many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of Not Applicable. This guide will walk through the various controls and provide updated example 11 Ensure that the etcd data directory permissions are set to 700 or more restrictive (Automated) Result: pass Remediation: On the etcd server node, get the etcd data directory, passed as an argument --data-dir /node/var/lib/etcd Expected Result: '700' is equal to '700' Returned Value: 700 1.1.12 Ensure that the etcd data directory ownership is set to etcd:etcd (Automated) Result: pass Remediation: On the

machine is configured with 2 virtual CPUs, 8 GB RAM, and thick provisioned disks on the PowerFlex backend storage. For more information about configuration of PowerFlex nodes, check the Configuration Running 1 36d rancher-webhook-b5b7b76c4-r9nwn 1/1 Running 1 36d Result: Rancher is up and running. Installation of the SUSE Rancher Kubernetes cluster 21 SUSE Rancher

this could be automated with cron, it includes no provision for saving to a remote endpoint. As a result, an effective backup solution will depend on the operator to design, install and maintain it. 2.1.2 OpenShift OpenShift runs an internal OAuth server and proxies communication to multiple backend providers. It maintains compatibility with providers based on LDAP, Keystone, OpenID Connect and

paths: - path: /test ## Path to service backend: serviceName: backend-service servicePort: 90 ## service_port In the above example defined a single rule with a host, path and corresponding backend service and port. We can define multiple host and path combinations pointing to backend services. For our nginx service, we will define root path. apiVersion: extensions/v1beta1 kind: Ingress metadata: name: simplelb spec: backend: serviceName: nginx-service servicePort: 90 Once you have created the ingress rule,

network: # plugin: canal # canal_network_provider: # iface: eth1 28 # network: options: flannel_backend_type: vxlan plugin: canal restore: restore: false # # services: # kube-api: # service_cluster_ip_range: network: # plugin: canal # canal_network_provider: # iface: eth1 # network: options: flannel_backend_type: vxlan plugin: canal # # services: # kube-api: # service_cluster_ip_range: 10.43.0.0/16 network: # plugin: canal # canal_network_provider: # iface: eth1 # network: options: flannel_backend_type: vxlan plugin: canal # # services: # kube-api: # service_cluster_ip_range: 10.43.0.0/16

"true" nginx.ingress.kubernetes.io/secure-backends: "true" nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/proxy-body-size: "0" nginx.ingress.kubernetes rules: - host: "backend: serviceName: vsystem servicePort: 8797 path: / tls: - hosts:

canal_flexvol: "" weave_node: "" weave_cni: "" pod_infra_container: "" ingress: "" ingress_backend: "" metrics_server: "" windows_pod_infra_container: "" ssh_key_path: "" ssh_cert_path: ""

canal_flexvol: "" weave_node: "" weave_cni: "" pod_infra_container: "" ingress: "" ingress_backend: "" metrics_server: "" windows_pod_infra_container: "" ssh_key_path: "" ssh_cert_path: ""

many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of Not Applicable. This guide will walk through the various controls and provide updated example that the API server pod specification file permissions are set to 644 or more restrictive (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain a configuration file for the API server 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain a configuration file for the API server

many of the control verification checks in the CIS Kubernetes Benchmark don't apply and will have a result of Not Applicable. This guide will walk through the various controls and provide updated example that the API server pod specification file permissions are set to 644 or more restrictive (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain a configuration file for the API server 1.1.2 Ensure that the API server pod specification file ownership is set to root:root (Scored) Result: Not Applicable Remediation: RKE doesn’t require or maintain a configuration file for the API server