prevent disclosing the secrets in the definition files that define containers/clusters, Kubernetes encodes them in Secret objects for later referral in the definition files. 1.3.4 Application Health some key points to note here: • There were three pods created for the frontend, based on the RC definition. It is a Kubernetes best practice to not create pods directly and to only create them through from service definition on the host and forwards all the traffic to intended container and port. NodePort is chosen randomly from a pre-configured range, or can be specified in the definition. The service

service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. -- anonymous-auth=false Based on your system, restart the kubelet service. For example: systemctl service.d/10- kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --authorization-mode=Webhook Based on your system, restart the kubelet service. For example: systemctl service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --client-ca-file= Based on your system, restart the kubelet service. For example: systemctl daemon-reload

that says that the Document is released under this License. If a section does not t the above definition of Secondary then it is not allowed to be designated as Invariant. The Document may contain zero when you modify the Document means that it remains a section "Entitled XYZ" according to this definition. The Document may include Warranty Disclaimers next to the notice which states that this Li- statements of peer review or that the text has been approved by an organization as the authoritative definition of a standard. You may add a passage of up to ve words as a Front-Cover Text, and a passage of

Rancher Kubernetes Cryptographic Library Page 3 of 16 Acronyms and Definitions Term Definition AES Advanced Encryption Standard API Application Programming Interface CAVP Cryptographic Computer HMAC Keyed-Hash Message Authentication Code IG Implementation Guidance Term Definition IV Initialization Vector KAS Key Agreement Scheme KAT Known Answer Test KDF Key Derivation

knowledge of containers, Kubernetes, PowerFlex, and Data Protection. Table 1. Terminology Term Definition CA Certificate Authority CNS Cloud Native Storage CSI Container Storage Interface Revisions Rancher and RKE Kubernetes cluster using CSI Driver on DELL EMC PowerFlex White Paper Term Definition DD Data Domain DNS Domain Name System DDVE PowerProtect DD Virtual Edition FQDN Fully

service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --anonymous-auth=false Based on your system, restart the kubelet service. For example: systemctl service.d/10- kubeadm.conf on each worker node and set the below parameter in KU BELET_AUTHZ_ARGS variable. CIS Benchmark Rancher Self-Assessment Guide - v2.4 42 --authorization-mode=Webhook Based on service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --client-ca-file= Based on your system, restart the kubelet service.

service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_SYSTEM_PODS_ARGS variable. --anonymous-auth=false Based on your system, restart the kubelet service. For example: systemctl service.d/10- kubeadm.conf on each worker node and set the below parameter in KU BELET_AUTHZ_ARGS variable. CIS 1.5 Benchmark - Self-Assessment Guide - Rancher v2.5 42 --authorization-mode=Webhook Based service.d/10-kubeadm.conf on each worker node and set the below parameter in KUBELET_AUTHZ_ARGS variable. --client-ca-file= Based on your system, restart the kubelet service.

CRD (Continued) Parameter Meaning Example enableNad True or false (to enable network address definition or not) true listenerPort The port that the Contrail controller listens on for communications