment

Master Node Security Configuration 1.1 Master Node Configuration Files 1.2 API Server 1.3 Controller Manager 1.4 Scheduler 2 Etcd Node Configuration 2 Etcd Node Configuration Files 3 Control Plane Plane Configuration 3.2 Logging 4 Worker Node Security Configuration 4.1 Worker Node Configuration Files 4.2 Kubelet 5 Kubernetes Policies 5.1 RBAC and Service Accounts 5.2 Pod Security Policies CIS Kubernetes services via Docker containers. Configuration is defined by arguments passed to the container at the time of initialization, not via configuration files. CIS 1.5 Benchmark - Self-Assessment