Feb 2022 A Buyer’s Guide to Enterprise Kubernetes Management Platforms Red Hat OpenShift 4.9, VMware Tanzu 1.4, Google Anthos 1.10 and SUSE Rancher 2.6 A Buyer’s Guide to Following its merger with IBM in 2019, Red Hat continues to command market share. By leveraging their existing relationships with global enterprises, Red Hat has been successful 1 “The Forrester capabilities of the four leading Kubernetes Management Platforms: Red Hat OpenShift Container Platform 4.9 (OpenShift/OCP4) with Red Hat Advanced Cluster Management for Kubernetes (RHACM), VMware Tanzu

Competitor Analysis: KubeSphere vs. Rancher and OpenShift September 2021 2 Table of Contents Competitor Analysis: KubeSphere vs. Rancher and OpenShift........................................1 I. Overview ......18 3 I. Overview 1.Metrics Comparison 1.1 Features Benchmarking Features KubeSphere OpenShift Rancher Monitoring ※※※※※ ※※※※ ※※※ Logging ※※※※※ ※※※ ※※※ Events ※※※※※ ※※※※ ※※※ Auditing ※※※※※ Metrics Details Product Overview Overview Product name KubeSphere OpenShift Rancher Company name QingCloud Technologies Red Hat Rancher Labs Parent company None IBM SUSE Place of incorporation

Networks, Inc. in the United States and other countries. All other trademarks, service marks, registered marks, or registered service marks are the property of their respective owners. Juniper Networks assumes Cloud-Native Contrail Networking is supported on the following: • (Upstream) Kubernetes • Red Hat Openshift • Amazon EKS • Rancher RKE2 Contrail Networking is an SDN solution that automates the creation supporting a rich SDN feature set that can meet the requirements of enterprises and service providers alike. Enterprises and service providers can now manage Contrail using simplified and familiar DevOps tools

without PAA Dell PowerEdge R440 clang 6.0.1 5 Red Hat Enterprise Linux 7.8 Intel® Xeon® Silver 4214R with PAA Dell PowerEdge R440 clang 6.0.1 6 Red Hat Enterprise Linux 7.8 Intel® Xeon® Silver 4214R without PAA Dell PowerEdge R440 clang 6.0.1 7 Red Hat Enterprise Linux 8.2 Intel® Xeon® Silver 4214R with PAA Dell PowerEdge R440 clang 6.0.1 8 Red Hat Enterprise Linux 8.2 Intel® Xeon® Silver 4214R interface are listed in the table below. Table 4 - Approved Services, Roles and Access Rights Service Approved Security Functions Keys and/or CSPs Roles Access Rights to Keys and/or CSPs Module

e n t i s s e t as ap p r o- p r i at e ( S c or e d ) • 1. 1. 23 - E n s u r e t h at t h e --service-account-lookup ar gu m e n t i s s e t t o t r u e ( S c or e d ) 7 • 1. 1. 24 - E n s u r e t t h e c om m an d s e c t i on of t h e ou t p u t : --anonymous-auth=false --profiling=false --service-account-lookup=true --enable-admission-plugins=ServiceAccount,NamespaceLifecycle,LimitRanger,PersistentVolumeLabel on u n d e r services: services: kube_api: always_pull_images: true pod_security_policy: true service_node_port_range: 30000-32767 event_rate_limit: enabled: true 8 audit_log: enabled: true sec

the default service accounts. The CIS 1.5 5.1.5 check requires the default service accounts have no roles or cluster roles bound to it apart from the defaults. In addition the default service accounts • • • Hardening Guide v2.4 3 should be configured such that it does not provide a service account token and does not have any explicit rights assignments. Configure Kernel Runtime Parameters The conf to enable the settings. Configure etcd user and group A user account and group for the etcd service is required to be setup prior to installing RKE. The uid and gid for the etcd user will be used in

conf to enable the settings. Configure etcd user and group A user account and group for the etcd service is required to be setup prior to installing RKE. The uid and gid for the etcd user will be used in etcd group run the following console commands. addgroup --gid 52034 etcd useradd --comment "etcd service account" --uid 52034 --gid 52034 etcd Update the RKE config.yml with the uid and gid of the etcd automountServiceAccountToken to false for defau lt service accounts Kubernetes provides a default service account which is used by cluster workloads where no specific service account is assigned to the pod. Where

Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling ✔ Service Discovery ✔ Networking ✔ RBAC & Access Control DEV DATA CENTER CLOUD BRANCH 5G / EDGE ✔ Common Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling ✔ Service Discovery ✔ Networking ✔ RBAC & Access Control ✔ Common API & Packaging ✔ Health Checks/HA ✔ Balancing ✔ Overlay Networking ✔ Network Security Policies ✔ Backup and Recovery ✔ Autoscaling ✔ Service Discovery ✔ Networking ✔ RBAC & Access Control Common compute platform across any infrastructure

set as appropriate (Automated) 1.2.27 Ensure that the --service-account-lookup argument is set to true (Automated) 1.2.28 Ensure that the --service-account-key-file argument is set as appropriate (Automated) set to false (Automated) 1.3.3 Ensure that the --use-service-account-credentials argument is set to true (Automated) 1.3.4 Ensure that the --service-account-private-key-file argument is set as appropriate Configuration Files 4.1.1 Ensure that the kubelet service file permissions are set to 644 or more restrictive (Automated) 4.1.2 Ensure that the kubelet service file ownership is set to root:root (Automated)

and Scaling ......................................................................... 6 1.3.6 Service Registry and Discovery ......................................................................... .........24 3 Deploying a Multi-Service Application .............................................................................26 3.1 Defining Multi-Service Application ....................... ........................................................26 3.2 Designing a Kubernetes service for an Application .....................................................26 3.3 Load Balancing using Rancher