reproduced and distributed in its entirety without modification. Rancher Kubernetes Cryptographic Library FIPS 140-2 Non-Proprietary Security Policy Document Version 1.1 January Policy Rancher Kubernetes Cryptographic Library Page 2 of 16 References Ref Full Specification Name Date [140] FIPS 140-2, Security Requirements for Cryptographic Modules 12/3/2002 [140AA] [140AA] FIPS 140-2 Annex A: Approved Security Functions 6/10/2019 [140AC] FIPS 140-2 Annex C: Approved Random Number Generators 6/10/2019 [140AD] FIPS 140-2 Annex D: Approved Key Establishment Techniques

Ensure only approved node drivers are active Rancher_Hardening_Guide.md 11/30/2018 21 / 24 Profile Applicability Level 1 Description Ensure that node drivers that are not needed or approved are not active

appropriately configured (Automated) 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) 1.3 Controller Manager 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set to true (Automated) 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) 5.1 RBAC and Service Accounts 5.1.1 Ensure that the cluster-admin role is Returned Value: - aescbc: true 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) Result: warn Remediation: Edit the API server pod specification file /etc/

ssl/kube-ca.pem Result: Pass 1.1.30 - Ensure that the API Server only makes use of strong cryptographic ciphers (Not Scored) Audit (Allowed Ciphers) docker inspect kube-apiserver | jq -e '.[0].Args[] RotateKubeletServerCertificate=true Result: Pass 2.1.14 - Ensure that the kubelet only makes use of strong cryptographic ciphers (Not Scored) Audit (Allowed Ciphers) docker inspect kubelet | jq -e '.[0].Args[] |

Modified Version by various parties—for example, statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard. You may add a passage of up to

attach any conformant Kubernetes cluster, Anthos features are only available on a small list of "approved" cluster types. RKE, one of SUSE's CNCF-certified Kubernetes distributions, is included in this