8/28/2020 [SP 800-38A] NIST SP 800-38A, Recommendation for Block Cipher Modes of Operation: Methods and Techniques 12/1/2001 [SP 800-38D] NIST SP 800-38D, Recommendation for Block Cipher Modes 11/28/2007 [SP 800-38F] NIST SP 800-38F, Recommendation for Block Cipher Modes of Operation: Methods for Key Wrapping 12/13/2012 [SP 800-56A Revised] NIST SP 800-56A Revised, Recommendation for Advanced Encryption Standard (AES) 11/26/2001 [FIPS 198-1] FIPS 198-1, The Keyed Hash Message Authentication Code (HMAC) 7/16/2008 FIPS 140-2 Security Policy Rancher Kubernetes Cryptographic

Longhorn Storage Terraform Operator Dashboards & Observability Monitoring & Alerts Security & Authentication Policy Enforcement & Governance RBAC, OPA, Pod & Network Policies CIS Benchmarking Monitoring be/k9lpsnXQv-I Use Ranchers K8s authentication for Vault Vault typically uses an authentication provider, like Active Directory or GitHub. K8s is also an authentication provider. This makes Vault quite https://www.vaultproject.io/docs/auth/kubernetes Use Secrets in Rancher Kubernetes Containers Multiple Methods 30 Vault Agent spec: template: metadata: annotations: vault.hashicorp.com/agent-inject:

production-grade Kubernetes clusters from data center to cloud and edge and unites them with centralized authentication, access control, and observability. SUSE Rancher lets you streamline cluster deployment on bare [/var/run/docker.sock]: [+] Network Plugin Type (flannel, calico, weave, canal, aci) [canal]: [+] Authentication Strategy [x509]: [+] Authorization Mode (rbac, none) [rbac]: [+] Kubernetes Docker image [ protection storage for backups. For more information about PowerProtect Data Manager deployment methods, see the Dell EMC PowerProtect Data Manager Deployment Guide. PowerProtect Data Manager can be

manage multiple Kubernetes clusters across different cloud providers. Rancher provides centralized authentication, role-based access control (RBAC), and monitoring capabilities. This makes it easier to collaborate the same way you monitor other Kubernetes components, using kubectl or other standard Kubernetes methods. You can also install the optional Contrail Analytics package, which packages Prometheus, Grafana cluster. You can follow the procedure in "Create a Rancher RKE2 Cluster" on page 59 or use your own methods to create a cluster. The cluster should have the following characteristics: • Cluster has no CNI

x/en/installation/ha/helm-rancher/chart-options/#advanced-options 3.2 - Rancher Management Control Plane Authentication 3.2.1 - Change the local admin password from the default value Profile Applicability Level Identity Provider for Authentication Profile Applicability Level 1 Description When running Rancher in a production environment, configure an identity provider for authentication. Rationale Rancher Rancher supports several authentication backends that are common in enterprises. It is recommended to tie Rancher into an external authentication system to simplify user and group access in the Rancher cluster

LDAP, Keystone, OpenID Connect and OAuth and it provides an interface for basic authentication and external authentication systems capable of setting a request header. 3.2.1.3 Tanzu Tanzu Kubernetes enables authentication against providers that support LDAP and OIDC. 3.2.1.4 Anthos Anthos supports OpenID Connect (OIDC) in all Anthos cluster types. This can perform authentication against any Google. Headless systems are unsupported. Users must use a browser-based workflow to perform authentication. 3.2.2 Pod and Network Security Policies • SUSE Rancher: 4 • OpenShift: 3 • Tanzu:

unique Certificate Authority is used for etcd (Automated) 3.1 Authentication and Authorization 3.1.1 Client certificate authentication should not be used for users (Manual) 3.2 Logging 3.2.1 Ensure (Automated) Result: pass Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml (Automated) Result: pass Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml

172.31.24.244 user: ubuntu role: [ "controlplane", "etcd", "worker" ] addon_job_timeout: 30 authentication: strategy: x509 authorization: {} bastion_host: ssh_agent_auth: false cloud_provider: {} 172.31.24.244 user: ubuntu role: [ "controlplane", "etcd", "worker" ] addon_job_timeout: 30 authentication: strategy: x509 30 ignore_docker_version: true # # # Currently only nginx ingress provider 172.31.24.244 user: ubuntu role: [ "controlplane", "etcd", "worker" ] addon_job_timeout: 30 authentication: strategy: x509 ignore_docker_version: true # # # Currently only nginx ingress provider is

(Scored) Result: PASS Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml (Scored) Result: PASS Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml false (Scored) Result: PASS Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file

(Scored) Result: PASS Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml (Scored) Result: PASS Remediation: Follow the documentation and configure alternate mechanisms for authentication. Then, edit the API server pod specification file /etc/kubernetes/manifests/kube-apiserver.yaml false (Scored) Result: PASS Remediation: If using a Kubelet config file, edit the file to set authentication: anonymous: enabled to false. If using executable arguments, edit the kubelet service file