Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Published 2023-09-08 Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089 USA 408-745-2000 reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Copyright software, you agree to the terms and conditions of that EULA. ii Table of Contents 1 Introduction Cloud-Native Contrail Networking Overview | 2 Terminology | 4 CN2 Components | 6 Deployment Models

infrastructure continue to choose cloud-based technologies to power their digital transformation. As they move away from their legacy environments to hybrid, multi-cloud stacks, enterprises are creating IT operations with containers and Kubernetes. The recent Forrester Wave report1 stated that these cloud native technologies are quickly becoming the preferred way for global organizations to build and containerized applications in production by 2022. Confidence of this prediction demonstrated the value of cloud native technologies for developers, who will always look for solutions to help them build applications

maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/ kube-apiserver-proxy-client-key maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/ kube-apiserver-proxy-client-key maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/ kube-apiserver-proxy-client-key

performance data can be stored in InfluxDB and visualized by Grafana, or it can be fed to Google Cloud monitoring for storage and visualization. 1.3.10 Log Management Fetching and analyzing log containers. This data can be fed to an ELK (Elasticsearch, Logstash and Kibana) stack or Google Cloud logging for further analysis and visualization. 1.4 Kubernetes Components Kubernetes works in if you access the same, you will see the guestbook application: If you are using a cloud provider, it is natural that the LoadBalancer type service will create a load balancer and attach

by all versions Certifications CNCF Kubernetes Conformance Certification Yes Yes Yes Trusted Cloud Yes Yes Yes 6 Certification Kubernetes-native No change to Kubernetes code Deep customization and webhook supported Notification Manager, a self-developed open-source tool that supports cloud provider SMS, DingTalk, and WeCom Pagerduty supported Pagerduty, Microsoft teams, DingTalk Deep integration with major cloud container services, including AWS EKS, Azure AKS, DigitalOcean Kubernetes, and QKE; importing of hosted clusters running on major cloud container services supported

technology firms • 19% YoY growth for SUSE • 88% YoY growth for SUSE Rancher • 50% ACV growth in cloud • Member of CNCF board and TOC • An independent leader in open source – SUSE SA (FRA) Acquired SUSE 2021 Powering Innovation With Leadership in Linux & Kubernetes Hybrid Cloud Infrastructure Dev Datacenter Branch Cloud Edge Support & Services Catalog Security Storage Governance The platform Inhibitors Driver: Public Cloud Adoption “Eventually, container infrastructure software as a service may become an expected functionality” Revenue Growth 2022 to 2025 Cloud +$778.9M, 25% CAGR On-Prem/Other

. . . . . . . . . . . . . . . . . . . . . . . 25 Ap p e n d i x A - C om p l e t e u b u n t u cloud-config E x am p l e . . . . . . . . 26 1 Ap p e n d i x B - C om p l e t e R K E cluster.yml E x t e s cl us t e r ho s t co nfig ur a t i o n ( S e e Ap p e n d i x A. f or f u l l u b u n t u cloud-config e x am p l e ) 1. 1. 1 - C on fi gu r e d e f au l t s y s c t l s e t t i n gs on al l h x A - C o m pl e t e ubunt u cloud-config E x a m pl e cloud-config fi l e t o au t om at e h ar d e n i n g m an u al s t e p s on n od e s d e p l oy m e n t . #cloud-config bootcmd: - apt-get update

etc? 6 Why Kubernetes ? Common compute platform across any infrastructure DEV DATA CENTER CLOUD BRANCH 5G / EDGE ✔ Common API & Packaging ✔ Health Checks/HA ✔ Load Balancing ✔ Overlay Networking Recovery ✔ Autoscaling ✔ Service Discovery ✔ Networking ✔ RBAC & Access Control DEV DATA CENTER CLOUD BRANCH 5G / EDGE ✔ Common API & Packaging ✔ Health Checks/HA ✔ Load Balancing ✔ Overlay Networking Google GKE Cloud Datacenter Edge Branch Dev Secret Management in Kubernetes 16 17 18 Secret Management Challenges ● Secrets sprawl ● Secrets rotation ● X.509 certificates, SSH and Cloud access ●

in the cloud, or at the edge, giving the DevOps team freedom to build and run containerized applications anywhere. The PowerFlex family offers key value propositions for traditional and cloud-native Data Manager enables users to protect, manage, and recover data in on-premises, virtualized, or cloud deployments. The PowerProtect Data Manager platform provides centralized governance that helps mitigate and Data Protection. Table 1. Terminology Term Definition CA Certificate Authority CNS Cloud Native Storage CSI Container Storage Interface Revisions We value your feedback Objective

configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: Hardening Guide v2.3.5 2 This document provides prescriptive guidance for hardening a production calico on AWS # # network: # plugin: calico # calico_network_provider: # cloud_provider: aws # # # To specify flannel interface Hardening Guide v2.3.5 18 # # network: windows_prefered_cluster: false Hardened Reference Ubuntu 18.04 LTS cloud-config: The reference cloud-config is generally used in cloud infrastructure environments to allow for configuration management