reproduced and distributed in its entirety without modification. Rancher Kubernetes Cryptographic Library FIPS 140-2 Non-Proprietary Security Policy Document Version 1.1 January Policy Rancher Kubernetes Cryptographic Library Page 2 of 16 References Ref Full Specification Name Date [140] FIPS 140-2, Security Requirements for Cryptographic Modules 12/3/2002 [140AA] Derived Test Requirements 1/4/2011 [140IG] Implementation Guidance for FIPS 140-2 and the Cryptographic Module Validation Program 8/28/2020 [SP 800-38A] NIST SP 800-38A, Recommendation for Block

appropriately configured (Automated) 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) 1.3 Controller Manager 1.3.1 Ensure that the --terminated-pod-gc-threshold argument is set to true (Automated) 4.2.13 Ensure that the Kubelet only makes use of Strong Cryptographic Ciphers (Automated) 5.1 RBAC and Service Accounts 5.1.1 Ensure that the cluster-admin role is Returned Value: - aescbc: true 1.2.35 Ensure that the API Server only makes use of Strong Cryptographic Ciphers (Automated) Result: warn Remediation: Edit the API server pod specification file /etc/

ssl/kube-ca.pem Result: Pass 1.1.30 - Ensure that the API Server only makes use of strong cryptographic ciphers (Not Scored) Audit (Allowed Ciphers) docker inspect kube-apiserver | jq -e '.[0].Args[] RotateKubeletServerCertificate=true Result: Pass 2.1.14 - Ensure that the kubelet only makes use of strong cryptographic ciphers (Not Scored) Audit (Allowed Ciphers) docker inspect kubelet | jq -e '.[0].Args[] |

Update grub and reboot: sudo update-grub sudo reboot 3. Load the poll mode driver (PMD) kernel module according to the capabilities of your NIC. • If your NIC supports VFIO, then you might not need uio_pci_generic. If you see a Module uio_pci_generic not found error, then install the module first (for example: sudo apt install linux-modules-extra-5.4.0-xx-generic) before loading the module. 67 Juniper CN2

s/tools/install-kubectl/ Docker 19.03.1 5 Docker is installed on each SLES node. #SUSEConnect -p sle- module- containers/15.2/x86_64 #zypper install docker SLES15 SP2 nodes SLES15 SP2 Ensure that the run the zypper update. 1. Run the following command to activate the containers module: $ SUSEConnect -p sle-module-containers/15.2/x86_64 2. Run the following commands to Install the docker, enable

Multi-platform and multi-cloud ● Central control and management ● Auditing ● Compliance & Hardware Security Module (HSM) integration ● Costs, scalability & productivity HashiCorp Vault Provides the foundation