Server SSD Solid-State Disk TLS Transport Layer Security VLAN Virtual Local Area Network VM Virtual Machine PowerFlex product overview 7 SUSE Rancher and RKE Kubernetes cluster server is used from Workstation VM. https://releases.rancher.com/s erver-charts/stable SUSE Rancher Kubernetes Engine (RKE) 1.2.6 RKE is used from Workstation VM. https://github.com/rancher/rke/ com/docs/rke/l atest/en/os/#ports PowerFlex CSI 1.4 PowerFlex CSI is used from the Workstation VM. https://github.com/dell/csi- vxflexos Requirements Installation of the SUSE Rancher Kubernetes

t o t r u e ( S c or e d ) A u d i t • Ve r i f y vm.overcommit_memory = 1 sysctl vm.overcommit_memory • Ve r i f y vm.panic_on_oom = 0 sysctl vm.panic_on_oom • Ve r i f y kernel.panic = 10 sysctl ol l ow i n g p ar am e t e r s i n /etc/sysctl.d/90-kubelet.conf on al l n od e s : 3 vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel hosts - path: /etc/sysctl.d/90-kubelet.conf owner: root:root permissions: '0644' content: | vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxkeys=1000000 kernel

type in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 needed before installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 - sysctl -w kernel.panic_on_oops=1 - curl path: /etc/sysctl.d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.3.5 21

type in the cluster. Set the following parameters in /etc/sysctl.d/90- kubelet.conf: vm.overcommit_memory=1 vm.panic_on_oom=0 kernel.panic=10 kernel.panic_on_oops=1 kernel.keys.root_maxbytes=25000000 needed before installing kubernetes. #cloud-config packages: - curl - jq runcmd: - sysctl -w vm.overcommit_memory=1 - sysctl -w kernel.panic=10 Hardening Guide v2.4 21 - sysctl -w kernel path: /etc/sysctl.d/kubelet.conf owner: root:root permissions: "0644" content: | vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Hardening Guide v2.4 22

that the --protect-kernel-defaults argument is set to true (Scored) Audit Verify vm.overcommit_memory = 1 sysctl vm.overcommit_memory Verify kernel.panic = 10 sysctl kernel.panic Verify kernel.panic_on_oops kernel.panic_on_oops Remediation Set the following parameters in /etc/sysctl.conf on all nodes: vm.overcommit_memory=1 kernel.panic=10 kernel.panic_on_oops=1 Run sysctl -p to enable the settings

dynamic end-to-end virtual networking and security for cloud-native containerized and virtual machine (VM) workloads, across multi-cluster compute and storage environments, all from a central point of control Prometheus and Grafana • Support for both CRI-O and containerd runtimes • Support for container and VM workloads (using kubevirt) • Support for DPDK data plane acceleration The Contrail controller automatically

virtualization platform based on Kubevirt and Longhorn. It offers a flexible and affordable way to put VM workloads in your edge locations. Harvester can be managed with SUSE Rancher, giving you a single