工具平台建设 02 试点项目实践 03 目录 CONTENTS 持续改进 04 工具平台建设-从0到1 Jira Confluence 需求 开发 测试 Jenkins 测试平台 Maven Junit Sonar Qube Gradle Nexus Jmeter GitLab Bitbucket Svn 代码管理 构建与依赖 单元测试 代码扫描 安全 AWVS 基于开源及商业工具自建 ⚫ 工具平台建设初期方案选择 ⚫ 工具平台建设初期工具使用情况 工具平台建设-从0到1 Jira Confluence 需求管理 开发与测试管理 Jenkins 测试平台 Maven Junit Sonar Qube Gradle Artifacoy GitLab 构建 单元测试 代码扫描 AWVS Burp Suit NPM Jacoco ITIL 产品&需求管理 安全 配置管理 落地实践 持续集成 内建质量 部署与发布管理 度量与反馈 工具平台建设-流水线过程 工具平台建设-综合门户 Jira Confluence Jenkins 测试平台 Maven Junit Sonar Qube Gradle Artifacoy GitLab AWVS Burp Suit NPM Jacoco 发布平台 Jmeter Xray Ansible

are using calico on AWS # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface # # network: # plugin: flannel # flannel_network_provider: specify flannel interface for canal plugin # # network: # plugin: canal # canal_network_provider: # iface: eth1 28 # network: options: flannel_backend_type: vxlan plugin: canal restore: restore: false are using calico on AWS # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface # # network: # plugin: flannel # flannel_network_provider:

admission control plugin EventRateLimit is set (Automated) 1.2.11 Ensure that the admission control plugin AlwaysAdmit is not set (Automated) 1.2.12 Ensure that the admission control plugin AlwaysPullImages 2.13 Ensure that the admission control plugin SecurityContextDeny is set if PodSecurityPolicy is not used (Manual) 1.2.14 Ensure that the admission control plugin ServiceAccount is set (Automated) 1.2.15 admission control plugin NamespaceLifecycle is set (Automated) 1.2.16 Ensure that the admission control plugin PodSecurityPolicy is set (Automated) 1.2.17 Ensure that the admission control plugin NodeRestriction

was removed in 1.14, so it cannot be set. Result: Pass 1.1.10 - Ensure that the admission control plugin AlwaysAdmit is not set (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | m captures[].string' Returned Value: null Result: Pass 1.1.11 - Ensure that the admission control plugin AlwaysPullImages is set (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] | string' Returned Value: AlwaysPullImages Result: Pass 1.1.12 - Ensure that the admission control plugin DenyEscalatingExec is set (Scored) Audit docker inspect kube-apiserver | jq -e '.[0].Args[] |

out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses canal to provide the policy enforcement. Additional information kubeproxy: image: "" extra_args: {} extra_binds: [] extra_env: [] network: plugin: "" options: {} mtu: 0 node_selector: {} authentication: strategy: "" sans: [] network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface Hardening Guide v2.3.5 18 # # network: # plugin: flannel #

out of the pods in that namespace. To enforce network policies, a CNI (container network interface) plugin must be enabled. This guide uses canal to provide the policy enforcement. Additional information kubeproxy: image: "" extra_args: {} extra_binds: [] extra_env: [] network: plugin: "" options: {} mtu: 0 node_selector: {} authentication: strategy: "" sans: [] # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface # # network: # plugin: flannel # flannel_network_provider:

the control plane nodes in the cluster. Rationale Set up the EventRateLimit admission control plugin to prevent clients from overwhelming the API server. The settings below are intended as an initial larger clusters. This supports the following control: 1.1.36 - Ensure that the admission control plugin EventRateLimit is set (Scored) Audit On nodes with the controlplane role run: stat /etc/kubernetes/admission admission control plugin AlwaysPullImages is set (Scored) 1.1.12 - Ensure that the admission control plugin DenyEscalatingExec is set (Scored) 1.1.14 - Ensure that the admission control plugin NamespaceLifecycle

the workloads reside in the worker nodes in the distributed workload clusters. The Contrail CNI plugin and vRouter sit in the worker nodes of the workload clusters. The Kubernetes control plane in the installed. 7. Download and install the CNI plugin. a. Create the following directory for the CNI plugin. mkdir -p /opt/cni/bin b. Download the CNI plugin. cd /opt/cni/bin/ wget 'https://github.c 5. Download and install the CNI plugin. a. Create the following directory for the CNI plugin. mkdir -p /opt/cni/bin b. Download the CNI plugin. cd /opt/cni/bin/ wget 'https://github.c

grep -v grep Expected result: 'Node,RBAC' has 'RBAC' 1.2.11 Ensure that the admission control plugin AlwaysAd mit is not set (Scored) Result: PASS Remediation: Edit the API server pod specification CIS Benchmark Rancher Self-Assessment Guide - v2.4 18 1.2.14 Ensure that the admission control plugin Service Account is set (Scored) Result: PASS Remediation: Follow the documentation and create 'ServiceAccount' OR '--enable- admission-plugins' is not present 1.2.15 Ensure that the admission control plugin Namespa ceLifecycle is set (Scored) Result: PASS Remediation: Edit the API server pod specification

grep -v grep Expected result: 'Node,RBAC' has 'RBAC' 1.2.11 Ensure that the admission control plugin AlwaysAd mit is not set (Scored) Result: PASS Remediation: Edit the API server pod specification 5 Benchmark - Self-Assessment Guide - Rancher v2.5 18 1.2.14 Ensure that the admission control plugin Service Account is set (Scored) Result: PASS Remediation: Follow the documentation and create 'ServiceAccount' OR '--enable- admission-plugins' is not present 1.2.15 Ensure that the admission control plugin Namespa ceLifecycle is set (Scored) Result: PASS Remediation: Edit the API server pod specification