Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Published 2023-09-08 Juniper Networks, Inc. 1133 Innovation Way Sunnyvale, California 94089 USA 408-745-2000 reserves the right to change, modify, transfer, or otherwise revise this publication without notice. Cloud Native Contrail Networking Installation and Life Cycle Management Guide for Rancher RKE2 Copyright software, you agree to the terms and conditions of that EULA. ii Table of Contents 1 Introduction Cloud-Native Contrail Networking Overview | 2 Terminology | 4 CN2 Components | 6 Deployment Models

infrastructure continue to choose cloud-based technologies to power their digital transformation. As they move away from their legacy environments to hybrid, multi-cloud stacks, enterprises are creating IT operations with containers and Kubernetes. The recent Forrester Wave report1 stated that these cloud native technologies are quickly becoming the preferred way for global organizations to build and containerized applications in production by 2022. Confidence of this prediction demonstrated the value of cloud native technologies for developers, who will always look for solutions to help them build applications

Best Practices SAP SAP Data Intelligence 3 on Rancher Kubernetes Engine 2 using VMware vSAN and vSphere SUSE Linux Enterprise Server 15 SP4 Rancher Kubernetes Engine 2 SAP Data Intelligence 3 Dr. Ulrich on Rancher Kubernetes Engine 2 using VMware vSAN and vSphere SAP Data Intelligence 3 on Rancher Kubernetes Engine 2 using VMware vSAN and vSphere Date: 2023-07-24 SAP Data Intelligence 3 is the tool the installation and configuration of SAP Data Intelligence 3 deployed on SUSE's RKE2 and VMWare vsphere and vsan. Disclaimer: Documents published as part of the SUSE Best Practices series have been

in the cloud, or at the edge, giving the DevOps team freedom to build and run containerized applications anywhere. The PowerFlex family offers key value propositions for traditional and cloud-native Data Manager enables users to protect, manage, and recover data in on-premises, virtualized, or cloud deployments. The PowerProtect Data Manager platform provides centralized governance that helps mitigate and Data Protection. Table 1. Terminology Term Definition CA Certificate Authority CNS Cloud Native Storage CSI Container Storage Interface Revisions We value your feedback Objective

the --etcd-cafile argument is set as appropriate (Automated) 1.2.33 Ensure that the --encryption-provider-config argument is set as appropriate (Automated) 1.2.34 Ensure that encryption providers are appropriately maxsize=100 --audit-log-format=json --requestheader-allowed- names=kube-apiserver-proxy-client --cloud-provider= --etcd- prefix=/registry --proxy-client-key-file=/etc/kubernetes/ssl/ kube-apiserver-proxy-client-key / kube-ca.pem --tls-private-key-file=/etc/kubernetes/ssl/kube- apiserver-key.pem --encryption-provider-config=/etc/ kubernetes/ssl/encryption.yaml --requestheader-extra-headers- prefix=X-Remote-Extra-

. . . . . . . . . . . . . . . . . . . . . . . 25 Ap p e n d i x A - C om p l e t e u b u n t u cloud-config E x am p l e . . . . . . . . 26 1 Ap p e n d i x B - C om p l e t e R K E cluster.yml E x t e s cl us t e r ho s t co nfig ur a t i o n ( S e e Ap p e n d i x A. f or f u l l u b u n t u cloud-config e x am p l e ) 1. 1. 1 - C on fi gu r e d e f au l t s y s c t l s e t t i n gs on al l h ogr ap h i c C i p h e r s ( Not S c or e d ) • 1. 1. 34 - E n s u r e t h at t h e --encryption-provider-config ar gu m e n t i s s e t as ap p r op r i at e ( S c or e d ) • 1. 1. 35 - E n s u r e t

configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: Hardening Guide v2.3.5 2 This document provides prescriptive guidance for hardening a production the policy enforcement. Additional information about CNI providers can be found here Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a permissive authorization: mode: "" options: {} ignore_docker_version: false private_registries: [] ingress: provider: "" options: {} node_selector: {} extra_args: {} dns_policy: "" extra_envs: []

configuration Reference Hardened RKE Template configuration Hardened Reference Ubuntu 18.04 LTS cloud-config: Hardening Guide v2.4 2 This document provides prescriptive guidance for hardening a production the policy enforcement. Additional information about CNI providers can be found here Once a CNI provider is enabled on a cluster a default network policy can be applied. For reference purposes a permissive {} ignore_docker_version: false private_registries: [] Hardening Guide v2.4 13 ingress: provider: "" options: {} node_selector: {} extra_args: {} dns_policy: "" extra_envs: []

kernel.panic_on_oops=1 Run sysctl -p to enable the settings. 1.1.2 - Install the encryption provider configuration on all control plane nodes Profile Applicability Level 1 Description Rancher_Hardening_Guide 1.34 - Ensure that the --experimental-encryption-provider-config argument is set as appropriate (Scored) 1.1.35 - Ensure that the encryption provider is set to aescbc (Scored) Audit On the control 1.34 - Ensure that the --experimental-encryption-provider-config argument is set as appropriate (Scored) 1.1.35 - Ensure that the encryption provider is set to aescbc (Scored) 1.1.36 - Ensure that the

performance data can be stored in InfluxDB and visualized by Grafana, or it can be fed to Google Cloud monitoring for storage and visualization. 1.3.10 Log Management Fetching and analyzing log containers. This data can be fed to an ELK (Elasticsearch, Logstash and Kibana) stack or Google Cloud logging for further analysis and visualization. 1.4 Kubernetes Components Kubernetes works in you access the same, you will see the guestbook application: If you are using a cloud provider, it is natural that the LoadBalancer type service will create a load balancer and attach the